joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c2cc
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x5afee0]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
xor ebx, ebx
cmp esi, edi
je 0x45c3ec
cmp word [esi], di
je 0x45c3ec
xor eax, eax
push 0x1fe
mov word [esp + 0x64], ax
lea eax, [esp + 0x66]
push edi
push eax
call fcn.00537010
add esp, 0xc
push 0x38
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00537010
add esp, 0xc
lea eax, [esp + 0x60]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push esi
mov dword [esp + 0x34], 0x3c
mov dword [esp + 0x48], 0xff
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x45c3ec
xor esi, esi
push dword [esi + 0x5b1e60]
lea eax, [esp + 0x64]
call fcn.00499cf5
pop ecx
test eax, eax
jne 0x45c3a6
add esi, 4
cmp esi, 0x24
jb 0x45c35a
lea ecx, [esp + 0xc]
call fcn.00416626
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
jbe 0x45c3d5
push edi
lea esi, [esp + 0x10]
call fcn.0047448e
cmp dword [eax + 0x18], 8
jb 0x45c3ab
mov eax, dword [eax + 4]
jmp 0x45c3ae
xor ebx, ebx
inc ebx
jmp 0x45c3e8
add eax, 4
push eax
lea eax, [esp + 0x64]
call fcn.00499cf5
pop ecx
test eax, eax
jne 0x45c3d2
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push 0x1c
cdq
pop ecx
idiv ecx
inc edi
cmp edi, eax
jb 0x45c391
jmp 0x45c3d5
xor ebx, ebx
inc ebx
lea ecx, [esp + 0xc]
call fcn.0041675a
push dword [esp + 0xc]
call fcn.0052f7c5
pop ecx
mov eax, ebx
jmp 0x45c3ee
xor eax, eax
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052f7d0
mov esp, ebp
pop ebp
ret

Function at 0x45d0ce
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x208], edi
cmp word [esi], di
je 0x45d18a
cmp ebx, edi
je 0x45d18a
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push edi
push eax
call fcn.00537010
push 0x38
lea eax, [ebp - 0x240]
push edi
push eax
call fcn.00537010
add esp, 0x18
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x244]
push eax
push edi
push edi
push esi
mov dword [ebp - 0x244], 0x3c
mov dword [ebp - 0x230], 0xff
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x45d182
lea eax, [ebp - 0x204]
push eax
push 0x57cb68
push 0xffffffffffffffff
push pe_nt_image_headers32
push ebx
call fcn.0052f7fd
add esp, 0x14
mov dword [ebp - 0x208], 1
mov eax, dword [ebp - 0x208]
jmp 0x45d18c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0052f7d0
leave
ret
Function at 0x45f1f5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
xor esi, esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
add esp, 0xc
push dword [esi + 0x5b1e50]
call fcn.00412e3d
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f257
inc edi
add esi, 8
cmp esi, 0x10
jb 0x45f20e
xor eax, eax
cmp dword [ebp + 8], eax
je 0x45f26e
cmp edi, 2
sete al
jmp 0x45f273
test edi, edi
setne al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret 4

Function at 0x45f283
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 8]
push 0x45f2d1
push 0
push 0
call fcn.0053364a
mov esi, eax
add esp, 0x18
test esi, esi
je 0x45f2cc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret 4
Function at 0x45f2f1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x564454
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x5afee0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x5afee0]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
lea eax, [esp + 0x34]
mov esi, ecx
xor ebx, ebx
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
call fcn.004b213d
mov dword [esp + 0x268], ebx
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
call fcn.00537010
add esp, 0xc
push dword [ebx + 0x5b1e50]
call fcn.00412e3d
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
je 0x45f417
and dword [esp + 0x10], 0
lea eax, [esp + 0x1c]
push eax
call fcn.004b213d
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x26c], 1
call edi
test eax, eax
je 0x45f3cb
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x54]
push eax
push esi
call fcn.004607db
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
test eax, 0xfffffffc
je 0x45f3f2
push dword [ebx + 0x5b1e54]
lea ecx, [esp + 0x20]
push esi
call fcn.00460ea4
mov dword [esp + 0x14], 1
cmp dword [esp + 0x10], 0
jne 0x45f402
lea ecx, [esp + 0x4c]
call fcn.00496aa0
lea esi, [esp + 0x1c]
mov byte [esp + 0x268], 0
call fcn.00472ee9
mov esi, dword [esp + 0x18]
add ebx, 8
cmp ebx, 0x10
jb 0x45f354
mov eax, dword [esp + 0x14]
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
lea esi, [esp + 0x34]
call fcn.00472ee9
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0052f7d0
mov esp, ebp
pop ebp
ret
Function at 0x460709
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x57c6dc
push dword [ebp + 8]
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0053221d
add esp, 0xc
test eax, eax
jne 0x4607d3
push esi
push 2
push edi
push dword [ebp - 4]
call fcn.00530734
push dword [ebp - 4]
call fcn.005327b7
push edi
push edi
push dword [ebp - 4]
mov esi, eax
call fcn.00530734
lea eax, [esi - 1]
add esp, 0x1c
cmp eax, 0x3ffffe
ja 0x4607c9
push ebx
lea ebx, [esi + 1]
push ebx
call fcn.0052f69b
mov edi, eax
pop ecx
test edi, edi
je 0x4607c8
push ebx
push 0
push edi
call fcn.00537010
push dword [ebp - 4]
push esi
push 1
push edi
call fcn.005325fd
add esp, 0x1c
cmp eax, esi
jne 0x4607c8
test esi, esi
jbe 0x4607b7
mov dword [ebp + 8], 7
sub dword [ebp + 8], edi
mov ecx, edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 8]
xor edx, edx
add eax, ecx
push 0xd
pop ebx
div ebx
add dl, 0x41
xor byte [ecx], dl
inc ecx
dec dword [ebp - 8]
jne 0x4607a0
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [ebp - 8], 1
pop ebx
push dword [ebp - 4]
call fcn.0052fd5d
pop ecx
pop esi
mov eax, dword [ebp - 8]
pop edi
leave
ret 0xc

Function at 0x461843
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
call fcn.00441d8e
call fcn.004a32e1
mov byte [0x5d8f84], 1
xor edi, edi
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x4618a1
push esi
push esi
mov dword [ebp - 4], esi
call fcn.0053364a
add esp, 0x18
cmp eax, esi
je 0x461883
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 5
jbe 0x461860
mov eax, dword [ebp + 8]
call fcn.0046243b
pop edi
mov dword [0x6542a8], 1
pop esi
leave
ret 4
Function at 0x462461
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x208], ebx
cmp edi, ebx
je 0x46256c
cmp word [edi], bx
je 0x46256c
lea esi, [eax + 0xac]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x46256c
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push ebx
push eax
call fcn.00537010
push 0x38
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.00537010
add esp, 0x18
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x244]
push eax
push ebx
push ebx
push edi
mov dword [ebp - 0x244], 0x3c
mov dword [ebp - 0x230], 0xff
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x46256c
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
xor edi, edi
test eax, eax
jbe 0x462564
push edi
call fcn.0047448e
cmp dword [eax + 0x18], 8
jb 0x462533
mov eax, dword [eax + 4]
jmp 0x462536
add eax, 4
push eax
lea eax, [ebp - 0x204]
call fcn.00499cf5
pop ecx
test eax, eax
jne 0x46255a
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
inc edi
cmp edi, eax
jb 0x462522
jmp 0x462564
mov dword [ebp - 0x208], 1
mov eax, dword [ebp - 0x208]
jmp 0x46256e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret 4

Function at 0x46c5e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
movzx eax, word [eax + 0xc]
cmp eax, 0x2e
je 0x46c623
cmp eax, 0x57
je 0x46c5fd
cmp eax, 0x71
jne 0x46c62a
mov ecx, esi
call fcn.004697ce
jmp 0x46c62a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x46c62a
push 0
push 0xf060
push 0x112
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46c62a
mov ecx, esi
call fcn.00469d87
xor eax, eax
pop ecx
ret
Function at 0x46c62e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [eax + 0xc]
push ebx
push esi
push edi
mov esi, ecx
cmp eax, 0xd
je 0x46c6f2
cmp eax, 0x2e
je 0x46c6eb
cmp eax, 0x41
je 0x46c681
cmp eax, 0x57
je 0x46c66a
cmp eax, 0x71
jne 0x46c707
call fcn.004697ce
jmp 0x46c707
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x46c707
push 0
jmp 0x46c6f4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x46c707
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
push ebx
push 0xb
add esi, 0x4e4
push dword [esi]
call edi
push ebx
push ebx
mov dword [ebp - 4], ebx
mov ebx, 0x1004
push ebx
push dword [esi]
call edi
test eax, eax
jle 0x46c6d3
push dword [ebp - 4]
push esi
call fcn.00470035
inc dword [ebp - 4]
push 0
push 0
push ebx
push dword [esi]
call edi
cmp dword [ebp - 4], eax
jl 0x46c6b9
push 0
push 1
push 0xb
push dword [esi]
call edi
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x46c707
call fcn.00469d87
jmp 0x46c707
push 0xffffffffffffffff
push 0xf060
push 0x112
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x46fcc8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp dword [ebp + 0xc], 0
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x65c]
je 0x46fd73
test eax, eax
je 0x46fd07
push eax
call ebx
and dword [edi + 0x65c], 0
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
mov ecx, dword [esi + 8]
sub ecx, dword [esi]
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [edi + 0x65c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 0xc]
push 0xcc0020
push eax
push ecx
push dword [ebp - 8]
sub edx, eax
mov eax, dword [esi + 8]
push edx
sub eax, ecx
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [edi + 0x660]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, eax
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_FrameRect]
push edi
call ebx
jmp 0x46fdc7
test eax, eax
je 0x46fdc7
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [edi + 0x65c]
call ebx
and dword [edi + 0x65c], 0
push dword [ebp - 4]
call ebx
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop ebx
leave
ret 8
Function at 0x474f78
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x4c4], ebx
call fcn.00537010
add esp, 0xc
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push dword [edi + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x475038
push 0x2b0
lea eax, [ebp - 0x4bc]
push ebx
push eax
mov dword [ebp - 0x4c0], ebx
call fcn.00537010
add esp, 0xc
push 0x300
push 0x2b4
lea eax, [ebp - 0x4c0]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4c0]
or dword [esi + 0x10], 0xffffffff
mov dword [esi + 8], eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [esi + 4]
push eax
call fcn.004082ed
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.004082ed
mov dword [ebp - 0x4c4], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c4]
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret 4

Function at 0x47523c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0x214
mov eax, 0x55e37e
call fcn.00539a44
mov eax, dword [0x5beb28]
mov esi, ecx
mov ecx, 0x5beb28
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00537010
push str.download
push str.Software_shouxin
push 0x57c6a4
lea eax, [ebp - 0x218]
push 0x103
push eax
call fcn.00532a01
mov eax, dword [esi + 0x710]
sub eax, dword [esi + 0x70c]
add esi, 0x700
add esp, 0x20
push 0x14
cdq
pop ecx
idiv ecx
mov ebx, 0x80000001
test eax, eax
jbe 0x475321
push edi
call fcn.004867ce
inc edi
mov dword [ebp - 0x220], eax
push edi
push str.path_d
lea eax, [ebp - 0x21c]
call fcn.004167f4
mov eax, dword [ebp - 0x220]
mov eax, dword [eax]
pop ecx
pop ecx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x14
cdq
pop ecx
idiv ecx
cmp edi, eax
jb 0x4752c7
cmp edi, 5
jge 0x475351
lea esi, [edi + 1]
push esi
push str.path_d
lea eax, [ebp - 0x21c]
call fcn.004167f4
pop ecx
pop ecx
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
inc esi
cmp esi, 6
jl 0x475324
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.00407d09
call fcn.00539ac7
ret
Function at 0x475365
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
push str.download
push str.Software_shouxin
push 0x57c6a4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00532a01
add esp, 0x20
test esi, esi
je 0x4753f2
cmp word [esi], 0
je 0x4753f2
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4753c5
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
push 1
push str.lastpath
lea eax, [ebp - 0x20c]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x475409
push str.lastpath
lea eax, [ebp - 0x20c]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret

Function at 0x475415
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x55ef83
call fcn.00539a44
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov ecx, 0x5beb28
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], edi
call fcn.004082b0
mov dword [ebp - 4], edi
mov ecx, esi
mov ebx, str.lastpath
mov dword [ebp - 0x21c], 1
call fcn.004754ae
test eax, eax
je 0x47546a
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4754a6
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00537010
add esp, 0xc
push edi
push 0x10
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.004082ed
mov eax, esi
call fcn.00539ac7
ret

Function at 0x4754ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x41c], esi
call fcn.00408209
xor esi, esi
cmp ebx, esi
je 0x47559a
cmp word [ebx], si
je 0x47559a
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.00537010
push str.download
push str.Software_shouxin
push 0x57c6a4
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.00532a01
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00537010
add esp, 0x2c
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
inc esi
push 0x80000001
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x420], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop edi
test eax, eax
jne 0x47559a
cmp dword [ebp - 0x418], esi
jne 0x47559a
cmp word [ebp - 0x20c], ax
je 0x47559a
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
call fcn.004082ed
mov eax, esi
jmp 0x47559c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret
Function at 0x4755a9
Capabilities:
Get file system object information

Disassembly:
push 0x2bc
mov eax, 0x55ef39
call fcn.00539a44
mov ebx, ecx
xor esi, esi
mov edi, edx
cmp word [ebx], si
jne 0x4755cb
xor eax, eax
call fcn.00539ac7
ret
mov eax, dword [0x5beb28]
mov ecx, 0x5beb28
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c8], eax
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 4], esi
call fcn.004754ae
mov ebx, dword [ebp - 0x2c8]
test eax, eax
jne 0x475605
lea eax, [ebx - 0x10]
call fcn.00407d09
mov eax, esi
jmp 0x4755c5
push 0x2b0
lea eax, [ebp - 0x2c0]
push esi
push eax
mov dword [ebp - 0x2c4], esi
call fcn.00537010
add esp, 0xc
push 0x300
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [0x5b1dbc]
inc dword [0x5b1dbc]
or dword [edi + 0x10], 0xffffffff
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x2c4]
mov dword [edi + 8], eax
lea eax, [ebp - 0x2b8]
push eax
lea eax, [edi + 4]
push eax
call fcn.004082ed
lea eax, [ebp - 0x2c8]
call fcn.0041a538
xor esi, esi
inc esi
jmp 0x4755f9

Function at 0x4757d1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x7e
xor esi, esi
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push esi
push eax
call fcn.00537010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.kl_writable__d.tmp
lea eax, [ebp - 0x84]
push 0x3f
push eax
call fcn.00532a01
xor eax, eax
push 0x206
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x28a]
push esi
push eax
call fcn.00537010
add esp, 0x1c
lea eax, [ebp - 0x84]
push eax
push edi
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x475885
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret
Function at 0x475894
Capabilities:
Check if file exists
Get disk size

Disassembly:
push 0x2c
mov eax, 0x567d62
call fcn.005399db
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp esi, ebx
je 0x475a41
cmp word [esi], bx
je 0x475a41
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4758be
sub eax, edx
sar eax, 1
push 0x3a
push esi
mov dword [ebp - 0x10], eax
call fcn.00534049
cmp dword [ebp - 0x10], 2
pop ecx
pop ecx
jl 0x475a3a
cmp eax, ebx
je 0x475a3a
inc eax
inc eax
mov edi, eax
sub edi, esi
push esi
sar edi, 1
mov ecx, 0x5beb28
lea esi, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call fcn.0041679e
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x475948
push esi
call edi
test eax, eax
jne 0x475948
mov edx, str.b_rN0R
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00487432
add esp, 0x18
lea eax, [esi - 0x10]
call fcn.00407d09
jmp 0x475a5a
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x475965
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x475965
mov edx, str.__rNcknx
jmp 0x475927
mov eax, dword [ebp + 0xc]
cmp word [eax], 0x5c
jne 0x47597c
cmp word [eax + 2], 0x5c
jne 0x47597c
mov edx, str.__rN
jmp 0x475927
push str._:_____r_n
push dword [ebp - 0x1c]
call fcn.00534006
pop ecx
pop ecx
test eax, eax
je 0x475996
mov edx, 0x586430
jmp 0x475927
cmp dword [ebp - 0x10], 0x64
jle 0x4759a3
mov edx, 0x58645c
jmp 0x475927
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edi, dword [ebp + 8]
test eax, eax
je 0x475a05
mov ecx, dword [edi + 0x4d0]
mov eax, dword [edi + 0x4d4]
mov edx, dword [ebp - 0x24]
add ecx, 0x1000000
adc eax, ebx
cmp edx, eax
ja 0x475a05
jb 0x4759f8
mov eax, dword [ebp - 0x28]
cmp eax, ecx
jae 0x475a05
mov edx, 0x586480
mov ecx, dword [edi + 0x10]
jmp 0x47592d
push 1
push dword [ebp + 0xc]
push ebx
push dword [edi + 0x10]
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
test eax, eax
jne 0x475a33
mov edi, dword [ebp + 0xc]
call fcn.004757d1
test eax, eax
je 0x475a30
mov dword [ebp - 0x14], 1
jmp 0x47593b
mov edi, dword [ebp + 8]
mov edx, 0x5864a8
jmp 0x4759fd
mov edx, str.__rNcknx
jmp 0x475a46
mov edx, 0x586398
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00487432
add esp, 0x18
mov eax, dword [ebp - 0x14]
call fcn.00539ab3
ret 8