joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e0e0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [eax]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4890b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x52aab0
push eax
call esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x80]
push 0x52aacc
push dword [eax]
call esi
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x80]
push 0x52aac0
push dword [eax]
call esi
cmp dword [ebp - 0x60], 0
mov esi, eax
je 0x4890b4
cmp dword [ebp - 0x84], 0
je 0x4890b4
test esi, esi
je 0x4890b4
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x48], 0x65004b
mov dword [ebp - 0x44], 0x620079
mov dword [ebp - 0x40], 0x61006f
mov dword [ebp - 0x3c], 0x640072
mov dword [ebp - 0x38], 0x4c0020
mov dword [ebp - 0x34], 0x790061
mov dword [ebp - 0x30], 0x75006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x750053
mov dword [ebp - 0x24], 0x730062
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x73
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x7c], 0
push eax
push 0x20019
lea ecx, [ebp - 0x80]
call fcn.004af9d0
push eax
call dword [ebp - 0x60]
test eax, eax
je 0x4890a5
lea ecx, [ebp - 0x78]
call fcn.0040a890
mov byte [ebp - 4], 1
lea eax, [ebp - 0x78]
push edi
push str._08x
push eax
call fcn.00413470
add esp, 0xc
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x14
xorps xmm0, xmm0
lea ecx, [ebp - 0x78]
movups xmmword [ebp - 0x5c], xmm0
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
call fcn.0040a750
push eax
push dword [ebp - 0x7c]
call dword [ebp - 0x84]
test eax, eax
jne 0x489094
push 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004e1a66
add esp, 0xc
mov edi, eax
push dword [ebp - 0x7c]
call esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.004afb60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4

Function at 0x4890e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5500a4]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004d98b0
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48913c
cmp dword [esp + 4], 6
jb 0x48913c
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004d6fd3
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.004d6fd3
add esp, 0x118
ret
Function at 0x489b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x230
mov eax, dword [0x5500a4]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x240]
push ebp
mov ebp, dword [esp + 0x240]
push edi
mov edi, dword [esp + 0x240]
test edi, edi
je 0x489c88
mov eax, dword [ecx]
test eax, eax
je 0x489c88
push esi
push 0x52aacc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x489c87
push 0x208
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004d98b0
add esp, 0xc
mov dword [esp + 0x10], 0x208
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
call fcn.0040a750
push eax
push edi
call esi
lea eax, [esp + 0x34]
push eax
call fcn.0040acf0
add esp, 4
lea ecx, [ebx + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0040ab90
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push str.Profile
push edi
call esi
lea eax, [esp + 0x34]
push eax
call fcn.0040acf0
add esp, 4
lea ecx, [ebx + 0x50]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0040ab90
xor eax, eax
mov dword [esp + 0x14], 0x65004b
mov word [esp + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebx
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0x620079
push eax
push edi
mov dword [esp + 0x34], 0x61006f
mov dword [esp + 0x38], 0x640072
mov dword [esp + 0x3c], 0x61004c
mov dword [esp + 0x40], 0x6f0079
mov dword [esp + 0x44], 0x740075
mov dword [esp + 0x28], 4
call esi
pop esi
mov ecx, dword [esp + 0x238]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d6fd3
add esp, 0x230
ret 0xc
Function at 0x48b210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff308
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040a8b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004131a0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0040a740
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x48b33d
call fcn.00402fb0
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x48b280
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x48b29a
mov ecx, esi
cmp eax, 8
jb 0x48b28f
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x48b3b8
mov ecx, esi
cmp eax, 8
jb 0x48b2a3
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x48b2b9
mov ecx, esi
cmp eax, 8
jb 0x48b2b2
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x48b30e
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.00412f80
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x48b2d7
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x48b30e
mov ecx, esi
cmp eax, 8
jb 0x48b2e7
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x48b30e
mov ecx, esi
cmp eax, 8
jb 0x48b2f7
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x48b30e
cmp eax, 8
jb 0x48b304
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x48b399
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret
call fcn.0040a740
cmp eax, 2
jne 0x48b30e
lea ecx, [ebp - 0x28]
call fcn.00402fb0
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x48b35b
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x48b30e
mov edx, eax
cmp ecx, 8
jb 0x48b36b
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x48b30e
cmp ecx, 8
jb 0x48b378
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x48b30e
push 0x52a89c
call fcn.0040acf0
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x52a89c
call fcn.0040c160
lea ecx, [ebp - 0x28]
call fcn.0040a750
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48b30e
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x48b310
Function at 0x48c050
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e798
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [ebp - 0x14], 0
call fcn.004d6fe4
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call fcn.004d98b0
add esp, 0x10
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48c0d4
cmp dword [ebp - 0x12c], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041d330
test al, al
je 0x48c0fe
lea ecx, [ebp - 0x14]
call fcn.0041c950
test al, al
jne 0x48c0fe
xor bl, bl
jmp 0x48c164
lea edx, [esi + 4]
xor ecx, ecx
call fcn.004bd290
test al, al
jne 0x48c114
lea ecx, [esi + 4]
call fcn.0040ff60
lea edx, [esi + 0x1c]
mov ecx, 0x1a
call fcn.004bd290
test al, al
jne 0x48c12d
lea ecx, [esi + 0x1c]
call fcn.0040ff60
lea edx, [esi + 0x34]
mov ecx, 2
call fcn.004bd290
test al, al
jne 0x48c146
lea ecx, [esi + 0x34]
call fcn.0040ff60
lea edx, [esi + 0x4c]
mov ecx, 0xb
call fcn.004bd290
test al, al
jne 0x48c15f
lea ecx, [esi + 0x4c]
call fcn.0040ff60
mov byte [esi], 1
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041c350
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret
Function at 0x48c220
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e7e1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, edi
push 0
mov dword [ebp - 0x34], esi
push 0x25
mov dword [ebp - 0x2c], 0
call fcn.0040a690
push edi
cmp eax, 0xffffffff
jne 0x48c286
mov ecx, esi
call fcn.0040a8b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
jmp 0x48c333
lea ecx, [ebp - 0x28]
call fcn.0040a8b0
mov dword [ebp - 4], 1
mov ecx, edi
push 0
push 0
call fcn.0040a750
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x48c2b8
push edi
mov ecx, esi
call fcn.0040a8b0
jmp 0x48c320
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d7ab4
mov edx, dword [ebp - 0x30]
add esp, 4
inc edx
mov ebx, eax
mov ecx, edi
push edx
push ebx
call fcn.0040a750
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x48c30c
cmp eax, dword [ebp - 0x30]
ja 0x48c30c
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call fcn.0040acf0
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push ebx
call fcn.0040ab90
push ebx
call fcn.004d72e4
add esp, 4
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040a810
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 8
Function at 0x48ce50
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e96c
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.004d98b0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.0040a850
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.0040a850
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00418310
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ac]
call fcn.0040a7c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c4]
call fcn.0040a7c0
lea eax, [ebp - 0x294]
push eax
call fcn.004140d0
add esp, 4
test al, al
jne 0x48cfb4
xor bl, bl
jmp 0x48d016
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x27c]
call fcn.00413c80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x27c]
call fcn.0040a730
test al, al
je 0x48cfdc
xor bl, bl
jmp 0x48d007
lea ecx, [ebp - 0x27c]
call fcn.00402fb0
cmp esi, eax
je 0x48d005
call fcn.00402fb0
mov edx, eax
cmp dword [eax + 0x14], 8
jb 0x48cffa
mov edx, dword [eax]
push dword [eax + 0x10]
mov ecx, esi
push edx
call fcn.0040ab90
mov bl, 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x27c]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.0040a7c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4
Function at 0x48d050
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e9de
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.004d98b0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.0040a850
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040a850
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00418310
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x29c]
call fcn.0040a7c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b4]
call fcn.0040a7c0
lea eax, [ebp - 0x27c]
push eax
call fcn.004140d0
add esp, 4
test al, al
je 0x48d258
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x280], 0
call fcn.004d6fe4
add esp, 4
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 5
mov dword [eax], 0
mov dword [eax], 0xffffffff
mov byte [ebp - 4], 4
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x27c]
push 0x80
push 4
push 1
push 0x80000000
push eax
lea ecx, [ebp - 0x280]
call fcn.0041b6f0
test al, al
jne 0x48d25c
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x48d258
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x48d243
test eax, eax
je 0x48d243
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.004d72ae
add esp, 8
mov dword [ebp - 0x280], 0
xor bl, bl
jmp 0x48d2a5
push esi
lea ecx, [ebp - 0x280]
call fcn.0041b8d0
mov bl, al
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x48d2a5
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x48d290
test eax, eax
je 0x48d290
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.004d72ae
add esp, 8
mov dword [ebp - 0x280], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.0040a7c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4
Function at 0x48de50
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ec80
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push str.2345PdfAsposeSDK.dll
lea ecx, [ebp - 0x28]
call fcn.0040a850
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00418310
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
push str.2345PdfAsposeSDK.dll
lea ecx, [ebp - 0x28]
call fcn.0040a850
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.00418310
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
lea eax, [ebp - 0x58]
push eax
call fcn.004140d0
add esp, 4
test al, al
je 0x48df85
push 0
lea ecx, [ebp - 0x70]
call fcn.0040a750
push eax
lea ecx, [ebp - 0x58]
call fcn.0040a750
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
call esi
test eax, eax
jne 0x48df85
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.0040a890
mov byte [ebp - 4], 6
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.0041c200
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp - 0x40]
call fcn.0040a890
mov byte [ebp - 4], 7
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x70]
call fcn.0041c200
test al, al
jne 0x48df57
test bl, bl
je 0x48df6d
push 0
lea ecx, [ebp - 0x40]
call fcn.0040a750
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a750
push eax
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
call fcn.0040a7c0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0040a7c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret
Function at 0x48eb60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ef9b
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], esi
lea ebx, [esi + 4]
mov dword [ebp - 0x48], esi
mov ecx, ebx
mov dword [esi], vtable.RC::RCVersionUpdateTask.0
call fcn.0040a890
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x28]
push eax
call fcn.004d43a0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040a730
test al, al
jne 0x48ec51
lea eax, [ebp - 0x28]
push eax
call fcn.00413fc0
add esp, 4
test al, al
jne 0x48ec2c
push 0
lea ecx, [ebp - 0x28]
call fcn.0040a750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x48ec2c
lea ecx, [ebp - 0x40]
call fcn.0040a890
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0041c200
test al, al
je 0x48ec20
push 0
lea ecx, [ebp - 0x40]
call fcn.0040a750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0040a7c0
push str.temp
call fcn.0040acf0
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push str.temp
call fcn.0040c160
push 0x5c
lea ecx, [ebp - 0x28]
call fcn.004136c0
lea ecx, [ebp - 0x28]
call fcn.00402fb0
cmp ebx, eax
je 0x48ec77
call fcn.00402fb0
mov edx, eax
cmp dword [eax + 0x14], 8
jb 0x48ec6c
mov edx, dword [eax]
push dword [eax + 0x10]
mov ecx, ebx
push edx
call fcn.0040ab90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6fd3
mov esp, ebp
pop ebp
ret 4
Function at 0x48fed0
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x4c]
sub esp, 0x4c
push 0xffffffffffffffff
push 0x50f22d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp + 0x48], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x54]
push edi
call fcn.00413fc0
add esp, 4
test al, al
jne 0x48ff19
xor al, al
jmp 0x490065
call fcn.004d2b00
mov ecx, edi
mov esi, eax
call fcn.0040a750
push eax
mov ecx, esi
call fcn.004d2ad0
test al, al
je 0x48ff12
push 0
call fcn.00491670
mov ecx, eax
call fcn.00491720
mov dword [ebp - 4], 0
sub esp, 8
lea eax, [ebp + 0x18]
push edi
push eax
call fcn.00490090
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x30]
call fcn.0040a890
mov byte [ebp - 4], 2
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00415fd0
add esp, 8
lea ecx, [ebp]
call fcn.0040a890
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov eax, dword [ebx + 0x1c]
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0x540
call fcn.004d2530
test al, al
mov ecx, str.runas
cmove ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp + 0x18]
call fcn.0040a750
lea ecx, [ebp + 0x30]
mov dword [ebp - 0x38], eax
call fcn.0040a750
lea ecx, [ebp]
mov dword [ebp - 0x30], eax
call fcn.0040a750
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x490003
xor bl, bl
jmp 0x490013
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x490011
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov byte [ebp - 4], 2
lea ecx, [ebp]
call fcn.0040a7c0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x30]
call fcn.0040a7c0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
call fcn.00491670
mov esi, dword [eax]
cmp byte [esi], 0
je 0x490063
call fcn.004427b0
push esi
mov ecx, eax
call fcn.00442a20
push 0
mov ecx, esi
call fcn.0043a8c0
mov byte [esi], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x48]
xor ecx, ebp
call fcn.004d6fd3
lea esp, [ebp + 0x4c]
pop ebp
ret 8