joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c877b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x248], eax
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x234], ebx
push ebx
push eax
mov esi, ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x230], ebx
call fcn.004d9c60
add esp, 0xc
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c87ec
xor eax, eax
jmp 0x4c8962
push edi
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4c8940
test esi, esi
je 0x4c881b
push esi
call edi
xor esi, esi
cmp dword [ebp - 0x234], 0
je 0x4c8833
push dword [ebp - 0x234]
call edi
and dword [ebp - 0x234], 0
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.004dbd04
pop ecx
pop ecx
test eax, eax
jne 0x4c88fd
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4c88fd
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x240], eax
jne 0x4c88fd
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4c88fd
lea eax, [ebp - 0x234]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4c88fd
and dword [ebp - 0x238], 0
lea eax, [ebp - 0x23c]
and dword [ebp - 0x23c], 0
push eax
lea eax, [ebp - 0x238]
push eax
push 1
push dword [ebp - 0x234]
call fcn.004c8561
add esp, 0x10
test eax, eax
je 0x4c88fd
mov eax, dword [ebp - 0x238]
push dword [eax]
call fcn.004c8691
pop ecx
push dword [ebp - 0x238]
test eax, eax
je 0x4c8914
call fcn.004c84e3
and dword [ebp - 0x238], 0
pop ecx
lea eax, [ebp - 0x230]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c8812
jmp 0x4c8939
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x244], 1
mov dword [ecx], eax
call fcn.004c84e3
and dword [ebp - 0x238], 0
pop ecx
test esi, esi
je 0x4c8940
push esi
call edi
cmp dword [ebp - 0x234], 0
je 0x4c8958
push dword [ebp - 0x234]
call edi
and dword [ebp - 0x234], 0
push ebx
call edi
mov eax, dword [ebp - 0x244]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9c43
mov esp, ebp
pop ebp
ret
Function at 0x4cb03a
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x254], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x24c
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x264], esi
call fcn.004d9c60
add esp, 0xc
lea ecx, [ebp - 0x260]
push esi
call fcn.004af026
call fcn.004afb89
push eax
lea ecx, [ebp - 0x258]
call fcn.004aef66
push 0x535f3c
mov edi, 0x104
lea ecx, [ebp - 0x260]
push edi
call fcn.004b03cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x260]
call fcn.004b5ee5
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4cb114
mov edi, dword [ebp - 0x258]
lea ecx, [edi - 0x10]
call fcn.004b04f5
mov ecx, dword [ebp - 0x260]
lea ecx, [ecx - 0x10]
call fcn.004b04f5
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9c43
mov esp, ebp
pop ebp
ret
mov edi, 0x104
push esi
lea ecx, [ebp - 0x258]
call fcn.004b063e
lea eax, [ebp - 0x228]
push eax
push edi
lea ecx, [ebp - 0x258]
call fcn.004b03cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x258]
call fcn.004b5ee5
push dword [ebp - 0x268]
lea ecx, [ebp - 0x25c]
call fcn.004af026
lea eax, [ebp - 0x228]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.004b03cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x25c]
call fcn.004b5ee5
test byte [ebp - 0x254], 0x10
mov edi, dword [ebp - 0x258]
mov esi, dword [ebp - 0x25c]
je 0x4cb210
lea eax, [ebp - 0x228]
push 0x548be0
push eax
call fcn.004d92ac
pop ecx
pop ecx
test eax, eax
je 0x4cb1d3
lea eax, [ebp - 0x228]
push 0x548be4
push eax
call fcn.004d92ac
pop ecx
pop ecx
test eax, eax
je 0x4cb1d3
mov eax, dword [ebp - 0x254]
mov ecx, 0x410
and eax, ecx
cmp eax, ecx
jne 0x4cb1de
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
jmp 0x4cb21d
cmp dword [ebp + 0x10], 0
je 0x4cb21a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cb1f6
push esi
call fcn.004cb2fa
pop ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4cb21a
push dword [ebp + 0x10]
push esi
push edi
call fcn.004cb03a
add esp, 0xc
jmp 0x4cb21a
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esi - 0x10]
call fcn.004b04f5
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [ebp - 0x264]
test eax, eax
jne 0x4cb10f
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4cb0e6
Function at 0x4cb24a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.004af026
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.004af026
lea eax, [ebp - 8]
push eax
call fcn.004cf451
mov edi, dword [ebp - 8]
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x4cb288
mov esi, dword [ebp - 4]
jmp 0x4cb2e0
push ebx
push edi
call fcn.004cf109
pop ecx
pop ecx
test eax, eax
jne 0x4cb2db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4cb2db
lea eax, [ebp - 4]
push eax
call fcn.004cf4c4
mov esi, dword [ebp - 4]
pop ecx
cmp dword [esi - 0xc], ebx
je 0x4cb2e1
push esi
call fcn.004cb24a
pop ecx
test eax, eax
je 0x4cb2e1
push ebx
push edi
call fcn.004cf109
pop ecx
pop ecx
test eax, eax
jne 0x4cb2de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4cb2de
jmp 0x4cb2e1
mov esi, dword [ebp - 4]
xor ebx, ebx
inc ebx
lea ecx, [edi - 0x10]
call fcn.004b04f5
lea ecx, [esi - 0x10]
call fcn.004b04f5
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cbabf
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x408]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push eax
push 0xf003f
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cbb74
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
jmp 0x4cbb46
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x408]
call fcn.004cbabf
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4cbb85
lea eax, [ebp - 0x414]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
push dword [ebp - 0x408]
mov dword [ebp - 0x40c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4cbb11
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9c43
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4cbb74
Function at 0x4cbba7
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
mov edx, dword [ebp - 0x10]
call fcn.004d9c43
mov esp, ebp
pop ebp
ret

Function at 0x4cc0e4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004af536
add eax, 0x10
mov dword [esp], 0x548bc8
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x258], eax
call fcn.004af319
mov esi, dword [ebp - 0x258]
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
jne 0x4cc173
xor eax, eax
mov ecx, edi
push eax
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
call fcn.004d0f65
lea ecx, [esi - 0x10]
mov dword [edi], eax
call fcn.004b04f5
lea ecx, [ebp + 0x10]
call fcn.004d1f06
lea ecx, [ebp + 0x10]
call fcn.004d1f06
jmp 0x4cc2aa
xor eax, eax
lea ecx, [ebp - 0x260]
push ebx
push eax
push eax
mov dword [ebp - 0x25c], eax
call fcn.004d0f65
mov ebx, eax
mov dword [ebp - 0x260], ebx
test byte [ebp - 0x254], 0x10
je 0x4cc245
cmp dword [ebp + 0x20], 0
lea eax, [ebp - 0x228]
push eax
jne 0x4cc1d1
lea ecx, [ebp - 0x258]
call fcn.004af026
lea eax, [ebp - 0x258]
push eax
push ebx
lea ecx, [ebp - 0x260]
call fcn.004c925a
mov ecx, dword [ebp - 0x258]
jmp 0x4cc237
lea ecx, [ebp - 0x268]
call fcn.004af026
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x4cc2bc
mov eax, dword [ecx]
lea edx, [ebp - 0x268]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x268]
mov bl, al
add ecx, 0xfffffff0
call fcn.004b04f5
test bl, bl
je 0x4cc23f
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x264]
call fcn.004af026
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x260]
call fcn.004c925a
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.004b04f5
mov ebx, dword [ebp - 0x260]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4cc191
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x260]
mov ecx, edi
push eax
call fcn.004ca3ea
lea ecx, [ebp - 0x260]
call fcn.004d20f9
push dword [ebp - 0x260]
call fcn.004d8fe0
pop ecx
lea ecx, [esi - 0x10]
call fcn.004b04f5
lea ecx, [ebp + 0x10]
call fcn.004d1f06
lea ecx, [ebp + 0x10]
call fcn.004d1f06
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004d9c43
mov esp, ebp
pop ebp
ret
call fcn.0050f1c7
int3
Function at 0x4cc45d
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x55e0d0]
push esi
xor esi, esi
test al, 1
jne 0x4cc4a7
or eax, 1
mov dword [0x55e0cc], 7
mov dword [0x55e0d0], eax
xor eax, eax
push 0x530700
mov dword [0x55e0c8], esi
mov word [0x55e0b8], ax
call fcn.004d9110
pop ecx
cmp dword [0x55e0c8], esi
je 0x4cc4b9
mov eax, 0x55e0b8
jmp 0x4cc575
push ebx
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004d9c60
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x55e0b8
test eax, eax
je 0x4cc571
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004d91fe
pop ecx
pop ecx
push esi
push esi
push esi
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x210]
push esi
push eax
push esi
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4cc571
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x535d54
push ebx
push eax
call fcn.004d02b8
add esp, 0x10
cmp word [ebp - 0x20c], si
je 0x4cc562
lea eax, [ebp - 0x20c]
push eax
call fcn.004d92ea
pop ecx
mov esi, eax
push esi
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, edi
call fcn.004063d0
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d9c43
mov esp, ebp
pop ebp
ret

Function at 0x4ccca9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push edi
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x4ccd30
push esi
push edi
call fcn.004d9125
pop ecx
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4ccd24
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 0x547988
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4ccd24
cmp dword [ebp - 8], ebx
je 0x4ccd24
mov ecx, dword [ebp - 0xc]
mov bl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test esi, esi
je 0x4ccd2f
push esi
call fcn.004d912e
pop ecx
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ccdd8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
test eax, eax
je 0x4cce4c
push str._cid
push eax
call fcn.004dc7ac
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4cce4c
add esi, 0xa
push 0x20
push esi
call fcn.004d91fe
pop ecx
pop ecx
test eax, eax
jne 0x4cce3a
push esi
call fcn.004d92ea
pop ecx
lea eax, [esi + eax*2]
sub eax, esi
mov ecx, ebx
sar eax, 1
push eax
push esi
call fcn.004b0667
jmp 0x4ccede
push dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
call fcn.004af026
push 0x547988
lea ecx, [ebp - 0x7c]
call fcn.004af319
push str.ProductInfo.xml
lea ecx, [ebp - 0x7c]
call fcn.004af319
lea ecx, [ebp - 0x78]
call fcn.004c75fd
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x78]
push esi
call fcn.004c79fe
test eax, eax
je 0x4ccece
push edi
push str.packetcid
lea ecx, [ebp - 0x78]
call fcn.004c7b18
test eax, eax
je 0x4ccea9
push ebx
push 0x535d30
lea ecx, [ebp - 0x78]
call fcn.004c7ca9
push edi
push str.packet_scid
lea ecx, [ebp - 0x78]
call fcn.004c7b18
test eax, eax
je 0x4ccece
push dword [ebp - 0x84]
lea ecx, [ebp - 0x78]
push 0x535d40
call fcn.004c7ca9
lea ecx, [ebp - 0x78]
call fcn.004c3238
lea ecx, [esi - 0x10]
call fcn.004b04f5
mov eax, dword [0x55e09c]
cmp dword [eax - 0xc], edi
je 0x4ccef4
push 0x55e09c
mov ecx, ebx
call fcn.004af11f
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
jne 0x4ccfc2
lea eax, [ebp - 0x84]
push edi
push eax
call fcn.004cc81c
mov esi, dword [ebp - 0x84]
push 0x5f
push esi
call fcn.004d9322
add esp, 0x10
test eax, eax
je 0x4ccfba
sub eax, esi
sar eax, 1
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x4ccfba
call fcn.004afb89
push eax
lea ecx, [ebp - 0x7c]
call fcn.004aef66
mov ecx, dword [ebp - 0x80]
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x84]
call fcn.004b0076
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004af11f
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.004b04f5
push edi
push str..exe
lea ecx, [ebp - 0x7c]
call fcn.004cbe22
push eax
push edi
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004b0076
push eax
lea ecx, [ebp - 0x7c]
call fcn.004af11f
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.004b04f5
lea eax, [ebp - 0x7c]
mov ecx, ebx
push eax
call fcn.004af11f
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.004b04f5
lea ecx, [esi - 0x10]
call fcn.004b04f5
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
jne 0x4cd001
push str.mktpublic
call fcn.004da1d0
pop ecx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jg 0x4ccff9
lea eax, [esi + esi]
call fcn.004daae0
mov eax, esp
push 3
push esi
push str.mktpublic
push eax
call fcn.004b1be5
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b063e
lea esp, [ebp - 0x90]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d9c43
mov esp, ebp
pop ebp
ret
Function at 0x4cf109
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x3000010
push 1
push 0
push 3
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
test ebx, ebx
je 0x4cf13c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x4cf147
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebx
pop ebp
ret

Function at 0x4cf20e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call fcn.004d9c60
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4cf25c
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d9c43
mov esp, ebp
pop ebp
ret

Function at 0x4cf50d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi], esi
je 0x4cf58d
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
mov dword [edi + 4], eax
jne 0x4cf58d
mov ecx, dword [ebp + 0xc]
call fcn.004af955
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
shr eax, 1
inc eax
push eax
call fcn.004b03cd
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 4], eax
test eax, eax
jne 0x4cf58d
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 0xc]
shr eax, 1
push 0xffffffffffffffff
mov word [ecx + eax*2], dx
mov ecx, dword [ebp + 0xc]
call fcn.004b5ee5
inc esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4cf597
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebx], esi
je 0x4cf664
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 7
mov dword [ebx + 4], eax
jne 0x4cf664
mov eax, dword [ebp - 4]
xor ecx, ecx
push edi
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d9125
mov edi, eax
pop ecx
test edi, edi
je 0x4cf5f6
xor eax, eax
mov word [edi], ax
jmp 0x4cf5f8
mov edi, esi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4cf658
push edi
call fcn.004d92ea
mov ebx, eax
mov eax, edi
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.004af026
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
call fcn.004d31a3
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004b04f5
inc ebx
add esi, ebx
lea eax, [edi + esi*2]
push eax
call fcn.004d92ea
mov ebx, eax
lea eax, [edi + esi*2]
pop ecx
test ebx, ebx
jg 0x4cf61f
xor esi, esi
inc esi
test edi, edi
je 0x4cf663
push edi
call fcn.004d912e
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cfce7
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x254], 0
push ebx
push esi
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x18]
push 0x24c
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x268], edi
call fcn.004d9c60
add esp, 0xc
lea ecx, [ebp - 0x260]
push edi
call fcn.004af026
call fcn.004afb89
push eax
lea ecx, [ebp - 0x258]
call fcn.004aef66
push 0x535f3c
mov esi, 0x104
lea ecx, [ebp - 0x260]
push esi
call fcn.004b03cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x260]
call fcn.004b5ee5
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4cfdd3
mov esi, dword [ebp - 0x258]
lea ecx, [esi - 0x10]
call fcn.004b04f5
mov ecx, dword [ebp - 0x260]
lea ecx, [ecx - 0x10]
call fcn.004b04f5
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9c43
mov esp, ebp
pop ebp
ret
mov esi, 0x104
push edi
lea ecx, [ebp - 0x258]
call fcn.004b063e
lea eax, [ebp - 0x228]
push eax
push esi
lea ecx, [ebp - 0x258]
call fcn.004b03cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x258]
call fcn.004b5ee5
push dword [ebp - 0x264]
lea ecx, [ebp - 0x25c]
call fcn.004af026
lea eax, [ebp - 0x228]
push eax
push esi
lea ecx, [ebp - 0x25c]
call fcn.004b03cd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x25c]
call fcn.004b5ee5
test byte [ebp - 0x254], 0x10
mov esi, dword [ebp - 0x258]
mov edi, dword [ebp - 0x25c]
je 0x4cfed0
lea eax, [ebp - 0x228]
push 0x548be0
push eax
call fcn.004d92ac
pop ecx
pop ecx
test eax, eax
je 0x4cfe92
lea eax, [ebp - 0x228]
push 0x548be4
push eax
call fcn.004d92ac
pop ecx
pop ecx
test eax, eax
je 0x4cfe92
mov eax, dword [ebp - 0x254]
mov ecx, 0x410
and eax, ecx
cmp eax, ecx
jne 0x4cfe9d
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
jmp 0x4cfeeb
cmp dword [ebp + 0x10], 0
je 0x4cfee8
push edi
call fcn.004cb24a
pop ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4cfee8
push dword [ebp - 0x270]
push dword [ebp - 0x26c]
push dword [ebp + 0x10]
push edi
push esi
call fcn.004cfce7
add esp, 0x14
jmp 0x4cfee8
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4cfee8
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [edi - 0x10]
call fcn.004b04f5
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x268]
test eax, eax
jne 0x4cfdce
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4cfda5