joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a05dd
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x107]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x210], edi
mov byte [ebp - 0x108], bl
call fcn.00401f80
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.00401f80
add esp, 0x18
mov edx, edi
call fcn.00445b2f
test eax, eax
jne 0x4a071e
mov edx, dword [ebp - 0x214]
call fcn.00445b2f
test eax, eax
jne 0x4a071e
push dword [ebp - 0x214]
lea edi, [esi + 1]
mov ecx, edi
lea eax, [ebp - 0x108]
call fcn.00444961
mov edx, eax
call fcn.004456dc
mov esi, edx
call fcn.00445630
mov eax, esi
push eax
call fcn.00401a80
pop ecx
pop ecx
jmp 0x4a0696
lea ecx, [ebp + eax - 0x108]
cmp byte [ecx], 0x5c
jne 0x4a069b
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x4a0688
lea esi, [ebp - 0x108]
call fcn.00444789
push dword [ebp - 0x210]
mov ecx, edi
lea eax, [ebp - 0x20c]
call fcn.00444961
mov edx, eax
call fcn.004456dc
mov esi, edx
call fcn.00445630
mov eax, esi
push eax
call fcn.00401a80
pop ecx
pop ecx
jmp 0x4a06e1
lea ecx, [ebp + eax - 0x20c]
cmp byte [ecx], 0x5c
jne 0x4a06e6
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x4a06d3
lea eax, [ebp - 0x20c]
call fcn.00444748
mov edx, eax
lea ecx, [ebp - 0x108]
call fcn.00446954
lea eax, [ebp - 0x108]
cmp dword [ebp + 0xc], ebx
je 0x4a071a
push 0xb
push eax
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x4a0720
push 0xa
jmp 0x4a070b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x4a0aea
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [0x523054]
xor ebx, ebx
call fcn.00450751
xor esi, esi
jmp 0x4a0b20
cmp esi, 0x56ce
jge 0x4a0b28
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xa8]
je 0x4a0b26
mov edi, dword [0x523054]
call fcn.00450704
inc esi
test eax, eax
jne 0x4a0b01
jmp 0x4a0b28
mov ebx, eax
mov eax, ebx
call fcn.0049ffb6
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4a0fc9
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x14]
push 0x103
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x107]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x110], esi
mov byte [ebp - 0x108], 0
call fcn.00401f80
push 0x1c8
push 1
call fcn.00401a3a
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x4a1036
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4a1127
mov eax, dword [0x523054]
test eax, eax
jne 0x4a1049
call fcn.0045052b
mov dword [0x523054], eax
push ebx
push edi
mov ebx, eax
call fcn.004504da
xor ebx, ebx
pop ecx
cmp dword [0x523054], ebx
jne 0x4a1071
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call fcn.00401a00
pop ecx
jmp 0x4a1124
push 0xc
lea eax, [edi + 4]
push ebx
push eax
mov dword [edi], ebx
call fcn.00401f80
mov eax, dword [ebp + 8]
push dword [ebp - 0x114]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x18], eax
push 0x40
lea eax, [edi + 0x24]
pop ecx
mov dword [edi + 0x10], esi
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
call fcn.00444961
push dword [ebp - 0x10c]
mov ecx, 0x104
lea eax, [ebp - 0x108]
call fcn.00444961
mov esi, eax
call fcn.00444789
mov eax, esi
push eax
push 0x40
lea eax, [edi + 0x64]
pop ecx
call fcn.00444961
mov eax, dword [ebp + 0x18]
add esp, 0x18
mov dword [edi + 0xa4], eax
mov dword [edi + 0xb0], ebx
call fcn.0041df75
mov dword [edi + 0xb4], eax
lea eax, [edi + 0xb8]
call fcn.004449db
push ebx
push ebx
push edi
push 0x4a0b41
push dword [ebp - 0x110]
mov dword [edi + 0xac], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xa8], eax
cmp eax, ebx
jne 0x4a1126
mov eax, edi
call fcn.0049ffb6
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401317
leave
ret 0x14
Function at 0x4a1173
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x10c], ebx
cmp edi, ebx
je 0x4a12c8
cmp byte [edi], 0x30
je 0x4a12c8
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00401f80
push edi
mov ecx, esi
lea eax, [ebp - 0x108]
call fcn.00444961
push 0x22
mov edi, eax
call fcn.004446e2
add esp, 0x14
cmp dword [ebp + 8], ebx
jbe 0x4a11fe
push 0xf7f
push str.File.c
push str.CreateDirectorySuper
mov eax, edi
push eax
push 0x49f5cc
xor ecx, ecx
call fcn.004a0fc9
mov esi, eax
jmp 0x4a1200
xor esi, esi
cmp esi, ebx
jne 0x4a123d
push ebx
push dword [ebp - 0x110]
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
cmp eax, ebx
je 0x4a1235
cmp eax, 0x50
je 0x4a1235
cmp eax, 0xb7
je 0x4a1235
cmp eax, 0x4c7
je 0x4a1235
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4a12c8
xor eax, eax
inc eax
jmp 0x4a12ca
call fcn.0041df75
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], ebx
jmp 0x4a127a
cmp dword [ebp - 0x10c], 0x103
jne 0x4a129a
call fcn.0041df75
sub eax, dword [ebp - 0x114]
cmp eax, dword [ebp + 8]
ja 0x4a128a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10c]
push eax
push esi
call edi
test eax, eax
jne 0x4a1256
jmp 0x4a129a
mov dword [ebp - 0x10c], ebx
mov dword [0x5215c0], 0x5b4
call fcn.0049ff62
push dword [0x5215c0]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
cmp dword [ebp - 0x10c], ebx
jne 0x4a1235
mov eax, dword [ebp - 0x110]
call fcn.0049f8cf
push dword [0x5215c0]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret

Function at 0x4a14db
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov edx, edi
call fcn.00445b2f
test eax, eax
je 0x4a14ef
xor eax, eax
jmp 0x4a152b
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
test eax, eax
jne 0x4a1528
call fcn.004a142a
test eax, eax
je 0x4a1528
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x4a14eb
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call esi
jmp 0x4a152b
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x4a152f
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov dword [ebp - 0x114], ebx
call fcn.00445b2f
test eax, eax
jne 0x4a1697
mov edx, edi
call fcn.00445b2f
test eax, eax
jne 0x4a1697
push ebx
call fcn.00401a80
mov esi, 0x104
pop ecx
cmp eax, esi
jae 0x4a164c
push edi
call fcn.00401a80
pop ecx
cmp eax, esi
jae 0x4a164c
push dword [ebp + 0x10]
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
call ebx
test eax, eax
jne 0x4a1647
push edi
call fcn.0049f690
pop ecx
test eax, eax
je 0x4a1615
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00401f80
add esp, 0xc
push dword [ebp - 0x114]
mov ecx, esi
lea eax, [ebp - 0x110]
call fcn.00444961
pop ecx
mov esi, eax
call fcn.00444789
mov edx, esi
call fcn.00445b2f
test eax, eax
jne 0x4a1697
mov edx, edi
mov ecx, esi
call fcn.00446954
push dword [ebp + 0x10]
mov eax, esi
push eax
push dword [ebp - 0x114]
call ebx
jmp 0x4a1699
cmp dword [ebp + 0x10], 0
jne 0x4a1697
call fcn.004a142a
test eax, eax
je 0x4a1697
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x4a1697
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
jmp 0x4a1608
xor eax, eax
inc eax
jmp 0x4a1699
mov eax, ebx
call fcn.00445cfa
mov esi, eax
mov eax, edi
call fcn.00445cfa
mov edi, eax
test esi, esi
je 0x4a168c
test edi, edi
je 0x4a1685
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
mov ebx, eax
call fcn.00401a00
pop ecx
push edi
call fcn.00401a00
pop ecx
mov eax, ebx
jmp 0x4a1699
push esi
call fcn.00401a00
pop ecx
test edi, edi
je 0x4a1697
push edi
call fcn.00401a00
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x4a1785
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
call fcn.00445b2f
test eax, eax
jne 0x4a1879
mov edx, dword [ebp + 0xc]
call fcn.00445b2f
test eax, eax
jne 0x4a1879
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 0x20
push 3
push ebx
push 7
push 0x80
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4a181c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4a1809
mov dword [ebp - 4], 1
jmp 0x4a1817
cmp dword [0x51079c], ebx
je 0x4a1817
mov dword [0x51079c], ebx
call fcn.0049ff62
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a152f
add esp, 0xc
test eax, eax
je 0x4a1879
cmp dword [ebp - 4], ebx
jne 0x4a1839
xor eax, eax
inc eax
jmp 0x4a187b
push ebx
push 0x80000020
push 3
push ebx
push 7
push pe_nt_image_headers32
push dword [ebp + 0xc]
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4a1834
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4a1872
inc dword [0x5215d4]
call fcn.0049ff62
jmp 0x4a1834
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a1b95
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x5092e4]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edx, esi
mov dword [esp + 0x10], esi
call fcn.00445b2f
test eax, eax
je 0x4a1bdc
xor eax, eax
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401317
mov esp, ebp
pop ebp
ret
call fcn.0041df75
push ebx
mov edi, 0x80
push edi
mov dword [esp + 0x1c], eax
push 3
push connect
mov eax, esi
call fcn.004a1899
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x4a1c69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
je 0x4a1c1d
call fcn.0041df75
sub eax, dword [esp + 0x14]
cmp eax, ebx
jae 0x4a1c5d
mov eax, dword [esp + 0x10]
push ebx
push edi
push 3
push 0x2000000
call fcn.004a1899
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x4a1c69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test ebx, ebx
je 0x4a1c52
call fcn.0041df75
sub eax, dword [esp + 0x14]
cmp eax, ebx
jae 0x4a1c5d
mov ecx, dword [esp + 0x10]
push ebx
call fcn.004a12d9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4a1bc5
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x4a1c86
call fcn.0049ff62
jmp 0x4a1bc5
cmp eax, ebx
jbe 0x4a1cb7
push ebx
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a1cab
cmp dword [esp + 0x10], ebx
jne 0x4a1cb7
call fcn.0049ff62
mov eax, ebx
jmp 0x4a1bc7
mov ebx, dword [esp + 0x14]
jmp 0x4a1cab
Function at 0x4a1e8c
Capabilities:
Read file on windows
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x113]
mov esi, ecx
mov edi, edx
push ebx
push eax
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x11c], edi
mov byte [ebp - 0x114], bl
call fcn.00401f80
add esp, 0xc
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
cmp esi, ebx
je 0x4a1f3a
cmp byte [esi], bl
je 0x4a1f3a
cmp edi, ebx
je 0x4a1f3a
cmp byte [edi], bl
je 0x4a1f3a
cmp dword [ebp + 8], ebx
je 0x4a1f07
mov eax, 0x81
mov dword [ebp - 0x118], 0x106
jmp 0x4a1f14
xor eax, eax
inc eax
mov dword [ebp - 0x118], 6
mov edi, 0x61a8
push edi
push 0x20
push 3
push eax
mov eax, esi
call fcn.004a1899
add esp, 0x10
mov dword [ebp - 0x124], eax
cmp eax, 0xffffffff
jne 0x4a1f4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
push dword [ebp - 0x11c]
mov ecx, 0x104
lea eax, [ebp - 0x114]
call fcn.00444961
pop ecx
mov esi, eax
call fcn.00445630
mov edx, esi
call fcn.00445b2f
test eax, eax
jne 0x4a1fa5
mov eax, esi
push eax
call fcn.00401a80
pop ecx
mov ecx, esi
cmp byte [eax + ecx - 1], 0x5c
jne 0x4a1fa5
push dword [ebp - 0x130]
mov ecx, 0x104
mov eax, esi
call fcn.00444961
pop ecx
push dword [ebp - 0x11c]
call fcn.00446ced
pop ecx
push edi
push 0x80000020
push 2
push dword [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.004a1899
add esp, 0x10
mov dword [ebp - 0x11c], eax
cmp eax, 0xffffffff
jne 0x4a1fe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x124]
call fcn.0049ff62
jmp 0x4a1f3a
mov esi, 0x100000
push esi
call fcn.004028f8
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4a207a
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x128], ebx
push ebx
lea eax, [ebp - 0x120]
push eax
push esi
push edi
push dword [ebp - 0x124]
mov dword [ebp - 0x120], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a2030
inc dword [0x521894]
inc dword [ebp - 0x128]
cmp dword [ebp - 0x120], ebx
jbe 0x4a2071
push ebx
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x120]
mov dword [ebp - 0x12c], ebx
push edi
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a2069
inc dword [0x521894]
inc dword [ebp - 0x118]
cmp dword [ebp - 0x120], ebx
ja 0x4a2004
push edi
call fcn.00401a00
pop ecx
jmp 0x4a2084
mov dword [ebp - 0x118], 1
cmp dword [ebp + 8], ebx
je 0x4a20cf
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4a20cf
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, dword [ebp - 0x11c]
call fcn.0049ff62
mov esi, dword [ebp - 0x124]
call fcn.0049ff62
cmp dword [ebp - 0x128], ebx
jne 0x4a1f3a
cmp dword [ebp - 0x118], ebx
jne 0x4a1f3a
xor eax, eax
inc eax
jmp 0x4a1f3c
Function at 0x4a2121
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.00401f80
add esp, 0xc
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00444961
pop ecx
mov esi, eax
call fcn.00445630
push 0
push 0x5c
call fcn.00445550
pop ecx
pop ecx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4a21c5
test al, 0x10
je 0x4a21c5
mov eax, esi
push 1
push eax
call fcn.004a2105
mov eax, esi
push eax
call fcn.0049fb5b
add esp, 0xc
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x114], eax
test esi, esi
jne 0x4a21bd
lea edi, [ebp - 0x110]
call fcn.004a142a
push dword [ebp - 0x114]
jmp 0x4a21de
xor esi, esi
cmp eax, 0xffffffff
je 0x4a21dc
call fcn.004a142a
test eax, eax
je 0x4a21dc
push edi
call fcn.0049f690
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401317
leave
ret
Function at 0x4a2c6b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x5092e4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x15]
push ebx
push eax
mov byte [esp + 0x1c], bl
call fcn.00401f80
add esp, 0xc
mov edx, edi
call fcn.00445b2f
test eax, eax
je 0x4a2cb6
xor eax, eax
jmp 0x4a2e62
push edi
push str._s.manifest
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.004451a8
add esp, 0x10
cmp dword [ebp + 0xc], ebx
jne 0x4a2cf1
push 0x80
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
call fcn.004a14db
jmp 0x4a2e62
push dword [ebp + 0x10]
push ebx
push edi
call fcn.004a2c6b
add esp, 0xc
push 0x18de
push str.File.c
mov edx, 0x4cf3e4
lea ecx, [esp + 0x18]
call fcn.004a0001
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x4a2da8
push 0x103
lea eax, [esp + 0x11d]
push ebx
push eax
mov byte [esp + 0x124], bl
call fcn.00401f80
lea eax, [esp + 0x1c]
add esp, 0xc
push eax
mov ecx, 0x104
lea eax, [esp + 0x11c]
call fcn.00444961
pop ecx
call fcn.00444748
push eax
call fcn.0049f690
pop ecx
test eax, eax
jne 0x4a2caf
cmp dword [0x5219a4], ebx
jne 0x4a2caf
push ebx
lea ecx, [esp + 0x11c]
call fcn.004a1173
pop ecx
push dword [ebp + 0x10]
mov dword [0x5219a4], 1
push dword [ebp + 0xc]
push edi
call fcn.004a2c6b
add esp, 0xc
mov dword [0x5219a4], ebx
jmp 0x4a2e62
push str.__xml_version_1.0__encoding_UTF_8__standalone_yes___
push esi
call fcn.00402261
push str._n_assembly_xmlns_urn:schemas_microsoft_com:asm.v1__manifestVersion_1.0__
push esi
call fcn.00402261
push str._n___trustInfo_xmlns_urn:schemas_microsoft_com:asm.v2__
push esi
call fcn.00402261
push str._n_____security_
push esi
call fcn.00402261
push str._n_______requestedPrivileges_
push esi
call fcn.00402261
push str._n_________requestedExecutionLevel
push esi
call fcn.00402261
add esp, 0x30
cmp dword [ebp + 0x10], ebx
je 0x4a2df9
push str._n__________level_requireAdministrator_
jmp 0x4a2dfe
push str._n__________level_asInvoker_
push esi
call fcn.00402261
pop ecx
pop ecx
push str._n__________uiAccess_false___
push esi
call fcn.00402261
push str._n________requestedPrivileges_
push esi
call fcn.00402261
push str._n______security_
push esi
call fcn.00402261
push str._n____trustInfo_
push esi
call fcn.00402261
push str._n__assembly_
push esi
call fcn.00402261
push 0x4ce78c
push esi
call fcn.00402261
add esp, 0x30
mov ecx, esi
call fcn.004a2aec
push 7
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401317
mov esp, ebp
pop ebp
ret
Function at 0x4a2f4b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.00401f80
add esp, 0xc
mov edx, edi
call fcn.00445b2f
test eax, eax
je 0x4a2f91
xor eax, eax
jmp 0x4a3015
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00444961
mov esi, eax
call fcn.00444789
mov eax, esi
push edi
push eax
call fcn.004023a0
add esp, 0xc
test eax, eax
jne 0x4a2fdb
push edi
push eax
push eax
call fcn.004623aa
pop ecx
pop ecx
push eax
push 0x4cda20
mov eax, esi
push 0x104
push eax
call fcn.004451a8
add esp, 0x14
mov edi, esi
push 0x1546
push str.File.c
mov edx, 0x4cc8b8
mov ecx, edi
call fcn.004a0001
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4a2f8a
push esi
push 1
lea eax, [ebp + 8]
push 4
push eax
call fcn.0040257f
add esp, 0x10
mov ecx, esi
mov edi, eax
call fcn.004a2aec
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401317
leave
ret

Function at 0x4a3023
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x114], esi
mov edi, edx
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x110], bl
call fcn.00401f80
add esp, 0xc
cmp edi, ebx
jne 0x4a3070
lea edi, [ebp - 0x118]
mov edx, esi
call fcn.00445b2f
test eax, eax
je 0x4a3084
mov dword [edi], ebx
xor eax, eax
jmp 0x4a311f
push esi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00444961
mov esi, eax
call fcn.00444789
push dword [ebp - 0x114]
mov eax, esi
push eax
call fcn.004023a0
add esp, 0xc
test eax, eax
jne 0x4a30de
push dword [ebp - 0x114]
push ebx
push ebx
call fcn.004623aa
pop ecx
pop ecx
push eax
push 0x4cda20
mov eax, esi
push 0x104
push eax
call fcn.004451a8
mov eax, esi
add esp, 0x14
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
push 0x1520
push str.File.c
mov edx, 0x4cc77c
call fcn.004a0001
mov esi, eax
pop ecx
pop ecx
mov dword [edi], ebx
cmp esi, ebx
je 0x4a307d
push esi
push 1
push 4
push edi
call fcn.00402244
add esp, 0x10
mov ecx, esi
mov edi, eax
call fcn.004a2aec
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x4a314b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x103
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.00401f80
add esp, 0xc
mov edx, edi
call fcn.00445b2f
test eax, eax
je 0x4a319a
xor eax, eax
jmp 0x4a323a
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00444961
pop ecx
mov esi, eax
call fcn.00444789
mov eax, esi
push edi
push eax
call fcn.004023a0
pop ecx
pop ecx
test eax, eax
jne 0x4a31e4
push edi
push eax
push eax
call fcn.004623aa
pop ecx
pop ecx
push eax
push 0x4cda20
mov eax, esi
push 0x104
push eax
call fcn.004451a8
add esp, 0x14
mov edi, esi
cmp dword [ebp - 0x114], 0
je 0x4a322f
push 0x14e8
push str.File.c
mov edx, 0x4cc8b8
mov ecx, edi
call fcn.004a0001
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4a3193
push edi
push 1
push 0x64
push dword [ebp - 0x114]
call fcn.0040257f
mov esi, eax
add esp, 0x10
neg esi
sbb esi, esi
mov ecx, edi
neg esi
call fcn.004a2aec
jmp 0x4a3238
mov eax, edi
call fcn.004a14db
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401317
leave
ret

Function at 0x4a3248
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov esi, edx
push 0
push eax
mov edi, ecx
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.00401f80
add esp, 0xc
test esi, esi
je 0x4a3327
mov edx, edi
call fcn.00445b2f
test eax, eax
jne 0x4a3327
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00444961
mov esi, eax
call fcn.00444789
mov eax, esi
push edi
push eax
call fcn.004023a0
add esp, 0xc
test eax, eax
jne 0x4a32e5
push edi
push eax
push eax
call fcn.004623aa
pop ecx
pop ecx
push eax
push 0x4cda20
mov eax, esi
push 0x104
push eax
call fcn.004451a8
add esp, 0x14
mov edi, esi
push 0x14c8
push str.File.c
mov edx, 0x4cc77c
mov ecx, edi
call fcn.004a0001
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4a3327
push edi
push 1
push 0x64
push dword [ebp - 0x114]
call fcn.00402244
add esp, 0x10
neg eax
sbb esi, esi
mov ecx, edi
neg esi
call fcn.004a2aec
mov eax, esi
jmp 0x4a3329
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401317
leave
ret