joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f2e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a3cc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x69f000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 3
cmp byte [edi + 0x65], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x43f35f
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x43f33f
cmp eax, 0xffffffff
je 0x43f33f
push eax
call ebx
mov dword [edi + 0xa0], 0
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x43f35b
cmp eax, 0xffffffff
je 0x43f35b
push eax
call ebx
mov dword [edi + 0x9c], 0
mov byte [edi + 0x65], 0
mov eax, dword [edi + 0xa4]
mov ecx, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x43f3a4
push 0x1388
push eax
call ecx
cmp eax, 0x102
jne 0x43f38c
push 0xffffffffffffffff
push dword [edi + 0xa4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [edi + 0xa4]
call ebx
mov ecx, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov dword [edi + 0xa4], 0
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
je 0x43f3fd
nop dword [eax]
mov eax, dword [esi]
push 0xbb8
mov ebx, dword [eax]
push ebx
call ecx
cmp eax, 0x102
jne 0x43f3cc
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi]
test eax, eax
je 0x43f3ef
cmp dword [eax], 0
je 0x43f3e4
mov dword [eax], 0
push 4
push eax
call fcn.005d0cf8
add esp, 8
mov ecx, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
add esi, 4
cmp esi, dword [edi + 8]
jne 0x43f3b0
mov byte [ebp - 4], 2
lea esi, [edi + 0xa8]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
push esi
call fcn.00443140
push 0x30
push dword [esi]
call fcn.005d0cf8
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [edi + 0x2c]
call fcn.00462690
mov byte [ebp - 4], 0
lea ecx, [edi + 0x10]
call fcn.0040bd90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 4]
test eax, eax
je 0x43f48e
mov ecx, dword [edi + 0xc]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x43f46f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43f4a0
mov eax, edx
push ecx
push eax
call fcn.005d0cf8
mov dword [edi + 4], 0
add esp, 8
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005d87bd
int3
Function at 0x43fd10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0xa4], 0
je 0x43fd59
call fcn.00408570
mov ecx, dword [eax + 0xf4]
add eax, 0xf4
push str.IPC_channel_already_opened...
push eax
call dword [ecx + 0x10]
add esp, 8
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push esi
push 0x442060
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xa4], eax
test eax, eax
jne 0x43fd48
call fcn.00408570
mov ecx, dword [eax + 0xf4]
add eax, 0xf4
push str.Failed_to_start_the_worker_Thread
push str.InitElevationHandler
push eax
call dword [ecx + 0x20]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor al, al
pop esi
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x462090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e7e8
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x9c], edx
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x94], eax
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], eax
cmp byte [esi + 0x38], al
je 0x462164
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
cmp byte [esi + 0x39], 0
je 0x462164
add eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
push 0
push ecx
push edi
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x90]
cmp eax, 0x6d
je 0x46212b
test ecx, ecx
jne 0x462138
jmp 0x46214a
cmp dword [ebp - 0x98], 0
je 0x4621e6
cmp ecx, edi
je 0x462164
add dword [ebp - 0x8c], ecx
sub edi, ecx
cmp ebx, 0x64
jg 0x462182
inc ebx
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [esi + 0x38], 0
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x9c]
jne 0x4620f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
push str.Terminate_channel
lea ecx, [ebp - 0x28]
call fcn.0040bb30
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 2
call fcn.0043f200
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 8
push ecx
mov dword [ebp - 0x64], 4
lea eax, [ecx + 1]
mov dword [ebp - 0x60], 0xffff
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x58]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040be20
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.00462f90
lea ecx, [ebp - 0x58]
call fcn.0040bd90
lea ecx, [ebp - 0x28]
jmp 0x462254
push str.Terminate_channel
lea ecx, [ebp - 0x40]
call fcn.0040bb30
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 0
call fcn.0043f200
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x2c], 8
push ecx
mov dword [ebp - 0x88], 4
lea eax, [ecx + 1]
mov dword [ebp - 0x84], 0xffff
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x7c]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0040be20
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
call fcn.00462f90
lea ecx, [ebp - 0x7c]
call fcn.0040bd90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.0040bd90
mov eax, dword [esi + 0x74]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x46227c
cmp eax, 0xffffffff
je 0x46227c
push eax
call edi
mov dword [esi + 0x74], 0
mov eax, dword [esi + 0x70]
test eax, eax
je 0x462292
cmp eax, 0xffffffff
je 0x462292
push eax
call edi
mov dword [esi + 0x70], 0
mov byte [esi + 0x39], 0
xor al, al
jmp 0x462166
Function at 0x462b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
xor ebx, ebx
mov dword [ebp - 8], eax
push ebx
lea edx, [ebp - 4]
mov dword [ebp - 0xc], ecx
push edx
push esi
push eax
push ecx
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x462b75
nop word [eax + eax]
mov eax, dword [ebp - 4]
cmp eax, esi
ja 0x462b75
jae 0x462b7f
add edi, eax
sub esi, eax
cmp ebx, 0x32
jg 0x462b75
push 0xa
inc ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push esi
add eax, edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x462b40
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463d70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60eafc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x69f000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
lea eax, [edi + 0x68]
mov dword [edi], 0x665398
mov dword [edi + 0x10], 0x6653b0
mov dword [ebp - 0x10], eax
mov dword [eax + 8], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push ecx
lea esi, [edi + 0x18]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x10], 1
call fcn.00428e00
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.004291a0
mov dword [esi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, edi
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46a250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0
push 0
mov edi, ecx
mov esi, edx
push edi
push 0
xor bl, bl
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
js 0x46a2de
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x46a2d0
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46a2b0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040be20
mov bl, 1
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x46a320
push 1
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x46a320
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46a300
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040be20
mov bl, 1
mov eax, dword [esi + 0x10]
test eax, eax
je 0x46a370
mov edx, dword [esi + 0x14]
mov ecx, esi
cmp edx, 8
jb 0x46a333
mov ecx, dword [esi]
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x46a370
lea ecx, [eax - 1]
cmp ecx, eax
ja 0x46a365
mov dword [esi + 0x10], ecx
cmp edx, 8
jb 0x46a34c
mov esi, dword [esi]
xor eax, eax
pop edi
mov word [esi + ecx*2], ax
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0046b100
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005d077b
mov esp, ebp
pop ebp
ret

Function at 0x46a390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x2b
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x46a3ce
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
push str.Adobe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005d847b
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46a3f0
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040be20
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x46a420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x1c
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x46a45e
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
push str.Adobe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005d847b
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46a480
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040be20
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x46ab00
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f21d
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46ab3c
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x46ab72
cmp dword [esi + 0x14], 8
jb 0x46ab4f
mov esi, dword [esi]
push esi
push str.Directory_to_delete_not_present_at_location__s
push 0x65fe6c
push str.FileUtils
push 0x28
push 0
call fcn.0046e820
add esp, 0x18
xor al, al
jmp 0x46acf8
cmp byte [ebp + 8], 0
je 0x46ace3
push esi
lea ecx, [ebp - 0x28]
call fcn.0040bb80
push 0x66ee40
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.0040bb30
push ecx
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0046aa50
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040bd90
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x294], eax
cmp eax, 0xffffffff
je 0x46acdb
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcmpW]
nop word [eax + eax]
push 0x662818
lea eax, [ebp - 0x264]
push eax
call ebx
test eax, eax
je 0x46acb4
push 0x66eefc
lea eax, [ebp - 0x264]
push eax
call ebx
test eax, eax
je 0x46acb4
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x46ac39
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46ac2d
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.0040be20
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040bb30
push ecx
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0046aa50
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040bd90
test byte [ebp - 0x290], 0x10
je 0x46ac87
push 0
push dword [ebp + 0xc]
mov edx, edi
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
call fcn.0046ab00
add esp, 0xc
jmp 0x46acb4
mov dl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0046ad20
add esp, 4
test al, al
jne 0x46acb4
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x46acb4
cmp dword [ebp - 0x14], 8
mov ecx, edi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040be20
lea eax, [ebp - 0x290]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x46abf0
push dword [ebp - 0x294]
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x28]
call fcn.0040bd90
cmp dword [esi + 0x14], 8
jb 0x46aceb
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
cmp eax, 1
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
Function at 0x46ad20
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov esi, ecx
mov bh, dl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x46ad30
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46ae15
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46ad49
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46ad5a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
sete bl
je 0x46ade1
test bh, bh
je 0x46ade1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x46ade1
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46ad82
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 1
je 0x46ade1
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x46ad97
mov ecx, dword [esi]
push eax
push ecx
push str.File__s_is_with_read_only._Its_attribute_is:__d._UnSetting_its_read_only_attr_and_retry_deleting
push 0x65fe6c
push str.FileUtils
push 0x14
push 0
call fcn.0046e820
add esp, 0x1c
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x46adbe
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46add4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
sete bl
test bl, bl
jne 0x46ae10
cmp dword [esi + 0x14], 8
jb 0x46aded
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push esi
push str.Failed_to_delete_file:__s_LastError:_d
push 0x65fe6c
push str.FileUtils
push 0x32
push 0
call fcn.0046e820
add esp, 0x1c
pop esi
mov al, bl
pop ebx
ret
pop esi
mov al, 1
pop ebx
ret
Function at 0x46ae20
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x46ae37
mov eax, dword [edi]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x46ae67
push str.Source_file_does_not_exist_in_CopyFileFromSourceToDestination
push 0x65fe6c
push str.FileUtils
push 0x32
push eax
call fcn.0046e820
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46ae71
mov eax, dword [esi]
push eax
call ebx
test eax, eax
je 0x46ae89
push ecx
mov dl, 1
mov ecx, esi
call fcn.0046ad20
add esp, 4
test al, al
je 0x46ae5e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46ae93
mov eax, dword [esi]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x46ae9d
mov ecx, dword [edi]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
jne 0x46afab
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebx
cmp eax, 5
jne 0x46af64
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], esi
jb 0x46aece
mov eax, dword [esi]
mov dword [ebp - 4], eax
push 0x44
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x44
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x46af77
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x46af16
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
sub esp, 0x14
push ebx
call fcn.0046afd0
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 8], 0
jne 0x46af77
push str.Trying_to_copy_file_after_setting_permissions
push 0x65fe6c
push str.FileUtils
push 0x1e
push 0
call fcn.0046e820
add esp, 0x14
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x46af48
mov eax, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x46af50
mov edi, dword [edi]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
jne 0x46afab
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [esi + 0x14], 8
jb 0x46af6c
mov esi, dword [esi]
call ebx
push eax
push esi
push str.Failed_to_copy_file_at_the_destination:_s._LastError:__d
jmp 0x46af8c
cmp dword [edi + 0x14], 8
jb 0x46af7f
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push edi
push str.Failed_to_set_permissions_for_path__s._LastError:__d
push 0x65fe6c
push str.FileUtils
push 0x32
push 0
call fcn.0046e820
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x46afb3
mov esi, dword [esi]
push 0x80
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e750
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 4], ecx
test edi, edi
jne 0x46e76c
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push 8
call fcn.00486cd6
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
je 0x46e78a
mov eax, dword [ebp + 0xc]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x46e78c
xor esi, esi
push 0
push 0
push esi
push 0x46e7e0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x46e7c3
test esi, esi
je 0x46e7d3
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.005d0cf8
add esp, 8
mov al, bl
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov bl, 1
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46e7d3
mov dword [ecx], eax
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46f9b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x46fa3d
xor eax, eax
cmp dword [edi + 0x60], 8
mov word [ebp - 4], ax
mov dword [ebp - 8], eax
lea eax, [edi + 0x4c]
jb 0x46f9db
mov eax, dword [eax]
push str.rb__ccsUTF_8
push eax
lea eax, [ebp - 8]
push eax
call fcn.005d8f69
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x46fa3d
push eax
push 2
lea eax, [ebp - 4]
push 1
push eax
call fcn.005de31f
push dword [ebp - 8]
call fcn.005d90e0
mov ax, word [ebp - 4]
add esp, 0x14
cmp al, 0xff
jne 0x46fa1a
cmp ah, 0xfe
je 0x46fa3d
cmp ah, 0xff
jne 0x46fa23
cmp al, 0xfe
je 0x46fa3d
mov eax, dword [ebx]
test eax, eax
je 0x46fa36
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.004708c0
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
mov eax, esi
jb 0x46fa4a
mov eax, dword [esi]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x46fae6
cmp dword [esi + 0x14], 8
jb 0x46fa72
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x46fa9d
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
push 0
jne 0x46facb
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0xfeff
push ecx
push 2
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 8]
mov word [ebp - 4], 0xbbef
push ecx
push 3
lea ecx, [ebp - 4]
mov byte [ebp - 2], 0xbf
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46fe60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x46fe70
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
add esi, esi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
push 0x66349c
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4