joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2f20
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x78], rdx
mov rcx, qword [rbp + 0x78]
call fcn.0040abd0
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040aa40
lea rcx, [0x004a3134]
mov rdx, qword [rbp + 0x78]
call fcn.0040cd70
test eax, eax
jne 0x4a3030
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.0040c6e0
mov rcx, qword [rbp + 0x78]
call fcn.0040c470
mov rbx, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c470
xor rcx, rcx
mov rdx, rbx
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_SearchPathW
mov ebx, eax
add ebx, 1
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040c6e0
mov rcx, qword [rbp + 0x78]
call fcn.0040c470
mov rsi, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c470
xor rcx, rcx
mov rdx, rsi
xor r8, r8
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x4a301e
mov rcx, qword [rbp + 0x48]
call fcn.0040c470
mov rcx, rax
call fcn.0040b2a0
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040c6e0
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
call fcn.0040b090
jmp 0x4a30d1
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
call fcn.0040b090
jmp 0x4a30d1
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.0040c6e0
mov rcx, qword [rbp + 0x78]
call fcn.0040c470
mov rbx, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c470
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
add ebx, 1
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040c6e0
mov rcx, qword [rbp + 0x78]
call fcn.0040c470
mov rsi, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c470
mov rcx, rsi
mov rdx, rax
mov r8d, ebx
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x4a30c4
mov rcx, qword [rbp + 0x48]
call fcn.0040c470
mov rcx, rax
call fcn.0040b2a0
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040c6e0
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
call fcn.0040b090
jmp 0x4a30d1
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
call fcn.0040b090
nop
lea rcx, [rbp + 0x48]
call fcn.0040aa40
lea rcx, [rbp + 0x78]
call fcn.0040aa40
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x4a3510
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x250
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x260], rcx
nop
mov rcx, qword [rbp + 0x260]
call fcn.0040aa40
nop
mov ecx, 0xff
lea rdx, [rbp + 0x50]
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x4a360a
mov rcx, qword [rbp + 0x260]
lea rdx, [rbp + 0x50]
call fcn.0040c4f0
lea rcx, [rbp + 0x30]
mov rax, qword [rbp + 0x260]
mov rdx, qword [rax]
call fcn.004a4b60
mov rcx, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x30]
call fcn.0040b090
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x260]
mov rdx, qword [rax]
call fcn.004a3380
mov rcx, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x28]
call fcn.0040b090
mov rax, qword [rbp + 0x260]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x44], 0
cmp qword [rbp + 0x48], 0
je 0x4a35d7
mov rax, qword [rbp + 0x48]
mov eax, dword [rax - 4]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x260]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x44]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x4a360a
mov rcx, qword [rbp + 0x260]
lea rdx, [0x004a3674]
call fcn.0040c7c0
jmp 0x4a360a
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040ab20
mov rax, qword [rbp + 0x260]
lea rsp, [rbp + 0x250]
pop rbp
ret
Function at 0x4a3680
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xa0], rcx
nop
nop
call fcn.004a1ee0
cmp al, 0xa
jb 0x4a3795
lea rcx, [rbp + 0x88]
mov edx, 0x104
call fcn.0040c6e0
nop
mov rcx, qword [rbp + 0x88]
call fcn.0040c470
xor rcx, rcx
mov edx, 0x1a
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], rax
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x4a3785
mov rcx, qword [rbp + 0x88]
call fcn.0040c470
mov rcx, qword [rbp + 0xa0]
mov rdx, rax
call fcn.00429050
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x7c], 0
cmp qword [rbp + 0x80], 0
je 0x4a374b
mov rax, qword [rbp + 0x80]
mov eax, dword [rax - 4]
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0
jle 0x4a3774
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
call fcn.00431fe0
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x40]
call fcn.0040b090
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.004a38a0
jmp 0x4a386a
nop
lea rcx, [rbp + 0x88]
xor rdx, rdx
call fcn.0040c6e0
mov rax, qword [0x00545b78]
mov rcx, qword [rax]
lea rdx, [0x004a392c]
lea r8, [0x004a39bc]
mov r9, qword [rbp + 0xa0]
call fcn.004a0270
test al, al
je 0x4a3869
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
call fcn.004a3380
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x38]
call fcn.0040b090
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x6c], 0
cmp qword [rbp + 0x70], 0
je 0x4a380a
mov rax, qword [rbp + 0x70]
mov eax, dword [rax - 4]
mov dword [rbp + 0x6c], eax
cmp dword [rbp + 0x6c], 0
jle 0x4a3869
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x5c], 0
cmp qword [rbp + 0x60], 0
je 0x4a3836
mov rax, qword [rbp + 0x60]
mov eax, dword [rax - 4]
mov dword [rbp + 0x5c], eax
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x5c]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x4a3869
mov rcx, qword [rbp + 0xa0]
lea rdx, [0x004a39d8]
call fcn.0040c7c0
jmp 0x4a3869
nop
lea rcx, [rbp + 0x38]
mov edx, 2
call fcn.0040ab20
lea rcx, [rbp + 0x88]
call fcn.0040aa40
mov rax, qword [rbp + 0xa0]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x4a4220
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0x26], dl
mov byte [rbp + 0x27], r8b
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
nop
mov al, 1
mov byte [rbp + 0x25], al
mov qword [rbp + 0x58], 0
movzx rax, byte [rbp + 0x26]
test al, al
je 0x4a4283
call fcn.004a2dc0
mov qword [rbp + 0x58], rax
xor rax, rax
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x4a4296
mov rax, qword [rbp + 0x28]
mov eax, dword [rax - 4]
test eax, eax
jne 0x4a42a5
xor rax, rax
mov byte [rbp + 0x25], al
jmp 0x4a43fb
movzx rax, byte [rbp + 0x27]
test al, al
je 0x4a43dd
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x28]
call fcn.0040b110
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
call fcn.00432040
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x48]
call fcn.0040b110
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00428730
xor rax, rax
cmp qword [rbp + 0x60], 0
je 0x4a42f7
mov rax, qword [rbp + 0x60]
mov eax, dword [rax - 4]
cmp eax, 2
jne 0x4a432e
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x60]
mov r8d, 2
mov r9d, 1
call fcn.0040caa0
mov rcx, qword [rbp + 0x38]
lea rdx, [0x004a44a8]
call fcn.0040ca90
test eax, eax
sete al
jmp 0x4a4331
xor rax, rax
test al, al
je 0x4a4339
mov al, 1
jmp 0x4a4344
mov rcx, qword [rbp + 0x60]
mov dl, 1
call fcn.00427e30
test al, al
je 0x4a434c
mov al, 1
jmp 0x4a435e
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0040ca90
test eax, eax
sete al
test al, al
jne 0x4a43fb
cmp qword [rbp + 0x68], 0
jne 0x4a438c
mov rcx, qword [rbp + 0x60]
call fcn.0040c470
mov rcx, rax
mov rdx, qword [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
mov byte [rbp + 0x25], al
jmp 0x4a43fa
mov rcx, qword [rbp + 0x68]
call fcn.0040c470
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.0040c4f0
mov rcx, qword [rbp + 0x30]
movzx rdx, byte [rbp + 0x26]
movzx r8, byte [rbp + 0x27]
call fcn.004a4220
test al, al
je 0x4a43d1
mov rcx, qword [rbp + 0x60]
call fcn.0040c470
mov rcx, rax
mov rdx, qword [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4a43d6
xor rax, rax
jmp 0x4a43d8
mov al, 1
mov byte [rbp + 0x25], al
jmp 0x4a43fa
mov rcx, qword [rbp + 0x28]
call fcn.0040c470
mov rcx, rax
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
mov byte [rbp + 0x25], al
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040ab20
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.0040ab20
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040ab20
movzx rax, byte [rbp + 0x25]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4a44b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.0040c470
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4a44ce
test eax, 0x10
jne 0x4a44d3
xor rax, rax
jmp 0x4a44d5
mov al, 1
add rsp, 0x28
ret
Function at 0x4a4a40
Capabilities:
Copy file

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov r13d, r9d
xor r14, r14
mov rcx, rbx
call fcn.004a4b30
test al, al
je 0x4a4abc
mov rcx, rsi
call fcn.004a4b30
test al, al
je 0x4a4a83
test r13b, r13b
je 0x4a4abc
mov rcx, rsi
call fcn.004a4ad0
test al, al
je 0x4a4abc
mov rcx, rbx
call fcn.0040c470
mov rbx, rax
mov rcx, rsi
call fcn.0040c470
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileW
test eax, eax
setne r14b
test r14b, r14b
je 0x4a4abc
test dil, dil
je 0x4a4abc
mov rcx, rsi
call fcn.004a4940
mov eax, r14d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret

Function at 0x4a4ad0
Capabilities:
Set file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor rsi, rsi
mov rcx, rbx
call fcn.004a4b30
test al, al
je 0x4a4b21
mov rcx, rbx
call fcn.00428480
mov esi, eax
test sil, sil
jne 0x4a4b21
mov rcx, rbx
call fcn.004a4940
mov rcx, rbx
call fcn.0040c470
mov rcx, rax
mov edx, 0x80
call sub.kernel32.dll_SetFileAttributesW
mov rcx, rbx
call fcn.00428480
mov esi, eax
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x4a4b30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.0040c470
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4a4b4e
test eax, 0x10
je 0x4a4b53
xor rax, rax
jmp 0x4a4b55
mov al, 1
add rsp, 0x28
ret
Function at 0x4ad220
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
mov byte [rbp + 0x78], dl
nop
mov qword [rbp + 0x58], 0
nop
cmp byte [rbp + 0x78], 0
je 0x4ad274
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
call fcn.004261b0
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x20]
mov r8w, 0xfde9
call fcn.0040bd80
jmp 0x4ad286
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x70]
mov r8w, 0xfde9
call fcn.0040bd80
mov qword [rbp + 0x40], 1
mov dword [rbp + 0x38], 0
cmp qword [rbp + 0x50], 0
je 0x4ad2a6
mov rax, qword [rbp + 0x50]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
mov eax, 1
mov ecx, dword [rbp + 0x38]
mov dword [rbp + 0x4c], eax
cmp dword [rbp + 0x4c], ecx
jg 0x4ad2ef
add ecx, 1
mov rax, qword [rbp + 0x40]
imul rax, rax, 0x5517e877
mov qword [rbp + 0x40], rax
lea rax, [0x0053a2d8]
mov rdx, qword [rbp + 0x50]
movsxd r8, dword [rbp + 0x4c]
movzx rdx, byte [rdx + r8 - 1]
mov rax, qword [rax + rdx*8]
xor qword [rbp + 0x40], rax
add dword [rbp + 0x4c], 1
cmp dword [rbp + 0x4c], ecx
jne 0x4ad2ba
nop
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x58], rax
jmp 0x4ad302
nop
lea rcx, [rbp + 0x20]
call fcn.0040aa40
lea rcx, [rbp + 0x50]
call fcn.0040aa90
mov rax, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x4ad490
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x88], r9
mov rcx, qword [rbp + 0x88]
call fcn.0040abd0
nop
mov rcx, qword [rbp + 0x40]
call fcn.0040c470
mov rbx, rax
mov rcx, qword [rbp + 0x38]
call fcn.0040c470
mov rsi, rax
mov rcx, qword [rbp + 0x88]
call fcn.0040c470
mov rcx, qword [rbp + 0x30]
lea rdx, [0x004ad554]
mov r8, rbx
mov r9, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta al
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x88]
call fcn.0040aa40
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret

Function at 0x4ad700
Capabilities:
Parse url

Disassembly:
push rbp
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0xb0], rcx
mov rcx, qword [rbp + 0xb0]
call fcn.0040abd0
nop
lea rcx, [rbp + 0x38]
mov edx, 0x68
xor r8, r8
call fcn.00406e20
lea rcx, [rbp + 0x38]
call fcn.004aeae0
nop
mov dword [rbp + 0x38], 0x68
mov rcx, qword [rbp + 0xb0]
call fcn.0040c470
mov rcx, rax
xor rdx, rdx
xor r8, r8
lea r9, [rbp + 0x38]
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [rbp + 0x4c]
mov dword [rbp + 0x34], eax
nop
lea rcx, [rbp + 0x38]
call fcn.004aec50
nop
lea rcx, [rbp + 0xb0]
call fcn.0040aa40
mov eax, dword [rbp + 0x34]
lea rsp, [rbp + 0xa0]
pop rbp
ret

Function at 0x4af390
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rax, [0x004af130]
movsxd rdx, ecx
mov rcx, rax
call sub.user32.dll_EnumWindows
add rsp, 0x28
ret
Function at 0x4af8b0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rax, [0x004af670]
movsxd rdx, ecx
mov rcx, rax
call sub.user32.dll_EnumWindows
add rsp, 0x28
ret

Function at 0x4afcf0
Capabilities:
Initialize iwebbrowser2

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rcx, rbx
call fcn.0040ff30
lea rcx, [0x0053b448]
xor rdx, rdx
mov r8d, 5
lea r9, [0x004afd2c]
mov qword [rsp + 0x20], rax
call sub.ole32.dll_CoCreateInstance
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x4b01e0
Capabilities:
Get token privileges

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
nop
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 0x20]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x10]
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
lea r8, [rbp + 0x88]
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4b044a
nop
mov rcx, qword [rbp + 0x88]
mov edx, 1
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
mov ecx, dword [rbp + 0x7c]
call fcn.00405960
mov rcx, qword [rbp + 0xc0]
mov qword [rcx + 0x18], rax
mov rcx, qword [rbp + 0x88]
mov edx, 1
mov rax, qword [rbp + 0xc0]
mov r8, qword [rax + 0x18]
mov r9d, dword [rbp + 0x7c]
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4b02bc
nop
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax + 0x18]
call fcn.004059c0
nop
mov rax, qword [rbp + 0xc0]
mov qword [rax + 0x18], 0
jmp 0x4b02c8
mov rcx, qword [rbp + 0xc0]
call fcn.004b0100
mov rcx, qword [rbp + 0x88]
mov edx, 3
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
mov ecx, dword [rbp + 0x7c]
call fcn.00405960
mov qword [rbp + 0x90], rax
nop
mov rcx, qword [rbp + 0x88]
mov edx, 3
mov r8, qword [rbp + 0x90]
mov r9d, dword [rbp + 0x7c]
lea rax, [rbp + 0x7c]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4b0430
mov rax, qword [rbp + 0x90]
cmp dword [rax], 0
jbe 0x4b0430
xor rax, rax
mov rcx, qword [rbp + 0x90]
mov ecx, dword [rcx]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x78], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x78], eax
ja 0x4b042f
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x90]
mov ecx, dword [rbp + 0x78]
lea rcx, [rcx + rcx*2]
mov rax, qword [rax + rcx*4 + 4]
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x7c], 0
xor rcx, rcx
lea rdx, [rbp + 0x80]
xor r8, r8
lea r9, [rbp + 0x7c]
call sub.advapi32.dll_LookupPrivilegeNameW
mov ecx, dword [rbp + 0x7c]
add ecx, 1
add ecx, ecx
mov ecx, ecx
call fcn.00405960
mov qword [rbp + 0x98], rax
nop
xor rcx, rcx
lea rdx, [rbp + 0x80]
mov r8, qword [rbp + 0x98]
lea r9, [rbp + 0x7c]
call sub.advapi32.dll_LookupPrivilegeNameW
test eax, eax
je 0x4b0412
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x98]
call fcn.0040c4f0
mov rcx, qword [0x004afd60]
mov dl, 1
mov r8, qword [rbp + 0x40]
call fcn.004b0020
mov qword [rbp + 0x60], rax
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00459600
mov dword [rbp + 0x5c], eax
nop
mov rcx, qword [rbp + 0x98]
call fcn.004059c0
add dword [rbp + 0x78], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x78], eax
jne 0x4b0361
nop
nop
mov rcx, qword [rbp + 0x90]
call fcn.004059c0
nop
mov rcx, qword [rbp + 0x88]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x40]
call fcn.0040aa40
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret
Function at 0x4b2650
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
mov rax, qword [0x00546118]
cmp dword [rax], 2
je 0x4b2678
lea rcx, [rbx + 8]
call sub.kernel32.dll_EnterCriticalSection_1
mov dil, 1
jmp 0x4b26c7
cmp esi, 0xffffffff
jne 0x4b268b
lea rcx, [rbx + 8]
call sub.kernel32.dll_EnterCriticalSection_1
mov dil, 1
jmp 0x4b26c7
call sub.kernel32.dll_GetTickCount_1
mov r13d, eax
lea rcx, [rbx + 8]
call sub.kernel32.dll_TryEnterCriticalSection
test eax, eax
setne dil
test dil, dil
jne 0x4b26c6
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 0xa
call sub.kernel32.dll_WaitForSingleObject
call sub.kernel32.dll_GetTickCount_1
sub eax, r13d
cmp eax, esi
jbe 0x4b2693
nop
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x4d5a70
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, r8
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x980]
call fcn.0040df50
test rax, rax
jl 0x4d5b55
cmp word [rsi], 0xd
jne 0x4d5b36
mov rax, qword [rbx + 0x30]
cmp byte [rax + 0x70b], 0
je 0x4d5b16
mov rcx, qword [rbx + 0x30]
call fcn.00489e00
mov edi, eax
mov rcx, qword [rbx + 0x30]
call fcn.00489a30
sub eax, 1
cmp edi, eax
jne 0x4d5ae1
mov rcx, rbx
call fcn.004e75d0
mov rcx, qword [rbx + 0x30]
xor rdx, rdx
call fcn.0048a100
jmp 0x4d5b66
mov rcx, qword [rbx + 0x30]
call fcn.00489e00
mov edi, eax
mov rcx, qword [rbx + 0x30]
call fcn.00489a30
sub eax, 2
cmp edi, eax
jne 0x4d5b0a
mov rcx, qword [rbx + 0x30]
xor rdx, rdx
call fcn.0048a100
jmp 0x4d5b66
mov rcx, qword [rbx + 0x30]
xor rdx, rdx
call fcn.0048a100
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x61b]
mov edx, 0x464
mov r8d, 0xd
xor r9, r9
call sub.user32.dll_SendMessageW
cmp word [rsi], 0x1b
jne 0x4d5b55
mov rax, qword [rbx + 0x30]
cmp byte [rax + 0x70b], 0
je 0x4d5b55
mov rcx, qword [rbx + 0x30]
xor rdx, rdx
call fcn.0048a100
cmp word [rsi], 0x21
jae 0x4d5b66
mov rax, qword [rbx + 0x30]
mov dword [rax + 0x5a], 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x4f14d0
Capabilities:
Set file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x50], dx
mov word [rbp + 0x52], r8w
mov word [rbp + 0x4e], r9w
mov qword [rbp + 0x58], 0
nop
call fcn.004f4ca0
mov rbx, rax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x40]
call fcn.0040c4c0
mov rcx, rbx
mov rdx, qword [rbp + 0x58]
call fcn.004f03d0
test al, al
je 0x4f152a
mov eax, 1
mov dword [rbp + 0x54], eax
jmp 0x4f15e5
mov rcx, qword [rbp + 0x40]
mov edx, 0xc0000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x8000080
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x4f157b
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [rbp + 0xc0]
mov dword [rcx], eax
xor rax, rax
mov dword [rbp + 0x54], eax
jmp 0x4f15e4
movzx rcx, word [rbp + 0x50]
movzx rdx, word [rbp + 0x52]
lea r8, [rbp + 0x78]
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x4f15be
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x70]
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x4f15be
mov rcx, rbx
lea rdx, [rbp + 0x70]
xor r8, r8
lea r9, [rbp + 0x70]
call sub.kernel32.dll_SetFileTime
mov rcx, rbx
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x40]
movzx rdx, word [rbp + 0x4e]
and dx, 0x27
movzx edx, dx
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
mov dword [rbp + 0x54], eax
nop
lea rcx, [rbp + 0x58]
call fcn.0040aa40
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x4f2600
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov dword [rbp + 0x40], r8d
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
nop
mov byte [rbp + 0x9f], 0
mov rax, qword [rbp + 0x38]
lea rax, [rax + 0x18]
add dword [rax], 1
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x78]
mov rax, qword [rbp + 0x38]
mov r8d, dword [rax + 0x18]
call fcn.004f23d0
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x78]
xor r8, r8
call fcn.0040bd80
mov rax, qword [rbp + 0x38]
lea rcx, [rax + 0x22]
mov rdx, qword [rbp + 0x90]
call fcn.00428d70
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x70]
mov rax, qword [rbp + 0x38]
mov r8d, dword [rax + 0x14]
call fcn.004f2180
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.0040bd80
mov rax, qword [rbp + 0x38]
lea rcx, [rax + 0x122]
mov rdx, qword [rbp + 0x90]
call fcn.00428d70
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x68]
mov rax, qword [rbp + 0x38]
mov r8d, dword [rax + 0x18]
call fcn.004f22c0
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x68]
xor r8, r8
call fcn.0040bd80
mov rax, qword [rbp + 0x38]
lea rcx, [rax + 0x222]
mov rdx, qword [rbp + 0x90]
call fcn.00428d70
mov rax, qword [rbp + 0x30]
cmp qword [rax + 0x68], 0
je 0x4f2754
mov rax, qword [rbp + 0x30]
lea rbx, [rax + 0x68]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x38]
mov r9d, dword [rbp + 0x40]
lea rax, [rbp + 0x9f]
mov qword [rsp + 0x20], rax
call qword [rbx]
cmp byte [rbp + 0x9f], 0
jne 0x4f27fc
lea rcx, [rbp + 0x88]
mov rax, qword [rbp + 0x38]
lea rdx, [rax + 0x222]
mov r8d, pe_nt_image_headers64
call fcn.0040c520
mov rcx, qword [rbp + 0x88]
call fcn.00427f70
lea rcx, [rbp + 0x50]
mov rax, qword [rbp + 0x38]
lea rdx, [rax + 0x222]
mov r8d, pe_nt_image_headers64
call fcn.0040c520
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x48]
mov rax, qword [rbp + 0x38]
lea rdx, [rax + 0x122]
mov r8d, pe_nt_image_headers64
call fcn.0040c520
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x88]
lea rdx, [rbp + 0x58]
mov r8d, 1
call fcn.004f0b90
mov rcx, qword [rbp + 0x88]
call fcn.0040c470
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x3fc], 0
mov dword [rax + 0x400], 0
cmp byte [rbp + 0x9f], 0
sete al
mov byte [rbp + 0x47], al
nop
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.0040ab20
lea rcx, [rbp + 0x68]
mov edx, 3
call fcn.0040ab20
lea rcx, [rbp + 0x88]
call fcn.0040aa40
lea rcx, [rbp + 0x90]
call fcn.0040aa90
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0xa8]
pop rbx
pop rbp
ret