joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8160
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4d81ae
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x4d81ab
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x4d81ab
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
mov dword [esi], eax
cmp dword [esi], 0
mov ecx, dword [ebp + 0x1c]
setne bl
cmp ecx, 8
jb 0x4d81c6
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00407b40
pop esi
mov al, bl
pop ebx
pop ebp
ret 0x18

Function at 0x4da330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f85ba
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebx + 4]
push 0
push 0x622628
mov dword [ebx + 0x64], edi
call fcn.00407060
push str.na1e_acc.services.adobe.com
lea ecx, [ebx + 4]
call fcn.004096d0
push 0x6478f0
lea ecx, [ebx + 0x1c]
call fcn.00407010
push 0
push 0
mov ecx, ebx
call fcn.004d8c40
push 0x5c
call fcn.00599c81
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
push 0x5c
push 0
push esi
mov dword [ebp - 4], 0
call fcn.005b3770
add esp, 0xc
lea ecx, [esi + 8]
call fcn.004dfa40
mov byte [ebp - 4], 1
mov dword [esi + 4], 0
mov dword [esi], 4
call fcn.004e1d80
mov dword [esi + 0x58], eax
lea eax, [esi + 0x54]
push eax
push 0
push esi
push 0x4df8a0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x4c], eax
xor eax, eax
mov dword [esi + 0x50], ebx
mov dword [ebx + 0x68], esi
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4dba70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f888a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [edi + 4]
mov esi, dword [ebp + 0xc]
push 0
push 0x622628
mov dword [edi + 0x64], eax
mov dword [edi + 0x12c], esi
call fcn.00407060
lea ecx, [edi + 4]
cmp esi, 1
jne 0x4dbac7
push 0x1a
push str.cc_api_data_stage.adobe.io
jmp 0x4dbace
push 0x14
push str.cc_api_data.adobe.io
call fcn.004097c0
push 8
push 0x647c28
lea ecx, [edi + 0x1c]
call fcn.00407060
push 0
push 0
mov ecx, edi
call fcn.004d8c40
push 0x5c
call fcn.00599c81
mov esi, eax
add esp, 4
mov dword [ebp + 0xc], esi
push 0x5c
push 0
push esi
mov dword [ebp - 4], 0
call fcn.005b3770
add esp, 0xc
lea ecx, [esi + 8]
call fcn.004dfa40
mov byte [ebp - 4], 1
mov dword [esi + 4], 0
mov dword [esi], 4
call fcn.004e1d80
mov dword [esi + 0x58], eax
lea eax, [esi + 0x54]
push eax
push 0
push esi
push 0x4df8a0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], edi
mov dword [edi + 0x68], esi
mov dword [esi + 4], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4dc550
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov dword [ebp - 4], edx
mov al, byte [ebx]
test al, al
je 0x4dc5ca
push esi
push edi
mov edi, dword [edx + 4]
mov esi, 0x34567890
nop
mov ecx, dword [edx]
lea ebx, [ebx + 1]
movsx eax, al
xor eax, dword [edx]
mov edx, dword [ebp + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edx], eax
movzx eax, al
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [edx + 4], edi
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ecx + eax*4]
mov dword [edx + 8], esi
mov al, byte [ebx]
test al, al
jne 0x4dc580
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dede0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4dedeb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004dee10
Function at 0x4df5d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f2590
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4df60c
mov eax, dword [ecx]
push str.Waiting_for_the_async_thread_to_get_the_task_completed
push ecx
call dword [eax + 0x14]
add esp, 8
mov ecx, dword [edi + 0x58]
mov dword [edi], 3
call fcn.004e1e20
push 0xffffffffffffffff
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x4df64d
mov edx, dword [edi + 4]
test edx, edx
je 0x4df642
mov ecx, dword [edx]
push eax
push dword [edi + 0x4c]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged_or_timeout_occurs._Error____d
push edx
call dword [ecx + 0x14]
add esp, 0x10
push 0
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [edi + 0x4c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [edi + 4]
mov dword [edi + 0x4c], 0
test ecx, ecx
je 0x4df672
mov eax, dword [ecx]
push str.Cleaning_up_the_event_queue
push ecx
call dword [eax + 0xc]
add esp, 8
mov ecx, dword [edi + 0x58]
call fcn.004e1f10
lea ebx, [edi + 0x34]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [edi + 0x18], 0
je 0x4df6a8
nop word [eax + eax]
add dword [edi + 0x18], 0xffffffff
jne 0x4df69f
mov dword [edi + 0x14], 0
jmp 0x4df6a2
inc dword [edi + 0x14]
cmp dword [edi + 0x18], 0
jne 0x4df690
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [edi + 8]
mov dword [edi + 0x50], 0
call fcn.004dfb00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e0020
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov edx, ecx
mov dword [esp + 0x14], 7
xor eax, eax
mov dword [esp + 0x10], 0
push ebx
push esi
mov word [esp + 8], ax
cmp word [edx], ax
je 0x4e005f
mov eax, edx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e0050
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.00407060
cmp dword [esp + 0x1c], 8
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0x1c]
sete bl
cmp eax, 8
jb 0x4e009c
inc eax
lea ecx, [esp + 8]
push eax
push dword [esp + 0xc]
call fcn.00407b40
test bl, bl
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e00b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8bc9
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x67d070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x4c], esi
jb 0x4e010e
mov eax, dword [esi]
jmp 0x4e0110
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.0049c0e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e015d
push ecx
lea ecx, [ebp - 0x28]
call fcn.0049ccd0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0049c0e0
test al, al
je 0x4e0176
push str.OOBE
lea ecx, [ebp - 0x28]
call fcn.004096d0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e0198
push ecx
lea ecx, [ebp - 0x28]
call fcn.0049ccd0
add esp, 4
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x4e01ab
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407550
push 0xc
xor eax, eax
mov dword [ebp - 0x30], 7
push str.temp_lbs_wid
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
call fcn.00407060
push ecx
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.0049c840
mov eax, dword [ebp - 0x30]
add esp, 4
cmp eax, 8
jb 0x4e01f5
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00407b40
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4e020a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407b40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
Function at 0x4e8a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f987e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov ecx, edi
push dword [ebp + 0x10]
mov eax, dword [edi]
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov bl, al
mov dword [ebp - 4], 1
mov ecx, esi
mov edx, dword [esi]
push 1
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4fdf10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e40e6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.005b3b4d
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4fdf5f
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x4fdf70
push 0x44
push esi
call fcn.0059a537
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4feb30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e40e6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x67d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x50]
xor al, al
mov ecx, dword [esi + 0x4c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.005b3b4d
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.005b3b4d
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4feb91
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x4feba2
push 0x60
push esi
call fcn.0059a537
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5001b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebp, ebp
push edi
mov edi, esi
mov dword [esp + 0x18], edx
shr edi, 2
mov ebx, ecx
test edi, edi
je 0x500264
cmp edi, 8
jb 0x500243
lea eax, [edx - 4]
lea eax, [eax + edi*4]
lea ecx, [ebx - 4]
lea ecx, [ecx + edi*4]
cmp ebx, eax
ja 0x5001e9
cmp ecx, edx
jae 0x500243
mov eax, edi
mov ecx, edi
and eax, 7
mov esi, edx
sub ecx, eax
sub esi, ebx
mov dword [esp + 0x10], esi
lea eax, [ebx + 0x10]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
mov ecx, edx
mov edx, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [ecx]
add ebp, 8
lea ecx, [ecx + 0x20]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax - 0x30]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebp, dword [esp + 0x14]
jb 0x500210
mov edx, dword [esp + 0x18]
cmp ebp, edi
jae 0x500264
mov esi, edx
lea ecx, [ebx + ebp*4]
sub edi, ebp
sub esi, ebx
add ebp, edi
mov eax, dword [ecx + esi]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x500252
mov esi, dword [esp + 0x20]
shl ebp, 2
sub esi, ebp
je 0x5002e4
add ebx, ebp
add edx, ebp
xor ecx, ecx
test esi, esi
je 0x5002e4
cmp esi, 0x20
jb 0x5002cb
lea eax, [edx - 1]
lea edi, [ebx - 1]
add eax, esi
add edi, esi
cmp ebx, eax
ja 0x50028c
cmp edi, edx
jae 0x5002cb
mov eax, esi
mov edi, esi
and eax, 0x1f
mov ebp, edx
sub edi, eax
mov eax, ebx
sub ebp, ebx
nop dword [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [edx + ecx + 0x10]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edi
jb 0x5002a0
cmp ecx, esi
jae 0x5002e4
sub edx, ebx
lea eax, [ecx + ebx]
sub esi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub esi, 1
jne 0x5002d6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x500520
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov eax, edx
push edi
mov edi, esi
mov dword [esp + 0x10], eax
shr edi, 2
xor ebx, ebx
xor edx, edx
mov dword [esp + 0x1c], edi
mov ebp, ecx
test edi, edi
je 0x5005f9
cmp edi, 8
jb 0x5005d6
mov ebx, dword [esp + 0x10]
mov eax, edi
and eax, 7
mov ecx, edi
sub ecx, eax
mov esi, ebp
sub esi, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
lea eax, [ebx + 0x10]
mov esi, dword [esp + 0x24]
xorps xmm3, xmm3
mov ebx, dword [esp + 0x14]
movaps xmm2, xmm3
mov edi, dword [esp + 0x18]
mov ecx, ebp
movups xmm0, xmmword [ecx]
add edx, 8
lea ecx, [ecx + 0x20]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax - 0x30]
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x500581
mov edi, dword [esp + 0x1c]
por xmm2, xmm3
mov eax, dword [esp + 0x10]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, edi
jae 0x5005f9
mov esi, ebp
lea ecx, [eax + edx*4]
sub edi, edx
sub esi, eax
add edx, edi
mov eax, dword [ecx + esi]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or ebx, eax
sub edi, 1
jne 0x5005e5
mov esi, dword [esp + 0x24]
shl edx, 2
sub esi, edx
jne 0x50060f
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
add ebp, edx
add ecx, edx
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov dword [esp + 0x10], ecx
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x1c], edx
test esi, esi
je 0x5006f5
cmp esi, 0x20
jb 0x5006d9
mov eax, esi
mov ebx, esi
and eax, 0x1f
mov edx, ebp
sub ebx, eax
xorps xmm3, xmm3
sub edx, ecx
mov eax, ecx
mov dword [esp + 0x18], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
nop dword [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x500670
por xmm2, xmm3
mov ecx, dword [esp + 0x10]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp edi, esi
jae 0x5006f5
sub ebp, dword [esp + 0x10]
add ecx, edi
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x5006e5
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
sete al
pop ebx
add esp, 0x10
ret
Function at 0x502c20
Capabilities:
Create directory

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x502c2d
mov eax, dword [esi]
jmp 0x502c2f
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x502c76
cmp eax, 0xb7
je 0x502c76
cmp eax, 0x50
je 0x502c76
cmp dword [esi + 0x14], 8
jb 0x502c52
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Unable_to_create_directoryPath_...Error_Code_is:__d_._At_desired_location:_s
push 0x647e5c
call fcn.00572740
push eax
call fcn.005734e0
add esp, 0x14
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x502c80
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov bh, dl
cmp dword [esi + 0x14], 8
jb 0x502c96
mov eax, dword [esi]
jmp 0x502c98
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x502cce
call fcn.00572740
cmp dword [esi + 0x14], 8
mov ecx, eax
jb 0x502cb2
mov esi, dword [esi]
mov eax, dword [ecx]
push esi
push str.File__s_does_not_exist
push 0x647e5c
push ecx
call dword [eax + 0x44]
add esp, 0x10
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x502cd8
mov eax, dword [esi]
jmp 0x502cda
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
sete bl
test bl, bl
jne 0x502da5
test bh, bh
je 0x502d7d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x502d7d
cmp dword [esi + 0x14], 8
jb 0x502d0c
mov eax, dword [esi]
jmp 0x502d0e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov dword [ebp - 4], eax
test al, 1
je 0x502d53
cmp dword [esi + 0x14], 8
jb 0x502d26
mov eax, dword [esi]
jmp 0x502d28
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
cmp dword [esi + 0x14], 8
jb 0x502d3e
mov eax, dword [esi]
jmp 0x502d40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
sete bl
test bl, bl
jne 0x502da5
jmp 0x502d7d
call fcn.00572740
cmp dword [esi + 0x14], 8
mov edx, eax
jb 0x502d64
mov ecx, dword [esi]
jmp 0x502d66
mov ecx, esi
push dword [ebp - 4]
mov eax, dword [edx]
push ecx
push str.File__s_is_not_read_only._Its_attribute_is:__d
push 0x647e5c
push edx
call dword [eax + 0x54]
add esp, 0x14
cmp dword [esi + 0x14], 8
jb 0x502d85
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push esi
push str.Failed_to_delete_file:__s_LastError:_d
push 0x647e5c
call fcn.00572740
push eax
call fcn.00573570
add esp, 0x14
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x502f30
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x502f3d
mov eax, dword [esi]
jmp 0x502f3f
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x502f71
call fcn.00572740
cmp dword [esi + 0x14], 8
mov ecx, eax
jb 0x502f59
mov esi, dword [esi]
mov eax, dword [ecx]
push esi
push str.File__s_does_not_exist
push 0x647e5c
push ecx
call dword [eax + 0x44]
add esp, 0x10
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x502f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x6229e0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x503000
mov edx, dword [ebp - 4]
cmp word [edx], 0
jne 0x502fd4
xor ecx, ecx
push ecx
push edx
mov ecx, esi
call fcn.00407060
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x502fe0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00407060
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Unable_to_retreive_Local_App_Data_Path_from_Win_library__error_occured__:__d
push 0x647e5c
push ecx
call fcn.00572740
add esp, 4
push eax
call fcn.00573570
add esp, 0x10
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x503030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x6229d0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x5030a0
mov edx, dword [ebp - 4]
cmp word [edx], 0
jne 0x503074
xor ecx, ecx
push ecx
push edx
mov ecx, esi
call fcn.00407060
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x503080
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00407060
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Unable_to_retreive_Local_App_Data_Path_from_Win_library__error_occured__:__d
push 0x647e5c
push ecx
call fcn.00572740
add esp, 4
push eax
call fcn.00573570
add esp, 0x10
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x503360
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x503370
mov eax, dword [edi]
jmp 0x503372
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5033bd
call fcn.00572740
cmp dword [edi + 0x14], 8
mov ecx, eax
jb 0x50338c
mov edi, dword [edi]
mov eax, dword [ecx]
push edi
push str.File__s_does_not_exist
push 0x647e5c
push ecx
call dword [eax + 0x44]
add esp, 0x10
push str.Source_file_does_not_exist_in_utilCopySrcFileToDstFile
push 0x647e5c
call fcn.00572740
push eax
call fcn.00573570
add esp, 0xc
xor al, al
pop edi
pop esi
ret
mov dl, 1
mov ecx, esi
call fcn.00502c80
test al, al
je 0x5033b8
cmp dword [esi + 0x14], 8
jb 0x5033d4
mov eax, dword [esi]
jmp 0x5033d6
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x5033de
mov edi, dword [edi]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
setne al
test al, al
jne 0x50341e
cmp dword [esi + 0x14], 8
jb 0x5033f9
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push esi
push str.Failed_to_copy_file_at_the_destination:_s._LastError:__d
push 0x647e5c
call fcn.00572740
push eax
call fcn.00573570
add esp, 0x14
xor al, al
pop edi
pop esi
ret
mov ecx, esi
call fcn.0049e240
cmp dword [esi + 0x14], 8
jb 0x50342d
mov esi, dword [esi]
push 0x80
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
pop edi
mov al, 1
pop esi
ret