joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a30d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push ecx
push 0
push 0x3a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4a30ed
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x40
push 0x3000
push 0x100
push 0
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x4a31ad
push 0
push 0x100
push 0x4a3090
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4a3142
push 4
push 0x1000
push 0x438
push 0
push edi
call esi
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x4a3161
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0x438
push dword [ebp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4a3191
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 8], eax
test eax, eax
jne 0x4a31bd
push 0x8000
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call esi
push 0x8000
push 0
push ebx
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push 0x438
push dword [ebp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0x100
push ebx
push edi
call esi
push 0x8000
push 0x438
push dword [ebp - 4]
push edi
call esi
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4a3920
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5d9658
push 0x537140
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5ea110]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x30], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x24], eax
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], ebx
push 4
push 0x1000
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x4a3a05
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x30]
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4a3a05
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x34], eax
jne 0x4a3a05
push 0x5c339c
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a3a05
push esi
push esi
push edi
push eax
push esi
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x4a3a05
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4a39f3
lea ebx, [eax + 1]
jmp 0x4a3a02
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
test eax, eax
sete bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.004a3a22
test ebx, ebx
je 0x4a3a49
xor eax, eax
jmp 0x4a3a5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4a3a5b
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a3ac0
Capabilities:
Create thread
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5d9678
push 0x537140
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x5ea110]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x450], ecx
xor ebx, ebx
mov dword [ebp - 0x448], ebx
xor esi, esi
mov dword [ebp - 0x454], esi
xor edi, edi
mov dword [ebp - 0x458], edi
mov dword [ebp - 4], ebx
push 0x5c33c0
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x45c], eax
test eax, eax
je 0x4a3c29
push dword [ebp - 0x450]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
je 0x4a3c29
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x454], esi
test esi, esi
je 0x4a3c29
mov dword [ebp - 0x444], 0x428
lea eax, [ebp - 0x444]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x4a3bd1
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x44c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4a3bc9
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x44c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4a3bc9
lea eax, [ebp - 0x444]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x4a3b87
mov eax, dword [ebp - 0x428]
jmp 0x4a3bd3
xor eax, eax
test eax, eax
jne 0x4a3be1
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4a3c29
push 0
push 0
push eax
push dword [ebp - 0x45c]
push 0
push 0
push dword [ebp - 0x450]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
mov dword [ebp - 0x458], edi
test edi, edi
je 0x4a3c29
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4a3c14
lea ebx, [eax + 1]
jmp 0x4a3c23
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
test eax, eax
sete bl
mov dword [ebp - 0x448], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.004a3c4f
test ebx, ebx
je 0x4a3c6c
xor eax, eax
jmp 0x4a3c7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4a3c7e
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0050ed39
mov esp, ebp
pop ebp
ret
Function at 0x4a3cf0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ea110]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4a3d60
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ed39
mov esp, ebp
pop ebp
ret
Function at 0x4a7060
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595938
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5ea110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0
push eax
push 0
push 1
push dword [ebp + 8]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x4a71c7
cmp dword [ebp - 0x10], 0
je 0x4a71c7
call fcn.00407fd0
mov ecx, eax
test ecx, ecx
jne 0x4a70cf
push 0x80004005
call fcn.00407ba0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
test edx, edx
jns 0x4a70f2
push 0x80070057
call fcn.00407ba0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4a710f
push edx
lea ecx, [ebp - 0x14]
call fcn.00407400
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push esi
push 1
push dword [ebp + 8]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
push dword [esi - 8]
push esi
test eax, eax
jne 0x4a7194
call fcn.005506ae
add esp, 8
test eax, eax
js 0x4a70e8
cmp eax, dword [esi - 8]
jg 0x4a70e8
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.00407fd0
mov ecx, eax
test ecx, ecx
jne 0x4a7157
push 0x80004005
call fcn.00407ba0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a71e6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005506ae
add esp, 8
test eax, eax
js 0x4a70e8
cmp eax, dword [esi - 8]
jg 0x4a70e8
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
add esi, 0xfffffff0
push esi
call fcn.004079b0
add esp, 4
add eax, 0x10
jmp 0x4a7162
call fcn.00407fd0
mov ecx, eax
test ecx, ecx
jne 0x4a71dc
push 0x80004005
call fcn.00407ba0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7320
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5959a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x5ea110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push ecx
push 0
push edi
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x4a73d1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4a73d1
push eax
lea ecx, [ebp - 0x24]
call fcn.004a84f0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push 0
push 0
push ecx
push dword [ebp - 0x24]
push edi
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov ecx, esi
test eax, eax
jne 0x4a73c6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
call fcn.004a8540
jmp 0x4a73fa
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x24]
call fcn.0046e2d0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a7424
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a8ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x4a8d11
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4a8d00
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4ad300
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x4ad4d6
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x4ad4d5
cmp eax, 0x29
jne 0x4ad338
cmp dword [esi + 0x10], 0
jne 0x4ad4d5
test dword [esi + 0x50], 0x10000000
je 0x4ad4e1
cmp eax, 0x2e
jne 0x4ad395
push 5
lea ecx, [esi + 0x24]
call fcn.004ad6f0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4ad389
cmp word [eax], 0x5c
jne 0x4ad386
add eax, 2
cmp eax, ecx
je 0x4ad386
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x4ad372
movzx edx, word [eax]
cmp edx, 0x28
je 0x4ad384
cmp edx, 0x29
je 0x4ad384
test cl, 0x10
jne 0x4ad386
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x4ad384
cmp ecx, 0x7d
jne 0x4ad386
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.004aaf20
jmp 0x4ad4c2
cmp eax, 0x5c
jne 0x4ad3fc
mov ecx, esi
call fcn.004ad2b0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4ad3c8
cmp word [esi + 0x48], 0x62
jne 0x4ad3c8
push 4
lea ecx, [esi + 0x24]
call fcn.004ad6f0
mov ecx, esi
call fcn.004ad2b0
jmp 0x4ad4c9
test eax, eax
je 0x4ad3f0
cmp word [esi + 0x48], 0x42
jne 0x4ad3f0
push 4
lea ecx, [esi + 0x24]
call fcn.004ad6f0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004ad2b0
jmp 0x4ad4c9
mov ecx, esi
call fcn.004ae860
jmp 0x4ad4c2
cmp eax, 0x5b
jne 0x4ad41e
mov ecx, esi
call fcn.004ad2b0
mov ecx, esi
call fcn.004ae810
cmp dword [esi + 0x4c], 0x5d
je 0x4ad4bb
jmp 0x4ad4da
cmp eax, 0x28
jne 0x4ad44e
mov ecx, esi
call fcn.004ad2b0
mov ecx, esi
call fcn.004ae930
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4ad4e1
mov ecx, esi
call fcn.004ad2b0
test bl, bl
je 0x4ad4c9
jmp 0x4ad4c2
cmp eax, 0x5e
jne 0x4ad466
push 2
lea ecx, [esi + 0x24]
call fcn.004ad6f0
mov ecx, esi
call fcn.004ad2b0
jmp 0x4ad4c9
cmp eax, 0x24
jne 0x4ad47e
push 3
lea ecx, [esi + 0x24]
call fcn.004ad6f0
mov ecx, esi
call fcn.004ad2b0
jmp 0x4ad4c9
cmp eax, 0x2a
je 0x4ad4ef
cmp eax, 0x2b
je 0x4ad4ef
cmp eax, 0x3f
je 0x4ad4ef
cmp eax, 0x7b
je 0x4ad4ef
cmp eax, 0x7d
jne 0x4ad4a0
test dword [esi + 0x50], 0x10000000
je 0x4ad4e8
cmp eax, 0x5d
jne 0x4ad4ae
test dword [esi + 0x50], 0x10000000
je 0x4ad4da
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004aeb80
mov ecx, esi
call fcn.004ad2b0
mov ecx, esi
call fcn.004ae9f0
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x4ad310
pop ebx
mov al, cl
pop esi
ret
push 4
call fcn.004f3f7f
push 5
call fcn.004f3f7f
push 6
call fcn.004f3f7f
push 0xa
call fcn.004f3f7f
int3
Function at 0x4bb630
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
mov eax, edx
push 3
push SysReAllocStringLen
push ecx
mov dword [eax], 0
mov dword [ebp - 4], eax
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4bb6a3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi], eax
test eax, eax
je 0x4bb6df
cmp eax, 0xffffffff
je 0x4bb6df
add eax, 8
push 0x5ef530
push eax
call fcn.0050ee34
mov ebx, dword [ebp - 4]
mov ecx, eax
add esp, 8
mov dword [ebx], ecx
test ecx, ecx
jne 0x4bb6ac
push esi
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
add eax, 8
push eax
push 0
push ecx
call fcn.00533670
add esp, 0xc
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
push dword [edi]
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
xor ebx, ebx
cmp ecx, dword [edi]
sete bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb6f0
Capabilities:
Delete file
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5ea110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x14], esi
mov ebx, ecx
test ebx, ebx
je 0x4bb81e
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4bb81e
test esi, esi
je 0x4bb81e
call fcn.00407fd0
mov ecx, eax
test ecx, ecx
jne 0x4bb753
push 0x80004005
call fcn.00407ba0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push str._s.write_cache
push eax
call fcn.0041ee80
mov esi, dword [ebp - 0x10]
add esp, 0xc
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x4bb7eb
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 8]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x10], edi
sete al
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x4bb7eb
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4bb80a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb840
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596f28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5ea110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
test esi, esi
je 0x4bb8ea
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bb8ea
mov dword [ebp - 0x1c], vtable.CxAutoArray_unsigned_char_.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea edx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov ecx, esi
call fcn.004bb630
mov esi, dword [ebp - 0x18]
add esp, 4
test eax, eax
je 0x4bb8c8
cmp dword [ebp - 0x10], 0
je 0x4bb8c8
mov edx, edi
mov ecx, esi
call fcn.004bba60
mov edi, eax
jmp 0x4bb8ca
xor edi, edi
test esi, esi
je 0x4bb8d7
push esi
call fcn.0050ee59
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bb900
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596f60
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ea110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.004077e0
mov dword [ebp - 4], 0
mov edx, 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x4bb963
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00407400
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x10]
push dword [eax - 8]
push eax
call fcn.005506ae
mov edx, eax
add esp, 8
test edx, edx
js 0x4bba4c
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ecx - 8]
jg 0x4bba4c
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov word [eax + edx*2], cx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bb9b2
push dword [ebp - 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
call fcn.00407fd0
mov ecx, eax
test ecx, ecx
jne 0x4bb9c7
push 0x80004005
call fcn.00407ba0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.004bbca0
mov esi, dword [ebp - 0x14]
test eax, eax
je 0x4bb9fa
push dword [esi - 0xc]
mov edx, esi
mov ecx, edi
call fcn.004bb6f0
add esp, 4
mov edi, eax
jmp 0x4bb9fc
xor edi, edi
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4bba1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4bba39
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00407ba0
int3
Function at 0x4be740
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push ecx
mov esi, ecx
call fcn.004be6e0
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4be75f
mov dword [esi + 4], 0xffffffff
jmp 0x4be790
cmp dword [esi], 0
mov edx, 0xc0000000
push 0
push 0x80
push 4
push 0
mov eax, SysReAllocStringLen
push 3
cmovne eax, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4be822
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x4be7a2
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jmp 0x4be7ad
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x10], eax
or eax, ecx
mov dword [esi + 0x14], ecx
jne 0x4be7cb
cmp dword [esi], eax
je 0x4be7cb
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x10]
mov cl, 0x20
mov edx, dword [esi + 0x14]
push ebx
xor ebx, ebx
cmp dword [esi], ebx
push 0
push dword [esi + 0x10]
setne bl
lea ebx, [ebx*2 + 2]
call fcn.00589a00
push eax
push ebx
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
pop ebx
test eax, eax
je 0x4be822
cmp dword [esi], 0
mov edx, 0xf001f
push 0
push 0
mov ecx, 4
push 0
cmovne ecx, edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
cmp dword [esi + 0xc], 0
jne 0x4be830
push ecx
mov ecx, esi
call fcn.004be6e0
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4be980
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5dbb30
push 0x537140
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5ea110]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x34], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
xor edi, edi
mov dword [ebp - 0x28], edi
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
mov ecx, eax
call fcn.004c1e60
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x4bea54
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x4bea54
push esi
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x30]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4bea54
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4bea54
push ecx
mov eax, dword [ebp - 0x1c]
shr eax, 2
push eax
mov ecx, dword [ebp - 0x34]
call fcn.004c1e00
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.004c1e90
push eax
call fcn.005330f0
add esp, 0xc
mov edi, 1
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.004bea7a
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret