joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d870
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov dword [eax], ecx
shr ecx, 2
and ebx, 3
test ecx, ecx
push esi
jbe 0x45d8b2
push edi
mov edi, ecx
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
mov dword [eax], esi
shl ecx, 0x10
xor ecx, esi
add edx, 2
mov dword [eax], ecx
movzx esi, word [edx]
shl esi, 0xb
xor esi, ecx
mov dword [eax], esi
mov ecx, esi
shr esi, 0xb
add esi, ecx
add edx, 2
dec edi
mov dword [eax], esi
jne 0x45d883
pop edi
mov ecx, ebx
dec ecx
je 0x45d8f6
dec ecx
je 0x45d8e1
dec ecx
jne 0x45d90c
movzx ecx, word [edx]
mov esi, dword [eax]
add esi, ecx
mov ecx, esi
shl ecx, 0x10
xor ecx, esi
mov dword [eax], ecx
movzx edx, byte [edx + 2]
shl edx, 0x12
xor edx, ecx
mov ecx, edx
shr ecx, 0xb
add ecx, edx
mov dword [eax], ecx
jmp 0x45d90c
movzx edx, word [edx]
mov ecx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xb
xor ecx, edx
mov edx, ecx
shr edx, 0x11
jmp 0x45d908
movzx ecx, byte [edx]
mov edx, dword [eax]
add edx, ecx
mov ecx, edx
shl ecx, 0xa
xor ecx, edx
mov edx, ecx
shr edx, 1
add edx, ecx
mov dword [eax], edx
mov edx, dword [eax]
lea ecx, [edx*8]
xor ecx, edx
mov edx, ecx
shr edx, 5
add edx, ecx
lea ecx, [edx*4]
xor ecx, edx
mov edx, ecx
shr edx, 0xf
add ecx, edx
mov edx, ecx
shl edx, 0xa
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
ret
Function at 0x4783a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push 0x3c
mov ebx, ecx
call fcn.00439320
mov esi, eax
add esp, 4
test esi, esi
je 0x4783f6
mov ecx, ebx
call fcn.00442450
test eax, eax
je 0x4783cf
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x1c]
mov cl, byte [eax + 0x109]
test cl, cl
jne 0x4783e5
mov eax, dword [ebx + 0x24]
mov ecx, dword [eax + 4]
cmp eax, dword [ecx + 0x3b8]
jne 0x4783e5
mov eax, dword [ecx + 0x3b4]
jmp 0x4783e8
add eax, 0xc
push eax
mov ecx, esi
call fcn.00451870
mov esi, eax
test esi, esi
jne 0x4783fd
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, dword [ebx + 0x48]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], ecx
mov dword [ebx + 0x48], esi
push ebp
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp]
mov dword [esi + 0x1c], edx
movzx cx, byte [eax + 3]
mov word [esi + 0xa], cx
movzx dx, byte [eax]
mov word [esi + 8], dx
movzx cx, byte [eax + 1]
mov word [esi + 6], cx
movzx dx, byte [eax + 2]
mov eax, dword [esp + 0x14]
test eax, eax
push edi
lea edi, [esi + 4]
mov word [edi], dx
je 0x478453
lea ecx, [eax + 0x1c]
cmp dword [ecx], 0
je 0x478453
push 1
push edi
call fcn.004586e0
movzx eax, word [edi + 6]
cmp eax, 0xff
jge 0x47848e
movzx ecx, word [edi + 4]
movzx edx, word [edi + 2]
inc eax
imul ecx, eax
imul edx, eax
sar ecx, 8
mov word [edi + 4], cx
movzx ecx, word [edi]
imul ecx, eax
sar edx, 8
sar ecx, 8
mov word [edi + 2], dx
mov word [edi], cx
mov eax, 1
jmp 0x478490
xor eax, eax
mov ecx, ebx
mov byte [esi + 0x24], al
call fcn.00442450
test eax, eax
je 0x4784b3
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x1c]
mov cl, byte [eax + 0x109]
test cl, cl
je 0x4784b3
add eax, 0xc
jmp 0x4784cc
mov ebx, dword [ebx + 0x24]
mov eax, dword [ebx + 4]
cmp ebx, dword [eax + 0x3b8]
jne 0x4784c9
mov eax, dword [eax + 0x3b4]
jmp 0x4784cc
lea eax, [ebx + 0xc]
mov ecx, dword [eax + 0x4c]
test ecx, ecx
je 0x4784da
mov ecx, esi
call fcn.0045c400
mov eax, dword [ebp]
inc eax
pop edi
mov dword [ebp], eax
pop ebp
mov eax, esi
pop esi
pop ebx
ret 0xc
Function at 0x496290
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x4962be
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x4962a1
pop esi
ret 4

Function at 0x496380
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ebx, ecx
mov eax, dword [ebx + 0xac8]
mov ecx, dword [ebx + 0xacc]
push edi
lea esi, [ebp*4]
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call fcn.00439320
mov edi, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov dword [ebx + 0xac8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov dword [ebx + 0xacc], ebp
add esp, 4
xor ebp, ebp
test eax, eax
jle 0x496440
jmp 0x4963e0
mov eax, dword [esp + 0x14]
mov edi, dword [eax + ebp*4]
test edi, edi
je 0x496437
mov ecx, edi
xor esi, esi
call fcn.00435810
mov cx, word [eax]
test cx, cx
je 0x49641e
lea esp, [esp]
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x496400
push esi
mov ecx, edi
call fcn.00435810
push eax
mov ecx, ebx
call fcn.004962d0
mov edx, dword [ebx + 0xac8]
mov dword [edx + eax*4], edi
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jl 0x4963e0
mov eax, dword [esp + 0x14]
push eax
call fcn.00527b30
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x499e60
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.00435810
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.00435810
mov cx, word [eax]
test cx, cx
je 0x499ea2
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x499e84
push esi
push ebp
mov ecx, edi
call fcn.004962d0
mov edx, dword [edi + 0xac8]
mov ecx, dword [edx + eax*4]
test ecx, ecx
lea eax, [edx + eax*4]
jne 0x499eea
mov dword [eax], ebx
mov eax, dword [edi + 0xad0]
mov esi, ebx
or esi, 5
inc eax
mov ecx, ebx
mov dword [edi + 0xad0], eax
call fcn.00435810
mov ecx, ebx
call fcn.00435ef0
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x4b9ed0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x18], 0xca
jne 0x4b9f0b
push esi
call fcn.004be740
add esp, 4
test eax, eax
jl 0x4b9f85
mov al, byte [esi + 0x48]
test al, al
je 0x4b9f04
mov dword [esi + 0x18], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x18], 0xcb
mov eax, dword [esi + 0x18]
cmp eax, 0xcb
jne 0x4b9f87
mov eax, dword [esi + 0x194]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4b9f74
mov eax, dword [esi + 8]
test eax, eax
je 0x4b9f2f
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x194]
push esi
call dword [ecx]
add esp, 4
test eax, eax
jl 0x4b9f85
je 0x4b9f70
cmp eax, 2
je 0x4b9f74
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b9f22
cmp eax, 3
je 0x4b9f57
cmp eax, 1
jne 0x4b9f22
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4b9f22
mov ecx, dword [esi + 0x120]
add dword [eax + 8], ecx
jmp 0x4b9f22
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x84]
mov dword [esi + 0x8c], edx
call fcn.004b9db0
pop esi
ret
cmp eax, 0xcc
je 0x4b9f80
mov eax, dword [esi]
mov dword [eax + 0x14], 0x11
mov ecx, dword [esi]
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov eax, 0xffffffef
pop esi
ret
Function at 0x4c6530
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x560cf4]
test eax, eax
jne 0x4c663c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov dword [0x560cf4], 1
call edi
push str.imm32.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov esi, eax
call edi
test esi, esi
je 0x4c6639
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmGetContext
push esi
call edi
test eax, eax
mov dword [0x560cf8], eax
je 0x4c6639
push str.ImmReleaseContext
push esi
call edi
test eax, eax
mov dword [0x560cfc], eax
je 0x4c6639
push str.ImmSetCompositionWindow
push esi
call edi
test eax, eax
mov dword [0x560d00], eax
je 0x4c6639
push str.ImmSetCompositionFontA
push esi
call edi
test eax, eax
mov dword [0x560d04], eax
je 0x4c6639
push str.ImmGetCompositionStringW
push esi
call edi
push str.ImmGetOpenStatus
push esi
mov dword [0x560d08], eax
call edi
push str.ImmSetOpenStatus
push esi
mov dword [0x560d0c], eax
call edi
push str.ImmGetConversionStatus
push esi
mov dword [0x560d10], eax
call edi
push str.ImmSetConversionStatus
push esi
mov dword [0x560d14], eax
call edi
push str.ImmSetCompositionStringW
push esi
mov dword [0x560d18], eax
call edi
push str.ImmNotifyIME
push esi
mov dword [0x560d1c], eax
call edi
push str.ImmGetCandidateListW
push esi
mov dword [0x560d20], eax
call edi
mov dword [0x560d24], eax
mov dword [0x560cf4], 2
pop edi
pop esi
pop ebx
ret

Function at 0x4c6640
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 7
lea ecx, [esp + 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4c668a
push esi
push 0xa
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00493390
add esp, 0x10
test eax, eax
mov eax, dword [esp + 4]
jne 0x4c668c
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x4c6730
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [0x560cf4]
sub esp, 8
test eax, eax
push edi
mov edi, str.UNKNOWN
jne 0x4c6747
call fcn.004c6530
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [0x560cf4], 2
jne 0x4c6868
mov eax, dword [0x560d14]
test eax, eax
je 0x4c6868
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [0x560cf8]
mov esi, eax
test esi, esi
je 0x4c6867
push ebx
call fcn.004c6640
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
mov ebx, eax
call dword [0x560d14]
test eax, eax
je case.0x4c67e0.17
mov eax, dword [esp + 0xc]
cmp eax, 0x400
jbe 0x4c67b0
sub eax, 0x400
lea ecx, [ebx - 0x3a4]
cmp ecx, 0x12
ja case.0x4c67e0.17
movzx ecx, byte [ecx + 0x4c6880]
jmp dword [ecx*4 + 0x4c6870]
add eax, 0xfffffff0
cmp eax, 0xb
ja case.0x4c67e0.17
movzx edx, byte [eax + 0x4c68ac]
jmp dword [edx*4 + 0x4c6894]
pop ebx
mov edi, str.ALPHANUMERIC_FULL
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_KATAKANA_FULL
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_KATAKANA_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_HIRAGANA
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4c67e0.17
movzx eax, byte [eax + 0x4c68c8]
jmp dword [eax*4 + 0x4c68b8]
pop ebx
mov edi, str.ALPHANUMERIC_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.KOREAN
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4c67e0.17
movzx ecx, byte [eax + 0x4c68e4]
jmp dword [ecx*4 + 0x4c68d4]
mov edi, str.CHINESE
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x4c7210
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 4]
push eax
push 0x20019
xor esi, esi
push esi
push ecx
push edx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c728f
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
push edi
push ecx
call ebx
test eax, eax
jne 0x4c728d
mov edx, dword [esp + 0x10]
push edx
call fcn.00439320
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push edi
push ecx
call ebx
test eax, eax
je 0x4c728d
push esi
call fcn.00527b30
add esp, 4
xor esi, esi
pop edi
pop ebx
mov eax, dword [esp + 4]
test eax, eax
je 0x4c729e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x4c7360
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x54
push ebx
push ebp
push esi
push edi
push str._shellopencommand
push eax
xor ebp, ebp
xor esi, esi
xor edi, edi
call fcn.00434d50
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4c73f0
push edi
push ebx
push 0x80000000
call fcn.004c7210
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4c73f0
mov ecx, dword [esp + 0x6c]
push ecx
push esi
call fcn.004c72b0
mov edi, eax
add esp, 8
test edi, edi
je 0x4c73f0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4c73f0
mov edx, dword [esp + 0x10]
push edx
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00527b30
push esi
call fcn.00527b30
push edi
call fcn.00527b30
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x54
ret

Function at 0x4c8110
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
dec eax
je 0x4c8181
dec eax
jne 0x4c819f
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4c816d
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x4c815a
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x4c819f
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x4c819f
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x4c8198
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x4c819f
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x4c8830
Capabilities:
Check os version
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x94
cmp eax, 7
jl 0x4c88e3
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4c8869
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x4c887f
cmp dword [esp + 4], 5
jae 0x4c8892
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push eax
call fcn.004c81b0
add esp, 4
add esp, 0x94
ret
cmp eax, 1
jne 0x4c8869
cmp dword [esp + 4], 4
jne 0x4c8869
cmp dword [esp + 8], 0x5a
jb 0x4c8869
push esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4c88bb
push str.GetUserDefaultUILanguage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4c88c5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop esi
add esp, 0x94
ret
push edi
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.004c81b0
add esp, 4
pop edi
pop esi
add esp, 0x94
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push eax
call fcn.004c81b0
add esp, 4
add esp, 0x94
ret
Function at 0x4cbd70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cbe7f
cmp byte [esi], 0
je 0x4cbe7f
mov ecx, dword [esp + 0x18]
push ebx
or ebx, 0xffffffff
test ecx, ecx
push edi
je 0x4cbe69
call fcn.00495de0
mov edi, eax
call fcn.004c80c0
test al, al
je 0x4cbe34
push 0x544eb8
lea ecx, [esp + 0x10]
call fcn.004350d0
push esi
lea ecx, [esp + 0x10]
call fcn.00434890
cmp edi, 5
jle 0x4cbddc
mov eax, dword [esp + 0xc]
push eax
call fcn.004b5400
add esp, 4
mov esi, eax
jmp 0x4cbe04
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b5830
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cbe1a
push edi
call fcn.004b5400
push edi
mov esi, eax
call fcn.00527b30
add esp, 8
test esi, esi
je 0x4cbe1a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call fcn.00527b30
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00527b30
add esp, 4
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cbe69
push 0
push esi
call fcn.004d70d0
mov esi, eax
add esp, 8
test esi, esi
je 0x4cbe72
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov ebx, eax
call fcn.00527b30
add esp, 4
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret

Function at 0x4cbe90
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cbf9b
cmp byte [esi], 0
je 0x4cbf9b
mov ecx, dword [esp + 0x18]
push ebx
xor bl, bl
test ecx, ecx
push edi
je 0x4cbf86
call fcn.00495de0
mov edi, eax
call fcn.004c80c0
test al, al
je 0x4cbf52
push 0x544eb8
lea ecx, [esp + 0x10]
call fcn.004350d0
push esi
lea ecx, [esp + 0x10]
call fcn.00434890
cmp edi, 5
jle 0x4cbefb
mov eax, dword [esp + 0xc]
push eax
call fcn.004b5400
add esp, 4
mov esi, eax
jmp 0x4cbf23
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b5830
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cbf3c
push edi
call fcn.004b5400
push edi
mov esi, eax
call fcn.00527b30
add esp, 8
test esi, esi
je 0x4cbf3c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
push esi
setne bl
call fcn.00527b30
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00527b30
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cbf86
push 0
push esi
call fcn.004d70d0
mov esi, eax
add esp, 8
test esi, esi
je 0x4cbf92
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
push esi
setne bl
call fcn.00527b30
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret
Function at 0x4cbfb0
Capabilities:
Move file

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4cc17c
cmp byte [esi], 0
je 0x4cc17c
push ebp
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4cc174
cmp byte [ebp], 0
je 0x4cc174
mov ecx, dword [esp + 0x2c]
test ecx, ecx
push edi
mov byte [esp + 0x28], 0
je 0x4cc15a
call fcn.00495de0
mov edi, eax
call fcn.004c80c0
test al, al
je 0x4cc107
push ebx
push 0x544eb8
lea ecx, [esp + 0x20]
call fcn.004350d0
push esi
lea ecx, [esp + 0x20]
call fcn.00434890
cmp edi, 5
jle 0x4cc035
mov eax, dword [esp + 0x1c]
push eax
call fcn.004b5400
add esp, 4
mov ebx, eax
jmp 0x4cc061
mov ecx, dword [esp + 0x1c]
push 0
push 6
push ecx
call fcn.004b5830
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4cc0ee
push esi
call fcn.004b5400
push esi
mov ebx, eax
call fcn.00527b30
add esp, 8
test ebx, ebx
je 0x4cc0ee
push 0x544eb8
lea ecx, [esp + 0x14]
call fcn.004350d0
push ebp
lea ecx, [esp + 0x14]
call fcn.00434890
cmp edi, 5
jle 0x4cc097
mov edx, dword [esp + 0x10]
push edx
call fcn.004b5400
add esp, 4
mov esi, eax
jmp 0x4cc0bf
mov eax, dword [esp + 0x10]
push 0
push 6
push eax
call fcn.004b5830
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cc0db
push edi
call fcn.004b5400
push edi
mov esi, eax
call fcn.00527b30
add esp, 8
test esi, esi
je 0x4cc0db
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
push esi
setne byte [esp + 0x30]
call fcn.00527b30
add esp, 4
push ebx
call fcn.00527b30
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00527b30
add esp, 8
mov edx, dword [esp + 0x1c]
push edx
call fcn.00527b30
mov al, byte [esp + 0x30]
add esp, 4
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x18
ret
cmp edi, 5
jle 0x4cc15a
push 0
push ebp
call fcn.004d70d0
mov edi, eax
add esp, 8
test edi, edi
je 0x4cc169
push 0
push esi
call fcn.004d70d0
mov esi, eax
add esp, 8
test esi, esi
je 0x4cc146
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
push esi
setne byte [esp + 0x2c]
call fcn.00527b30
add esp, 4
push edi
call fcn.00527b30
mov al, byte [esp + 0x2c]
add esp, 4
pop edi
pop ebp
pop esi
add esp, 0x18
ret
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne byte [esp + 0x28]
mov al, byte [esp + 0x28]
pop edi
pop ebp
pop esi
add esp, 0x18
ret
pop ebp
xor al, al
pop esi
add esp, 0x18
ret
xor al, al
pop esi
add esp, 0x18
ret
Function at 0x4cc190
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cc29b
cmp byte [esi], 0
je 0x4cc29b
mov ecx, dword [esp + 0x18]
push ebx
xor bl, bl
test ecx, ecx
push edi
je 0x4cc286
call fcn.00495de0
mov edi, eax
call fcn.004c80c0
test al, al
je 0x4cc252
push 0x544eb8
lea ecx, [esp + 0x10]
call fcn.004350d0
push esi
lea ecx, [esp + 0x10]
call fcn.00434890
cmp edi, 5
jle 0x4cc1fb
mov eax, dword [esp + 0xc]
push eax
call fcn.004b5400
add esp, 4
mov esi, eax
jmp 0x4cc223
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b5830
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cc23c
push edi
call fcn.004b5400
push edi
mov esi, eax
call fcn.00527b30
add esp, 8
test esi, esi
je 0x4cc23c
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push esi
setne bl
call fcn.00527b30
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00527b30
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cc286
push 0
push esi
call fcn.004d70d0
mov esi, eax
add esp, 8
test esi, esi
je 0x4cc292
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
push esi
setne bl
call fcn.00527b30
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne bl
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret

Function at 0x4cc2b0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cc360
cmp byte [esi], 0
je 0x4cc360
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4cc39f
push edi
call fcn.00495de0
mov edi, eax
call fcn.004c80c0
test al, al
je 0x4cc365
push 0x544eb8
lea ecx, [esp + 0xc]
call fcn.004350d0
push esi
lea ecx, [esp + 0xc]
call fcn.00434890
cmp edi, 5
jle 0x4cc314
mov eax, dword [esp + 8]
push eax
call fcn.004b5400
add esp, 4
mov esi, eax
jmp 0x4cc33c
mov ecx, dword [esp + 8]
push 0
push 6
push ecx
call fcn.004b5830
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cc352
push edi
call fcn.004b5400
push edi
mov esi, eax
call fcn.00527b30
add esp, 8
test esi, esi
je 0x4cc352
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.00527b30
add esp, 4
mov edx, dword [esp + 8]
push edx
call fcn.00527b30
add esp, 4
pop edi
pop esi
add esp, 0xc
ret
cmp edi, 5
push 0
push esi
jle 0x4cc393
call fcn.004d70d0
mov esi, eax
add esp, 8
test esi, esi
je 0x4cc35f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call fcn.00527b30
add esp, 4
pop edi
pop esi
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
add esp, 0xc
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop esi
add esp, 0xc
ret
Function at 0x4cc7f0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret

Function at 0x4cc820
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret