joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x48e739
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x66bbd4], 0
je 0x48e5df
mov eax, 0x48e748
mov cx, word [0x48e7ac]
mov dl, 3
call fcn.0061f580
cmp ax, 6
jne 0x48e716
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48db00]
call fcn.00622b40
mov esi, eax
mov eax, esi
call fcn.0063c5d0
dec eax
jne 0x48e70f
lea edx, [ebp - 8]
mov eax, dword [esi + 0x1a4]
call fcn.0063fce0
mov edx, dword [ebp - 8]
mov eax, 0x66bbd4
call fcn.004032c8
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x1a0]
call fcn.0063fd30
mov edx, dword [ebp - 0xc]
mov eax, 0x66bbd8
call fcn.004038bc
mov eax, dword [0x66bbd8]
call fcn.00403ab8
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 4]
mov edx, dword [0x66bbd8]
call fcn.00403358
mov eax, dword [ebp - 4]
call fcn.0040351c
mov ebx, eax
cmp ebx, 1
jl 0x48e679
lea eax, [ebp - 4]
call fcn.004036ec
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0x17
mov byte [eax + ebx - 1], dl
dec ebx
test ebx, ebx
jne 0x48e65e
mov eax, dword [0x669778]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dl, 4
call fcn.00618694
lea eax, [ebp - 4]
mov edx, dword [0x66bbd4]
call fcn.0040330c
mov eax, dword [ebp - 4]
call fcn.0040351c
mov ebx, eax
cmp ebx, 1
jl 0x48e6c2
lea eax, [ebp - 4]
call fcn.004036ec
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0x17
mov byte [eax + ebx - 1], dl
dec ebx
test ebx, ebx
jne 0x48e6a7
mov eax, dword [0x669778]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dl, 5
call fcn.00618694
mov eax, dword [0x669778]
mov eax, dword [eax]
call fcn.006187a4
mov eax, dword [0x6692fc]
mov edx, dword [0x669828]
mov edx, dword [edx]
call fcn.00403438
call fcn.004fe288
call fcn.004fb6b4
mov edx, dword [0x6692fc]
mov edx, dword [edx]
mov eax, dword [0x669168]
mov eax, dword [eax]
call fcn.0063cd1c
mov eax, esi
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e740
lea eax, [ebp - 0xc]
call fcn.00403880
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403298
ret
Function at 0x490d9c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov al, byte [edi + 6]
mov byte [esi + 6], al
mov al, byte [edi + 7]
mov byte [esi + 7], al
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov edx, dword [edi + 0xc]
mov eax, dword [esi + 0xc]
call fcn.0064e164
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
mov al, byte [edi + 0x10]
mov byte [esi + 0x10], al
mov al, byte [edi + 0x11]
mov byte [esi + 0x11], al
mov edx, dword [edi + 0x14]
mov eax, dword [esi + 0x14]
call fcn.0064e164
mov edx, dword [edi + 0x18]
mov eax, dword [esi + 0x18]
call fcn.0064e164
mov bl, 0x1f
mov ebp, ebx
and ebp, 0x7f
cmp dword [edi + ebp*4 + 0x1c], 0
jne 0x490e1a
lea eax, [esi + ebp*4 + 0x1c]
call fcn.006526a0
jmp 0x490e37
cmp dword [esi + ebp*4 + 0x1c], 0
jne 0x490e2a
call fcn.0064dfa0
mov dword [esi + ebp*4 + 0x1c], eax
mov edx, dword [edi + ebp*4 + 0x1c]
mov eax, dword [esi + ebp*4 + 0x1c]
call fcn.0064e164
dec ebx
cmp bl, 0xff
jne 0x490e03
mov eax, dword [edi + 0xa0]
mov dword [esi + 0xa0], eax
mov edx, dword [edi + 0xa4]
mov eax, dword [esi + 0xa4]
mov ecx, dword [eax]
call dword [ecx]
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49aa0c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49aa88
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0065867c
sub eax, dword [ebx + 8]
cmp eax, 0xbb8
jl 0x49aa6a
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x49aaa0
call fcn.00403568
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0065432c
mov eax, dword [ebp - 4]
call fcn.00620aa8
mov eax, 0x206c
call fcn.0049a860
call fcn.0065867c
mov dword [ebx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49aa8f
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x4a7aa4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7b50
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4a7b2d
mov edx, ebx
mov eax, dword [0x66bcb4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
jne 0x4a7b2d
mov eax, ebx
call fcn.00654560
test al, al
je 0x4a7b2d
lea edx, [ebp - 0xc]
mov eax, dword [0x66bcb4]
mov eax, dword [eax + 0x24]
call fcn.0065539c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0065432c
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x66bcb8]
call fcn.00403b24
mov edx, ebx
mov eax, dword [0x66bcb4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [ebp - 4]
mov eax, dword [0x66bcb4]
mov ecx, dword [eax]
call dword [ecx + 0x30]
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_CopyFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7b57
lea eax, [ebp - 0xc]
call fcn.00403274
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x4a7d10
Capabilities:
Copy file

Disassembly:
push ebx
push esi
push edi
mov edi, 0x66bcb4
cmp byte [0x66bcb0], 0
je 0x4a7d7f
call fcn.00529a70
mov esi, eax
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x4a7d48
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + ebx*4]
call fcn.0052289c
dec ebx
cmp ebx, 0xffffffff
jne 0x4a7d34
mov eax, dword [esi + 8]
call fcn.0064e4dc
xor ebx, ebx
jmp 0x4a7d71
push 0
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + ebx*4]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + ebx*4 + 4]
push eax
call sub.kernel32.dll_CopyFileW
add ebx, 2
mov eax, dword [edi]
cmp ebx, dword [eax + 0x24]
jl 0x4a7d54
mov eax, esi
call fcn.00522ccc
pop edi
pop esi
pop ebx
ret

Function at 0x4b2c94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, 0xffffffff
add ecx, edx
cmp ecx, edx
jbe 0x4b2cc5
mov ebx, dword [0x6691a8]
mov ebx, dword [ebx]
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shl esi, 2
add ebx, esi
mov ebx, dword [ebx]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc edx
cmp ecx, edx
ja 0x4b2c9f
xor eax, 0xffffffff
pop esi
pop ebx
Function at 0x4b3094
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff8
xor edx, edx
push ebp
push 0x4b31e7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx]
cmp byte [eax + 0xc], 0
jne 0x4b3140
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebx]
cmp dword [eax + 0x2c], 0
jne 0x4b30f9
mov eax, dword [ebx]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebx]
lea edx, [eax + 0x448]
mov eax, dword [ebx]
call fcn.004b2ccc
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebx]
mov dword [eax + 0x2c], 0x4000
mov eax, dword [ebx]
add eax, 0x448
mov edx, dword [ebx]
mov dword [edx + 0x28], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov eax, dword [ebx]
add eax, 0x1c
mov edx, 4
call fcn.00405f10
mov edx, dword [ebx]
mov edx, dword [edx + 0x30]
sub edx, esi
mov ecx, dword [ebx]
add dword [ecx + 0x40], edx
dec eax
jne 0x4b30c1
mov eax, dword [ebx]
mov eax, dword [eax + 0x40]
test eax, eax
jle 0x4b3136
mov ecx, eax
mov eax, dword [ebx]
lea edx, [eax + 0x448]
mov eax, dword [ebx]
call fcn.004b2ccc
mov eax, dword [ebx]
add eax, 0x1c
call fcn.00405ccc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebx]
add edx, 0x48
add edx, 0x10
mov dword [edx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x30]
mov edx, dword [ebx]
add edx, 0x48
add edx, 0x14
mov dword [edx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
mov edx, dword [ebx]
add edx, 0x48
add edx, 0x18
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebx]
lea edx, [eax + 0x48]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
call fcn.0064dcb8
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
call fcn.00650c20
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x44]
add edx, 0xe
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebx]
call fcn.004b2cf0
mov eax, dword [ebx]
mov edx, dword [eax + 0x30]
mov eax, dword [ebx]
call fcn.004b2cf0
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
call fcn.004b2cf0
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
inc dword [eax + 0x18]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b31f3
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b3af0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b3cf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4b2b70]
call fcn.004b2d18
mov edi, eax
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004b2d50
test al, al
je 0x4b3cba
mov bl, 1
cmp dword [0x66bd00], 0
je 0x4b3b7e
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0061c8e8
mov edx, dword [0x66bd00]
mov eax, dword [ebp - 0x10]
call fcn.0061c4d0
mov byte [edi + 0xc], 1
mov ecx, 0x4b3d0c
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004b31fc
mov byte [edi + 0xc], 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_DeleteFileW
call fcn.0064d744
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, 0x4b3d24
mov eax, dword [ebp - 4]
call fcn.00621c48
mov eax, dword [ebp - 0xc]
call fcn.00650684
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
dec eax
test eax, eax
jl 0x4b3ca9
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
call fcn.004038bc
cmp dword [0x66bd04], 0
je 0x4b3c15
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [0x66bd04]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, eax
cmp esi, 0xffffffff
je 0x4b3c15
mov edx, esi
mov eax, dword [0x66bd04]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [0x66bd08]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0x10]
call fcn.004038bc
cmp byte [0x66bd0c], 0
je 0x4b3c5a
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.006549c4
mov esi, 0xfffffffd
mov ebx, 0x662f00
lea eax, [ebp - 0x24]
mov edx, dword [ebx]
call fcn.004039a0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.00654730
test al, al
je 0x4b3c54
mov byte [edi + 0xc], 1
jmp 0x4b3c5a
sub ebx, 4
inc esi
jne 0x4b3c35
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00403ab8
mov edx, eax
inc edx
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.00653e88
mov eax, dword [ebp - 0x28]
mov cx, 0x2f
mov dx, 0x5c
call fcn.006533f0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004b31fc
mov ebx, eax
mov byte [edi + 0xc], 0
test bl, bl
je 0x4b3ca9
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x4b3bba
mov eax, dword [ebp - 0xc]
call fcn.004028c0
mov eax, edi
call fcn.004b352c
jmp 0x4b3cbc
xor ebx, ebx
test bl, bl
jne 0x4b3cc9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, edi
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3cff
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403898
ret
Function at 0x4c0d1c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c0e44
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x6698b0]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4c0e54
call fcn.00403b24
mov eax, dword [ebp - 4]
call fcn.00654560
test al, al
jne 0x4c0d71
lea edx, [ebp - 0xc]
mov al, 4
call fcn.00621464
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x4c0e54
call fcn.00403b24
mov eax, dword [ebp - 4]
call fcn.00654560
test al, al
jne 0x4c0ddc
mov eax, 0x4c0e70
mov cl, 0x2c
mov dl, 3
call fcn.0061faa0
cmp ax, 6
jne 0x4c0ddc
call fcn.004fe288
mov ecx, 0x4c0f64
xor edx, edx
call fcn.004fb54c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x6698c0]
mov eax, dword [eax]
push eax
mov al, byte [0x4c0f80]
push eax
lea edx, [ebp - 0xc]
mov eax, 0x4c0f84
call fcn.00654410
mov edx, dword [ebp - 0xc]
mov ecx, 0x4c0fa8
xor eax, eax
call fcn.004570bc
call fcn.004fe288
xor edx, edx
call fcn.004fb5a4
mov eax, dword [ebp - 4]
call fcn.00654560
test al, al
je 0x4c0e29
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [0x669208]
mov edx, dword [edx + 0x33]
call fcn.00403a34
mov eax, dword [ebp - 0xc]
mov ecx, ebx
mov edx, 0x4c0fdc
call fcn.00653fc0
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa8
push eax
mov eax, dword [ebp - 4]
push eax
push 0x4c0fe4
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0e4b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403898
ret

Function at 0x4c6b60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c6c98
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c6c78
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x104
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.00403990
lea eax, [ebp - 0x21c]
mov edx, 0x4c6cac
call fcn.00403ac4
mov eax, dword [ebp - 0x21c]
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x4c6c01
lea eax, [ebp - 0x216]
push eax
call sub.kernel32.dll_lstrlenW
mov ecx, eax
lea edx, [ebp - 0x216]
mov eax, ebx
call fcn.00403964
jmp 0x4c6c08
mov eax, ebx
call fcn.00403880
cmp si, 0x61
jae 0x4c6c2a
lea edx, [ebp - 0x21c]
mov eax, dword [ebx]
call fcn.00653dc8
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.004038bc
jmp 0x4c6c44
lea edx, [ebp - 0x21c]
mov eax, dword [ebx]
call fcn.00653d58
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.004038bc
cmp dword [ebx], 0
je 0x4c6c61
push 0x4c6cb8
push dword [ebx]
push 0x4c6cc0
mov eax, ebx
mov edx, 3
call fcn.00403b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6c7f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4c6d9c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c6ef2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0063613c
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
mov dword [esi + 0x18c], ebx
mov dword [ebp - 4], ebx
mov ebx, 2
mov eax, ebx
cmp eax, 0x1f
ja 0x4c6de7
bt dword [ebp - 4], eax
jae 0x4c6ec5
mov edi, ebx
add di, 0x61
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00403990
lea eax, [ebp - 0x14]
mov edx, 0x4c6f04
call fcn.00403ac4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetDriveTypeW
mov byte [ebp - 5], al
cmp byte [ebp - 5], 5
je 0x4c6ec5
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00403990
lea eax, [ebp - 0x14]
mov edx, 0x4c6f04
call fcn.00403ac4
mov eax, dword [ebp - 0x14]
call fcn.0061c66c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4c6e56
mov al, byte [esi + 0x190]
test al, al
je 0x4c6e66
sub al, 2
je 0x4c6e66
cmp byte [ebp - 0xd], 0
jne 0x4c6ec5
mov al, byte [esi + 0x190]
sub al, 2
jae 0x4c6ec5
cmp byte [ebp - 5], 4
jne 0x4c6e78
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.004c6cc4
jmp 0x4c6e82
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.004c6b60
mov byte [ebp - 6], 2
cmp byte [ebp - 0xd], 0
je 0x4c6e90
mov byte [ebp - 6], 3
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.00403990
push dword [ebp - 0x18]
push 0x4c6f10
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403b88
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [ebp - 6]
mov eax, dword [esi + 0x120]
call fcn.0064ed68
inc ebx
cmp ebx, 0x1a
jne 0x4c6ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6ef9
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0xc]
call fcn.00403880
ret

Function at 0x4c8a34
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c8ade
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, edi
call fcn.006532bc
cmp ax, 0x5c
jne 0x4c8a68
mov eax, edi
call fcn.006216bc
jmp 0x4c8ac0
lea edx, [ebp - 4]
mov eax, edi
call fcn.006548ec
mov eax, dword [ebp - 4]
call fcn.006216bc
mov eax, esi
call fcn.00654560
test al, al
je 0x4c8ac0
push 0
push edi
push esi
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4c8ac0
lea ecx, [ebp - 8]
mov eax, 0x4c8af0
mov edx, edi
call fcn.006552a0
mov eax, dword [ebp - 8]
mov cx, word [0x4c8b0c]
mov dl, 1
call fcn.004c89cc
sub eax, 3
je 0x4c8abe
sub eax, 2
jne 0x4c8a7a
jmp 0x4c8ac0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8ae5
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x4da8bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4daae7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x4daaf8
call fcn.00654410
mov eax, dword [ebp - 0xc]
push eax
call fcn.004fe288
mov eax, dword [eax + 0x1b4]
add eax, 0x38
mov edx, dword [0x6698dc]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 8]
pop ecx
call fcn.00403b24
call fcn.004fe288
mov eax, dword [eax + 0x1b4]
mov byte [eax + 0x56], 2
call fcn.004fe288
mov eax, dword [eax + 0x1b4]
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
je 0x4daac1
mov eax, dword [0x669468]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jl 0x4da96b
inc ebx
xor esi, esi
mov eax, dword [0x669468]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + esi*4]
cmp byte [edi + 0x427], 0
je 0x4da967
mov eax, edi
call fcn.00593dd0
test al, al
jne 0x4daac1
inc esi
dec ebx
jne 0x4da942
mov eax, dword [0x669468]
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jl 0x4daa10
inc ebx
xor esi, esi
mov eax, dword [0x669468]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + esi*4]
cmp byte [edi + 0x45c], 0
jne 0x4daa08
cmp byte [edi + 0x43c], 0
je 0x4da9af
mov eax, dword [edi + 0x160]
call fcn.00654560
test al, al
je 0x4daa08
cmp dword [ebp - 4], 0
je 0x4da9c2
lea eax, [ebp - 4]
mov edx, 0x4dab14
call fcn.00403524
call fcn.005336e0
mov edx, dword [0x669468]
mov edx, dword [edx]
mov edx, dword [edx + 0x1c]
cmp eax, dword [edx + esi*4]
jne 0x4da9e4
lea eax, [ebp - 4]
mov edx, 0x4dab20
call fcn.00403524
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x160]
call fcn.0062686c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
call fcn.006542f4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00403524
inc esi
dec ebx
jne 0x4da981
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.006544e4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0040330c
call fcn.004fe288
mov eax, dword [eax + 0x1b4]
lea edx, [ebp - 0xc]
call fcn.0062d7b8
mov eax, dword [ebp - 0xc]
call fcn.006585c4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4daa6d
call fcn.004fe288
mov eax, dword [eax + 0x1b4]
lea edx, [ebp - 0xc]
call fcn.0062d7b8
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0061fba8
cmp ax, 2
je 0x4daac1
jmp 0x4daa26
cmp dword [ebp - 4], 0
je 0x4daabb
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040351c
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x4daabb
call fcn.004fe288
mov eax, dword [eax + 0x1b4]
lea edx, [ebp - 0xc]
call fcn.0062d7b8
mov eax, dword [ebp - 0xc]
mov dl, 2
call fcn.0061fba8
cmp ax, 2
jne 0x4daa73
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x4daac1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daaee
lea eax, [ebp - 0x10]
call fcn.00403274
lea eax, [ebp - 0xc]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x4dd498
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.00533eb0
test eax, eax
je 0x4dd4b1
call fcn.005939bc
ret
mov eax, dword [0x669328]
cmp byte [eax], 0
je 0x4dd4f8
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
call fcn.005343a0
test al, al
je 0x4dd4f8
push 5
push 0
push 0
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
push eax
push 0x4dd52c
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4dd52b
mov eax, 0x4dd538
call fcn.0061f884
jmp 0x4dd52b
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
call fcn.005342bc
test al, al
je 0x4dd51e
call fcn.005336d8
mov edx, dword [0x669700]
mov edx, dword [edx + 8]
call fcn.00531698
jmp 0x4dd52b
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
call fcn.00621268
ret

Function at 0x4dd560
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4dd6c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
call fcn.00654994
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.00654870
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004038bc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
push eax
push 0x4f22f0
lea eax, [ebp - 8]
mov cl, 1
mov edx, 0x4dd6e0
call fcn.004273ec
test al, al
je 0x4dd6ae
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.00533eb0
mov ebx, eax
test ebx, ebx
je 0x4dd5f3
mov eax, ebx
call fcn.005939bc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov edx, 0x8c
call fcn.004ea098
mov eax, dword [0x669118]
mov eax, dword [eax]
mov edx, ebx
call fcn.0064e36c
test al, al
jne 0x4dd6ae
lea edx, [ebp - 0x10]
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
call fcn.006549c4
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006547e4
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
call fcn.006548ec
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
pop ecx
call fcn.00403b24
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4dd690
mov eax, dword [0x669700]
add eax, 8
mov edx, dword [ebp - 8]
call fcn.004038bc
mov eax, dword [0x669510]
mov byte [eax + 0x11], 1
test ebx, ebx
je 0x4dd689
call fcn.005336d8
mov edx, dword [ebp - 8]
call fcn.00531698
call fcn.004fe3f4
jmp 0x4dd6ae
mov eax, dword [0x669700]
mov eax, dword [eax + 8]
call fcn.00654560
test al, al
je 0x4dd6ae
mov eax, 0x4dd6ec
mov edx, dword [ebp - 4]
call fcn.0061f938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd6d0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403898
ret