joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47be60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.004079b8
cmp ax, 0xffff
jne 0x47be81
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x47bf0d
push eax
push edi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x47bf0d
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x47bece
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x47beba
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x47bf0d
cmp dword [ebp + 8], 0
jle 0x47bf0d
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042f9c0
mov esi, eax
test esi, esi
jle 0x47bf04
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004079cc
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x47ca6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x47cad0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004045f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409788
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cad7
lea eax, [ebp - 0xc]
call fcn.00404370
ret

Function at 0x47cb7c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x47cbd8
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47cba7
call fcn.0040efe4
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402a24
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47cbd8
call fcn.0040efe4
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x483818
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040484c
xor eax, eax
push ebp
push 0x48390e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404370
cmp dword [ebp - 4], 0
je 0x483874
mov eax, dword [ebp - 4]
call fcn.0048b368
test al, al
je 0x483874
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.0040a3cc
jmp 0x483885
lea eax, [ebp - 0x109]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040a570
mov eax, dword [ebp - 0x110]
call fcn.0048b368
test al, al
jne 0x4838c1
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x109]
call fcn.0040a570
mov eax, dword [ebp - 0x114]
call fcn.0048b72c
lea eax, [ebp - 0x109]
push eax
push 0
push 0x48391c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a570
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483915
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404394
lea eax, [ebp - 4]
call fcn.00404370
ret
Function at 0x4866cc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.0040484c
xor eax, eax
push ebp
push 0x4867c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004830dc
test al, al
je 0x486794
xor edx, edx
push ebp
push 0x486736
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00483924
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.00409d90
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x486740
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0048364c
test al, al
jne 0x48676e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
push eax
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3200], 0
je 0x4867aa
cmp dword [ebp + 8], 0x20
je 0x4867aa
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040485c
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4867aa
mov eax, dword [ebp - 4]
add eax, 0x4d8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3208]
call fcn.004043c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4867c7
lea eax, [ebp - 0xc]
call fcn.00404370
ret

Function at 0x486c60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x486c8c
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x5024f4]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x486c66
pop esi
pop ebx
ret

Function at 0x487638
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040484c
xor eax, eax
push ebp
push 0x48769d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x487680
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0048b15c
mov eax, dword [ebp - 8]
call fcn.0048b10c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x487682
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4876a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404394
ret
Function at 0x4876ac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040484c
xor eax, eax
push ebp
push 0x487778
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x487753
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x60]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x487738
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0048b15c
mov eax, dword [ebp - 0x10]
call fcn.0048b10c
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x48773c
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48775a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x487c4c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x487c65
add esp, 0xfffffff0
call fcn.00403884
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.0040484c
mov eax, dword [ebp + 0xc]
call fcn.0040484c
xor eax, eax
push ebp
push 0x487d5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x5c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x487d05
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.00483818
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x64]
call fcn.004043c4
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 0xc]
call fcn.004043c4
mov byte [ebx + 0x50], 1
jmp 0x487d1c
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.004043c4
lea eax, [ebx + 0x54]
call fcn.00404370
mov byte [ebx + 0x50], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x64]
xor edx, edx
mov eax, ebx
call fcn.0048c054
mov ax, word [ebp + 8]
mov word [ebx + 0x62], ax
mov byte [ebx + 0x60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487d63
lea eax, [ebp - 8]
call fcn.00404370
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404394
ret
Function at 0x48ab58
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x50495c
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x502484]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x502484]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x48ac78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x48aca1
call fcn.0048ac58
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.0048ab58
inc dword [esi]
dec ebx
jne 0x48ac8a
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48aca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x48acdc
call fcn.0048ac58
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.0048ab58
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x48acbb
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48ad04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.0040484c
xor eax, eax
push ebp
push 0x48adb3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x48ad9d
mov eax, dword [ebp + 8]
call fcn.0048abbc
test eax, eax
jne 0x48ad9d
xor ebx, ebx
call fcn.0048ac58
xor edx, edx
mov dl, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
call fcn.0048ab58
xor eax, eax
mov al, bl
mov dl, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x48ad40
mov bl, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x48ad8b
mov eax, dword [ebp - 4]
call fcn.004079b8
call fcn.004079bc
cmp bl, al
sete al
mov ebx, eax
jmp 0x48ad9d
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48adba
lea eax, [ebp + 8]
call fcn.00404370
ret

Function at 0x48b368
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040484c
xor eax, eax
push ebp
push 0x48b3b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040485c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x48b39d
test al, 0x10
jne 0x48b3a1
xor ebx, ebx
jmp 0x48b3a3
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b3c0
lea eax, [ebp - 4]
call fcn.00404370
ret
Function at 0x48b528
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x48b550
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.004045f0
jmp 0x48b559
mov eax, ebx
xor edx, edx
call fcn.004049e8
add esp, 0x104
pop ebx
ret

Function at 0x48dd48
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor edx, edx
push ebp
push 0x48dea9
push dword fs:[edx]
mov dword fs:[edx], esp
sub al, 1
jb 0x48dd6c
je 0x48dd86
dec al
je 0x48dda0
jmp 0x48de5b
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de60
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de60
push 0x80
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
call fcn.0040485c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x48ddd1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
call fcn.00409de8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x370]
call fcn.0040a300
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
test dword [eax + 0x1e1e], 0x200
jbe 0x48de34
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
mov dl, 1
call fcn.0048b45c
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 0x4d8
call fcn.004043c4
push 0
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de60
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
call fcn.0040485c
push eax
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de60
mov esi, 0xc
test esi, esi
je 0x48de93
push 0x48dec0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, esi
call fcn.0048cf10
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax + 0x3208]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor ecx, ecx
mov ebx, dword [eax]
call dword [ebx + 0x98]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48deb0
lea eax, [ebp - 4]
call fcn.00404370
ret
Function at 0x4a1e84
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x51cad8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4a1ea6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a1ea8
shr eax, 1
dec edx
jne 0x4a1e94
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a1e8d
mov byte [0x51ced8], 1
pop esi
pop ebx
ret

Function at 0x4a1ec4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x51ced8], 0
jne 0x4a1edb
call fcn.004a1e84
mov eax, edi
dec eax
test eax, eax
jl 0x4a1f04
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51cad8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a1ee5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a4a20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4a4a51
dec al
je 0x4a4a8d
dec al
je 0x4a4ad1
dec al
je 0x4a4b3c
jmp 0x4a4bc6
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a4bc6
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a4a61
jmp 0x4a4bc6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a4bc6
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a4a9d
jmp 0x4a4bc6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a4bc6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a4aff
xor ebp, ebp
jmp 0x4a4b10
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a4b19
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a4ae1
jmp 0x4a4bc6
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a4bc6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a4b94
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a1f0c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a4b50
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a8d68
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a8dd7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20e]
push eax
push 0
push 0x4a8de8
mov eax, dword [ebp - 4]
call fcn.00404cec
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x4a8dbf
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4a8dc1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8dde
lea eax, [ebp - 4]
call fcn.00404aa8
ret

Function at 0x4a92a4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a93c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cec
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004027b0
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4a938d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4a93d0
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 8]
shr ebx, 0x10
mov si, word [eax + 8]
and si, 0xffff
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1e], dx
mov di, word [eax + 0xc]
and di, 0xffff
mov eax, dword [ebp - 8]
push eax
movzx eax, bx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, si
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, word [ebp - 0x1e]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, di
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x4a93dc
call fcn.0040aa60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a939f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.004027d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a93c7
lea eax, [ebp - 4]
call fcn.00404aa8
ret
Function at 0x4a93f8
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a9564
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x4a9578
mov edx, dword [ebp - 4]
call fcn.00404d68
mov eax, dword [ebp - 0x25c]
call fcn.00404cec
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a9509
lea eax, [ebp - 8]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00404c54
mov eax, 0x4a9584
mov edx, dword [ebp - 8]
call fcn.00404e14
je 0x4a94ee
mov eax, 0x4a958c
mov edx, dword [ebp - 8]
call fcn.00404e14
je 0x4a94ee
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404d68
mov eax, dword [ebp - 0x258]
and eax, 0x10
cmp eax, 0x10
je 0x4a94d0
push 0x20
mov eax, dword [ebp - 8]
call fcn.00404cec
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesW
push esi
call sub.kernel32.dll_DeleteFileW
jmp 0x4a94ee
lea eax, [ebp - 0x260]
mov ecx, 0x4a9598
mov edx, dword [ebp - 8]
call fcn.00404d68
mov eax, dword [ebp - 0x260]
call fcn.004a93f8
lea eax, [ebp - 0x258]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4a9469
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cfc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404e98
mov eax, dword [ebp - 0x264]
call fcn.00404cec
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a956b
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00404ac0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ac0
ret

Function at 0x4a97dc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4a980c
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4a9806
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
jmp 0x4a980c
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4a990c
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a9960
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov eax, dword [ebp - 4]
call fcn.00404cec
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesW
push ebx
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9967
lea eax, [ebp - 4]
call fcn.00404aa8
ret