joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bc6a
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.004c05d0
push esi
lea eax, [ebp + 0x8d]
push ebx
push eax
mov byte [ebp + 0x8c], bl
call fcn.004c05d0
add esp, 0x18
cmp dword [ebp + 0x19c], ebx
mov dword [ebp - 0x7c], ebx
jne 0x40bcce
cmp dword [ebp + 0x1a0], ebx
jne 0x40bcce
push str.SoftwareMicrosoftWindowsCurrentVersionRun
jmp 0x40bcd3
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov esi, 0x104
mov ecx, esi
lea eax, [ebp - 0x78]
call fcn.00485786
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop ecx
push ebx
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
push SysStringLen
call edi
test eax, eax
je 0x40bd2a
push ebx
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
push connect
call edi
test eax, eax
je 0x40bd2a
xor eax, eax
jmp 0x40be8d
cmp dword [ebp + 0x19c], ebx
jne 0x40bde4
cmp dword [ebp + 0x1a0], ebx
jne 0x40be2f
push str.PAULA.exe
push ebx
push ebx
call fcn.0045f646
pop ecx
pop ecx
push eax
push str._s_s__InitServer
lea eax, [ebp + 0x8c]
push esi
push eax
call fcn.00486e10
lea eax, [ebp + 0x8c]
push eax
call fcn.004bf880
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0x18
inc eax
push eax
lea eax, [ebp + 0x8c]
push eax
push 1
push ebx
push str.PAULA_Server
push dword [ebp - 0x7c]
call edi
push str.PAULA_Updt.exe
push 0x4e0dd4
push ebx
push ebx
mov dword [ebp - 0x80], eax
call fcn.0045f646
pop ecx
pop ecx
push eax
push str._s_s_s__StartupLGUProc__Spawned
lea eax, [ebp + 0x8c]
push esi
push eax
call fcn.00486e10
lea eax, [ebp + 0x8c]
push eax
call fcn.004bf880
add esp, 0x1c
inc eax
push eax
lea eax, [ebp + 0x8c]
push eax
push 1
push ebx
push str.PAULA_Update
push dword [ebp - 0x7c]
call edi
or dword [ebp - 0x80], eax
jmp 0x40be7c
cmp dword [ebp + 0x1a0], ebx
jne 0x40be2f
push str.PAULA.exe
push ebx
push ebx
call fcn.0045f646
pop ecx
pop ecx
push eax
push str._s_s__StartOnce
lea eax, [ebp + 0x8c]
push esi
push eax
call fcn.00486e10
lea eax, [ebp + 0x8c]
push eax
call fcn.004bf880
add esp, 0x18
inc eax
push eax
lea eax, [ebp + 0x8c]
push eax
push 1
push ebx
push str.PAULA_Server
jmp 0x40be70
push str.PAULA.exe
push ebx
push ebx
call fcn.0045f646
pop ecx
pop ecx
push eax
push str._s_s__CreateTerminal
lea eax, [ebp + 0x8c]
push esi
push eax
call fcn.00486e10
lea eax, [ebp + 0x8c]
push eax
call fcn.004bf880
add esp, 0x18
inc eax
push eax
lea eax, [ebp + 0x8c]
push eax
push 1
push ebx
push str.PAULA_Create
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80], eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x80], ebx
sete al
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
add ebp, 0x194
leave
ret
Function at 0x40c726
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1a4]
xor ebx, ebx
push 0x207
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.004c05d0
push 0x208
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
call fcn.004c05d0
mov eax, dword [ebp - 0x78]
add esp, 0x18
call fcn.004856d7
mov edx, edi
call fcn.00485754
test eax, eax
je 0x40c794
xor eax, eax
jmp 0x40c7ce
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], 0x207
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40c7bc
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40c790
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x78]
mov ecx, 0x102
call fcn.00485786
pop ecx
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
pop ebx
call fcn.004bfeb5
add ebp, 0x198
leave
ret
Function at 0x40cf2f
Capabilities:
Manipulate console buffer

Disassembly:
call fcn.0040ffd6
test eax, eax
je 0x40cf3c
xor eax, eax
inc eax
ret
jmp fcn.0040cf41

Function at 0x40e803
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x52849c]
test eax, eax
push ebx
push edi
mov edi, dword [esp + 0xc]
je 0x40e844
xor ebx, ebx
inc ebx
test eax, eax
mov dword [0x5284a0], ebx
je 0x40e82c
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x52849c]
test edi, edi
je 0x40e836
test eax, eax
jne 0x40e812
jmp 0x40e847
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x40e950
xor ebx, ebx
inc ebx
test edi, edi
je 0x40e94e
push esi
mov esi, 0x5284a8
push edi
mov ecx, 0x104
mov eax, esi
call fcn.00485786
pop ecx
mov eax, edi
call fcn.004856d7
mov cl, byte [0x5284a8]
xor edx, edx
xor eax, eax
jmp 0x40e8a0
test edx, edx
je 0x40e88a
cmp cl, 0x29
jne 0x40e881
xor edx, edx
mov byte [eax + 0x5285b0], 0x20
jmp 0x40e899
cmp cl, 0x28
jne 0x40e893
mov edx, ebx
jmp 0x40e881
mov byte [eax + 0x5285b0], cl
mov cl, byte [eax + 0x5284a9]
inc eax
test cl, cl
jne 0x40e876
push ebp
mov ebp, 0x5285b0
push ebp
push esi
mov byte [eax + 0x5285b0], cl
call fcn.004c0ab0
test eax, eax
pop ecx
pop ecx
je 0x40e92d
call fcn.0040e6bd
test eax, eax
jne 0x40e92d
and dword [esp + 0x14], eax
and dword [0x5284a0], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ebx, 0x5284a0
call fcn.0040ae33
test eax, eax
jne 0x40e921
cmp dword [esp + 0x14], eax
mov dword [0x52849c], 1
je 0x40e8fe
push ebp
call edi
mov eax, 0x2ee
jmp 0x40e906
push esi
call edi
mov eax, 0x5dc
call fcn.004af78c
xor eax, eax
cmp dword [esp + 0x14], eax
sete al
cmp dword [0x5284a0], 0
mov dword [esp + 0x14], eax
je 0x40e8db
push esi
call edi
and dword [0x52849c], 0
jmp 0x40e94c
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
and dword [0x52849c], 0
push 0x3e8
mov dword [0x5284a0], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebp
pop esi
xor eax, eax
pop edi
pop ebx
ret 4
Function at 0x40ea19
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xa8]
mov ebx, 0x100
lea esi, [ebx - 1]
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x6f]
push 0
push eax
mov byte [ebp - 0x70], 0
call fcn.004c05d0
and word [ebp - 0x74], 0
xor eax, eax
and dword [ebp - 0x80], eax
lea edi, [ebp - 0x72]
stosw word es:[edi], ax
mov eax, dword [ebp - 0x78]
add esp, 0xc
call fcn.00485776
test eax, eax
je 0x40ea86
xor eax, eax
jmp 0x40eb1f
push dword [ebp - 0x7c]
lea edi, [ebp - 0x70]
push dword [ebp - 0x78]
mov eax, edi
push esi
push eax
jmp 0x40eac3
lea eax, [ebp - 0x70]
cmp edi, eax
je 0x40eaa3
push edi
call fcn.004bf2a6
pop ecx
add ebx, ebx
lea eax, [ebx + 0xa]
push eax
push 1
call fcn.004bf452
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x40ea7f
push dword [ebp - 0x7c]
lea eax, [ebx - 1]
push dword [ebp - 0x78]
push eax
push edi
call fcn.004c0cfb
add esp, 0x10
cmp eax, 0xffffffff
je 0x40ea95
mov cx, word [ebp + 0x9c]
mov word [ebp - 0x74], cx
mov cx, word [ebp + 0xa0]
mov word [ebp - 0x72], cx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp - 0x74]
push eax
push edi
call fcn.0040d379
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
test eax, eax
jne 0x40eb0e
cmp byte [0x527ecb], al
jne 0x40eb0e
mov byte [0x527ecb], 1
lea eax, [ebp - 0x70]
cmp edi, eax
je 0x40eb1c
push edi
call fcn.004bf2a6
pop ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
add ebp, 0x94
leave
ret
Function at 0x40fbd8
Capabilities:
Get disk size
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0xf0]
push 0x90
mov dword [ebp - 0xf4], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
push esi
push eax
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
call fcn.004c05d0
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0xd4], esi
lea edi, [ebp - 0xd0]
rep stosd dword es:[edi], eax
mov edi, 0x94
push edi
lea eax, [ebp - 0xa0]
push esi
push eax
call fcn.004c05d0
push 0x24
lea eax, [ebp - 0xd4]
push esi
push eax
call fcn.004c05d0
push 0x20
lea eax, [ebp - 0xf4]
push esi
push eax
call fcn.004c05d0
add esp, 0x30
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40fc94
xor eax, eax
jmp 0x40fd09
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push esi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb0]
push eax
push esi
push esi
call fcn.0045f646
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x40fc90
movzx eax, word [ebp - 0xb2]
add eax, dword [ebp - 0xa8]
movzx ecx, word [ebp - 0xd4]
add ecx, eax
add ecx, dword [ebp - 0xec]
mov eax, dword [ebp - 0x9c]
add ecx, dword [ebp - 0x98]
lea eax, [ecx + eax + 0x2222]
cmp eax, esi
jne 0x40fd09
mov eax, 0x111
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004bfeb5
leave
ret
Function at 0x40fe92
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x12c]
sub esp, 0x1ac
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp + 0x128], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x90
lea eax, [ebp - 0x6c]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x70], ebx
call fcn.004c05d0
mov esi, 0x94
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.004c05d0
add esp, 0x18
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40fef2
mov dword [ebp - 0x78], ebx
jmp 0x40fefc
cmp dword [ebp - 0x6c], 6
sbb eax, eax
inc eax
mov dword [ebp - 0x78], eax
cmp edi, ebx
je 0x40ffa4
cmp dword [ebp - 0x78], ebx
je 0x40ff9f
push 0x103
lea eax, [ebp + 0x25]
push ebx
push eax
mov byte [ebp + 0x24], bl
call fcn.004c05d0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov ecx, 0x104
lea eax, [ebp + 0x24]
mov dword [ebp - 0x74], ebx
call fcn.00485786
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0x10
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
mov edi, 0x20019
push edi
push ebx
push ebx
push ebx
lea eax, [ebp + 0x24]
push eax
push SysStringLen
call esi
cmp eax, ebx
mov dword [ebp - 0x7c], eax
je 0x40ff7f
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
lea eax, [ebp + 0x24]
push eax
push connect
call esi
test eax, eax
jne 0x40ff7a
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x7c], ebx
jne 0x40ff9f
push str.EnableLUA
push dword [ebp - 0x74]
call fcn.0040c818
pop ecx
pop ecx
push dword [ebp - 0x74]
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x80]
mov dword [eax], ebx
mov ecx, dword [ebp + 0x128]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
add ebp, 0x12c
leave
ret
Function at 0x410878
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor esi, esi
cmp dword [esp + 0x14], esi
push edi
jle 0x4108d0
push 1
mov ebx, 0x410
push ebx
call fcn.004bf452
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x4108d0
push ebx
push esi
push edi
call fcn.004c05d0
mov ebx, dword [0x528e04]
add esp, 0xc
cmp ebx, esi
jne 0x4108ba
call fcn.0046e649
mov ebx, eax
mov dword [0x528e04], ebx
push edi
call fcn.0046e6fb
cmp dword [0x528e04], esi
pop ecx
jne 0x4108d6
push edi
call fcn.004bf2a6
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea eax, [edi + 0x1b8]
push 0x4e119c
push eax
call fcn.004bf9a0
lea ebx, [edi + 0x250]
push str..ConsoleField.c
push ebx
mov dword [edi + 0x15c], 1
mov dword [edi + 0x174], esi
mov dword [edi + 0x190], esi
mov dword [edi + 0x18c], 2
call fcn.0041cee3
mov esi, str.A_Console_Field_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0041d0de
mov eax, 0xbb8
mov ecx, ebx
call fcn.0041d107
mov eax, edi
call fcn.004155cd
push 0x4e04c4
push 0xffffffffffffffff
push dword [esp + 0x30]
mov eax, edi
push dword [esp + 0x30]
push dword [esp + 0x30]
call fcn.00410ae8
add esp, 0x24
test eax, eax
jne 0x410964
mov eax, edi
call fcn.0041097a
jmp 0x4108d0
mov esi, edi
call fcn.00410f77
push 0x5f
call fcn.00410fa2
pop ecx
mov eax, edi
jmp 0x4108d2
Function at 0x419613
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x8d]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x7c], edi
mov byte [ebp + 0x8c], bl
call fcn.004c05d0
push esi
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.004c05d0
add esp, 0x18
mov edx, edi
call fcn.00485754
test eax, eax
jne 0x419741
mov edx, dword [ebp - 0x80]
call fcn.00485754
test eax, eax
jne 0x419741
push dword [ebp - 0x80]
lea edi, [esi + 1]
mov ecx, edi
lea eax, [ebp + 0x8c]
call fcn.00485786
mov edx, eax
call fcn.00486276
mov esi, edx
call fcn.00486317
mov eax, esi
push eax
call fcn.004bf880
pop ecx
pop ecx
jmp 0x4196c5
lea ecx, [ebp + eax + 0x8c]
cmp byte [ecx], 0x5c
jne 0x4196ca
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x4196b7
lea esi, [ebp + 0x8c]
call fcn.00485a88
push dword [ebp - 0x7c]
mov ecx, edi
lea eax, [ebp - 0x78]
call fcn.00485786
mov edx, eax
call fcn.00486276
mov esi, edx
call fcn.00486317
mov eax, esi
push eax
call fcn.004bf880
pop ecx
pop ecx
jmp 0x419707
lea ecx, [ebp + eax - 0x78]
cmp byte [ecx], 0x5c
jne 0x41970c
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x4196fc
lea eax, [ebp - 0x78]
call fcn.00485acb
mov edx, eax
lea ecx, [ebp + 0x8c]
call fcn.00485d15
cmp dword [ebp + 0x1a0], ebx
lea eax, [ebp + 0x8c]
je 0x41973d
push 0xb
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x419743
push 0xa
jmp 0x419731
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
add ebp, 0x194
leave
ret

Function at 0x41975b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov edi, ecx
mov byte [ebp - 0x110], 0
call fcn.004c05d0
add esp, 0xc
push edi
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00485786
pop ecx
mov esi, eax
call fcn.00486317
push 0
push 0x5c
call fcn.004863c2
pop ecx
pop ecx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419801
test al, 0x10
je 0x419801
mov eax, esi
push 1
push eax
call fcn.00419848
mov eax, esi
push 1
push eax
call fcn.00419864
add esp, 0x10
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [ebp - 0x114], eax
jne 0x4197f9
lea edi, [ebp - 0x110]
call fcn.0041a56b
push dword [ebp - 0x114]
jmp 0x41981a
xor esi, esi
cmp eax, 0xffffffff
je 0x419818
call fcn.0041a56b
test eax, eax
je 0x419818
push edi
call fcn.0041a61c
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004bfeb5
leave
ret
Function at 0x419918
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
push 6
xor ebx, ebx
pop ecx
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00485754
test eax, eax
jne 0x419a00
mov edx, dword [ebp + 0xc]
call fcn.00485754
test eax, eax
jne 0x419a00
push dword [ebp + 8]
call fcn.004bf880
push dword [ebp + 8]
call fcn.004bf880
add eax, 0xa
push eax
push 1
call fcn.004bf452
push dword [ebp + 0xc]
mov esi, eax
call fcn.004bf880
add eax, 0xa
push eax
push 1
call fcn.004bf452
add esp, 0x1c
cmp esi, ebx
mov edi, eax
je 0x419a00
cmp edi, ebx
je 0x419a00
push dword [ebp + 8]
push esi
call fcn.004bf9a0
push dword [ebp + 0xc]
push edi
call fcn.004bf9a0
push esi
call fcn.004bf880
push edi
mov byte [eax + esi + 1], bl
call fcn.004bf880
mov byte [eax + edi + 1], bl
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov word [ebp - 0x14], 0x614
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0xa], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.004bf2a6
push edi
call fcn.004bf2a6
xor eax, eax
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
sete al
jmp 0x419a02
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x419a07
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
push 6
xor ebx, ebx
pop ecx
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00485754
test eax, eax
jne 0x419aef
mov edx, dword [ebp + 0xc]
call fcn.00485754
test eax, eax
jne 0x419aef
push dword [ebp + 8]
call fcn.004bf880
push dword [ebp + 8]
call fcn.004bf880
add eax, 0xa
push eax
push 1
call fcn.004bf452
push dword [ebp + 0xc]
mov esi, eax
call fcn.004bf880
add eax, 0xa
push eax
push 1
call fcn.004bf452
add esp, 0x1c
cmp esi, ebx
mov edi, eax
je 0x419aef
cmp edi, ebx
je 0x419aef
push dword [ebp + 8]
push esi
call fcn.004bf9a0
push dword [ebp + 0xc]
push edi
call fcn.004bf9a0
push esi
call fcn.004bf880
push edi
mov byte [eax + esi + 1], bl
call fcn.004bf880
mov byte [eax + edi + 1], bl
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0xa], ebx
mov word [ebp - 0x14], 0x1694
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.004bf2a6
push edi
call fcn.004bf2a6
xor eax, eax
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
sete al
jmp 0x419af1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419af6
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
call fcn.00485754
test eax, eax
jne 0x419bec
mov edx, dword [ebp + 0xc]
call fcn.00485754
test eax, eax
jne 0x419bec
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 0x20
push 3
push ebx
push 7
push 0x80
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x419b8d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x419b7a
mov dword [ebp - 8], 1
jmp 0x419b88
cmp dword [0x521070], ebx
je 0x419b88
mov dword [0x521070], ebx
call fcn.0041cc21
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00419f7a
add esp, 0xc
test eax, eax
je 0x419bec
cmp dword [ebp - 8], ebx
jne 0x419bac
xor eax, eax
inc eax
jmp 0x419bee
push ebx
push 0x80000020
push 3
push ebx
push 7
push 0x100
push dword [ebp + 0xc]
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x419ba7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x419be5
inc dword [0x52a5c4]
call fcn.0041cc21
jmp 0x419ba7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419f7a
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov dword [ebp - 0x114], ebx
call fcn.00485754
test eax, eax
jne 0x41a0e2
mov edx, edi
call fcn.00485754
test eax, eax
jne 0x41a0e2
push ebx
call fcn.004bf880
mov esi, 0x104
cmp eax, esi
pop ecx
jae 0x41a097
push edi
call fcn.004bf880
cmp eax, esi
pop ecx
jae 0x41a097
push dword [ebp + 0x10]
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
call ebx
test eax, eax
jne 0x41a092
push edi
call fcn.0041a61c
test eax, eax
pop ecx
je 0x41a060
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.004c05d0
add esp, 0xc
push dword [ebp - 0x114]
mov ecx, esi
lea eax, [ebp - 0x110]
call fcn.00485786
pop ecx
mov esi, eax
call fcn.00485a88
mov edx, esi
call fcn.00485754
test eax, eax
jne 0x41a0e2
mov edx, edi
mov ecx, esi
call fcn.00485d15
push dword [ebp + 0x10]
mov eax, esi
push eax
push dword [ebp - 0x114]
call ebx
jmp 0x41a0e4
cmp dword [ebp + 0x10], 0
jne 0x41a0e2
call fcn.0041a56b
test eax, eax
je 0x41a0e2
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x41a0e2
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
jmp 0x41a053
xor eax, eax
inc eax
jmp 0x41a0e4
mov eax, ebx
call fcn.00488264
mov esi, eax
mov eax, edi
call fcn.00488264
test esi, esi
mov edi, eax
je 0x41a0d7
test edi, edi
je 0x41a0d0
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
mov ebx, eax
call fcn.004bf2a6
pop ecx
push edi
call fcn.004bf2a6
pop ecx
mov eax, ebx
jmp 0x41a0e4
push esi
call fcn.004bf2a6
pop ecx
test edi, edi
je 0x41a0e2
push edi
call fcn.004bf2a6
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret

Function at 0x41a0f3
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov edx, edi
call fcn.00485754
test eax, eax
je 0x41a107
xor eax, eax
jmp 0x41a143
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
test eax, eax
jne 0x41a140
call fcn.0041a56b
test eax, eax
je 0x41a140
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x41a103
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call esi
jmp 0x41a143
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret