joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4628d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x14
mov eax, 0x624316
call fcn.005b83f6
mov esi, ecx
mov dword [ebp - 0x1c], esi
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
sub edi, dword [eax]
sar edi, 3
mov dword [ebp - 4], ecx
mov dword [esi], ebx
mov dword [ebp - 4], ecx
mov dword [esi + 4], ebx
mov dword [ebp - 4], ecx
mov dword [esi + 8], ebx
test edi, edi
je 0x4629f6
mov dword [ebp - 4], ecx
cmp edi, 0x1fffffff
jbe 0x462935
push str.vector_T__too_long
call fcn.005a58d1
mov dword [ebp - 4], ecx
push 1
push 8
push edi
call fcn.0041613c
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 4], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
lea eax, [eax + edi*8]
mov dword [esi + 8], eax
mov dword [ebp - 4], 0x35
mov byte [ebp - 4], 0x34
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x3a
mov byte [ebp - 4], 0x39
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x40
mov byte [ebp - 4], 0x3f
mov byte [ebp - 4], 0x3c
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x32
mov eax, dword [esi]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x43
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x32
mov byte [ebp + 8], bl
push ecx
mov dword [ebp - 0x20], esp
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x32
push dword [ebp + 8]
push ecx
push eax
call fcn.00462b64
add esp, 0x10
mov byte [ebp - 4], 0x47
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 0x45
mov byte [ebp - 4], 0x32
mov dword [esi + 4], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.005b8354
ret 4
Function at 0x470e1b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x8d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, 0x208
xor esi, esi
push edi
push esi
push eax
call fcn.005b9760
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005b9760
lea edi, [ebx + 0xc]
add esp, 0x18
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
test eax, eax
je 0x470eae
mov eax, dword [ebx]
lea ecx, [ebp - 0x414]
push 0x104
push ecx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push esi
mov ecx, ebx
call dword [eax + 8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi]
mov ecx, edi
inc esi
call dword [eax + 4]
cmp esi, eax
jb 0x470e68
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525a3e
mov esp, ebp
pop ebp
ret 4

Function at 0x470fd9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
and dword [ecx], 0
cmp byte [eax + 4], 0
je 0x471004
cmp dword [ebp + 0x10], 0x50
mov byte [eax + 4], 0
mov dword [ecx], 0x25
jle 0x471004
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop ebp
ret 0x14
Function at 0x478f9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xc
mov eax, 0x627c4e
call fcn.005b83f6
xor ebx, ebx
mov dword [ebp - 4], 3
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
mov eax, dword [0x129ac8c]
mov ecx, dword [eax + 4]
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
mov byte [ebp - 4], 6
mov byte [ebp - 4], 5
mov byte [ebp - 4], bl
mov esi, dword [0x129ac8c]
mov al, 1
mov byte [ebp - 0x14], al
mov edi, dword [ebp + 0x10]
cmp byte [ecx + 0xd], 0
jne 0x47902f
mov esi, ecx
test bl, bl
je 0x47900c
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 9
mov byte [ebp - 4], bl
mov eax, dword [ecx + 0x10]
cmp eax, dword [edi]
setge al
jmp 0x47901f
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], bl
mov eax, dword [edi]
cmp eax, dword [ecx + 0x10]
setl al
mov byte [ebp - 0x14], al
test al, al
je 0x47902a
mov ecx, dword [ecx]
jmp 0x478feb
mov ecx, dword [ecx + 8]
jmp 0x478feb
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], bl
mov ecx, esi
mov dword [ebp + 0x10], ecx
test al, al
je 0x4790bc
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x13
mov eax, dword [0x129ac8c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x4790b1
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], bl
push dword [ebp + 0x14]
push ecx
push esi
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.0047918e
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 1
mov byte [ebp - 4], bl
call fcn.005b8354
ret 0x10
lea ecx, [ebp + 0x10]
call fcn.0041f189
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], bl
mov eax, dword [ecx + 0x10]
cmp eax, dword [edi]
jge 0x4790f0
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], bl
push dword [ebp + 0x14]
push ecx
push esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
call fcn.0047918e
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x21
jmp 0x47909b
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], bl
push 0x28
push 1
push dword [ebp + 0x14]
call fcn.00416193
add esp, 0xc
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov byte [eax + 4], bl
jmp 0x4790a6
Function at 0x479e3c
Capabilities:
Get file version info

Disassembly:
push 0x10
mov eax, 0x627cfd
call fcn.005b83f6
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.NGUtils::AFileVersionInfo.0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.NGUtils::CFileVersionInfo.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x479f12
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x479f12
mov byte [ebp - 4], 1
push ebx
call fcn.005261a0
pop ecx
mov dword [esi + 0xc], eax
mov dword [ebp - 4], edi
jmp 0x479ebb
cmp dword [esi + 0xc], 0
je 0x479f12
push dword [esi + 0xc]
push ebx
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x479f12
mov dword [ebp + 8], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x10]
push eax
push 0x7f6ab0
push dword [esi + 0xc]
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
call edi
test eax, eax
je 0x479f00
mov eax, dword [ebp + 8]
shr eax, 2
mov dword [esi + 8], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 4]
push eax
push 0x6daccc
push dword [esi + 0xc]
call edi
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.005b8354
ret 4

Function at 0x47a320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret 0x28

Function at 0x47a3f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x47a4d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esp, ebp
pop ebp
ret 8

Function at 0x47a690
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret 4
Function at 0x47b1f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esp, ebp
pop ebp
ret 8

Function at 0x47bcf1
Capabilities:
Create directory

Disassembly:
push 0x94
mov eax, 0x627ff0
call fcn.005b83bf
mov edi, edx
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0xa0]
push ebx
push ebx
push 0x17e
push str.NGUtils::CPathUtils::CreatePathHierarchy
push 0x129adc8
push dword [0x129b158]
call fcn.0041f881
mov dword [ebp - 4], ebx
mov ecx, esi
call fcn.00416b80
mov eax, dword [eax]
test eax, eax
je 0x47bdd2
mov ecx, esi
call fcn.0047bdf9
test al, al
jne 0x47bddc
mov ecx, esi
call fcn.00416aea
push eax
push str.wstrPathToCreate__s
push 0x184
lea eax, [ebp - 0xa0]
push 0x10
push eax
call fcn.0041fc07
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0047b84f
add esp, 0x1c
mov byte [ebp - 4], 1
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0047bcf1
mov dword [ebp - 0x98], eax
test eax, eax
jns 0x47bd97
cmp eax, 0x8004ffff
jne 0x47bdc5
push edi
mov ecx, esi
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47bdc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, 0x80004005
cmp eax, 0xb7
cmove ecx, edx
mov dword [ebp - 0x98], ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.0041660a
jmp 0x47bddc
mov dword [ebp - 0x98], 0x8004ffff
mov esi, dword [ebp - 0x98]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.0041f95a
mov eax, esi
call fcn.005b8369
ret

Function at 0x47c1c5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x3c
mov eax, 0x628128
call fcn.005b842d
mov ebx, ecx
and dword [ebp - 4], 0
push 0xfa00
call fcn.005261a0
mov edi, eax
mov dword [esp], 0x7f739c
lea ecx, [ebp - 0x30]
call fcn.0041b35f
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.00416b80
cmp dword [eax], 2
jbe 0x47c249
push 2
push 0
lea eax, [ebp - 0x48]
push eax
mov ecx, ebx
call fcn.004205d5
mov byte [ebp - 4], 2
push 0x7f73a8
mov ecx, eax
call fcn.0041e772
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0041660a
test esi, esi
jne 0x47c249
mov esi, 0x6d970c
push esi
call fcn.004160c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.0041bf96
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [ebp - 0x30]
call fcn.0041d412
push 0
push edi
push 0x7d00
lea ecx, [ebp - 0x30]
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
dec eax
cmp eax, 0x7cfe
ja 0x47c278
push edi
jmp 0x47c281
lea ecx, [ebp - 0x30]
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
push edi
call fcn.00529880
pop ecx
cmp ebx, 0xffffffff
jne 0x47c2a3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0041660a
jmp 0x47c2c2
test bl, 0x10
jne 0x47c295
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0041660a
mov al, 1
jmp 0x47c2c4
xor al, al
call fcn.005b837a
ret
Function at 0x47c53f
Capabilities:
Create directory

Disassembly:
push 0x98
mov eax, 0x6281ce
call fcn.005b83bf
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0xa0]
push ebx
push ebx
push 0x180
push str.NGUtils::CFileUtils::CreateDirectoryW
push 0x129adfc
push dword [0x129b158]
call fcn.0041f881
mov dword [ebp - 4], ebx
and dword [ebp - 0xa4], ebx
test bl, bl
jne 0x47c67a
push 0x7f739c
lea ecx, [ebp - 0x28]
call fcn.0041b35f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0xffffffffffffffff
push 0
push esi
call fcn.0041d412
push 0
lea ecx, [ebp - 0x28]
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
add bl, 1
jne 0x47c615
cmp edi, 0xb7
je 0x47c663
mov ecx, esi
call fcn.00416b80
mov ecx, esi
mov eax, dword [eax]
cmp edi, 5
jne 0x47c639
push edi
push eax
call fcn.00416aea
push eax
push str.::CreateDirectory__s__len_d___error_d._Sleeping_...
push 0x199
lea eax, [ebp - 0xa0]
push 0x80
push eax
call fcn.0041fc07
add esp, 0x1c
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0041660a
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp eax, 2
jb 0x47c57d
jmp 0x47c67a
push edi
push eax
call fcn.00416aea
push eax
push str.::CreateDirectory__s__len_d___error_d
push 0x19e
lea eax, [ebp - 0xa0]
push 0x80
push eax
call fcn.0041fc07
add esp, 0x1c
xor bl, bl
jmp 0x47c66e
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0041660a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.0041f95a
mov al, bl
call fcn.005b8369
ret

Function at 0x47c691
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0x7c
mov eax, 0x628201
call fcn.005b83bf
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x88]
push ebx
push ebx
push 0x1ac
push str.NGUtils::CFileUtils::DeleteFileW
push 0x129adfc
push dword [0x129b158]
call fcn.0041f881
mov dword [ebp - 4], ebx
mov ecx, esi
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47c724
test bl, 1
je 0x47c73d
and ebx, 0xfffffffe
mov ecx, esi
push ebx
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x47c73d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov ecx, esi
call fcn.00416aea
push eax
push str.::SetFileAttributes__s__0x_X___error_d
push 0x1bb
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.0041fc07
add esp, 0x1c
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.0041f95a
mov al, bl
call fcn.005b8369
ret
mov ecx, esi
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x47c77e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00416aea
push eax
push str.::DeleteFile__s___error_d
push 0x1c2
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.0041fc07
add esp, 0x18
jmp 0x47c724
mov bl, 1
jmp 0x47c726
Function at 0x47ce16
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, edi
jmp 0x47ce2b
mov ebx, dword [ebp - 4]
add edi, 0x200
test esi, esi
je 0x47ce3c
push esi
call fcn.00529880
pop ecx
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005261a0
mov esi, eax
pop ecx
test esi, esi
je 0x47cea5
xor eax, eax
lea ecx, [ebx + 4]
mov word [esi], ax
call fcn.00416aea
push eax
push edi
push esi
push 0x6d970c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
lea ecx, [edi - 1]
cmp ebx, ecx
jae 0x47ce28
push esi
call fcn.004160c0
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push esi
call fcn.0041bf96
push esi
call fcn.00529880
xor eax, eax
cmp eax, ebx
pop ecx
sbb eax, eax
neg eax
jmp 0x47cea7
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x486c60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62a60d
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x8d600c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x8c]
push 0
push 0
push 0xa44
push str.HPXS::CeSCLDevManager::StopScan
push 0x129b5b8
push dword [0x12992f8]
call fcn.0041f881
mov dword [ebp - 4], 0
mov dword [edi], 0
cmp word [esi + 0xbc], 1
jne 0x486d31
movzx ecx, word [esi + 0x5e]
xor eax, eax
test cx, cx
setne al
cmp dword [esi + 0x48], 0
mov dword [esi + 0x4c], eax
je 0x486d04
test cx, cx
jne 0x486cf8
mov ax, word [esi + 0x5c]
inc word [esi + 0x60]
mov dword [esi + 0x4c], 1
jmp 0x486d2d
lea eax, [ecx - 1]
mov dword [esi + 0x4c], 1
jmp 0x486d2d
push ecx
push str.ADF_stack:_duplicate_d
push 0xa58
lea eax, [ebp - 0x8c]
push 0x200
push eax
call fcn.0041fc07
movzx eax, word [esi + 0x5e]
add esp, 0x14
test ax, ax
je 0x486d31
dec eax
mov word [esi + 0x5e], ax
cmp dword [esi + 0x58], 2
jne 0x486d9f
mov eax, dword [esi + 0x500]
test eax, eax
je 0x486d8e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x500], 0
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
cmp dword [esi + 0x98], 8
jb 0x486d6b
mov eax, dword [esi + 0x84]
jmp 0x486d71
lea eax, [esi + 0x84]
push eax
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x6d970c
lea ecx, [esi + 0x84]
call fcn.0041bf96
mov dword [ebp - 0x84], 0
xor esi, esi
jmp 0x486e5b
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x486e55
mov eax, dword [esi + 0x64]
xor dl, dl
mov byte [ebp - 0x91], dl
cmp eax, dword [esi + 0x68]
jb 0x486dd9
cmp byte [esi + 0x10], dl
je 0x486dd9
cmp byte [esi + 0x44], dl
je 0x486dd9
cmp byte [esi + 0x11], 0
movzx eax, dl
mov edx, 1
cmove eax, edx
mov byte [ebp - 0x91], al
push dword [ebp - 0x91]
lea eax, [ebp - 0x8d]
push eax
call fcn.00492140
push eax
push str.Finished_m_peSCLDevice__StopScan_hr0x_08X
push 0xa74
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x8c]
push 0x200
push eax
call fcn.0041fc07
add esp, 0x14
cmp byte [esi + 0x11], 0
je 0x486e3c
push str.A_cancel_has_been_received___from_user
push 0xa77
lea eax, [ebp - 0x8c]
push 0x200
push eax
call fcn.0041fc07
add esp, 0x10
mov dword [edi], 0x10
jmp 0x486e4d
mov eax, dword [ebp - 0x84]
test eax, eax
jns 0x486e4d
push edi
push eax
call fcn.00486930
mov ecx, dword [esi + 0x40]
call fcn.0048d450
mov esi, dword [ebp - 0x84]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0xffffffff
call fcn.0041f95a
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00525a3e
mov esp, ebp
pop ebp
ret 4
Function at 0x48b620
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [ebp + 8]
push 0x1cff
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp edi, ebx
jne 0x48b6bb
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax + eax]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
je 0x48b690
cmp dword [ebp - 0x1c], 0x12
je 0x48b6c6
lea eax, [ebp - 0x20]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x48b672
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
ja 0x48b6d9
push 0x1cff
push ecx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp edi, dword [ebp + 8]
je 0x48b660
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0x102
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48b9a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62ac9f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x8d600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x12812fc], 0
mov ebx, 0x12812f8
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x11], 1
je 0x48bbdc
mov ecx, ebx
call fcn.0048bc10
test al, al
je 0x48bbdc
mov esi, dword [ebp + 0xc]
mov ecx, 0x200000
mov dword [0x128133c], 0
mov dword [0x1281340], 0
mov dword [0x128131c], esi
mov dword [0x1281318], ecx
test esi, esi
jle 0x48ba51
mov eax, ecx
cdq
idiv esi
cmp eax, 0x10
jge 0x48ba3c
nop dword [eax]
add ecx, ecx
mov eax, ecx
cdq
idiv esi
cmp eax, 0x10
jl 0x48ba30
mov eax, ecx
cdq
idiv esi
imul eax, esi
mov dword [0x1281318], eax
mov eax, dword [ebp + 8]
mov dword [0x1281320], eax
mov dword [ebp - 4], 0
xor edi, edi
nop word [eax + eax]
cmp edi, 3
jge 0x48bb01
push 0x10
call fcn.00525a5d
mov esi, eax
add esp, 4
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 1
mov ecx, dword [0x1281318]
push ecx
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ecx
call fcn.005261a0
mov dword [esi], eax
add esp, 4
mov dword [esi + 8], 0
mov byte [ebp - 4], 0
mov dword [edi*4 + 0x1281300], esi
inc edi
jmp 0x48ba60
cmp byte [ebp - 0x11], 0
mov dword [ebp - 4], 0xffffffff
je 0x48bbcc
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
push 3
push 0
push 0
mov dword [0x128130c], 0
mov dword [0x1281310], 0
mov dword [0x1281314], 0
call esi
push 0
push 3
push 3
push 0
mov dword [0x128132c], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [0x1281328], eax
call esi
push 0
push 0
push 1
push 0
mov dword [0x1281330], eax
call esi
push 0
push 0
push 1
push 0
mov dword [0x1281334], eax
call esi
cmp dword [0x128132c], 0
mov dword [0x1281338], eax
je 0x48bbcc
cmp dword [0x1281328], 0
je 0x48bbcc
cmp dword [0x1281330], 0
je 0x48bbcc
cmp dword [0x1281334], 0
je 0x48bbcc
test eax, eax
je 0x48bbcc
lea eax, [ebp + 0xc]
push eax
push 0
push ebx
push 0x48b990
push 0
push 0
call fcn.005ce3c0
add esp, 0x18
mov dword [0x1281324], eax
cmp dword [0x1281324], 0
jne 0x48bbf2
mov ecx, ebx
call fcn.0048bc10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48bc10
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov byte [ebp - 1], 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
cmp dword [ebx + 0x2c], 0
je 0x48bc75
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x48bc39
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xea60
push dword [ebx + 0x2c]
call edi
cmp eax, 0x102
jne 0x48bc69
push 0
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x7d0
push dword [ebx + 0x2c]
call edi
mov byte [ebp - 1], 0
push dword [ebx + 0x2c]
call esi
mov dword [ebx + 0x2c], 0
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x48bc86
push eax
call esi
mov dword [ebx + 0x34], 0
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x48bc97
push eax
call esi
mov dword [ebx + 0x30], 0
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x48bca8
push eax
call esi
mov dword [ebx + 0x38], 0
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x48bcb9
push eax
call esi
mov dword [ebx + 0x3c], 0
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x48bcca
push eax
call esi
mov dword [ebx + 0x40], 0
mov eax, 3
lea edi, [ebx + 8]
mov dword [ebp - 8], eax
mov esi, dword [edi]
test esi, esi
je 0x48bd04
mov eax, dword [esi]
test eax, eax
je 0x48bcf0
push eax
call fcn.00529880
add esp, 4
mov dword [esi], 0
push 0x10
push esi
call fcn.00525a4f
mov eax, dword [ebp - 8]
add esp, 8
mov dword [edi], 0
add edi, 4
sub eax, 1
mov dword [ebp - 8], eax
jne 0x48bcd5
mov al, byte [ebp - 1]
pop edi
pop esi
mov dword [ebx + 0x50], 0
pop ebx
mov esp, ebp
pop ebp
ret