joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475810
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
jne 0x47582a
xor al, al
pop esi
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.irc_capabilities
push eax
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x4758e1
mov ecx, dword [esi]
push str.irc_string
push ecx
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x4758e1
mov edx, dword [esi]
push str.irc_set_callback
push edx
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x4758e1
mov eax, dword [esi]
push str.irc_decode_init
push eax
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x4758e1
mov ecx, dword [esi]
push str.irc_decode_process
push ecx
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x4758e1
mov edx, dword [esi]
push str.irc_decode_exit
push edx
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x4758e1
mov eax, dword [esi]
push str.irc_encode_init
push eax
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4758e1
mov ecx, dword [esi]
push str.irc_encode_process
push ecx
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x4758e1
mov edx, dword [esi]
push str.irc_encode_flush
push edx
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x4758e1
mov eax, dword [esi]
push str.irc_encode_exit
push eax
call edi
mov dword [esi + 0x28], eax
test eax, eax
jne 0x4758e8
pop edi
xor al, al
pop esi
ret 4
mov ecx, dword [esi]
push str.irc_encode_config
push ecx
call edi
mov dword [esi + 0x2c], eax
test eax, eax
pop edi
setne al
pop esi
ret 4

Function at 0x4783a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c2879
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4f00a8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 3
call fcn.00478470
mov eax, dword [esi + 0x40]
xor edi, edi
cmp eax, edi
je 0x4783e8
push eax
call fcn.00490f74
add esp, 4
mov eax, dword [esi + 0x34]
push eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
call fcn.00490f74
mov eax, dword [esi + 0x28]
add esp, 4
cmp eax, edi
je 0x47840d
push eax
call fcn.00490f74
add esp, 4
mov ecx, dword [esi + 0x1c]
push ecx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.00490f74
mov edx, dword [esi + 0xc]
push edx
call fcn.0049119f
mov eax, dword [esi]
push eax
call fcn.0049119f
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4795ae
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f00a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x479683
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x479672
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x47965c
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x479672
push eax
push edi
push dword [ebp - 0x110]
call fcn.0047954b
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x479685
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004911aa
leave
ret 4
Function at 0x490cec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x53a21c], 0
push esi
jne 0x490c5f
call fcn.00490b85
test eax, eax
je 0x490ca2
mov eax, dword [0x53a21c]
cmp eax, 1
jne 0x490c80
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x490ca2
pop esi
ret
push eax
call dword [0x53a224]
test eax, eax
jne 0x490cea
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x490ca6
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x53a21c]
call dword [0x53a224]
mov edi, eax
test edi, edi
je 0x490ccb
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x490ce7
mov edi, esi
add esi, 0xff0
push edi
push dword [0x53a21c]
call dword [0x53a220]
add edi, 0x10
cmp edi, esi
jb 0x490cd3
mov eax, edi
pop edi
pop esi
ret
jmp 0x490c4c

Function at 0x4911aa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f00a8]
jne 0x4911b4
repz ret
jmp fcn.004976a0

Function at 0x4a75d4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00497175
and dword [ebp - 4], 0
cmp dword [0x53ae58], 0
mov ebx, eax
jne 0x4a7685
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4a7736
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4a7736
push eax
call fcn.00497103
mov dword [esp], 0x4dac2c
push edi
mov dword [0x53ae58], eax
call esi
push eax
call fcn.00497103
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x53ae5c], eax
call esi
push eax
call fcn.00497103
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x53ae60], eax
call esi
push eax
call fcn.00497103
pop ecx
mov dword [0x53ae68], eax
test eax, eax
je 0x4a7685
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00497103
pop ecx
mov dword [0x53ae64], eax
mov eax, dword [0x53ae64]
cmp eax, ebx
je 0x4a76dd
cmp dword [0x53ae68], ebx
je 0x4a76dd
push eax
call fcn.0049717e
push dword [0x53ae68]
mov esi, eax
call fcn.0049717e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4a76dd
test edi, edi
je 0x4a76dd
call esi
test eax, eax
je 0x4a76d4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a76d4
test byte [ebp - 0xc], 1
jne 0x4a76dd
or dword [ebp + 0x10], 0x200000
jmp 0x4a7716
mov eax, dword [0x53ae5c]
cmp eax, ebx
je 0x4a7716
push eax
call fcn.0049717e
pop ecx
test eax, eax
je 0x4a7716
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4a7716
mov eax, dword [0x53ae60]
cmp eax, ebx
je 0x4a7716
push eax
call fcn.0049717e
pop ecx
test eax, eax
je 0x4a7716
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x53ae58]
call fcn.0049717e
pop ecx
test eax, eax
je 0x4a7736
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a7738
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ac9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4f00a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], ecx
push 0x800
push 0
mov eax, dword [ebp - 0x6c]
add eax, 8
push eax
call fcn.004911c0
add esp, 0xc
push 0x20
mov ecx, dword [ebp - 0x6c]
add ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x20
mov edx, dword [ebp - 0x6c]
add edx, 0x30
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x80
mov eax, dword [ebp - 0x6c]
add eax, 0xc6
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x80
mov ecx, dword [ebp - 0x6c]
add ecx, 0x146
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x80
mov edx, dword [ebp - 0x6c]
add edx, 0x1c6
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x80
mov eax, dword [ebp - 0x6c]
add eax, 0x246
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x25
mov ecx, dword [ebp - 0x6c]
add ecx, 0x2c6
push ecx
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x25
mov edx, dword [ebp - 0x6c]
add edx, 0x2eb
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
push 0x25
mov eax, dword [ebp - 0x6c]
add eax, 0x310
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.004ac6c0
mov ecx, dword [ebp - 0x6c]
mov byte [ecx + 8], 2
mov edx, dword [ebp - 0x6c]
mov byte [edx + 0xe], 1
mov eax, dword [ebp - 0x6c]
mov byte [eax + 0x379], 1
push 5
mov ecx, dword [str.CD001]
push ecx
mov edx, dword [ebp - 0x6c]
add edx, 9
push edx
call fcn.00492030
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov byte [eax + 0x60], 0x25
mov ecx, dword [ebp - 0x6c]
mov byte [ecx + 0x61], 0x2f
mov edx, dword [ebp - 0x6c]
mov byte [edx + 0x62], 0x45
mov eax, dword [ebp - 0x6c]
mov byte [eax + 0xa4], 0x22
mov ecx, dword [ebp - 0x6c]
mov byte [ecx + 0xbd], 2
mov edx, dword [ebp - 0x6c]
mov byte [edx + 0xc4], 1
push 0x200
push 0x20
mov eax, dword [ebp - 0x6c]
add eax, 0x37b
push eax
call fcn.004911c0
add esp, 0xc
mov byte [ebp - 0x68], 0
mov byte [ebp - 0x67], 0x49
mov byte [ebp - 0x66], 0
mov byte [ebp - 0x65], 0x6e
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x63], 0x66
mov byte [ebp - 0x62], 0
mov byte [ebp - 0x61], 0x72
mov byte [ebp - 0x60], 0
mov byte [ebp - 0x5f], 0x61
mov byte [ebp - 0x5e], 0
mov byte [ebp - 0x5d], 0x52
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x5b], 0x65
mov byte [ebp - 0x5a], 0
mov byte [ebp - 0x59], 0x63
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x57], 0x6f
mov byte [ebp - 0x56], 0
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 0x64
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x51], 0x65
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4f], 0x72
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0x20
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x4b], 0x28
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x49], 0x43
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 0x29
mov byte [ebp - 0x46], 0
mov byte [ebp - 0x45], 0x20
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0x32
mov byte [ebp - 0x42], 0
mov byte [ebp - 0x41], 0x30
mov byte [ebp - 0x40], 0
mov byte [ebp - 0x3f], 0x30
mov byte [ebp - 0x3e], 0
invalid
inc ebp
Function at 0x4b2580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4f00a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
mov byte [eax], 0
push 0x17
push 0
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call fcn.004911c0
add esp, 0xc
push 8
push 0
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
call fcn.004911c0
add esp, 0xc
lea eax, [ebp - 2]
push eax
lea ecx, [ebp - 1]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004b1ef0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 4
ja case.default.0x4b25e2
mov eax, dword [ebp - 0x20]
jmp dword [eax*4 + 0x4b2730]
mov byte [ebp - 0x18], 0x2a
mov byte [ebp - 0x17], 0x49
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x66
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x72
push 0xe
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
add edx, 1
push edx
call fcn.00492030
add esp, 0xc
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
mov byte [eax + 0x18], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 2]
mov byte [edx + 0x19], al
jmp case.default.0x4b25e2
push 0xc
push str.UDF_LV_Info
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call fcn.00492030
add esp, 0xc
push 0x102
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
call fcn.004b8350
add esp, 8
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
mov byte [eax + 0x1a], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 2]
mov byte [edx + 0x1b], al
jmp case.default.0x4b25e2
push 0x13
push str.OSTA_UDF_Compliant
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call fcn.00492030
add esp, 0xc
push 0x102
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
call fcn.004b8350
add esp, 8
mov eax, dword [ebp + 8]
mov byte [eax + 0x1a], 3
mov ecx, dword [ebp + 8]
mov dl, byte [ebp - 2]
mov byte [ecx + 0x1b], dl
jmp case.default.0x4b25e2
push 0x10
push str.UDF_FreeEASpaceBEA01
mov eax, dword [ebp + 8]
add eax, 1
push eax
call fcn.00492030
add esp, 0xc
push 0x102
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
call fcn.004b8350
add esp, 8
jmp case.default.0x4b25e2
push 0x12
push str.UDF_DVD_CGMS_Info
mov edx, dword [ebp + 8]
add edx, 1
push edx
call fcn.00492030
add esp, 0xc
push 0x102
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
call fcn.004b8350
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004911aa
mov esp, ebp
pop ebp
ret 8
Function at 0x4bcc80
Capabilities:
Encrypt data using rc4 prga
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.00402780
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.ckcore::CrcStream.0
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 4], 1
mov edx, dword [ebp - 0x18]
mov byte [edx + 5], 0x20
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0xc], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x10], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], 0xffffffff
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x4c11db7
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x4bccf2
cmp dword [ebp - 0x1c], 2
je 0x4bcd20
jmp 0x4bcd53
mov dword [ebp - 0xc], 0x8005
mov edx, dword [ebp - 0x18]
mov byte [edx + 5], 0x10
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xc], 0xffff
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], 0xffff
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x14], 0xffff
jmp 0x4bcd53
mov dword [ebp - 0xc], 0x1021
mov eax, dword [ebp - 0x18]
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 5], 0x10
mov edx, dword [ebp - 0x18]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x18]
movzx ecx, byte [edx + 5]
sub ecx, 1
mov eax, 1
shl eax, cl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
lea edx, [ecx + ecx - 2]
or edx, 1
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], edx
mov dword [ebp - 0x10], 0
jmp 0x4bcd89
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x100
jge 0x4bce45
mov edx, dword [ebp - 0x18]
movzx eax, byte [edx + 4]
test eax, eax
je 0x4bcdb4
push 8
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.004bcc20
mov dword [ebp - 0x20], eax
jmp 0x4bcdba
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 5]
sub ecx, 8
mov edx, dword [ebp - 0x20]
shl edx, cl
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0
jmp 0x4bcdde
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 8
jge 0x4bce03
mov ecx, dword [ebp - 8]
and ecx, dword [ebp - 4]
je 0x4bcdf9
mov edx, dword [ebp - 8]
shl edx, 1
xor edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
jmp 0x4bce01
mov eax, dword [ebp - 8]
shl eax, 1
mov dword [ebp - 8], eax
jmp 0x4bcdd5
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ecx + 4]
test edx, edx
je 0x4bce27
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 5]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.004bcc20
mov dword [ebp - 0x24], eax
jmp 0x4bce2d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
and edx, dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + eax*4 + 0x18], edx
jmp 0x4bcd80
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x4bd030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
call fcn.004be530
mov ecx, eax
call fcn.00401430
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4bd066
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x4bd066
mov dword [ebp - 8], 1
jmp 0x4bd06d
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4bd0b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.004be530
mov ecx, eax
call fcn.00401430
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4bd0e9
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x4bd0e9
mov dword [ebp - 0xc], 1
jmp 0x4bd0f0
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4bd500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2fb1
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x4f00a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x21c]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4bd554
xor ecx, ecx
mov word [ebp - 0x21c], cx
lea edx, [ebp - 0x424]
push edx
push 0
push 0x4de600
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4bd5c7
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.file
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.0049282b
push eax
call fcn.004bdd10
add esp, 4
push eax
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str..tmp
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004be890
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004be1d0
add esp, 4
movzx edx, al
test edx, edx
je 0x4bd5fc
lea eax, [ebp - 0x2c]
push eax
call fcn.004be1a0
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004bd440
mov edx, dword [ebp - 0x428]
or edx, 1
mov dword [ebp - 0x428], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004be590
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004911aa
mov esp, ebp
pop ebp
ret
Function at 0x4bd650
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2ff4
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x4f00a8]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3c]
call fcn.00402cb0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004be540
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004be750
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x10], edx
jmp 0x4bd6c1
push 0
lea ecx, [ebp - 0x1c]
call fcn.004be770
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004be570
push eax
lea ecx, [ebp - 0x1c]
call fcn.004beaf0
movzx ecx, al
test ecx, ecx
je 0x4bd7df
lea edx, [ebp - 0x78]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004be8b0
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 1
push 0x4dd5f4
mov ecx, dword [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x94]
push edx
call fcn.00405520
add esp, 0xc
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004013a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x94]
call fcn.00401360
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.00401360
lea ecx, [ebp - 0x3c]
call fcn.00401430
push eax
lea ecx, [ebp - 0xb4]
call fcn.004be890
lea edx, [ebp - 0xb4]
push edx
call fcn.004bd030
add esp, 4
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x95], al
lea ecx, [ebp - 0xb4]
call fcn.004be590
movzx ecx, byte [ebp - 0x95]
test ecx, ecx
je 0x4bd7da
push 0
lea ecx, [ebp - 0x3c]
call fcn.00401430
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4bd7da
mov byte [ebp - 0xb5], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401360
mov al, byte [ebp - 0xb5]
jmp 0x4bd7fb
jmp 0x4bd6b7
mov byte [ebp - 0xb6], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401360
mov al, byte [ebp - 0xb6]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004911aa
mov esp, ebp
pop ebp
ret

Function at 0x4bdd40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
jne 0x4bdd59
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x4bdd8d
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4bdd88
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x4bdd8d
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bdda0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
jne 0x4bddb9
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x4bdded
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4bdde8
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x4bdded
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret 8

Function at 0x4bdf80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
push 0x20
push 3
push 0
push 3
push SHChangeNotifyDeregister
mov ecx, dword [ebp + 8]
call fcn.004be530
mov ecx, eax
call fcn.00401430
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4bdfba
xor eax, eax
xor edx, edx
jmp 0x4be00d
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4bdff1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4bdff1
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x4be00d
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4be020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.004be530
mov ecx, eax
call fcn.00401430
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4be047
xor al, al
jmp 0x4be053
mov eax, dword [ebp - 4]
and eax, 2
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x4be1d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
call fcn.004be530
mov ecx, eax
call fcn.00401430
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4be206
mov eax, dword [ebp - 4]
and eax, 0x10
jne 0x4be206
mov dword [ebp - 8], 1
jmp 0x4be20d
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret