joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46da43
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x46dad0
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004eff60
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x46da90
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x46dab2
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x46db8f
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x46daf8
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x46db03
xor eax, eax
jmp 0x46db50
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x46db21
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.004712a8
pop ecx
jmp 0x46db34
cmp ecx, 2
jne 0x46db3a
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.0046f83e
add esp, 0xc
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.004eff60
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x46db7b
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x46db8f
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x46da4e
pop edi
pop ebx
leave
ret
Function at 0x472fc1
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x472fe0
test byte [ebp - 4], 7
je 0x472fe0
xor eax, eax
inc eax
jmp 0x472fe5
call fcn.00472f4e
leave
ret 4
Function at 0x4745dd
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x5209fc
call fcn.0051f0b4
sub esp, 0x428
mov eax, dword [0x56e8f8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
cmp eax, 0xffffffff
je 0x474652
cmp eax, edi
jl 0x47462d
cmp eax, 1
jae 0x47462d
lea ecx, [ebp - 0x14]
push ecx
push 0x547ccc
push 0x17
shl eax, 4
push edi
add eax, 0x5472a8
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x47462d
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
neg eax
sbb eax, eax
pop edi
and eax, 0x7fffbffb
pop esi
add eax, 0x80004005
mov dword fs:[0], ecx
pop ebx
leave
ret
mov dword [0x56e8f8], 0xfffffffe
mov dword [ebp - 0x1c], 6
cmp dword [ebp - 0x1c], edi
jl 0x47462d
cmp dword [ebp - 0x1c], 6
je 0x4746fc
mov esi, 0x410
push esi
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x1c]
push dword [eax*4 + 0x5472b8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
je 0x4747ca
cmp eax, esi
ja 0x4747ca
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x4747ca
push str.DllRegisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
jne 0x4746d5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4747ca
mov dword [ebp - 4], 2
call eax
cmp eax, edi
push esi
jge 0x4746f2
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or dword [ebp - 4], 0xffffffff
jmp 0x4747ca
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], edi
jl 0x4747b8
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
mov ebx, 0x547ccc
push ebx
push 0x17
shl esi, 4
push edi
mov dword [ebp - 4], 4
mov edi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea esi, [esi + 0x5472a8]
push esi
call edi
test eax, eax
jge 0x474769
and dword [ebp - 0x14], 0
cmp eax, 0x800401f0
je 0x47462d
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x18]
xor edi, edi
jmp 0x474702
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push str._doc__test_test__test___doc_
push eax
call dword [ecx + 0x104]
test eax, eax
jl 0x4747d2
cmp word [ebp - 0x20], 0
je 0x4747d2
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x14], 0
mov dword [0x56e8f8], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x17
push 0
push esi
call edi
test eax, eax
jge 0x4747b2
and dword [ebp - 0x14], 0
or dword [ebp - 4], 0xffffffff
xor edi, edi
cmp dword [ebp - 0x14], edi
jne 0x47462d
cmp dword [ebp - 0x24], edi
jne 0x47462d
dec dword [ebp - 0x1c]
jmp 0x474663
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x14], 0
jmp 0x474747
Function at 0x4768a3
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4768cb
push 5
pop eax
jmp 0x47694b
push edi
mov edi, esi
call fcn.00487b82
test eax, eax
jne 0x4768dc
push 6
pop eax
jmp 0x47694a
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push 8
mov edx, esi
pop eax
call section..text
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x476948
push 2
push 0x5437ac
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x476948
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x476948
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
xor ecx, ecx
shl eax, 0x14
cmp edx, ecx
ja 0x476948
jb 0x476945
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
jae 0x476948
push 7
pop ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x477413
Capabilities:
Delete file

Disassembly:
mov eax, 0x522c9d
call fcn.0051f0b4
push ecx
push ebx
push esi
and dword [ebp - 4], 0
push 0x5c
lea esi, [ebp + 8]
call fcn.004116a7
lea ebx, [ebp - 0x10]
mov ecx, esi
call fcn.00404af0
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00404918
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040297c
mov eax, dword [edi + 0xc8]
mov esi, 0x537290
test eax, eax
je 0x47746a
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
jmp 0x47746c
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x477492
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x477489
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
jmp 0x47748b
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [edi]
shrd ecx, edx, 0x14
push ecx
push dword [ebp + 8]
shr edx, 0x14
push edi
call dword [eax + 0x68]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040297c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x4774c8
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov eax, 0x522c9d
call fcn.0051f0b4
push ecx
push esi
push edi
and dword [ebp - 4], 0
mov edi, 0x56e8fc
mov esi, dword [edi]
push 0x56f16c
lea ecx, [ebp - 0x10]
call fcn.00402946
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004142e8
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x477524
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x477524
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.0040297c
add edi, 4
cmp edi, 0x56e908
jl 0x4774de
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4790e2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa28
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x820], ax
xor edi, edi
lea eax, [ebp - 0x81e]
push edi
push eax
call fcn.004ee670
xor eax, eax
push esi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push edi
push eax
call fcn.004ee670
xor eax, eax
push esi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.004ee670
xor eax, eax
push esi
mov word [ebp - 0x618], ax
lea eax, [ebp - 0x616]
push edi
push eax
call fcn.004ee670
xor eax, eax
push esi
mov word [ebp - 0xa28], ax
lea eax, [ebp - 0xa26]
push edi
push eax
call fcn.004ee670
push ebx
add esi, 2
push str._s._hd
mov eax, esi
lea edi, [ebp - 0x820]
call fcn.00445e60
add esp, 0x44
push ebx
push str._s._qd
mov eax, esi
lea edi, [ebp - 0x410]
call fcn.00445e60
push ebx
push str._s.p2s
mov eax, esi
lea edi, [ebp - 0x618]
call fcn.00445e60
push ebx
push 0x547a18
mov eax, esi
lea edi, [ebp - 0x208]
call fcn.00445e60
push ebx
push str._s.p2p
mov eax, esi
lea edi, [ebp - 0xa28]
call fcn.00445e60
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
push ebx
call esi
test eax, eax
jne 0x479226
lea eax, [ebp - 0x820]
push eax
call esi
test eax, eax
jne 0x479226
lea eax, [ebp - 0x410]
push eax
call esi
test eax, eax
jne 0x479226
lea eax, [ebp - 0x618]
push eax
call esi
test eax, eax
jne 0x479226
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
jne 0x479226
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
jne 0x479226
mov eax, edi
push eax
call esi
test eax, eax
je 0x479229
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x47e0b5
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
xor ebx, ebx
mov ebp, 0xa00000
cmp dword [esi + 0x264], ebx
jne 0x47e0fc
push str.iAppleIniMD9420448_500A_4618_B675_8DD99A6D2B84
push ebp
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x264], eax
cmp eax, ebx
jne 0x47e0e9
xor eax, eax
jmp 0x47e146
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47e0fc
mov dword [esi + 0x270], ebx
push edi
lea edi, [esi + 0x268]
cmp dword [edi], ebx
jne 0x47e121
push ebp
push ebx
push ebx
push 0xf001f
push dword [esi + 0x264]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
cmp eax, ebx
je 0x47e13e
add esi, 0x26c
cmp dword [esi], ebx
jne 0x47e142
push str.iAppleIniEvectMB56D843B_0ABE_4f87_9BB5_0C93278C9E3B
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
cmp eax, ebx
jne 0x47e142
xor eax, eax
jmp 0x47e145
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47fd55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
xor edi, edi
inc edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x47fd89
xor eax, eax
jmp 0x47fe18
xor ecx, ecx
push ebx
mov word [esp + 0x24], cx
lea ecx, [esp + 0x14]
push ecx
push 6
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], ebx
mov word [esp + 0x38], si
mov word [esp + 0x36], di
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47fe0a
cmp dword [esp + 0x10], 6
jne 0x47fe0a
mov eax, esi
shl eax, 4
add eax, 6
xor edi, edi
cmp esi, ebx
mov dword [esp + 0x1c], eax
jle 0x47fe0a
mov dword [esp + 0xc], 6
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x10]
mov eax, dword [ebp + 8]
push dword [eax + edi*4]
push dword [esp + 0x20]
call fcn.0047fad1
add esp, 0x10
test eax, eax
je 0x47fe06
add dword [esp + 0xc], 0x10
inc edi
cmp edi, esi
jl 0x47fddb
jmp 0x47fe0a
mov dword [esp + 0x18], ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48029b
Capabilities:
Create thread

Disassembly:
push ebx
push edi
xor edi, edi
cmp dword [esi + 0xc], edi
je 0x4802a9
cmp dword [esi + 8], edi
jne 0x4802fa
cmp dword [esi + 0x10], edi
jne 0x4802c4
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x10], eax
cmp eax, edi
jne 0x4802c4
xor eax, eax
jmp 0x480335
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi + 0xc], edi
jne 0x4802e2
push edi
push edi
push esi
push 0x480271
push edi
push edi
call ebx
mov dword [esi + 0xc], eax
cmp eax, edi
je 0x4802c0
cmp dword [esi + 8], edi
jne 0x4802fa
push edi
push edi
push esi
push 0x480286
push edi
push edi
call ebx
mov dword [esi + 8], eax
cmp eax, edi
je 0x4802c0
mov ebx, dword [esp + 0xc]
cmp dword [ebx], 1
jne 0x480318
lea edi, [esi + 0xb0]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x90]
jmp 0x480325
lea edi, [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x38]
push ebx
call fcn.00482b72
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc eax
pop edi
pop ebx
ret 4
Function at 0x480c78
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
je 0x480dab
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x480dab
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
push ebx
mov byte [ebp - 4], bl
lea edi, [ebp - 3]
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
je 0x480da2
cmp dword [ebp - 0x14], 2
jne 0x480da2
push 2
lea edx, [ebp - 0xc]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], ebx
call fcn.0047f674
pop ecx
test eax, eax
je 0x480da2
cmp dword [ebp - 0xc], 1
je 0x480d81
jle 0x480d95
cmp dword [ebp - 0xc], 3
jg 0x480d95
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x480d95
push dword [ebp - 0x10]
call fcn.004e7db0
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x480d95
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x480d76
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x480d76
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x14], edi
jne 0x480d76
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.004814ae
mov ebx, eax
push dword [ebp + 0xc]
call fcn.004e93ab
pop ecx
jmp 0x480d95
push 0x2010
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x480dad
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x484d89
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.00401f01
push 0x56f16c
lea ecx, [ebp - 8]
call fcn.00402946
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x484dd6
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.0040297c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x484e13
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.0040297c
mov eax, esi
jmp 0x484dcf
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
mov edi, eax
push 0x1000
lea ebx, [edi + 1]
push ebx
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp + 0xc], eax
cmp eax, esi
je 0x484f10
push ebx
push esi
push eax
call fcn.004ee670
add esp, 0xc
push esi
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x484f10
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp dword [ebp + 0x10], esi
jne 0x484e75
add ecx, 0x1068
jmp 0x484e7b
add ecx, 0x20cc
call fcn.00435445
lea edi, [ebp - 0x14]
call fcn.00464bc1
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push esi
push dword [ebp + 0xc]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc eax
push eax
push dword [ebp + 0xc]
push esi
push 0xfde9
call ebx
mov esi, dword [ebp - 0x14]
mov ecx, eax
mov dword [ebp - 0x18], ecx
test esi, esi
je 0x484ec3
mov eax, dword [esi]
add ecx, 2
push ecx
push esi
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x18]
jmp 0x484ec5
xor eax, eax
add ecx, 2
push ecx
push eax
push dword [ebp + 0xc]
call edi
inc eax
push eax
push dword [ebp + 0xc]
push 0
push 0xfde9
call ebx
test esi, esi
je 0x484ee7
mov eax, dword [esi]
push esi
call dword [eax + 0x24]
push dword [ebp + 0x10]
push ecx
mov eax, esp
mov dword [ebp + 0x10], esp
mov dword [eax], esi
test esi, esi
je 0x484efc
mov eax, dword [esi]
push esi
call dword [eax + 4]
push dword [ebp + 8]
call fcn.004849d5
test esi, esi
je 0x484f0e
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor esi, esi
push 0x8000
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
jmp 0x484df9
Function at 0x48793b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x567570]
xor eax, ebp
mov dword [ebp + 0x94], eax
push esi
mov esi, 0x114
push esi
lea eax, [ebp - 0x80]
push 0
push eax
mov byte [edi], 0
call fcn.004ee670
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x70], 1
jne 0x487989
push edi
call fcn.00487757
jmp 0x487995
cmp dword [ebp - 0x70], 2
jne 0x4879ad
push edi
call fcn.0048751a
pop ecx
test al, al
je 0x4879af
mov ecx, edi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x48799f
sub ecx, esi
cmp ecx, 5
jae 0x4879af
xor al, al
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
pop esi
call fcn.004ee5a2
add ebp, 0x98
leave
ret

Function at 0x4879c5
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x567570]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call esi
test eax, eax
jne 0x4879f4
inc eax
jmp 0x487a8b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call ebx
test eax, eax
jne 0x487a87
push 0x208
push eax
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push eax
call fcn.004ee670
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov edx, edi
mov eax, 0x20a
call section..text
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x5480bc
lea eax, [ebp - 0x80]
call fcn.0048907a
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x80]
call fcn.0048907a
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
je 0x487a63
lea eax, [ebp - 0x80]
push eax
call ebx
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, 1
jne 0x487a83
push 4
push 0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x487a8a
xor eax, eax
jmp 0x487a8a
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.004ee5a2
add ebp, 0x190
leave
ret
Function at 0x487aa1
Capabilities:
Get disk information

Disassembly:
push ebp
sub esp, 0x190
lea ebp, [esp - 4]
mov eax, dword [0x567570]
xor eax, ebp
mov dword [ebp + 0x190], eax
push 0xc
mov eax, 0x5232e3
call fcn.004f301b
mov eax, dword [ebp + 0x19c]
xor edi, edi
mov dword [ebp - 4], edi
mov esi, 0xc8
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp]
mov ebx, ecx
push edi
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
call fcn.004ee670
push esi
lea eax, [ebp + 0xc8]
push edi
push eax
call fcn.004ee670
add esp, 0x18
push 0x56f16c
mov ecx, ebx
call fcn.00402946
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
push 3
pop eax
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x18], 1
call fcn.00404af0
push esi
lea eax, [ebp + 0xc8]
push eax
push edi
push edi
push edi
push esi
lea eax, [ebp]
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x487b54
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0xc8]
push eax
call fcn.00401ed2
lea ecx, [esi - 0x10]
call fcn.0040297c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.004ee5a2
add ebp, 0x194
leave
ret

Function at 0x487c9a
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xc
mov eax, 0x5232a7
call fcn.004f301b
mov edi, ecx
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x487cad
sub eax, edx
sar eax, 1
test edi, edi
je 0x487dbe
test eax, eax
je 0x487dbe
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x487cde
xor eax, eax
inc eax
jmp 0x487dc0
mov esi, 0x56f16c
push esi
lea ecx, [ebp - 0x10]
call fcn.00402946
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x14]
call fcn.00402946
push edi
lea eax, [ebp - 0x10]
push 0x53f368
push eax
mov byte [ebp - 4], 1
call fcn.004142e8
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 0xc]
lea ecx, [eax - 1]
add esp, 0xc
test ecx, ecx
jl 0x487dde
cmp ecx, eax
jg 0x487dde
movzx eax, word [edi + ecx*2]
cmp ax, 0x5c
je 0x487d42
push 0x53f8bc
lea ecx, [ebp - 0x10]
call fcn.004143bd
mov edi, dword [ebp - 0x10]
push 0x5c
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.0043f2b9
mov esi, eax
cmp esi, 0xffffffff
je 0x487dc6
mov eax, esi
lea ebx, [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.00404af0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00404918
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040297c
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x487d98
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x487dae
lea ecx, [esi + 1]
push 0x5c
lea esi, [ebp - 0x10]
call fcn.0043f2b9
mov esi, eax
cmp esi, 0xffffffff
jne 0x487d55
jmp 0x487dc9
lea ecx, [ebx - 0x10]
call fcn.0040297c
lea ecx, [edi - 0x10]
call fcn.0040297c
xor eax, eax
call fcn.004f30ba
ret
mov ebx, dword [ebp - 0x14]
lea ecx, [ebx - 0x10]
call fcn.0040297c
lea ecx, [edi - 0x10]
call fcn.0040297c
jmp 0x487cd6
push 0x80070057
call fcn.00402afe
int3