joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c46d0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x24c
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c4705
mov ecx, dword [ebp - 4]
add ecx, 0x24c
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret

Function at 0x4c4d40
Capabilities:
Check if file exists
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x438], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x214], 0x208
mov ecx, dword [ebp - 0x438]
add ecx, 0x13c
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c4dbd
mov ecx, dword [ebp - 0x438]
add ecx, 0x13c
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 4]
push ecx
push str.Skin
push 0x53789c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c4f4b
lea edx, [ebp - 0x210]
push edx
push 0x5378cc
mov eax, dword [ebp - 0x438]
add eax, 0x244
push eax
call fcn.0043dc90
add esp, 0xc
push 2
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x438]
add ecx, 0x244
call fcn.00475580
push 0x5378d4
lea ecx, [ebp - 0x218]
call fcn.0043cbd0
test eax, eax
jne 0x4c4e4b
mov edx, dword [ebp - 0x438]
mov dword [edx], 1
jmp 0x4c4f40
mov eax, dword [ebp - 0x438]
mov dword [eax], 0
push 0x5378dc
lea ecx, [ebp - 0x21c]
call fcn.0043caa0
push str.default
mov ecx, dword [ebp - 0x438]
add ecx, 0x244
call fcn.0043cbd0
test eax, eax
je 0x4c4f0e
xor ecx, ecx
mov word [ebp - 0x428], cx
push 0x206
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 0x42c], 0x208
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 4]
push edx
push str.skinurl
push str.SOFTWARE360SafeTheme
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c4f0e
lea eax, [ebp - 0x428]
push eax
push 0x537930
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0043dc90
add esp, 0xc
push ecx
mov ecx, esp
lea edx, [ebp - 0x21c]
push edx
call fcn.0043ca80
mov ecx, dword [ebp - 0x438]
call fcn.004c4f60
push ecx
mov ecx, esp
lea eax, [ebp - 0x21c]
push eax
call fcn.0043ca80
mov ecx, dword [ebp - 0x438]
call fcn.004c4f60
mov ecx, dword [ebp - 0x438]
mov dword [ecx + 4], 1
lea ecx, [ebp - 0x21c]
call fcn.0043cae0
lea ecx, [ebp - 0x218]
call fcn.0043cae0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x4c50c0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 4]
add ecx, 0x24c
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c5108
mov ecx, dword [ebp - 4]
add ecx, 0x24c
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret

Function at 0x4c5230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x214]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4c52e3
mov dword [ebp - 0x220], 0x208
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
push 0x5379f4
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043caa0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x4cea80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x14
call fcn.004ecc6b
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ceaad
mov ecx, dword [ebp - 0x18]
call fcn.004ce9f0
mov dword [ebp - 0x1c], eax
jmp 0x4ceab4
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ceb3d
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
call fcn.004d14d0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0043cb20
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0x4ce990
call fcn.004f28a2
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4ceb35
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4ceb23
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp 0x4ceb35
lea ecx, [ebp - 0xc]
call fcn.004d1530
mov edx, dword [ebp - 8]
mov dword [edx + 8], 1
lea ecx, [ebp - 0xc]
call fcn.004d14f0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4cee70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0xc], eax
call fcn.004d0940
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cee98
xor eax, eax
jmp 0x4cefb4
mov ecx, dword [ebp - 4]
call fcn.004d0bb0
test eax, eax
je 0x4ceeae
mov eax, 1
jmp 0x4cefb4
mov dword [ebp - 8], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004ed5e0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x537d10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cef8b
lea edx, [ebp - 0x21c]
push edx
call fcn.004d0d70
add esp, 4
mov ecx, eax
call fcn.0043cc50
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0049bd40
lea ecx, [ebp - 0x21c]
call fcn.0043cae0
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cef8b
push str.360NetBase.dll
lea edx, [ebp - 0x220]
push edx
call fcn.004d0d10
add esp, 8
mov ecx, eax
call fcn.0043cc50
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0049bd40
lea ecx, [ebp - 0x220]
call fcn.0043cae0
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004d0bd0
test eax, eax
je 0x4cefb1
mov ecx, dword [ebp - 4]
call fcn.004d0bb0
test eax, eax
je 0x4cefb1
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x4cfed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x130], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4d0066
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x130]
cmp dword [ecx + 0xc], 0
je 0x4d005c
mov edx, dword [ebp - 0x130]
cmp dword [edx + 0x10], 8
jbe 0x4d005c
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 8
mov dword [ebp - 0x10], edx
mov eax, dword [str._r_n_r_n]
mov dword [ebp - 0x128], eax
mov cl, byte [0x537d5c]
mov byte [ebp - 0x124], cl
push 0xff
push 0
lea edx, [ebp - 0x123]
push edx
call fcn.004ed5e0
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
call fcn.004ee2e0
add esp, 4
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov ecx, 1
test ecx, ecx
je 0x4d0015
mov edx, dword [ebp - 0x10]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x18]
movsx edx, byte [ebp + ecx - 0x128]
cmp eax, edx
jne 0x4cffeb
mov eax, dword [ebp - 0x12c]
sub eax, 1
cmp dword [ebp - 0x18], eax
jg 0x4cffeb
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4d0013
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x12c]
jge 0x4d0011
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x4d0013
jmp 0x4d0015
jmp 0x4cffa2
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov edx, dword [ebp - 0x130]
mov eax, dword [edx + 0x10]
sub eax, ecx
mov dword [ebp - 0x14], eax
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x130]
mov eax, dword [edx + 0x10]
xor ecx, ecx
cmp eax, dword [ebp - 0xc]
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret 4
Function at 0x4d00b0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x33c]
mov edx, dword [ecx + 4]
push edx
call fcn.004d13b0
add esp, 8
cmp dword [ebp - 8], 0
je 0x4d0269
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x33c]
call fcn.004d0080
test eax, eax
jne 0x4d0119
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jbe 0x4d0125
mov dword [ebp - 4], 0
jmp 0x4d0269
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call fcn.004ed5e0
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x338]
push edx
call fcn.004ed5e0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0xffffffff
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx + 4]
push eax
call fcn.004d1370
add esp, 0x14
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x4d01e9
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx + 4]
push eax
call fcn.004d13b0
add esp, 8
jmp 0x4d00ec
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0x186a0
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x22c]
add edx, 1
push edx
call sub.WS2_32.dll_select
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffff
je 0x4d0245
jmp 0x4d0247
jmp 0x4d0264
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx + 4]
push eax
call fcn.004d13b0
add esp, 8
mov dword [ebp - 4], 1
jmp 0x4d00ec
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4d0db0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], 0
movzx eax, word [0x566aa0]
test eax, eax
jne 0x4d0f26
push 0x104
push 0x566aa0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0xc], eax
push 0x5c
push 0x566aa0
call fcn.004d0f40
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d0e04
xor edx, edx
mov eax, dword [ebp - 4]
mov word [eax + 2], dx
push str.360sd.exe
lea ecx, [ebp - 8]
call fcn.0043caa0
cmp dword [ebp + 0xc], 0
jne 0x4d0e4b
lea ecx, [ebp - 8]
push ecx
push 0x566aa0
lea edx, [ebp - 0x18]
push edx
call fcn.0049e1d0
add esp, 0xc
or dword [ebp - 0x24], 1
mov ecx, eax
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d0e4b
mov dword [ebp - 0x28], 1
jmp 0x4d0e52
mov dword [ebp - 0x28], 0
mov al, byte [ebp - 0x28]
mov byte [ebp - 0x11], al
mov ecx, dword [ebp - 0x24]
and ecx, 1
je 0x4d0e6c
and dword [ebp - 0x24], 0xfffffffe
lea ecx, [ebp - 0x18]
call fcn.0043cae0
movzx edx, byte [ebp - 0x11]
test edx, edx
je 0x4d0f1e
lea eax, [ebp - 0x10]
push eax
call fcn.004d0f60
add esp, 4
lea ecx, [ebp - 0x10]
call fcn.0043cc80
test eax, eax
jle 0x4d0ed2
lea ecx, [ebp - 0x10]
call fcn.0043cc80
cmp eax, 0x104
jge 0x4d0ed2
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00468a30
add esp, 0xc
or dword [ebp - 0x24], 2
mov ecx, eax
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d0ed2
mov dword [ebp - 0x2c], 1
jmp 0x4d0ed9
mov dword [ebp - 0x2c], 0
mov cl, byte [ebp - 0x2c]
mov byte [ebp - 0x19], cl
mov edx, dword [ebp - 0x24]
and edx, 2
je 0x4d0ef3
and dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0x20]
call fcn.0043cae0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x4d0f16
push 0x103
lea ecx, [ebp - 0x10]
call fcn.0043cc50
push eax
push 0x566aa0
call fcn.004eeac7
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0043cae0
lea ecx, [ebp - 8]
call fcn.0043cae0
push 0x566aa0
mov ecx, dword [ebp + 8]
call fcn.0043caa0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4d0f60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x224], 0x208
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x214]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x4d1057
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
push str.Path
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x210]
push edx
call fcn.004ecf28
add esp, 4
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jbe 0x4d1057
mov eax, dword [ebp - 0x224]
movzx ecx, word [ebp + eax*2 - 0x212]
cmp ecx, 0x5c
je 0x4d1057
mov edx, 0x5c
mov eax, dword [ebp - 0x224]
mov word [ebp + eax*2 - 0x210], dx
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x218]
call fcn.0043caa0
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043ca80
lea ecx, [ebp - 0x218]
call fcn.0043cae0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x4de910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 0x53817c
mov eax, dword [ebp + 8]
push eax
call fcn.004f1a90
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4de93b
or eax, 0xffffffff
jmp 0x4dea36
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x2c0]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004ef27a
add esp, 0xc
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x2d4], 0
je 0x4de984
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x2d4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004e9596
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x2d4], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x2bc], 0
ja 0x4de9a4
mov ecx, dword [ebp - 4]
push ecx
call fcn.004eec8f
add esp, 4
or eax, 0xffffffff
jmp 0x4dea36
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x2bc]
push eax
call fcn.004e68e6
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x2d4], edx
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x2bc]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x2d4]
push ecx
call fcn.004eefc8
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.004eec8f
add esp, 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x2d4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x2014b50
jne 0x4dea0e
xor eax, eax
jmp 0x4dea36
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x2d4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004e9596
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x2d4], 0
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 4
Function at 0x4df8f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa024
call fcn.004ed7c0
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xa024], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004ef182
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 2
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ef27a
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.004ef182
add esp, 4
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ef27a
add esp, 0xc
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x14]
jae 0x4df9f9
mov eax, dword [ebp + 8]
push eax
push 0xa000
push 1
lea ecx, [ebp - 0xa020]
push ecx
call fcn.004eefc8
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4df990
jmp 0x4df9f9
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
push eax
call fcn.004ef182
add esp, 4
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ef27a
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0xa020]
push edx
call fcn.004f1372
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.004ef182
add esp, 4
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ef27a
add esp, 0xc
jmp 0x4df95f
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4dfa90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x5381a0
mov eax, dword [ebp + 8]
push eax
call fcn.004f1a90
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4dfabb
or eax, 0xffffffff
jmp 0x4dfb86
push 0x16
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x2b0
push ecx
call fcn.004ed5e0
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x2b0], 0x6054b50
mov eax, dword [ebp - 8]
push eax
push 1
push 0x16
mov ecx, dword [ebp - 0xc]
add ecx, 0x2b0
push ecx
call fcn.004f1372
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.004eec8f
add esp, 4
cmp dword [ebp + 0xc], 0
jne 0x4dfb0e
xor eax, eax
jmp 0x4dfb86
mov eax, dword [ebp + 8]
push eax
push 0x5381a4
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
push ecx
call fcn.004f25ef
add esp, 0xc
push 0x5381a8
mov edx, dword [ebp + 0xc]
push edx
call fcn.004f1a90
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4dfb45
or eax, 0xffffffff
jmp 0x4dfb86
mov eax, dword [ebp + 0xc]
push eax
push 0x5381ac
mov ecx, dword [ebp - 0xc]
add ecx, 0x138
push ecx
call fcn.004f25ef
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.004eec8f
add esp, 4
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.004df0f0
movzx eax, al
neg eax
sbb eax, eax
neg eax
sub eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4dfc60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x148], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x140]
push ecx
call fcn.004f25ef
add esp, 8
lea edx, [ebp - 0x140]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x144], eax
push 0x5c
mov ecx, dword [ebp - 4]
push ecx
call fcn.004dfe80
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4dfd0e
lea edx, [ebp - 0x14]
cmp dword [ebp - 8], edx
jae 0x4dfd0e
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4dfcec
push 0
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4dfcec
xor eax, eax
jmp 0x4dfd13
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov byte [ecx], 0x5c
push 0x5c
mov edx, dword [ebp - 4]
push edx
call fcn.004dfe80
add esp, 8
mov dword [ebp - 8], eax
jmp 0x4dfcaf
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret 4