joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6ed4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebx], esi
je 0x4c6fa1
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 7
mov dword [ebx + 4], eax
jne 0x4c6fa1
mov eax, dword [ebp - 4]
xor ecx, ecx
push edi
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004cdcd1
mov edi, eax
pop ecx
test edi, edi
je 0x4c6f33
xor eax, eax
mov word [edi], ax
jmp 0x4c6f35
mov edi, esi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4c6f95
push edi
call fcn.004cde96
mov ebx, eax
mov eax, edi
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.004a6716
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
call fcn.004caade
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004a7be5
inc ebx
add esi, ebx
lea eax, [edi + esi*2]
push eax
call fcn.004cde96
mov ebx, eax
lea eax, [edi + esi*2]
pop ecx
test ebx, ebx
jg 0x4c6f5c
xor esi, esi
inc esi
test edi, edi
je 0x4c6fa0
push edi
call fcn.004cdcda
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c7624
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x54e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x254], 0
push ebx
push esi
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x18]
push 0x24c
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x268], edi
call fcn.004ce800
add esp, 0xc
lea ecx, [ebp - 0x260]
push edi
call fcn.004a6716
call fcn.004a7279
push eax
lea ecx, [ebp - 0x258]
call fcn.004a6656
push 0x529f0c
mov esi, 0x104
lea ecx, [ebp - 0x260]
push esi
call fcn.004a7abd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x260]
call fcn.004ad5d5
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c7710
mov esi, dword [ebp - 0x258]
lea ecx, [esi - 0x10]
call fcn.004a7be5
mov ecx, dword [ebp - 0x260]
lea ecx, [ecx - 0x10]
call fcn.004a7be5
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ce7ef
mov esp, ebp
pop ebp
ret
mov esi, 0x104
push edi
lea ecx, [ebp - 0x258]
call fcn.004a7d2e
lea eax, [ebp - 0x228]
push eax
push esi
lea ecx, [ebp - 0x258]
call fcn.004a7abd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x258]
call fcn.004ad5d5
push dword [ebp - 0x264]
lea ecx, [ebp - 0x25c]
call fcn.004a6716
lea eax, [ebp - 0x228]
push eax
push esi
lea ecx, [ebp - 0x25c]
call fcn.004a7abd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x25c]
call fcn.004ad5d5
test byte [ebp - 0x254], 0x10
mov esi, dword [ebp - 0x258]
mov edi, dword [ebp - 0x25c]
je 0x4c780d
lea eax, [ebp - 0x228]
push 0x525680
push eax
call fcn.004cde58
pop ecx
pop ecx
test eax, eax
je 0x4c77cf
lea eax, [ebp - 0x228]
push 0x52566c
push eax
call fcn.004cde58
pop ecx
pop ecx
test eax, eax
je 0x4c77cf
mov eax, dword [ebp - 0x254]
mov ecx, 0x410
and eax, ecx
cmp eax, ecx
jne 0x4c77da
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
jmp 0x4c7828
cmp dword [ebp + 0x10], 0
je 0x4c7825
push edi
call fcn.004c2b89
pop ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4c7825
push dword [ebp - 0x270]
push dword [ebp - 0x26c]
push dword [ebp + 0x10]
push edi
push esi
call fcn.004c7624
add esp, 0x14
jmp 0x4c7825
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4c7825
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [edi - 0x10]
call fcn.004a7be5
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [ebp - 0x268]
test eax, eax
jne 0x4c770b
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4c76e2
Function at 0x4c7855
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x54]
push 0x40
push edi
push eax
mov ebx, edi
call fcn.004ce800
add esp, 0xc
mov dword [ebp - 0x58], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 1
movdqu xmmword [ebp - 0x14], xmm0
call fcn.004a7279
push eax
lea ecx, [ebp - 4]
call fcn.004a6656
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push 0x5299b4
push eax
call fcn.004a719c
add esp, 0x10
cmp dword [ebp + 0x14], ebx
je 0x4c78b6
push 0xa
pop eax
jmp 0x4c78b8
xor eax, eax
mov esi, dword [ebp - 4]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4c7900
cmp dword [ebp + 0x10], ebx
je 0x4c78fd
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4c78fd
cmp dword [ebp + 0x18], ebx
je 0x4c78fd
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x14], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4c7914
push dword [ebp - 0x14]
call edi
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x4c7923
push dword [ebp - 0x10]
call edi
and dword [ebp - 0x10], 0
lea ecx, [esi - 0x10]
call fcn.004a7be5
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c8d42
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x54e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x258]
push ebx
push esi
push edi
push eax
xor edi, edi
call fcn.004a6716
push 0x529a98
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004b95df
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x270]
mov ebx, eax
add ecx, 0xfffffff0
mov dword [ebp - 0x25c], ebx
call fcn.004a7be5
cmp ebx, 0xffffffff
jne 0x4c8db4
inc edi
jmp 0x4c8eff
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0x228]
je 0x4c8e70
push 0x525680
push eax
call ebx
test eax, eax
je 0x4c8ed5
push 0x52566c
lea eax, [ebp - 0x228]
push eax
call ebx
test eax, eax
je 0x4c8ed5
push str.Config
lea eax, [ebp - 0x228]
push eax
call ebx
test eax, eax
je 0x4c8ed5
push 0x53b478
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.004b95df
add esp, 0xc
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004b95df
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call fcn.004c8d42
mov ecx, dword [ebp - 0x260]
add esp, 0x18
add ecx, 0xfffffff0
mov esi, eax
call fcn.004a7be5
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.004a7be5
test esi, esi
je 0x4c8ef3
jmp 0x4c8ed5
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.004b95df
add esp, 0xc
push 0x80
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.004a7be5
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.004b95df
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x268]
lea ecx, [ecx - 0x10]
call fcn.004a7be5
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4c8dba
xor edi, edi
inc edi
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x258]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi - 0x10]
call fcn.004a7be5
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ce7ef
mov esp, ebp
pop ebp
ret
Function at 0x4ca2f5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
lea eax, [ebp - 8]
push edi
lea esi, [ebx + 4]
push esi
push eax
call fcn.004c9959
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 8]
je 0x4ca336
mov ecx, dword [ebp + 8]
push eax
call fcn.004a680f
push esi
lea ecx, [ebx + 0xc]
call fcn.004a680f
mov bl, 1
jmp 0x4ca3d6
push ebx
push eax
mov ecx, ebx
call fcn.004c9959
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ca366
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.004a680f
push ebx
lea ecx, [ebx + 0xc]
call fcn.004a680f
mov bl, 1
jmp 0x4ca3ce
call fcn.004a7279
push eax
lea ecx, [ebp - 8]
call fcn.004a6656
call fcn.004a7279
push eax
lea ecx, [ebp - 4]
call fcn.004a6656
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebx + 8]
push eax
call fcn.004cab2e
add esp, 0xc
test al, al
je 0x4ca3b6
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.004a680f
lea eax, [ebp - 4]
push eax
lea ecx, [ebx + 0xc]
call fcn.004a680f
mov bl, 1
jmp 0x4ca3b8
xor bl, bl
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004a7be5
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.004a7be5
lea ecx, [esi - 0x10]
call fcn.004a7be5
lea ecx, [edi - 0x10]
call fcn.004a7be5
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ca522
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x54e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
xor ebx, ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x4ca5aa
push 0x110
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.004ce800
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4ca5a4
cmp dword [ebp - 0x114], 6
jne 0x4ca5a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4ca5e8
mov dword [edi], ebx
xor eax, eax
jmp 0x4ca5e8
mov ecx, dword [ebp - 0x120]
mov eax, ebx
push esi
mov esi, 0x490
cmp dword [ebp - 0x11c], eax
jbe 0x4ca5df
lea edx, [ecx + 8]
cmp dword [edx], ebx
je 0x4ca5d5
inc eax
add edx, 0xc
cmp eax, dword [ebp - 0x11c]
jb 0x4ca5c3
jmp 0x4ca5df
imul eax, eax, 0xc
mov esi, ebx
mov eax, dword [eax + ecx]
mov dword [edi], eax
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ce7ef
mov esp, ebp
pop ebp
ret
Function at 0x4ca5f8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x54e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4ca618
or eax, 0xffffffff
jmp 0x4ca671
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004ce800
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4ca65b
cmp dword [ebp - 0x114], 5
jne 0x4ca65b
cmp dword [ebp - 0x110], 0
je 0x4ca666
push esi
call fcn.004ca9a8
pop ecx
test eax, eax
je 0x4ca66f
push esi
call fcn.004ca7bf
pop ecx
jmp 0x4ca671
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ce7ef
mov esp, ebp
pop ebp
ret

Function at 0x4ca7bf
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x54e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x238], eax
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4ca7f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4ca8c1
push esi
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x234], ebx
push ebx
push eax
mov esi, 0x490
call fcn.004ce800
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4ca875
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.004d08a4
pop ecx
pop ecx
test eax, eax
je 0x4ca865
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4ca83b
jmp 0x4ca879
mov eax, dword [ebp - 0x228]
xor esi, esi
mov dword [ebp - 0x234], eax
jmp 0x4ca879
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x234]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4ca89d
call ebx
jmp 0x4ca8c0
push dword [ebp - 0x238]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4ca8b7
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ce7ef
mov esp, ebp
pop ebp
ret

Function at 0x4cb0c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4cb0f3
xor eax, eax
jmp 0x4cb10e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
push edi
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x4cb3d1
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop ebp
ret 8

Function at 0x4cb5a3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x4cb5db
push dword [esi + 4]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.004d79e8
push dword [esi + 4]
push 2
push 1
push 0x52a590
call fcn.004d79e8
push dword [esi + 4]
call fcn.004d7752
add esp, 0x24
pop esi
pop ebp
ret 8

Function at 0x4ccc59
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004a6c26
add eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
pop ecx
lea ecx, [ebp + 8]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004a6a32
mov esi, dword [ebp + 8]
push 0
push 1
push esi
call fcn.004c3278
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0x536a68
push str.last_version
push 0x529a88
call fcn.004aa1f5
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push 2
push dword [eax]
call fcn.004a9bec
mov ebx, dword [ebp + 0x18]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [ebx]
call edi
test eax, eax
je 0x4ccd8b
call fcn.004c6b4b
test eax, eax
je 0x4ccd8b
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.004a7279
push eax
lea ecx, [ebp + 8]
call fcn.004a6656
push 0x104
lea ecx, [ebp + 8]
call fcn.004a7abd
push eax
push 0
push 0x1a
push 0
call fcn.004c7aa6
add esp, 0x10
lea ecx, [ebp + 8]
push 0xffffffffffffffff
call fcn.004ad5d5
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea ecx, [ebp + 8]
call fcn.004a6a09
push str.CapCut.lnk
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004b95df
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp + 0xc]
mov edi, eax
add ecx, 0xfffffff0
call fcn.004a7be5
test edi, edi
je 0x4ccd80
push str.CapCut.lnk
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004b95df
push 0
push dword [eax]
push 0x536a68
push dword [ebx]
call fcn.004c2fa9
mov ecx, dword [ebp + 0xc]
add esp, 0x1c
lea ecx, [ecx - 0x10]
call fcn.004a7be5
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004a7be5
pop edi
lea ecx, [esi - 0x10]
pop esi
pop ebx
pop ebp
jmp fcn.004a7be5
Function at 0x4ccdba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.004ce800
add esp, 0xc
mov dword [ebp - 0x58], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 1
movdqu xmmword [ebp - 0x14], xmm0
push 0xa
pop eax
mov word [ebp - 0x28], ax
call fcn.004a7279
push eax
lea ecx, [ebp - 4]
call fcn.004a6656
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push 0x5299b4
push eax
call fcn.004a719c
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x14]
add esp, 0x10
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x14], 0
mov ebx, eax
je 0x4cce43
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x4cce56
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
lea ecx, [esi - 0x10]
call fcn.004a7be5
xor eax, eax
test ebx, ebx
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4faeef
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x54e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004e3811
mov dword [ebp - 0x14], eax
cmp dword [0x552054], esi
jne 0x4fafe2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4faf6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4fb0c2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4fb0c2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4fb0c2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x552054], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x552058], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x55205c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x552064], eax
test eax, eax
je 0x4fafdf
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x552060], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4fb007
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4faffa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4fb01c
push 4
pop eax
jmp 0x4fb0c4
cmp dword [ebp - 0x14], esi
je 0x4fb01c
push dword [0x552054]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4fb001
mov eax, dword [0x552060]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4fb07a
cmp dword [0x552064], edi
je 0x4fb07a
push eax
call ebx
push dword [0x552064]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4fb07a
test eax, eax
je 0x4fb07a
call ecx
test eax, eax
je 0x4fb06f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4fb06f
test byte [ebp - 8], 1
jne 0x4fb07a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4fb0aa
mov eax, dword [0x552058]
cmp eax, edi
je 0x4fb0a7
push eax
call ebx
test eax, eax
je 0x4fb0a7
call eax
mov esi, eax
test esi, esi
je 0x4fb0a7
mov eax, dword [0x55205c]
cmp eax, edi
je 0x4fb0a7
push eax
call ebx
test eax, eax
je 0x4fb0a7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x552054]
call ebx
test eax, eax
je 0x4fb0c2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4fb0c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ce7ef
mov esp, ebp
pop ebp
ret
Function at 0x10016940
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.msvcr100.dll__read]
add esp, 0xc
ret 0xc

Function at 0x100169af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100169be
pop dword [ebp - 0x50]
mov eax, 0xa2e4017e
add eax, 0x6d1d6840
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd0c3c835
add dword [ebp - 0x60], 0x7d8e7d16
mov dword [ebp - 0x5c], 0x7ce62417
sub dword [ebp - 0x5c], 0x4ab2d7d2
mov dword [ebp - 0x58], 0x41b360b8
sub dword [ebp - 0x58], 0xf5671c8a
mov dword [ebp - 0x54], 0xbdc1ecd9
add dword [ebp - 0x54], 0x423e1327
lea eax, [ebp - 0x60]
push eax
mov eax, 0xda7dd24b
sub eax, 0xca7a40e3
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe89b5c4a
sub dword [ebp - 0x60], 0x7428f2f4
mov dword [ebp - 0x5c], 0x40fbc1af
add dword [ebp - 0x5c], 0x709fc6
mov dword [ebp - 0x58], 0x5b33b4d2
sub dword [ebp - 0x58], 0xf7c44866
mov dword [ebp - 0x54], 0xaaa5ffa2
sub dword [ebp - 0x54], 0xaaa5ffa2
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x352e6521
sub eax, 0x252ad4c1
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3d56e
push 0
call eax
mov ecx, 0x5f539a2e
add ecx, 0xa0acbca9
xor esi, esi
add esi, eax
mov edx, 0x25588c9a
sub edx, 0x1553549a
add edx, dword [ebp - 0x50]
mov edi, 0x2ce3a67d
add edi, 0x8165f388
sub dword [ebp - 4], 0x885d8350
mov ebx, dword [edx]
xor dword [ebp - 8], eax
xor ebx, edi
sub dword [ebp - 0x18], ebx
mov dword [esi], ebx
xor dword [ebp - 0x30], 0x77a077f
add esi, 0xc7787291
sub esi, 0xc778728d
add edx, 0xaaae994a
sub edx, 0xaaae9946
loop 0x10016ae2
add eax, 0x5f08e982
sub eax, 0x5f079b53
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x23e922a0
sub ecx, 0x13e922a0
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x10017236
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100436e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 2
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.100169af
push 2
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.100169af
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcr100.dll_rename]
pop ecx
pop ecx
pop esi
test eax, eax
je 0x100172bb
call dword [sym.imp.msvcr100.dll__errno]
mov eax, dword [eax]
dec eax
dec eax
je 0x100172b2
sub eax, 0xb
je 0x100172ae
sub eax, 4
je 0x100172aa
dec eax
je 0x100172a6
push 5
jmp 0x100172b4
push 0x4a
jmp 0x100172b4
push 0x3a
jmp 0x100172b4
push 0x4b
jmp 0x100172b4
push 0x35
pop eax
push eax
call fcn.1000c0de
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029dae
leave
ret 8