joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df7e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6996d0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebx + 8]
mov dword [ebp - 0x2c], eax
cmp eax, dword [edx + 4]
jne 0x4df858
mov ecx, dword [ebx + 8]
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [ebx + 0x14]
jne 0x4df858
mov eax, dword [ebx + 8]
inc dword [eax + 8]
test byte [0x831a80], 0x80
je 0x4df851
mov eax, dword [ebx + 8]
mov edx, 0x6feb88
push dword [eax + 0xc]
push dword [eax + 8]
push ebx
call fcn.004dcc6b
xor eax, eax
jmp 0x4df9d3
mov ecx, dword [ebx + 8]
xor eax, eax
mov dword [ebp - 0x28], eax
xor al, al
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x21], al
mov ecx, dword [ecx]
jmp 0x4df873
mov al, byte [ebp - 0x21]
mov esi, ecx
mov edx, ecx
and esi, 0x7ff
cmp esi, 0x7fb
je 0x4df8a4
test esi, esi
je 0x4df8a4
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x22], 0
test al, al
jne 0x4df8cb
and ecx, 0xfffff800
add ecx, 0x800
or ecx, esi
jmp 0x4df8cb
mov eax, dword [ebx + 0x14]
xor eax, ecx
mov byte [ebp - 0x22], 1
and eax, 0x7ff
xor ecx, eax
cmp byte [ebp - 0x21], 0
je 0x4df8cb
mov eax, ecx
and ecx, 0x7ff
shr eax, 0xb
dec eax
shl eax, 0xb
or ecx, eax
mov edi, dword [ebx + 8]
mov eax, edx
lock cmpxchg dword [edi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x4df870
cmp byte [ebp - 0x22], 0
mov eax, dword [ebx + 8]
jne 0x4df996
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x4df907
mov eax, dword [0x81cf10]
mov ecx, 0x81cf10
push 0x1c124c
call dword [eax + 4]
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x4df93f
cmp byte [ebp - 0x21], 0
jne 0x4df926
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [ebp - 0x28], edi
test esi, esi
jne 0x4df93f
jmp 0x4df929
mov edi, dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, edi
cmp ecx, esi
jae 0x4df964
sub esi, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp + 8], esi
mov eax, dword [ebp + 0xc]
mov ecx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x21], 1
mov dword [ebp - 0x1c], esi
call fcn.004df9f1
mov ecx, dword [ebx + 8]
mov al, byte [ebp - 0x21]
mov ecx, dword [ecx]
jmp 0x4df873
mov eax, dword [ebx + 8]
mov eax, dword [eax]
nop dword [eax]
mov esi, dword [ebx + 8]
mov ecx, eax
shr ecx, 0xb
mov edx, eax
dec ecx
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x4df970
mov eax, 0x102
jmp 0x4df9d3
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 8]
mov dword [eax + 8], 1
test byte [0x831a80], 0x80
je 0x4df9c3
mov eax, dword [ebx + 8]
mov edx, 0x6feb88
push dword [eax + 0xc]
push dword [eax + 8]
push ebx
call fcn.004dcc6b
xor eax, eax
mov ecx, 0x80
cmp esi, 0x7fb
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
Function at 0x4e193a
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69ccab
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test byte [0x831a80], 0x20
je 0x4e198f
push dword [ebx + 0xc]
mov edx, 0x6fece8
push dword [ebx + 8]
call fcn.004e3d26
mov eax, dword [0x81cf10]
mov ecx, 0x81cf10
push 0x1c135e
call dword [eax + 4]
lea eax, [esi + 8]
mov esi, dword [eax]
mov ecx, esi
mov edi, dword [eax + 4]
mov edx, edi
shr ecx, 0xc
dec ecx
mov dword [ebp - 0x14], eax
shl ecx, 0xc
mov eax, esi
xor ecx, esi
mov dword [ebp - 0x20], esi
and ecx, 0x7f000
xor ecx, esi
mov esi, dword [ebp - 0x14]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x20]
jne 0x4e19de
cmp ecx, edi
je 0x4e1a0e
mov esi, eax
mov dword [ebp - 0x20], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 0x14]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x4e19de
cmp ecx, dword [ebp - 0x20]
jne 0x4e19de
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x4e5e27
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x4e5e43
mov ebx, 0x80004005
jmp 0x4e5ef8
mov edx, dword [esi + 0x38]
push edi
cmp edx, dword [esi + 0x34]
ja 0x4e5e70
lea edx, [edx*4 + 0x14]
lea ecx, [esi + 0x2c]
call fcn.004f7364
test eax, eax
jne 0x4e5e69
mov ebx, 0x8007000e
jmp 0x4e5ef7
add dword [esi + 0x38], 5
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.004e5f00
mov ebx, eax
test ebx, ebx
js 0x4e5ee9
mov ecx, dword [esi + 0x40]
or ecx, dword [esi + 0x44]
jne 0x4e5e95
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
mov edi, dword [ebp - 4]
lock inc dword [edi + 0x908]
lea eax, [edi + 0x8f0]
push eax
xor eax, eax
push eax
push edi
push 0x4e6680
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4e5ec9
mov ecx, edi
call fcn.004e6d33
mov ebx, 0x80004005
jmp 0x4e5eec
mov dword [edi + 0x8ec], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x2c]
push 0x3e
mov dword [eax + ecx*4], edi
xor edi, edi
inc dword [esi + 0x34]
lea eax, [esi + 0x30]
pop ecx
lock xadd dword [eax], ecx
jmp 0x4e5eec
mov edi, dword [ebp - 4]
test edi, edi
je 0x4e5ef7
mov ecx, edi
call fcn.004e6d33
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f16d9
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a2dec
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
and dword [ebp - 0x418], 0
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x420], esi
test edi, edi
jne 0x4f1724
xor eax, eax
jmp 0x4f182f
and dword [edi], 0
lea ecx, [ebp - 0x410]
xor ebx, ebx
inc ebx
push ebx
push esi
push edx
call fcn.004f2647
mov ecx, esi
mov dword [ebp - 0x424], eax
shr ecx, 0x1a
not cl
mov byte [ebp - 0x411], 0
and ecx, 0xffffff01
mov dword [ebp - 0x41c], ecx
test eax, eax
je 0x4f1778
push eax
mov eax, esi
shr eax, 0x17
and eax, ebx
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ecx, dword [ebp - 0x41c]
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
jne 0x4f1808
test cl, cl
je 0x4f1828
push ebx
lea edx, [ebp - 0x418]
mov ecx, esi
call fcn.004f2400
test eax, eax
je 0x4f17fd
push dword [ebp - 0x424]
mov eax, esi
shr eax, 0x19
and eax, ebx
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, dword [ebp - 0x420]
lea edx, [ebp - 0x418]
mov esi, eax
call fcn.004f260b
cmp esi, 5
jne 0x4f17fd
cmp byte [ebp - 0x411], 0
jne 0x4f17fd
mov ecx, dword [ebp - 0x41c]
mov esi, dword [ebp - 0x420]
mov eax, dword [ebp - 0x424]
mov byte [ebp - 0x411], bl
jmp 0x4f1758
mov eax, dword [edi]
test eax, eax
cmovne eax, eax
test eax, eax
je 0x4f180d
cmp eax, 0xffffffff
jne 0x4f182d
cmp byte [ebp - 0x41c], 0
je 0x4f1828
mov eax, dword [0x81cf10]
mov ecx, 0x81cf10
push 0x1631e1
call dword [eax + 4]
and dword [edi], 0
xor ebx, ebx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4f289a
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push 0x20
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4f28f6
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
Function at 0x4f33a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.0064f890
add esp, 0xc
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x20c]
push esi
push 0x2b
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4f3412
cmp word [ebp - 0x20c], si
je 0x4f3412
push ecx
push edi
mov edx, str.Microsoft_Shared
lea ecx, [ebp - 0x20c]
call fcn.004f3424
mov esi, eax
test esi, esi
jne 0x4f3414
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret

Function at 0x4f8069
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
je 0x4f80fa
cmp dword [esi + 0x10], 0x3fff
jbe 0x4f80a8
lea eax, [edi + 8]
push eax
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.004f88d3
jmp 0x4f810b
mov eax, dword [edx]
mov edx, dword [edx + 4]
sub edx, eax
push 0
pop ecx
cmove eax, ecx
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4f80bf
mov ecx, dword [esi]
push edx
push eax
push 3
push 0
push ecx
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4f80e8
lea ecx, [edi + 8]
push ecx
push esi
push ecx
push eax
push ecx
lea ecx, [ebp - 0x398]
call fcn.004f88ef
jmp 0x4f810b
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.SetValue_failure:_Registry_key_is_not_initialized
push ecx
lea ecx, [ebp - 0x398]
call fcn.004f88b8
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3
Function at 0x4f83e5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
je 0x4f84c4
xor edx, edx
mov dword [ebp - 0x3a0], 3
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x39c], edx
jb 0x4f8429
mov eax, dword [esi]
lea ecx, [ebp - 0x39c]
push ecx
push edx
lea ecx, [ebp - 0x3a0]
push ecx
push edx
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x4f84af
cmp dword [ebp - 0x3a0], 3
jne 0x4f84af
test eax, eax
je 0x4f8469
lea eax, [edi + 8]
push eax
push esi
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.004f895d
jmp 0x4f84d2
push ebx
push dword [ebp - 0x39c]
mov ecx, ebx
call fcn.00433e9e
mov eax, dword [ebx + 4]
mov ecx, esi
sub eax, dword [ebx]
neg eax
sbb eax, eax
and eax, dword [ebx]
cmp dword [esi + 0x14], 8
jb 0x4f848c
mov ecx, dword [esi]
lea edx, [ebp - 0x39c]
push edx
push eax
lea eax, [ebp - 0x3a0]
push eax
push 0
push ecx
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f8455
mov al, 1
jmp 0x4f84b1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push esi
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.0042543b
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3
Function at 0x4f84e4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3cc
mov eax, 0x6a342d
call fcn.0064d018
mov edi, ecx
cmp dword [edi + 0x20], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3d4], eax
je 0x4f8653
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x3c4], 7
mov dword [ebp - 0x3c0], 1
jb 0x4f8529
mov eax, dword [esi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x3c0]
push ecx
push 0
lea ecx, [ebp - 0x3c4]
push ecx
push 0
push eax
push dword [edi + 0x20]
call ebx
mov ecx, eax
cmp ecx, 2
je 0x4f8649
cmp dword [ebp - 0x3c4], 7
jne 0x4f8649
test ecx, ecx
je 0x4f857b
push esi
lea eax, [edi + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x3bc]
call fcn.00425419
jmp 0x4f8660
mov eax, dword [ebp - 0x3c0]
lea ecx, [ebp - 0x3d0]
add eax, 2
push eax
mov dword [ebp - 0x3c0], eax
call fcn.004f7c0b
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x3d0]
sub eax, ecx
push 0
pop eax
cmove ecx, eax
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4f85b8
mov eax, dword [esi]
lea edx, [ebp - 0x3c0]
push edx
push ecx
lea ecx, [ebp - 0x3c4]
push ecx
push 0
push eax
push dword [edi + 0x20]
call ebx
mov ecx, eax
test ecx, ecx
jne 0x4f8563
mov eax, dword [ebp - 0x3cc]
xor esi, esi
mov edx, dword [ebp - 0x3d0]
sub eax, edx
mov edi, dword [ebp - 0x3d4]
xor ecx, ecx
test eax, eax
cmove edx, ecx
lea ecx, [ebp - 0x2c]
lea eax, [edx + esi*2]
push eax
call fcn.0040d412
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.0043420b
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
inc eax
mov byte [ebp - 4], 0
add esi, eax
call fcn.0040d475
mov eax, dword [ebp - 0x3cc]
mov edx, dword [ebp - 0x3d0]
sub eax, edx
push 0
pop ebx
mov ecx, edx
cmove ecx, ebx
cmp byte [ecx + esi*2], bl
jne 0x4f85eb
lea ecx, [ebp - 0x3d0]
call fcn.00419dd5
mov al, 1
jmp 0x4f864b
xor al, al
call fcn.0064cfc2
ret 8
push ecx
push ecx
lea ecx, [ebp - 0x3bc]
call fcn.004f897c
push 0x811494
lea eax, [ebp - 0x3bc]
push eax
call fcn.0064f293
int3

Function at 0x4fc157
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4fc177
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4fc1b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4fc1b8
cmp eax, 5
jne 0x4fc1b4
mov ecx, esi
call fcn.004fc23c
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4fc1a3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4fc1b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4fc1c9
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret
push esi
push str.failed_to_delete_file__s
push eax
push ecx
lea ecx, [ebp - 0x398]
call fcn.004fcb4d
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3
Function at 0x4fc23c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, 0x80
mov dword [ebp - 0x39c], ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4fc267
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4fc282
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x39c]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [ebp - 0x398]
call fcn.004fcb6e
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3
Function at 0x4fc53c
Capabilities:
Enumerate files on windows

Disassembly:
push 0x630
mov eax, 0x6a38c2
call fcn.0064d018
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x63c], ebx
mov esi, dword [ebp + 8]
mov ecx, edi
call fcn.004fbf18
test al, al
je 0x4fc76f
mov ecx, ebx
call fcn.00415451
xor ebx, ebx
mov dword [ebp - 0x44], 7
xor eax, eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], ax
push edi
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.0040d37a
xor eax, eax
mov dword [ebp - 0x30], ebx
push 0x6d9558
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.0040d510
push 1
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.0040bdd3
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0040d475
test bl, bl
jne 0x4fc60f
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
push 0x6d9558
mov word [ebp - 0x28], ax
call fcn.0040d510
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x58]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040d537
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040d475
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4fc619
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x58]
push eax
call fcn.0040d537
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4fc670
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x4fc75f
cmp eax, 2
je 0x4fc75f
push ecx
push eax
push ecx
lea ecx, [ebp - 0x638]
call fcn.004fcbe8
jmp 0x4fc77d
test byte [ebp - 0x2a8], 0x10
jne 0x4fc742
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
and dword [ebp - 0x2c], 0
push edi
call fcn.0040d595
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
and dword [ebp - 0x18], 0
xor eax, eax
push 0x6d9558
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040d510
push 1
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.0040bdd3
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
mov bl, al
call fcn.0040d475
test bl, bl
jne 0x4fc718
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
push 0x6d9558
mov word [ebp - 0x28], ax
call fcn.0040d510
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040d537
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0040d475
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040d32d
mov ecx, dword [ebp - 0x63c]
lea eax, [ebp - 0x40]
push eax
call fcn.0043420b
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0040d475
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4fc670
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x58]
call fcn.0040d475
call fcn.0064cfc2
ret 4
push edi
push ecx
push ecx
lea ecx, [ebp - 0x638]
call fcn.004fcbcc
push 0x811494
lea eax, [ebp - 0x638]
push eax
call fcn.0064f293
int3
Function at 0x4fd7bc
Capabilities:
Read file on windows

Disassembly:
push 0x748
mov eax, 0x6a39cc
call fcn.0064d018
mov edi, ecx
cmp dword [edi + 0x20], 0xffffffff
mov esi, dword [ebp + 8]
je 0x4fd8ec
xor ecx, ecx
mov dword [ebp - 0x18], 7
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x2c], ax
push ecx
lea eax, [ebp - 0x750]
mov dword [ebp - 4], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
push 2
lea eax, [ebp - 0x754]
mov dword [ebp - 0x750], ecx
push eax
push dword [edi + 0x20]
call ebx
test eax, eax
je 0x4fd86a
push 0xa
pop ecx
cmp dword [ebp - 0x750], 2
jne 0x4fd877
mov eax, dword [ebp - 0x754]
cmp ax, cx
je 0x4fd877
cmp ax, 0xd
je 0x4fd894
mov ecx, 0xfeff
cmp ax, cx
je 0x4fd845
push eax
lea ecx, [ebp - 0x2c]
call fcn.00418d3f
and dword [ebp - 0x750], 0
lea eax, [ebp - 0x750]
push 0
push eax
push 2
lea eax, [ebp - 0x754]
push eax
push dword [edi + 0x20]
call ebx
push 0xa
pop ecx
test eax, eax
jne 0x4fd818
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x26
jne 0x4fd8ca
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.0040d3df
lea ecx, [ebp - 0x2c]
call fcn.0040d475
mov eax, esi
call fcn.0064cfc2
ret 4
push 0
lea eax, [ebp - 0x750]
push eax
push 2
lea eax, [ebp - 0x754]
push eax
push dword [edi + 0x20]
call ebx
test eax, eax
je 0x4fd86a
push 0xa
pop eax
cmp word [ebp - 0x754], ax
je 0x4fd877
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
mov ecx, edi
call fcn.004fd69f
jmp 0x4fd877
push str.read_from_file_failed
call edi
push eax
push 0xf
lea ecx, [ebp - 0x3bc]
call fcn.004fdee7
push 0x811494
lea eax, [ebp - 0x3bc]
jmp 0x4fd909
push str.trying_to_read_from_a_file_thats_not_open
push 0x15
lea ecx, [ebp - 0x74c]
call fcn.00413a99
push 0x811494
lea eax, [ebp - 0x74c]
push eax
call fcn.0064f293
int3

Function at 0x4fdcf5
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call fcn.004fd736
test al, al
jne 0x4fdd11
xor al, al
jmp 0x4fdd58
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4fdd1b
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4fdd0d
push ebx
push edi
mov ecx, ebx
call fcn.00433e9e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
neg eax
sbb eax, eax
and eax, dword [ebx]
cmp dword [esi + 0x14], 8
jb 0x4fdd48
mov esi, dword [esi]
push eax
push edi
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fdd5f
Capabilities:
Copy file

Disassembly:
push 0x3b0
mov eax, 0x6a3a9b
call fcn.0064d086
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
mov ecx, esi
mov dword [ebp - 0x3b4], edi
mov dword [ebp - 0x3b8], esi
jb 0x4fdd88
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4fdd92
mov eax, dword [edi]
movzx edx, byte [ebp + 8]
xor edx, 1
push edx
push ecx
push eax
mov dword [ebp - 0x3ac], edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4fddf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x3b0], ebx
cmp ebx, 5
jne 0x4fde14
and dword [ebp - 4], 0
mov ecx, esi
call fcn.004fc23c
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4fddd4
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4fddde
mov eax, dword [edi]
push dword [ebp - 0x3ac]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4fde10
call fcn.0064cfd3
ret 4
or dword [ebp - 4], 0xffffffff
push esi
push edi
push ecx
push ebx
push ecx
lea ecx, [ebp - 0x3a8]
call fcn.004fdfd9
push 0x811494
lea eax, [ebp - 0x3a8]
push eax
call fcn.0064f293
int3

Function at 0x4fde36
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4fde47
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4fde79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov ecx, 0x231f193
lea eax, [ebp - 4]
push eax
push esi
push str.Failed_to_schedule_delete_file__s.__Error_Code:_0x_x.
push 0x64
call fcn.004fe085
xor al, al
jmp 0x4fde7b
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ff1db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x104
mov esi, ecx
call fcn.00414b29
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4ff207
mov eax, dword [esi]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4ff22e
push 0
push eax
mov ecx, esi
call fcn.00414b29
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret
push str.Cannot_get_temp_path
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x398]
call fcn.004fde80
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3