joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496620
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
mov ebx, ecx
lea esi, [edx + 1]
push edi
mov dword [ebp - 0x24], ebx
xor edi, edi
nop word [eax + eax]
movzx edx, byte [esi - 1]
lea esi, [esi + 4]
movzx eax, byte [esi - 4]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 3]
shl edx, 8
or edx, eax
movzx eax, byte [esi - 2]
shl edx, 8
or edx, eax
mov dword [ebp + edi*4 - 0x128], edx
inc edi
cmp edi, 0x10
jb 0x496640
cmp edi, 0x40
jae 0x4966bf
mov ebx, 0x40
lea eax, [ebp + edi*4 - 0x130]
sub ebx, edi
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x496682
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x50]
xor edx, edx
mov dword [ebp - 0x28], eax
mov edi, eax
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x6c]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
nop dword [eax]
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 8]
and eax, ebx
xor ecx, eax
mov eax, edi
add esi, ecx
rol eax, 0xa
add esi, dword [edx + 0x619c88]
add esi, dword [ebp + edx - 0x128]
mov edx, edi
add esi, dword [ebp - 0x1c]
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
lea edi, [edx + esi]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x20]
add ebx, esi
mov eax, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], edx
cmp edx, 0x100
jb 0x496700
mov eax, dword [ebp - 0x28]
add eax, edi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x24]
pop edi
pop esi
add dword [ebx + 0x54], ecx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x58], eax
mov eax, dword [ebp - 0x14]
add dword [ebx + 0x5c], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x60], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x64], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x68], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x6c], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4967d0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x64106c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x210]
push 0x104
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x496813
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c21c3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push 0x627490
push eax
call fcn.00529f1b
add esp, 8
test eax, eax
je 0x496831
xor ecx, ecx
mov word [eax + 2], cx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x496802
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.004c21c3
mov esp, ebp
pop ebp
ret

Function at 0x496880
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2928
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x64106c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x24], edi
mov ebx, ecx
push 0x100
call fcn.004c244f
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x80
push eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x44
push eax
push edi
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
jne 0x49695c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x49695a
cmp dword [ebp - 0x14], 0x44
jbe 0x49690b
xor bl, bl
jmp 0x49695f
mov eax, dword [ebp - 0x20]
cmp eax, 0x80
jbe 0x49693f
xor ecx, ecx
mov edx, 2
mul edx
mov edi, esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c244f
add esp, 4
mov esi, eax
test edi, edi
je 0x49693f
push edi
call fcn.004c221a
add esp, 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
setne bl
test esi, esi
je 0x49696c
push esi
call fcn.004c221a
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c21c3
mov esp, ebp
pop ebp
ret
Function at 0x49a881
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
movzx eax, byte [esi + 4]
cmp eax, 8
ja 0x49a90e
je 0x49a8f2
sub eax, 4
je 0x49a8c0
sub eax, 1
je 0x49a8b9
sub eax, 1
je 0x49a8b2
sub eax, 1
jne 0x49a92f
mov eax, dword [esi + 0xc]
add eax, 0x18
jmp 0x49a925
pop edi
pop esi
jmp fcn.0049a820
pop edi
pop esi
jmp 0x49b7e2
mov edx, dword [edi + 0x10]
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x18]
dec ecx
and ecx, dword [esi + 8]
lea ecx, [eax + ecx*4]
jmp 0x49a8d7
mov ecx, dword [ecx]
add ecx, 0xc
cmp dword [ecx], esi
jne 0x49a8d2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
mov ecx, edi
dec dword [edx + 0x1c]
mov edx, esi
movzx eax, byte [esi + 7]
add eax, 0x11
jmp 0x49a925
mov edx, dword [esi + 0x20]
mov ecx, esi
call fcn.0049e350
mov ecx, esi
call fcn.00488e2f
push 0
push 0x7c
lea edx, [esi - 4]
mov ecx, edi
jmp 0x49a928
cmp eax, 9
je 0x49a93a
cmp eax, 0x14
je 0x49a932
cmp eax, 0x26
jne 0x49a92f
movzx eax, byte [esi + 6]
inc eax
shl eax, 4
push 0
push eax
call fcn.0049efe0
pop ecx
pop ecx
pop edi
pop esi
ret
mov eax, dword [esi + 0xc]
add eax, 0x11
jmp 0x49a925
pop edi
pop esi
jmp 0x49e3f4
push ebx
push esi
mov esi, edx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [esi + 0x14], ebx
je 0x49b809
mov cl, byte [esi + 7]
xor eax, eax
mov edx, dword [esi + 0x10]
inc eax
shl eax, cl
mov ecx, edi
shl eax, 5
push ebx
push eax
call fcn.0049efe0
pop ecx
pop ecx
mov eax, dword [esi + 8]
mov ecx, edi
mov edx, dword [esi + 0xc]
shl eax, 4
push ebx
push eax
call fcn.0049efe0
push ebx
push 0x20
mov edx, esi
mov ecx, edi
call fcn.0049efe0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
push ebx
push esi
mov esi, edx
xor ebx, ebx
push edi
push ebx
mov edi, ecx
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x30]
shl eax, 2
push eax
call fcn.0049efe0
mov eax, dword [esi + 0x1c]
mov ecx, edi
mov edx, dword [esi + 0x34]
shl eax, 2
push ebx
push eax
call fcn.0049efe0
mov eax, dword [esi + 0x10]
mov ecx, edi
mov edx, dword [esi + 0x2c]
shl eax, 4
push ebx
push eax
call fcn.0049efe0
mov eax, dword [esi + 0x18]
mov ecx, edi
mov edx, dword [esi + 0x38]
shl eax, 2
push ebx
push eax
call fcn.0049efe0
imul eax, dword [esi + 0x20], 0xc
mov ecx, edi
mov edx, dword [esi + 0x3c]
push ebx
push eax
call fcn.0049efe0
mov eax, dword [esi + 0xc]
mov ecx, edi
mov edx, dword [esi + 0x40]
shl eax, 3
push ebx
push eax
call fcn.0049efe0
push ebx
push pe_nt_image_headers32
mov edx, esi
mov ecx, edi
call fcn.0049efe0
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x49cea4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
mov dword [ebp - 0x18], edx
push edi
mov dword [ebp - 8], esi
call fcn.00512bd2
xor edi, edi
xorps xmm1, xmm1
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
movzx eax, byte [esi]
test byte [eax + 0x61a029], 8
je 0x49cefe
inc esi
movzx eax, byte [esi]
test byte [eax + 0x61a029], 8
jne 0x49ceee
mov dword [ebp - 8], esi
lea ecx, [ebp - 8]
call fcn.0049ce89
mov edx, dword [ebp - 8]
mov dword [ebp - 0x24], eax
cmp byte [edx], 0x30
jne 0x49d026
mov cl, byte [edx + 1]
cmp cl, 0x78
je 0x49cf26
cmp cl, 0x58
jne 0x49d026
mov al, byte [ebp - 1]
add edx, 2
mov esi, edi
mov cl, byte [edx]
cmp cl, al
jne 0x49cf3b
test esi, esi
jne 0x49cf8b
inc esi
jmp 0x49cf88
movzx eax, cl
test byte [eax + 0x61a029], 0x10
je 0x49cf8b
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x49cf58
cmp cl, 0x30
jne 0x49cf58
inc dword [ebp - 0x14]
jmp 0x49cf80
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x49cf7f
movsx ecx, cl
call fcn.0049ce75
mulsd xmm1, qword [0x629c68]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
jmp 0x49cf80
inc edi
mov al, byte [ebp - 1]
test esi, esi
je 0x49cf88
dec edi
inc edx
jmp 0x49cf2e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edi
push 0
pop edi
add eax, ecx
je 0x49d026
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov esi, eax
mov al, byte [edx]
shl esi, 2
cmp al, 0x70
je 0x49cfb6
cmp al, 0x50
jne 0x49cfff
inc edx
lea ecx, [ebp - 8]
mov dword [ebp - 8], edx
call fcn.0049ce89
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov al, byte [edx]
movzx ecx, al
test byte [ecx + 0x61a029], 2
je 0x49d026
imul ecx, edi, 0xa
movsx edi, al
add edi, 0xffffffd0
add edi, ecx
inc edx
movzx eax, byte [edx]
test byte [eax + 0x61a029], 2
mov al, byte [edx]
jne 0x49cfd6
cmp dword [ebp - 0x1c], 0
je 0x49cff8
neg edi
mov eax, dword [ebp - 0x18]
add esi, edi
mov dword [eax], edx
cmp dword [ebp - 0x24], 0
je 0x49d00c
xorps xmm1, xmmword [0x629e20]
push esi
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.00516937
fstp qword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x28]
add esp, 0xc
jmp 0x49d029
xorps xmm0, xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4a002e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x64106c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
xor ecx, ecx
mov dword [ebp - 0x10], eax
push edi
push ecx
mov dword [ebx], ecx
push str.kernel32.dll
mov dword [eax], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4a00b3
push esi
push edi
call fcn.004c244f
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4a00ab
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x61fedc
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4a00ab
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
push esi
call fcn.004c221a
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004c21c3
mov esp, ebp
pop ebp
ret

Function at 0x4a005f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x64106c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
xor ecx, ecx
mov dword [ebp - 0x10], eax
push edi
push ecx
mov dword [ebx], ecx
push str.kernel32.dll
mov dword [eax], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4a00b3
push esi
push edi
call fcn.004c244f
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4a00ab
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x61fedc
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4a00ab
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
push esi
call fcn.004c221a
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004c21c3
mov esp, ebp
pop ebp
ret
Function at 0x4a7035
Capabilities:
Check if file exists

Disassembly:
push 0x74
mov eax, 0x5e3734
call fcn.004c281e
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x78]
push dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x7c], eax
call fcn.00404f90
push 0xfde9
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x70]
call fcn.00419490
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], ebx
call fcn.0046b6a9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
mov edi, eax
call fcn.00405040
test edi, edi
jne 0x4a708c
xor al, al
jmp 0x4a71ed
push dword [ebp + 0x14]
lea ecx, [ebp - 0x78]
call fcn.00404f90
push 0xfde9
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x28]
call fcn.00419490
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
mov dword [esp], 0x61ed04
call fcn.004050d0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.0046cf13
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00405080
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00405040
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00405040
push ecx
push dword [ebp - 0x7c]
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00473c51
pop ecx
pop ecx
test al, al
je 0x4a7183
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a7183
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x78]
call fcn.00404f90
push dword [ebp + 0x18]
lea ecx, [ebp - 0x80]
call fcn.00404f90
mov ebx, 0xfde9
lea edx, [ebp - 0x78]
push ebx
lea ecx, [ebp - 0x58]
call fcn.00419490
push ebx
lea edx, [ebp - 0x80]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
call fcn.00419490
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
lea edx, [ebp - 0x28]
call fcn.004a6808
add esp, 0x10
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
mov bl, al
call fcn.00405040
lea ecx, [ebp - 0x58]
jmp 0x4a71d6
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x78]
call fcn.00404f90
push 0x10
mov edx, 0x61a400
lea ecx, [ebp - 0x40]
call fcn.0046b36e
mov esi, eax
mov byte [ebp - 4], 4
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x58]
mov dword [esp], 0xfde9
call fcn.00419490
pop ecx
push ebx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
mov eax, dword [edi]
push esi
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00405040
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00405040
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405040
mov al, bl
call fcn.004c27c8
ret 0x18
Function at 0x4af359
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x64106c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4af379
mov eax, dword [esi]
jmp 0x4af37b
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4af42c
push edi
mov edi, 0x208
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0050b8e0
push edi
xor edi, edi
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0050b8e0
add esp, 0x18
cmp dword [esi + 0x14], 8
jb 0x4af3bb
mov eax, dword [esi]
jmp 0x4af3bd
mov eax, esi
push eax
lea eax, [ebp - 0x20c]
push str._s.del
push eax
call fcn.0046e4c1
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
cmp dword [esi + 0x14], 8
jb 0x4af3e9
mov eax, dword [esi]
jmp 0x4af3eb
mov eax, esi
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
cmp dword [esi + 0x14], 8
jb 0x4af409
mov esi, dword [esi]
push 2
lea eax, [ebp - 0x414]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
call esi
test eax, eax
je 0x4af42b
push 4
push edi
lea eax, [ebp - 0x414]
push eax
call esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c21c3
mov esp, ebp
pop ebp
ret
Function at 0x4af52a
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push 0x58
mov eax, 0x5e3ee4
call fcn.004c281e
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x4af544
mov eax, dword [esi]
jmp 0x4af546
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
je 0x4af628
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x28]
push ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
call fcn.00406850
push 0xffffffffffffffff
lea edx, [ebp - 0x28]
mov dword [ebp - 4], ebx
mov ecx, esi
call fcn.0046cd81
pop ecx
test al, al
je 0x4af615
push edi
lea ecx, [ebp - 0x64]
call fcn.00404f90
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x58]
call fcn.004215d0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.00404f90
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x40]
call fcn.004215d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x44], 0x10
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00527d3c
mov byte [ebp - 4], 1
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
test eax, eax
jne 0x4af605
call fcn.004051e0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.004051e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004051e0
mov al, 1
jmp 0x4af68d
call fcn.004051e0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.004051e0
mov ecx, esi
call fcn.004af359
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004051e0
mov ecx, esi
call fcn.0046d268
cmp dword [esi + 0x14], 8
jb 0x4af637
mov esi, dword [esi]
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4af68b
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x4af660
mov edi, dword [edi]
push ebx
lea ecx, [ebp - 0x5c]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4af684
cmp dword [ebp - 0x5c], 0
je 0x4af684
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4af5fe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.004c27c8
ret
Function at 0x4af8a1
Capabilities:
Check mutex on windows

Disassembly:
push 0xac
mov eax, 0x5e3fc0
call fcn.004c281e
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x90], ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x40]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0x10]
push str.GlobalReadyFile_2F1FD62C_8B36_4AD2_90B7_7238893E1B7E
mov dword [ebp - 0x74], eax
call fcn.004050d0
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push ebx
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0xc
push eax
mov dword [ebp - 0x9c], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x94], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.00419470
push str._files.db
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00413340
add esp, 0xc
push eax
mov ecx, 0xa27180
mov byte [ebp - 4], 2
call fcn.00411390
lea ecx, [ebp - 0x58]
call fcn.004051e0
lea ecx, [ebp - 0x70]
call fcn.004051e0
mov dword [ebp - 0x88], 0x628694
mov byte [ebp - 0x7c], 1
push ecx
push ecx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.004afab8
test al, al
je 0x4af9c2
movss xmm1, dword [0x629cc8]
lea ecx, [ebp - 0x88]
call fcn.004afd9e
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
call fcn.00406850
push dword [ebp - 0x74]
mov esi, dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 4
lea edx, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [edi], bl
call fcn.004af759
pop ecx
pop ecx
test al, al
jne 0x4afa2b
push dword [ebp - 0x74]
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x28]
push eax
mov edx, esi
call fcn.004af693
pop ecx
pop ecx
test al, al
je 0x4afa28
lea edx, [ebp - 0x88]
mov byte [edi], 1
lea ecx, [ebp - 0x28]
call fcn.004af43b
jmp 0x4afa2b
mov byte [ebp - 0x78], bl
lea ecx, [ebp - 0x88]
call fcn.004afb34
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [ebp - 0x78], 0
je 0x4afa58
mov edx, dword [ebp - 0x98]
lea ecx, [ebp - 0x28]
call fcn.004af52a
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.004051e0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], 0x628694
call fcn.004afb34
lea ecx, [ebp - 0x40]
call fcn.00405040
mov al, bl
call fcn.004c27c8
ret