joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485280
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x248
lea ecx, [esp]
push edi
push 0x105
push eax
push ecx
call fcn.00486310
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 1
jle 0x4852fa
cmp ecx, 4
jge 0x4852fa
cmp byte [esp + 1], 0x3a
jne 0x4852fa
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
test eax, eax
je 0x485355
mov cl, byte [esp]
mov edx, 0x41
cmp cl, 0x60
jle 0x4852df
mov edx, 0x61
sub ecx, edx
mov edx, 1
shl edx, cl
mov ecx, edx
and ecx, eax
xor eax, eax
cmp ecx, edx
sete al
add esp, 0x248
ret
cmp byte [esp + ecx - 1], 0x5c
je 0x485316
test ecx, ecx
je 0x485316
push 0x105
lea edx, [esp + 4]
push str..
push edx
jmp 0x485325
push 0x105
lea eax, [esp + 4]
push 0x4d7238
push eax
call fcn.00486350
add esp, 0xc
lea ecx, [esp + 0x108]
lea edx, [esp]
push ecx
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x485355
push eax
call dword [sym.imp.kernel32.dll_FindClose]
mov al, 1
add esp, 0x248
ret
xor al, al
add esp, 0x248
ret

Function at 0x489d20
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.00489e00
mov ebx, dword [esp + 0x14]
test ebx, ebx
jne 0x489d63
mov al, byte [esp + 0x18]
push ebx
test al, al
push 0x80
je 0x489d51
mov eax, dword [esp + 0x18]
push 4
push ebx
push 3
push 0x80000000
push eax
jmp 0x489dae
mov ecx, dword [esp + 0x18]
push 3
push 0
push 3
push 0x80000000
push ecx
jmp 0x489dae
mov al, byte [esp + 0x1c]
mov edi, dword [esp + 0x10]
test al, al
je 0x489d8f
push edi
call fcn.00485230
add esp, 4
test al, al
je 0x489d8f
push edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x489d8f
pop edi
pop esi
xor al, al
pop ebx
ret 0x10
mov al, byte [esp + 0x18]
push 0
test al, al
push 0x80
je 0x489da2
push 4
jmp 0x489da4
push 3
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00489f60
test al, al
jne 0x489dc8
pop edi
pop esi
pop ebx
ret 0x10
mov ecx, esi
mov dword [esi + 0xc], ebx
call fcn.00489f80
test eax, eax
je 0x489de9
test ebx, ebx
je 0x489de9
mov ecx, esi
call fcn.0048a250
pop edi
pop esi
mov al, 1
pop ebx
ret 0x10
mov ecx, esi
call fcn.0048a0d0
pop edi
pop esi
mov al, 1
pop ebx
ret 0x10

Function at 0x489eb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00489f60
test al, al
jne 0x489ec4
xor eax, eax
pop esi
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x489ed3
xor eax, eax
pop esi
pop ecx
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push 0
push ecx
push eax
mov eax, dword [esi + 4]
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x48a120
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xe0
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00489f60
test al, al
jne 0x48a140
pop edi
pop esi
pop ebx
add esp, 0xe0
ret 4
mov ax, word [0x4cb968]
mov cl, byte [0x4cb96a]
lea edx, [esp + 0x14]
push ebp
push edx
mov word [esp + 0x14], ax
mov byte [esp + 0x16], cl
mov dword [esp + 0x18], 0
call dword [sym.imp.kernel32.dll_GetLocalTime]
push 0
lea eax, [esp + 0x1c]
push 1
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00488fc0
mov edi, 0x4c780c
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push eax
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
push eax
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [ebx + 4]
mov esi, dword [sym.imp.kernel32.dll_WriteFile]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x34]
push ecx
push edx
call esi
test eax, eax
pop ebp
jne 0x48a1e6
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xe0
ret 4
mov edx, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx + 4]
push edx
push ecx
call esi
test eax, eax
jne 0x48a21a
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xe0
ret 4
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push edx
push ecx
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x18]
push eax
push ecx
call esi
test eax, eax
pop edi
pop esi
setne al
pop ebx
add esp, 0xe0
ret 4
Function at 0x48dca0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0xffffffff
jne 0x48dcaf
xor al, al
pop esi
pop ecx
ret
mov ecx, esi
call fcn.0048dd80
test al, al
je 0x48dcbf
xor al, al
pop esi
pop ecx
ret
mov eax, dword [esi + 0x20]
test eax, eax
je 0x48dcd4
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 0
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x48dda0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x20], eax
test eax, eax
setne cl
mov al, cl
pop esi
pop ecx
ret

Function at 0x48dd00
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x48dd4e
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0x20]
push ecx
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x48dd33
mov eax, dword [esi + 0x20]
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov ecx, dword [esi + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ResetEvent]
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 0
pop esi
ret 4
Function at 0x490c60
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b31c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00489cd0
mov esi, dword [esp + 0x38]
xor edi, edi
push esi
mov dword [esp + 0x34], edi
call dword [sym.imp.kernel32.dll_DeleteFileA]
push edi
push 1
push 1
push esi
lea ecx, [esp + 0x28]
call fcn.00489d20
test al, al
jne 0x490cc3
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00489d10
xor al, al
jmp 0x490da4
mov eax, dword [ebx + 8]
mov dword [esp + 0x10], 3
cmp eax, edi
jne 0x490cd8
mov dword [esp + 0x14], edi
jmp 0x490ce4
mov ecx, dword [ebx + 0xc]
sub ecx, eax
sar ecx, 2
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x10]
push 8
push edx
lea ecx, [esp + 0x20]
call fcn.00489eb0
cmp eax, 8
je 0x490d11
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00489d10
xor al, al
jmp 0x490da4
xor esi, esi
mov eax, dword [ebx + 8]
test eax, eax
je 0x490d91
mov ecx, dword [ebx + 0xc]
sub ecx, eax
sar ecx, 2
cmp esi, ecx
jae 0x490d91
mov edx, dword [eax + esi*4]
push 0x130
push edx
lea ecx, [esp + 0x20]
call fcn.00489eb0
cmp eax, 0x130
jne 0x490cf9
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + esi*4]
add eax, 0x130
mov edx, dword [eax + 4]
test edx, edx
jne 0x490d55
xor ebp, ebp
jmp 0x490d5a
mov ebp, dword [eax + 8]
sub ebp, edx
mov eax, dword [ecx + esi*4]
mov ecx, dword [eax + 0x134]
mov edx, dword [eax + 0x134]
add eax, 0x130
test ecx, ecx
jne 0x490d76
xor edi, edi
jmp 0x490d7b
mov edi, dword [eax + 8]
sub edi, ecx
push ebp
push edx
lea ecx, [esp + 0x20]
call fcn.00489eb0
cmp eax, edi
jne 0x490cf9
inc esi
jmp 0x490d13
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00489d10
mov al, 1
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x491d40
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b324b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
call fcn.00489cd0
lea eax, [esp + 0x12c]
mov dword [esp + 0x63c], 0
push eax
push 0x105
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
jbe 0x491f09
lea ecx, [esp + 0x24]
lea edx, [esp + 0x12c]
push ecx
push 0
push 0x4d83ac
push edx
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
push 0
push 1
lea eax, [esp + 0x2c]
push 1
push eax
lea ecx, [esp + 0x24]
call fcn.00489d20
test al, al
je 0x491f09
mov edi, dword [esp + 0x644]
mov ebp, dword [sym.imp.kernel32.dll_Sleep]
lea ebx, [esi + 0x2c]
mov ecx, ebx
call fcn.0048a6c0
mov ecx, esi
call fcn.0048dd60
test al, al
jne 0x491eee
lea ecx, [esp + 0x14]
call fcn.00489f80
cmp eax, dword [esi + 0xb5c]
ja 0x491eee
mov ecx, ebx
call fcn.0048a6d0
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
lea ecx, [edx + edi + 4]
call fcn.004846c0
test al, al
je 0x491e97
mov eax, dword [edi + 4]
mov dword [esp + 0x10], 0x400
mov ecx, dword [eax + 4]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x238]
mov edx, dword [ecx + edi + 4]
lea ecx, [ecx + edi + 4]
push eax
call dword [edx + 4]
test al, al
je 0x491eb3
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x491e8e
lea ecx, [esp + 0x234]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00489eb0
cmp eax, dword [esp + 0x10]
jne 0x491ef5
mov ecx, ebx
call fcn.0048a6c0
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0xb58]
add eax, edx
mov ecx, ebx
mov dword [esi + 0xb58], eax
call fcn.0048a6d0
jmp 0x491dd6
push 2
call ebp
jmp 0x491dd6
lea ecx, [esp + 0x14]
call fcn.00489f80
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.00489e00
lea eax, [esp + 0x24]
push edi
push eax
jmp 0x491ecd
lea ecx, [esp + 0x14]
call fcn.00489f80
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.00489e00
lea ecx, [esp + 0x24]
push edi
push ecx
mov ecx, esi
call fcn.00492000
lea ecx, [esp + 0x14]
mov bl, al
mov dword [esp + 0x63c], 0xffffffff
call fcn.00489d10
mov al, bl
jmp 0x491f1f
mov ecx, ebx
call fcn.0048a6d0
lea ecx, [esp + 0x14]
call fcn.00489e00
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
mov dword [esp + 0x63c], 0xffffffff
call fcn.00489d10
xor al, al
mov ecx, dword [esp + 0x634]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x630
ret 4
Function at 0x492000
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x2c]
mov ecx, edi
call fcn.0048a6c0
mov eax, dword [esp + 0x120]
mov ecx, dword [esi + 0xb5c]
cmp eax, ecx
mov ecx, edi
je 0x49204b
call fcn.0048a6d0
mov ecx, dword [esp + 0x11c]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x108
ret 8
call fcn.0048a6d0
lea ebx, [esi + 0x949]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x105
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str..old
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call fcn.00486350
mov edi, dword [sym.imp.kernel32.dll_DeleteFileA]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call edi
mov esi, dword [sym.imp.kernel32.dll_MoveFileA]
lea eax, [esp + 0x10]
push eax
push ebx
call esi
mov ebp, dword [esp + 0x11c]
push ebx
push ebp
call esi
test eax, eax
jne 0x4920d4
push ebp
call edi
lea ecx, [esp + 0x10]
push ebx
push ecx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x108
ret 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x108
ret 8
Function at 0x492200
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b32e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x4ba76c
push 0x36ee80
mov dword [esp + 0x30], 5
call fcn.0048dd00
mov ecx, esi
call fcn.004929b0
mov eax, dword [esi + 0x68]
mov edi, dword [eax]
cmp edi, eax
je 0x49225b
mov ecx, dword [edi + 8]
call fcn.00493820
mov edi, dword [edi]
mov eax, dword [esi + 0x68]
cmp edi, eax
jne 0x49224a
mov eax, dword [esi + 0x68]
xor ebx, ebx
mov edi, dword [eax]
cmp edi, eax
je 0x49227c
mov ecx, dword [edi + 8]
cmp ecx, ebx
je 0x492273
mov eax, dword [ecx]
push 1
call dword [eax]
mov edi, dword [edi]
mov eax, dword [esi + 0x68]
cmp edi, eax
jne 0x492266
mov ebp, dword [esi + 0x68]
lea edi, [esi + 0x64]
mov eax, dword [ebp]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x4922b1
lea ecx, [esp + 0x18]
push ebx
push ecx
lea ecx, [esp + 0x18]
call fcn.0048d470
mov edx, dword [eax]
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, edi
call fcn.00492d20
cmp dword [esp + 0x10], ebp
jne 0x49228d
mov eax, dword [esi + 0x8c]
mov ebp, dword [esi + 0x88]
cmp ebp, eax
mov byte [esp + 0x2c], 4
mov dword [esp + 0x10], eax
je 0x4922dd
push ebx
mov ecx, ebp
call fcn.00493230
mov eax, dword [esp + 0x10]
add ebp, 0x18
cmp ebp, eax
jne 0x4922ca
mov eax, dword [esi + 0x88]
push eax
call fcn.004a2a3d
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov ebp, dword [edi + 4]
add esp, 4
mov byte [esp + 0x2c], 3
mov eax, dword [ebp]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x492335
lea ecx, [esp + 0x1c]
push ebx
push ecx
lea ecx, [esp + 0x18]
call fcn.0048d470
mov edx, dword [eax]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, edi
call fcn.00492d20
cmp dword [esp + 0x10], ebp
jne 0x492311
mov eax, dword [edi + 4]
push eax
call fcn.004a2a3d
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x58]
push eax
mov dword [esp + 0x28], eax
call fcn.004a2a3d
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov eax, dword [esi + 0x48]
push eax
mov dword [esp + 0x2c], eax
call fcn.004a2a3d
add esp, 0xc
lea ecx, [esi + 0x28]
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov byte [esp + 0x2c], bl
call fcn.004839c0
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.0048dc30
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x492b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b3323
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
mov ebp, ecx
push 0x54
call fcn.004a2a14
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x30], 0
je 0x492b4f
mov ecx, eax
call fcn.00483eb0
jmp 0x492b51
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
push ecx
push esi
mov ecx, eax
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x10], eax
call fcn.004841f0
test al, al
jne 0x492b95
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x492b80
mov edx, dword [ecx]
push 1
call dword [edx]
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov al, byte [esp + 0x40]
push ebx
push edi
push 0
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
call fcn.00410c90
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], 1
mov word [esp + 0x18], si
call fcn.004841b0
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebx, ecx
lea ecx, [esp + 0x20]
push ebx
call fcn.00410dd0
test al, al
je 0x492c00
mov edi, dword [esp + 0x20]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov byte [eax + ebx], 0
mov ecx, dword [esp + 0x48]
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x2c], ecx
lea ecx, [ebp + 0x84]
lea edx, [esp + 0x18]
push edx
push 1
push eax
call fcn.00492da0
mov eax, dword [ebp + 0x4c]
lea ecx, [ebp + 0x44]
lea edx, [esp + 0x10]
push edx
push 1
push eax
call fcn.004167b0
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp + 0x54]
lea edx, [esp + 0x48]
push edx
push 1
push eax
call fcn.004167b0
mov eax, dword [esp + 0x20]
pop edi
test eax, eax
pop ebx
je 0x492c6e
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x492c65
cmp al, 0xff
je 0x492c65
dec al
mov byte [ecx], al
jmp 0x492c6e
push ecx
call fcn.004a2a3d
add esp, 4
mov ecx, dword [esp + 0x28]
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x494010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b3454
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], esi
mov dword [esi + 0x2c], 1
mov byte [esi + 0x938], al
mov dword [esi + 0x93c], ebx
mov dword [esi + 0x940], ebx
mov dword [esi + 0x944], ebx
lea ecx, [esi + 0xbbc]
mov dword [esp + 0x18], ebx
mov dword [esi + 0xab0], 0xffffffff
call fcn.0048d830
mov cl, byte [esp + 0xb]
mov byte [esi + 0x1bdc], bl
mov dword [esi + 0x1c44], ebx
mov byte [esi + 0x1cac], bl
mov byte [esi + 0x1cad], bl
mov dword [esi + 0x1cb0], ebx
mov dword [esi + 0x1cb4], ebx
mov byte [esi + 0x1cb8], 1
mov dword [esi + 0x1cbc], ebx
mov dword [esi + 0x1cc0], ebx
mov dword [esi + 0x1cc4], ebx
mov byte [esi + 0x1ccc], cl
mov dword [esi + 0x1cd0], ebx
mov dword [esi + 0x1cd4], ebx
mov dword [esi + 0x1cd8], ebx
mov dl, byte [esp + 0xb]
mov byte [esi + 0x1cdc], bl
mov dword [esi + 0x1ce0], ebx
mov dword [esi + 0x20e4], ebx
mov dword [esi + 0x20e8], ebx
mov byte [esi + 0x20ec], dl
mov dword [esi + 0x20f0], ebx
mov dword [esi + 0x20f4], ebx
mov dword [esi + 0x20f8], ebx
mov al, byte [esp + 0xb]
mov byte [esi + 0x20fc], bl
mov byte [esi + 0x20fd], bl
mov dword [esi + 0x2100], ebx
mov byte [esi + 0x2104], bl
mov dword [esi + 0x2108], ebx
mov dword [esi + 0x210c], ebx
mov byte [esi + 0x2110], al
mov dword [esi + 0x2114], ebx
mov dword [esi + 0x2118], ebx
mov dword [esi + 0x211c], ebx
mov cl, byte [esp + 0xb]
mov dword [esi + 0x2124], ebx
mov byte [esi + 0x2120], cl
mov dword [esi + 0x2128], ebx
mov dword [esi + 0x212c], ebx
lea ecx, [esi + 0x2134]
mov byte [esp + 0x18], 5
mov dword [esi + 0x2130], ebx
call fcn.00489cd0
mov byte [esi + 0x2144], bl
mov byte [esi + 0x2145], bl
mov dword [esi], 0x4ba78c
mov byte [esi + 4], bl
mov byte [esi + 0x18], bl
mov byte [esi + 0x30], bl
mov byte [esi + 0x135], bl
mov byte [esi + 0x948], bl
mov byte [esi + 0xa49], bl
mov byte [esi + 0xab4], bl
mov byte [esi + 0x1bdd], bl
mov byte [esi + 0x1c48], bl
mov byte [esi + 0x2146], bl
mov byte [esi + 0x1ce4], bl
mov byte [esi + 0x224b], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x49402d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b3454
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0xc], esi
mov dword [esi + 0x2c], 1
mov byte [esi + 0x938], al
mov dword [esi + 0x93c], ebx
mov dword [esi + 0x940], ebx
mov dword [esi + 0x944], ebx
lea ecx, [esi + 0xbbc]
mov dword [esp + 0x18], ebx
mov dword [esi + 0xab0], 0xffffffff
call fcn.0048d830
mov cl, byte [esp + 0xb]
mov byte [esi + 0x1bdc], bl
mov dword [esi + 0x1c44], ebx
mov byte [esi + 0x1cac], bl
mov byte [esi + 0x1cad], bl
mov dword [esi + 0x1cb0], ebx
mov dword [esi + 0x1cb4], ebx
mov byte [esi + 0x1cb8], 1
mov dword [esi + 0x1cbc], ebx
mov dword [esi + 0x1cc0], ebx
mov dword [esi + 0x1cc4], ebx
mov byte [esi + 0x1ccc], cl
mov dword [esi + 0x1cd0], ebx
mov dword [esi + 0x1cd4], ebx
mov dword [esi + 0x1cd8], ebx
mov dl, byte [esp + 0xb]
mov byte [esi + 0x1cdc], bl
mov dword [esi + 0x1ce0], ebx
mov dword [esi + 0x20e4], ebx
mov dword [esi + 0x20e8], ebx
mov byte [esi + 0x20ec], dl
mov dword [esi + 0x20f0], ebx
mov dword [esi + 0x20f4], ebx
mov dword [esi + 0x20f8], ebx
mov al, byte [esp + 0xb]
mov byte [esi + 0x20fc], bl
mov byte [esi + 0x20fd], bl
mov dword [esi + 0x2100], ebx
mov byte [esi + 0x2104], bl
mov dword [esi + 0x2108], ebx
mov dword [esi + 0x210c], ebx
mov byte [esi + 0x2110], al
mov dword [esi + 0x2114], ebx
mov dword [esi + 0x2118], ebx
mov dword [esi + 0x211c], ebx
mov cl, byte [esp + 0xb]
mov dword [esi + 0x2124], ebx
mov byte [esi + 0x2120], cl
mov dword [esi + 0x2128], ebx
mov dword [esi + 0x212c], ebx
lea ecx, [esi + 0x2134]
mov byte [esp + 0x18], 5
mov dword [esi + 0x2130], ebx
call fcn.00489cd0
mov byte [esi + 0x2144], bl
mov byte [esi + 0x2145], bl
mov dword [esi], 0x4ba78c
mov byte [esi + 4], bl
mov byte [esi + 0x18], bl
mov byte [esi + 0x30], bl
mov byte [esi + 0x135], bl
mov byte [esi + 0x948], bl
mov byte [esi + 0xa49], bl
mov byte [esi + 0xab4], bl
mov byte [esi + 0x1bdd], bl
mov byte [esi + 0x1c48], bl
mov byte [esi + 0x2146], bl
mov byte [esi + 0x1ce4], bl
mov byte [esi + 0x224b], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x494200
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b34c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4ba78c
lea ebp, [esi + 0xbbc]
mov dword [esp + 0x20], 6
mov ecx, ebp
call fcn.0048d910
lea ecx, [esi + 0x2134]
call fcn.00489e00
mov al, byte [esi + 0x1bdc]
mov edi, dword [sym.imp.kernel32.dll_DeleteFileA]
xor ebx, ebx
cmp al, bl
je 0x494263
lea eax, [esi + 0xab4]
push eax
call edi
mov cl, byte [esi + 0x2146]
lea eax, [esi + 0x2146]
cmp cl, bl
je 0x494276
push eax
call edi
xor edi, edi
mov eax, dword [esi + 0x93c]
cmp eax, ebx
je 0x4942a2
mov ecx, dword [esi + 0x940]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x4942a2
mov edx, eax
mov eax, dword [edx + edi*4]
push eax
call fcn.004a2a3d
add esp, 4
inc edi
jmp 0x494278
xor edi, edi
mov eax, dword [esi + 0x1cd0]
cmp eax, ebx
je 0x4942ce
mov ecx, dword [esi + 0x1cd4]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x4942ce
mov edx, eax
mov eax, dword [edx + edi*4]
push eax
call fcn.004a2a3d
add esp, 4
inc edi
jmp 0x4942a4
xor edi, edi
mov eax, dword [esi + 0x20f0]
cmp eax, ebx
je 0x4942fa
mov ecx, dword [esi + 0x20f4]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x4942fa
mov edx, eax
mov eax, dword [edx + edi*4]
push eax
call fcn.004a2a3d
add esp, 4
inc edi
jmp 0x4942d0
mov eax, dword [esi + 0x1cbc]
cmp eax, ebx
je 0x49430d
push eax
call fcn.004a2a3d
add esp, 4
mov eax, dword [esi + 0x20e8]
cmp eax, ebx
je 0x494320
push eax
call fcn.004a2a3d
add esp, 4
lea ecx, [esi + 0x2134]
mov byte [esp + 0x20], 5
call fcn.00489d10
mov eax, dword [esi + 0x2124]
push eax
mov dword [esp + 0x18], eax
call fcn.004a2a3d
mov dword [esi + 0x2124], ebx
mov dword [esi + 0x2128], ebx
mov dword [esi + 0x212c], ebx
mov eax, dword [esi + 0x2114]
push eax
mov dword [esp + 0x1c], eax
call fcn.004a2a3d
mov dword [esi + 0x2114], ebx
mov dword [esi + 0x2118], ebx
mov dword [esi + 0x211c], ebx
mov eax, dword [esi + 0x20f0]
push eax
mov dword [esp + 0x20], eax
call fcn.004a2a3d
mov dword [esi + 0x20f0], ebx
mov dword [esi + 0x20f4], ebx
mov dword [esi + 0x20f8], ebx
mov eax, dword [esi + 0x1cd0]
push eax
mov dword [esp + 0x24], eax
call fcn.004a2a3d
add esp, 0x10
mov ecx, ebp
mov dword [esi + 0x1cd0], ebx
mov dword [esi + 0x1cd4], ebx
mov dword [esi + 0x1cd8], ebx
mov byte [esp + 0x20], bl
call fcn.0048d880
mov eax, dword [esi + 0x93c]
push eax
mov dword [esp + 0x18], eax
call fcn.004a2a3d
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x93c], ebx
mov dword [esi + 0x940], ebx
mov dword [esi + 0x944], ebx
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret