joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2ca0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x6cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x24], ecx
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x77c], ecx
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x780], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x2c], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 0x20]
mov dword [edx + 0x784], eax
cmp dword [ebp + 8], 0
jne 0x4a2d2e
call fcn.004a27f0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x30]
mov edx, dword [eax + 0xc]
call edx
cmp dword [ebp + 0x1c], 0
je 0x4a2d2e
call fcn.004a27f0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x14]
call eax
cmp dword [ebp - 0x28], 0
je 0x4a2d3f
mov ecx, dword [ebp - 0x28]
add ecx, 0x10
mov dword [ebp - 0x38], ecx
jmp 0x4a2d46
mov dword [ebp - 0x38], 0
call fcn.004a27f0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x77c], 0
jne 0x4a2d77
mov ecx, dword [ebp + 0x18]
call fcn.00412f70
mov dword [ebp - 0x40], eax
jmp 0x4a2d9a
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x77c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x77c]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call fcn.00412f70
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x24]
call fcn.0041d560
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 8], edx
push 0
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
mov dword [eax + 0xc], edx
push 0x88
push SysReAllocString
push 0
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.0041cb00
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4a2e15
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x2c], eax
jmp 0x4a2df8
push 5
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e185
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4ace80
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
sub edx, 0x21
mov dword [ebp - 0x214], edx
cmp dword [ebp - 0x214], 0xd
ja case.0x4aceec.8
mov eax, dword [ebp - 0x214]
movzx ecx, byte [eax + 0x4acf8c]
jmp dword [ecx*4 + 0x4acf84]
mov edx, dword [ebp - 0x210]
or edx, 0x100
mov dword [ebp - 0x210], edx
cmp dword [ebp + 0x10], 0
je 0x4acf1c
mov eax, dword [ebp - 0x210]
or eax, 0x1000000
mov dword [ebp - 0x210], eax
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004f2410
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x210]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041d610
mov edx, dword [ebp - 0x218]
or edx, 1
mov dword [ebp - 0x218], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e185
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4acef3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
sub edx, 0x21
mov dword [ebp - 0x214], edx
cmp dword [ebp - 0x214], 0xd
ja case.0x4aceec.8
mov eax, dword [ebp - 0x214]
movzx ecx, byte [eax + 0x4acf8c]
jmp dword [ecx*4 + 0x4acf84]
mov edx, dword [ebp - 0x210]
or edx, 0x100
mov dword [ebp - 0x210], edx
cmp dword [ebp + 0x10], 0
je 0x4acf1c
mov eax, dword [ebp - 0x210]
or eax, 0x1000000
mov dword [ebp - 0x210], eax
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004f2410
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x210]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041d610
mov edx, dword [ebp - 0x218]
or edx, 1
mov dword [ebp - 0x218], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e185
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b3a72
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x258
mov eax, 0x63af33
call fcn.0040eae7
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], cx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.004040a3
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push ebx
push eax
call fcn.004f2410
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push dword [ebp + 0x14]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4b3afa
push 0x6b9448
mov ecx, edi
call fcn.004040a3
jmp 0x4b3bd2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040407c
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
dec eax
push eax
call fcn.004b3d29
cmp word [eax], 0x5c
je 0x4b3b35
push 0x6b9320
lea ecx, [ebp - 0x230]
call fcn.00401918
push esi
lea ecx, [ebp - 0x230]
call fcn.00401918
xor eax, eax
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], ax
lea ecx, [ebp - 0x260]
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x238]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x24c], 7
push eax
call fcn.004047e5
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x260]
call fcn.0040341a
lea ecx, [ebp - 0x260]
mov esi, eax
call fcn.0040199e
test esi, esi
je 0x4b3bc4
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x230]
push eax
call fcn.004018a7
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.004059c3
lea ecx, [ebp - 0x248]
call fcn.0040199e
lea ecx, [ebp - 0x230]
call fcn.0040199e
mov eax, edi
call fcn.0040ea91
ret 0x10
Function at 0x4b4704
Capabilities:
Create process on windows

Disassembly:
push 0x18
mov eax, 0x63b054
call fcn.0040eab3
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
call fcn.00403ee7
push eax
lea ecx, [ebp - 0x10]
call fcn.00403c40
mov byte [ebp - 4], 1
call fcn.00403ee7
push eax
lea ecx, [ebp - 0x18]
call fcn.00403c40
push 0x20119
push str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004b3c0e
mov edi, 0x1000
test eax, eax
jne 0x4b479a
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
call fcn.00403a35
lea ecx, [ebp - 0x14]
push ecx
push eax
push str.InstallLocation
lea ecx, [ebp - 0x24]
call fcn.004b3c63
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.004b4933
test esi, esi
jne 0x4b479a
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], ebx
jne 0x4b47e3
jmp 0x4b479d
mov esi, dword [ebp - 0x10]
push 0x20119
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x24]
call fcn.004b3c0e
test eax, eax
jne 0x4b47e3
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
call fcn.00403a35
lea ecx, [ebp - 0x14]
push ecx
push eax
push str.InstallLocation
lea ecx, [ebp - 0x24]
call fcn.004b3c63
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004b4933
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x4b47ef
mov edi, dword [ebp - 0x18]
jmp 0x4b484f
dec eax
lea ecx, [ebp - 0x10]
push eax
call fcn.004b4684
cmp ax, 0x5c
je 0x4b4811
push 1
push 0x6b9320
lea ecx, [ebp - 0x10]
call fcn.004b4558
mov esi, dword [ebp - 0x10]
push 0x78
push 0x65
push 0x6d
push 0x6f
push 0x72
push 0x68
push 0x63
push esi
lea eax, [ebp - 0x18]
push str._s_c_c_c_c_c_c.e_ce
push eax
call fcn.004b45e4
mov edi, dword [ebp - 0x18]
add esp, 0x28
push 5
push ebx
push dword [ebp + 8]
push edi
push 0x64fbf4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
setg bl
lea ecx, [edi - 0x10]
call fcn.00403f8b
lea ecx, [esi - 0x10]
call fcn.00403f8b
lea ecx, [ebp - 0x24]
call fcn.004b371d
mov eax, ebx
call fcn.0040ea7c
ret
Function at 0x4b486f
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x210
mov eax, 0x63b07a
call fcn.0040eae7
mov esi, dword [ebp + 8]
push 1
push 0
push esi
push str.iexplore.exe
push 0x64fbf4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
setg bl
jle 0x4b48af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
jne 0x4b492b
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004f2410
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00403ee7
push eax
lea ecx, [ebp - 0x21c]
call fcn.00403c40
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x21c]
push str.__sInternet_Exploreriexplore.exe_
push eax
call fcn.004b45e4
add esp, 0xc
push 1
push ebx
push esi
mov esi, dword [ebp - 0x21c]
push esi
push 0x64fbf4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea ecx, [esi - 0x10]
setg bl
call fcn.00403f8b
mov eax, ebx
call fcn.0040ea91
ret

Function at 0x4b495f
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 1
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push 0x64fbf4
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4b4982
pop ebp
jmp fcn.004b486f
pop ebp
ret
Function at 0x4b93b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4b9432
cmp byte [esi + 0x3d], 0
je 0x4b9432
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4b9404
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4b9408
sub eax, 1
je 0x4b940c
dec eax
sub eax, 1
je 0x4b9432
xor al, al
jmp 0x4b9434
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4b9429
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00506ba6
add esp, 0x10
cmp edi, eax
jne 0x4b9404
cmp byte [esi + 0x3d], 0
sete al
jmp 0x4b9434
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040e185
leave
ret

Function at 0x4ba2d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x4ba2f7
xor eax, eax
jmp 0x4ba3b9
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4ba320
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x4ba320
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x4ba3b9
cmp dword [esi + 0x4c], 0
je 0x4ba3b7
mov ecx, esi
call fcn.004b976e
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x4ba34c
push dword [esi + 0x4c]
push eax
call fcn.004b54a0
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x4ba3b7
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4ba3b7
cmp eax, 1
jle 0x4ba386
cmp eax, 3
jne 0x4ba3b7
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x4ba33e
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x4ba3a9
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00506ba6
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x4ba3b7
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x4ba3b9
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e185
leave
ret 4
Function at 0x4bb088
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4bb0aa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004bb166
jmp 0x4bb161
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x4bb0cb
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4bb0cd
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x4bb155
jg 0x4bb0e0
test esi, esi
je 0x4bb155
test ecx, ecx
jl 0x4bb122
jg 0x4bb0ea
test eax, eax
je 0x4bb122
cmp ebx, ecx
jg 0x4bb0fc
jl 0x4bb0f4
cmp esi, eax
jae 0x4bb0fc
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004f25e0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4bb128
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x4bb155
jg 0x4bb132
test esi, esi
je 0x4bb155
cmp dword [edi + 0x4c], 0
je 0x4bb155
mov ecx, edi
call fcn.004b976e
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0050542f
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x4bb235
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4bb257
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004bb309
jmp 0x4bb304
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x4bb278
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4bb27a
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x4bb2f8
jg 0x4bb28d
test esi, esi
je 0x4bb2f8
test ecx, ecx
jl 0x4bb2d1
jg 0x4bb297
test eax, eax
je 0x4bb2d1
cmp edi, ecx
jg 0x4bb2a9
jl 0x4bb2a1
cmp esi, eax
jae 0x4bb2a9
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004f25e0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4bb2d4
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4bb2f8
jg 0x4bb2de
test esi, esi
je 0x4bb2f8
cmp dword [ebx + 0x4c], 0
je 0x4bb2f8
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.00506ba6
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4bc29e
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x6cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bc2cd
push 2
pop eax
jmp 0x4bc355
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004bc0b1
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.004f2410
add esp, 0x14
mov dword [ebp - 0x58], edi
test ebx, ebx
mov dword [ebp - 0x48], esi
mov ecx, 0x64fbf4
mov dword [ebp - 0x54], 0x40
mov eax, 0x650310
mov dword [ebp - 0x3c], 5
cmove eax, ecx
cmp dword [ebp - 8], 8
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
and dword [ebp - 0x40], 0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 0
mov esi, eax
je 0x4bc34b
cmp dword [ebp + 0x10], 0
je 0x4bc34b
push dword [ebp + 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x1c]
call fcn.0040199e
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e185
leave
ret
Function at 0x4bd765
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x63c032
call fcn.0040eae7
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
call fcn.004bd492
and dword [ebp - 4], 0
lea esi, [edi + 4]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4bd797
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x650378
call fcn.00401918
push 0x65037c
mov ecx, esi
call fcn.00401918
push 0x6b9320
mov ecx, esi
call fcn.00401918
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.004018a7
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4bd7ec
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd884
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004f2410
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004bd472
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4bd843
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00401918
push 0x6b9320
mov ecx, esi
call fcn.00401918
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.004018a7
cmp dword [esi + 0x14], 8
jb 0x4bd88c
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [edi + 0x1c]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4bd8a4
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x650378
call fcn.00401918
push 0x65037c
mov ecx, esi
call fcn.00401918
push 0x6b9320
mov ecx, esi
call fcn.00401918
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.004bd4f1
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040479d
lea ecx, [ebp - 0x248]
call fcn.0040199e
lea ecx, [ebp - 0x230]
call fcn.0040199e
call fcn.0040ea91
ret
Function at 0x4be930
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x63c1f5
call fcn.0040eae7
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x4be951
push dword [esi + 0x1c]
call fcn.0050c51d
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004bde8a
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00506de2
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x4be9d5
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.004bde8a
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004bde8a
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.0040199e
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0040199e
sub edi, 1
jns 0x4be97f
mov ecx, esi
call fcn.004be80f
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.0040199e
call fcn.0040ea91
ret

Function at 0x4be9ee
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x63c1f5
call fcn.0040eae7
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x4bea0f
push dword [esi + 0x1c]
call fcn.0050c51d
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004bde8a
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00506de2
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x4bea93
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.004bde8a
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004bde8a
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.0040199e
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0040199e
sub edi, 1
jns 0x4bea3d
mov ecx, esi
call fcn.004be8a6
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.0040199e
call fcn.0040ea91
ret