joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7c04
Capabilities:
Write file on windows

Disassembly:
push 8
mov eax, 0x50f3e4
call fcn.004cea03
mov esi, ecx
xor ebx, ebx
cmp dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 0x10], ebx
jne 0x4a7c3b
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ebx
mov word [eax], cx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
jmp 0x4a7c8f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0x10]
add eax, eax
cmp dword [ecx + 0x14], 8
jb 0x4a7c4b
mov ecx, dword [ecx]
push ebx
lea edx, [ebp + 0x10]
push edx
push eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a7c73
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ebx
mov word [eax], cx
jmp 0x4a7c2f
push 1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004a7a86
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
call fcn.004ce9cc
ret 0xc

Function at 0x4a7c97
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov edx, dword [eax + 0x10]
add edx, edx
cmp dword [eax + 0x14], 8
jb 0x4a7cad
mov eax, dword [eax]
push 0
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4
Function at 0x4a8da5
Capabilities:
Parse credit card information

Disassembly:
push 0x64
mov eax, 0x50f755
call fcn.004cea37
mov esi, ecx
xor ebx, ebx
xor eax, eax
mov edi, str.PIDTemplate
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
push edi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
call fcn.004d3ded
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00407ba8
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 4]
push edx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ecx]
call dword [eax]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.004048ce
mov ecx, dword [ebp - 0x18]
cmp ecx, 3
jb 0x4a8f73
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax], 0x3c
jne 0x4a8f73
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x3e
jne 0x4a8f73
lea eax, [ecx - 2]
push eax
push 1
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x28]
call fcn.004195c1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
push eax
call fcn.0040f1ab
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
push ebx
push 1
call fcn.004048ce
xor eax, eax
mov dword [ebp - 0x30], ebx
mov edi, str.PIDKEY
mov dword [ebp - 0x2c], ebx
push edi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
call fcn.004d3ded
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00407ba8
mov byte [ebp - 4], 4
lea edx, [ebp - 0x40]
mov ecx, dword [esi + 4]
push edx
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ecx]
call dword [eax]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.004048ce
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x18]
jne 0x4a8f63
mov esi, ebx
test eax, eax
je 0x4a8f5d
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x44]
mov edi, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x28]
cmp ebx, 8
lea eax, [ebp - 0x28]
cmovae eax, ecx
movzx eax, word [eax + esi*2]
cmp eax, 0x3d
ja 0x4a8f1f
je 0x4a8f53
sub eax, 0x23
je 0x4a8efc
dec eax
sub eax, 1
je 0x4a8efc
sub eax, 1
jmp 0x4a8f31
cmp edx, 8
lea eax, [ebp - 0x58]
cmovae eax, edi
movzx eax, word [eax + esi*2]
push eax
call fcn.004d7ebd
pop ecx
test eax, eax
je 0x4a8f61
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x44]
mov edi, dword [ebp - 0x58]
jmp 0x4a8f50
cmp eax, 0x3f
jb 0x4a8f33
cmp eax, 0x40
jbe 0x4a8f53
cmp eax, 0x5e
je 0x4a8f53
cmp eax, 0x60
je 0x4a8f53
cmp edx, 8
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x28]
cmovae eax, edi
cmp ebx, 8
cmovae ecx, dword [ebp - 0x28]
mov ax, word [eax + esi*2]
cmp ax, word [ecx + esi*2]
jne 0x4a8f61
mov ecx, dword [ebp - 0x28]
inc esi
cmp esi, dword [ebp - 0x48]
jb 0x4a8ed8
mov bl, 1
jmp 0x4a8f63
xor ebx, ebx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
push 0
push 1
call fcn.004048ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.004048ce
mov al, bl
call fcn.004ce9e1
ret
Function at 0x4abdad
Capabilities:
Check if file exists

Disassembly:
push 0x50
mov eax, 0x51002c
call fcn.004cea37
mov edi, dword [ebp + 8]
sub esp, 0x18
add edi, 4
mov dword [ebp - 0x5c], esp
mov ecx, esp
push edi
call fcn.0040a832
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00465390
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4abe3e
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00466ec0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x4abdfd
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov byte [ebp - 4], bl
push 0
push ebx
lea ecx, [ebp - 0x40]
call fcn.004048ce
test esi, esi
jne 0x4abe70
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00467650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.0045cc80
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x58]
push esi
push ebx
call fcn.004048ce
cmp dword [ebp - 0x18], 0
jne 0x4abde5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push ebx
call fcn.004048ce
cmp dword [edi + 0x14], 8
jb 0x4abe5b
mov edi, dword [edi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
neg eax
sbb eax, eax
neg eax
call fcn.004ce9e1
ret 4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push ebx
call fcn.004048ce
mov al, bl
jmp 0x4abe68
Function at 0x4af383
Capabilities:
Reference sql statements

Disassembly:
push 0x68
mov eax, 0x510bf9
call fcn.004cea37
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, str.prereq
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
call fcn.004d3ded
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00407ba8
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0045135c
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.004048ce
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov ebx, str.SELECT__Data__FROM__Binary__WHERE__Name___Prereq.dll
push ebx
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.004d3ded
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x44]
call fcn.00407ba8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.004a0a2f
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
push 0
push 1
call fcn.004048ce
cmp dword [ebp - 0x48], 8
lea ecx, [ebp - 0x5c]
cmovae ecx, dword [ebp - 0x5c]
call fcn.00415142
mov dword [ebp - 0x60], eax
lea edx, [ebp - 0x68]
push dword [ebp - 0x60]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], eax
call fcn.004b369a
pop ecx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x60], 0
je 0x4af48a
push str.InstallPrereq
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4af48a
push esi
call eax
mov dword [edi], eax
mov bl, 1
jmp 0x4af48c
xor bl, bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
call fcn.004b3200
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
push 0
push 1
call fcn.004048ce
mov al, bl
call fcn.004ce9e1
ret 4
Function at 0x4b2457
Capabilities:
Get common file path

Disassembly:
push 0x230
mov eax, 0x51159e
call fcn.004cea37
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
mov esi, dword [ebp + 8]
push 0x104
push eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add eax, eax
cmp eax, 0x208
jae 0x4b254e
sub esp, 0x18
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
mov ecx, esp
lea eax, [ebp - 0x218]
mov dword [ebp - 0x23c], esp
push eax
call fcn.00407c3b
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.00465390
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x234], edi
mov edi, str.msiexec.exe
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
cmp word [str.msiexec.exe], ax
jne 0x4b250a
mov eax, ebx
jmp 0x4b2511
push edi
call fcn.004d3ded
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.00407ba8
mov dword [ebp - 4], 2
lea eax, [ebp - 0x230]
push eax
mov ecx, esi
call fcn.00425d47
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x230]
push ebx
push 1
call fcn.004048ce
mov eax, esi
call fcn.004ce9e1
ret 4
call fcn.004ce683
int3
Function at 0x4b3dff
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x80
mov eax, 0x511b6e
call fcn.004cea37
mov esi, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, esp
mov dword [ebp - 0x74], esp
mov dword [ebp - 0x8c], eax
push esi
call fcn.00407c3b
xor edi, edi
mov dword [ebp - 4], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00465390
mov dword [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x70]
call fcn.00465870
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x4b3e58
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
mov dword [ebp - 0x74], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.004048ce
mov eax, dword [ebp + 0xc]
cmp ebx, 3
jne 0x4b3e82
test eax, 0x20000
jne 0x4b3ec6
cmp ebx, 2
jne 0x4b3e8e
test eax, 0x10000
jne 0x4b3ec6
cmp ebx, 4
jne 0x4b3e9a
test eax, 0x40000
jne 0x4b3ec6
cmp ebx, 5
jne 0x4b3ea6
test eax, 0x80000
jne 0x4b3ec6
cmp ebx, 6
jne 0x4b3eb2
test eax, 0x100000
jne 0x4b3ec6
cmp ebx, 2
jne 0x4b3f8e
test eax, 0x200000
je 0x4b3f8e
lea eax, [ebp - 0x28]
mov dword [ebp - 0x84], edi
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
call fcn.00465870
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x4b3eed
mov eax, dword [eax]
push edi
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push edi
push 1
call fcn.004048ce
push esi
lea ecx, [ebp - 0x28]
call fcn.00407c3b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 0x78]
mov ebx, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0x80]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040a832
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 7
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004048ce
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x58]
push eax
call fcn.004b5163
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push edi
push 1
call fcn.004048ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
push edi
push 1
call fcn.004048ce
call fcn.004ce9e1
ret 0x18
Function at 0x4c2e81
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4c2fed
mov ebp, 0x10000000
cmp eax, 0x7c
je 0x4c2fed
cmp eax, 0x29
jne 0x4c2eba
cmp dword [esi + 0x10], 0
jne 0x4c2fed
test dword [esi + 0x50], ebp
je 0x4c2ffb
cmp eax, 0x2e
jne 0x4c2ed5
push 5
lea ecx, [esi + 0x24]
call fcn.004c30f8
mov ecx, esi
call fcn.004c2e5c
jmp 0x4c2fd8
cmp eax, 0x5c
jne 0x4c2f32
mov ecx, esi
call fcn.004c2e5c
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4c2f08
cmp word [esi + 0x48], 0x62
jne 0x4c2f08
push 4
lea ecx, [esi + 0x24]
call fcn.004c30f8
mov ecx, esi
call fcn.004c2e5c
jmp 0x4c2fdf
test eax, eax
je 0x4c2f26
cmp word [esi + 0x48], 0x42
jne 0x4c2f26
push 4
lea ecx, [esi + 0x24]
call fcn.004c30f8
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4c2efc
mov ecx, esi
call fcn.004c3bcf
jmp 0x4c2fd8
cmp eax, 0x5b
jne 0x4c2f56
mov ecx, esi
call fcn.004c2e5c
mov ecx, esi
call fcn.004c3b83
cmp dword [esi + 0x4c], 0x5d
je 0x4c2ec9
push 4
jmp 0x4c2ffd
cmp eax, 0x28
jne 0x4c2f7e
mov ecx, esi
call fcn.004c2e5c
mov ecx, esi
call fcn.004c3c7d
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4c2ffb
mov ecx, esi
call fcn.004c2e5c
jmp 0x4c2fd4
cmp eax, 0x5e
jne 0x4c2f8a
push 2
jmp 0x4c2ef4
cmp eax, 0x24
jne 0x4c2f96
push 3
jmp 0x4c2ef4
cmp eax, 0x2a
je 0x4c2ff7
cmp eax, 0x2b
je 0x4c2ff7
cmp eax, 0x3f
je 0x4c2ff7
cmp eax, 0x7b
je 0x4c2ff7
cmp eax, 0x7d
jne 0x4c2fb4
test dword [esi + 0x50], ebp
je 0x4c2ff3
cmp eax, 0x5d
jne 0x4c2fbe
test dword [esi + 0x50], ebp
je 0x4c2f4f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004c3e1c
mov ecx, esi
call fcn.004c2e5c
mov bl, 1
test bl, bl
je 0x4c2fdf
mov ecx, esi
call fcn.004c3d59
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4c2e99
pop esi
pop ebp
mov al, cl
pop ebx
ret
push 6
jmp 0x4c2ffd
push 0xa
jmp 0x4c2ffd
push 5
call fcn.004cb969
int3
Function at 0x4c6d2a
Capabilities:
Get common file path

Disassembly:
push 0x254
mov eax, 0x5162ed
call fcn.004cea37
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x250], eax
add eax, eax
cmp eax, 0x208
jae 0x4c6f04
sub esp, 0x18
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
mov ecx, esp
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x260], esp
push eax
call fcn.00407c3b
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00465390
mov dword [ebp - 4], 1
xor eax, eax
mov esi, str.msi.dll
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
push esi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
call fcn.004d3ded
pop ecx
push eax
push esi
lea ecx, [ebp - 0x234]
call fcn.00407ba8
mov byte [ebp - 4], 2
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00425d47
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
push ebx
push 1
call fcn.004048ce
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x250], ebx
call fcn.00466ec0
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x4c6e3a
mov eax, dword [eax]
mov esi, dword [sym.imp.msi.dll_MsiMessageBoxW]
lea ecx, [ebp - 0x250]
push ebx
push ebx
push ecx
push ebx
push eax
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
push ebx
push 1
call fcn.004048ce
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x25c]
inc eax
push eax
call fcn.00467400
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00466ec0
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x4c6e90
mov eax, dword [eax]
mov edi, dword [ebp - 0x25c]
lea ecx, [ebp - 0x250]
push ebx
push ebx
push ecx
push edi
push eax
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
push ebx
push 1
call fcn.004048ce
mov eax, ebx
mov edx, ebx
cmp edx, dword [ebp - 0x250]
jae 0x4c6ed8
movzx esi, word [edi + edx*2]
cmp esi, 0x2e
je 0x4c6ed2
imul ecx, eax, 0xa
lea eax, [esi - 0x30]
add eax, ecx
inc edx
cmp edx, 3
jb 0x4c6eb9
imul esi, eax, 0xa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x25c]
call fcn.004679a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
push ebx
push 1
call fcn.004048ce
mov eax, esi
call fcn.004ce9e1
ret
call fcn.004ce683
int3
Function at 0x4c82f1
Capabilities:
Delete directory

Disassembly:
push 0xc
mov eax, 0x5167dd
call fcn.004cea03
mov edi, edx
mov esi, ecx
call fcn.00406abb
push eax
lea ecx, [ebp - 0x10]
call fcn.004068e6
mov dword [ebp - 4], 1
mov eax, dword [edi]
push 0x5c
pop ebx
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4c8360
dec eax
mov ecx, edi
push eax
call fcn.0046a4e0
cmp ax, bx
jne 0x4c8360
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00447d83
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00446330
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406bb0
jmp 0x4c8369
push edi
lea ecx, [ebp - 0x10]
call fcn.00446330
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi]
mov eax, dword [eax - 0xc]
cmp eax, dword [ecx - 0xc]
jge 0x4c83c7
push ebx
push ecx
call fcn.004d18c5
pop ecx
pop ecx
test eax, eax
jne 0x4c8388
or eax, 0xffffffff
jmp 0x4c838c
sub eax, dword [esi]
sar eax, 1
push eax
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00447d83
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x4c83b8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.004c82f1
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406bb0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406bb0
call fcn.004ce9cc
ret

Function at 0x4c83dc
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x516820
call fcn.004cea03
mov edi, edx
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4c846f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00406abb
push eax
lea ecx, [ebp - 0x10]
call fcn.004068e6
mov dword [ebp - 4], 1
push 0x5c
push dword [esi]
call fcn.004d18c5
pop ecx
pop ecx
test eax, eax
je 0x4c8450
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x4c8450
push eax
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00447d83
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
push eax
call fcn.00446330
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406bb0
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4c8463
mov edx, edi
lea ecx, [ebp - 0x10]
call fcn.004c82f1
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406bb0
call fcn.004ce9cc
ret
Function at 0x4c8a0f
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x5169d9
call fcn.004cea37
mov dword [ebp - 0x80], edx
mov edx, ecx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x84], edx
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
and dword [ebp - 0x74], 0
mov dword [ebp - 0x78], ecx
mov ecx, edx
push eax
mov dword [ebp - 0x88], edx
call fcn.0040a832
push dword [ebp + 0x1c]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x80]
push esi
push edi
mov edi, dword [ebp - 0x7c]
mov edx, edi
push ebx
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 1
call fcn.004c86e2
add esp, 0x14
cmp dword [edi + 0x14], 8
jb 0x4c8a7f
mov eax, dword [edi]
jmp 0x4c8a81
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x4c8b81
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x84], esp
push edi
call fcn.0040a832
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.00465390
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x58]
call fcn.00467650
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.00466e50
mov esi, eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x40]
call fcn.00466e50
push esi
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0040ff27
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.00404677
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00404677
test esi, esi
jne 0x4c8b69
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00466ec0
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x4c8b2d
mov eax, dword [eax]
push eax
call ebx
test eax, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
setne bl
call fcn.00404677
test bl, bl
je 0x4c8b69
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00466ec0
push eax
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.0040f1ab
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00404677
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00407949
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.00407949
mov eax, edi
call fcn.004ce9e1
ret
Function at 0x4c921a
Capabilities:
Check os version

Disassembly:
push 0x120
mov eax, 0x516ade
call fcn.004cea37
mov esi, ecx
mov dword [ebp - 0x128], esi
call fcn.00423bed
and dword [ebp - 4], 0
lea edi, [esi + 0x20]
push 0x58
push 0
push edi
call fcn.004cfc80
xor eax, eax
mov dword [esi + 0x78], 1
xor ecx, ecx
mov dword [edi], 0x58
lea ebx, [esi + 0x27c]
mov word [esi + 0x7c], cx
push 0x110
mov word [ebx], ax
lea eax, [ebp - 0x120]
push ecx
push eax
mov dword [ebp - 0x124], 0x114
call fcn.004cfc80
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4c92b0
cmp dword [ebp - 0x120], 5
jae 0x4c92b6
cmp dword [ebp - 0x120], 4
jne 0x4c92b0
cmp dword [ebp - 0x11c], 0x5a
jae 0x4c92b6
mov dword [edi], 0x4c
and dword [esi + 0x5c], 0
lea eax, [esi + 0x7c]
mov dword [esi + 0x44], eax
mov eax, esi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0x104
mov dword [esi + 0x48], 0x100
mov dword [esi + 0x54], 0x880024
mov dword [esi + 0x2c], 0x53aab8
mov ecx, dword [0x5723f0]
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x64], 0x4233f6
mov dword [esi + 0x24], ecx
call fcn.004ce9e1
ret 0x18

Function at 0x4c9630
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4cc973
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x516ba4
call fcn.004cea37
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4cca90
cmp byte [ebx + 0x3e], 0
je 0x4cca90
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.004ce98f
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x4cc9bf
xor al, al
jmp 0x4cca92
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004516c6
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4cc9ef
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.004ce98f
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x4cca24
sub eax, 1
je 0x4cca28
dec eax
sub eax, 1
je 0x4cca7e
xor bl, bl
jmp 0x4cca80
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x4cca38
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x4cca60
cmp eax, 0x10
jae 0x4cca47
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004df7e9
add esp, 0x10
cmp esi, eax
jne 0x4cca20
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x4cca7e
test esi, esi
jne 0x4cc9e3
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004040e5
jmp 0x4cc9dd
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040450d
mov al, bl
jmp 0x4cca92
mov al, 1
call fcn.004ce9e1
ret