joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x4aaafa
cmp dword [esi + 0x20], 0
je 0x4aaafa
cmp dword [esi + 0x24], 0
je 0x4aaafa
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4aaafa
cmp dword [ecx], esi
jne 0x4aaafa
mov eax, dword [ecx + 4]
cmp eax, 0x2a
je 0x4aa993
cmp eax, 0x39
je 0x4aa993
cmp eax, 0x45
je 0x4aa993
cmp eax, 0x49
je 0x4aa993
cmp eax, 0x5b
je 0x4aa993
cmp eax, 0x67
je 0x4aa993
cmp eax, 0x71
je 0x4aa993
cmp eax, 0x29a
jne 0x4aaafa
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 8]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], eax
test edx, edx
jns 0x4aa9c8
neg edx
mov dword [ecx + 0x18], edx
cmp edx, 2
jne 0x4aa9d2
lea eax, [edx + 0x37]
jmp 0x4aa9e3
push edi
mov edi, 0x2a
test edx, edx
mov eax, 0x71
cmovne eax, edi
pop edi
mov dword [ecx + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [esi + 0x30], eax
lea eax, [ecx + 0x94]
mov dword [ecx + 0xb18], eax
lea eax, [ecx + 0x988]
mov dword [ecx + 0xb24], eax
lea eax, [ecx + 0xa7c]
mov dword [ecx + 0xb30], eax
xor eax, eax
mov dword [ecx + 0x28], 0
mov dword [ecx + 0xb20], 0x62e02c
mov dword [ecx + 0xb2c], 0x62e0dc
mov dword [ecx + 0xb38], 0x62e084
mov word [ecx + 0x16b8], ax
mov dword [ecx + 0x16bc], eax
call fcn.004b05c0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.0058c8f0
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x641b8a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x641b88]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x641b8c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x641b8e]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x4afdb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4afdbb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004afdf0
Function at 0x4b03e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x108], edx
push edi
mov edi, dword [ebp + 8]
test esi, esi
jg 0x4b0416
jl 0x4b04fb
test edi, edi
je 0x4b04fb
mov ecx, 1
mov dword [ebp - 0x84], 0xedb88320
mov eax, ecx
nop word [eax + eax]
mov dword [ebp + eax*4 - 0x84], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x4b0430
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x104]
call fcn.004b0380
lea edx, [ebp - 0x104]
lea ecx, [ebp - 0x84]
call fcn.004b0380
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x104]
call fcn.004b0380
mov eax, edi
and eax, 1
or eax, 0
je 0x4b049d
xor ecx, ecx
lea eax, [ebp - 0x104]
test ebx, ebx
je 0x4b049b
mov edx, ebx
test bl, 1
je 0x4b0491
xor ecx, dword [eax]
shr ebx, 1
add eax, 4
cmp edx, 2
jae 0x4b0488
mov ebx, ecx
shrd edi, esi, 1
sar esi, 1
mov eax, edi
or eax, esi
je 0x4b04f5
lea edx, [ebp - 0x104]
lea ecx, [ebp - 0x84]
call fcn.004b0380
mov eax, edi
and eax, 1
or eax, 0
je 0x4b04e5
xor ecx, ecx
lea eax, [ebp - 0x84]
test ebx, ebx
je 0x4b04e3
mov edx, ebx
test bl, 1
je 0x4b04d9
xor ecx, dword [eax]
shr ebx, 1
add eax, 4
cmp edx, 2
jae 0x4b04d0
mov ebx, ecx
shrd edi, esi, 1
sar esi, 1
mov eax, edi
or eax, esi
jne 0x4b0461
xor ebx, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret
Function at 0x4b2c40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
test eax, eax
je 0x4b2d50
xor edx, edx
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], dx
push ecx
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edx
push str.cmddump_file__s__moduleid__s__
push eax
call fcn.004b2b00
lea eax, [ebp - 0x44]
push eax
call fcn.00579160
add esp, 0x14
mov edx, dword [eax]
xor eax, eax
mov ecx, edx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2cd0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00449bc0
mov edx, dword [ebp - 0x44]
or eax, 0xffffffff
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b2d08
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x11
push str.QQWBBugReport.exe
lea ecx, [ebp - 0x28]
call fcn.0044ed80
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push 0
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 0
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x5ff750
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.00449860
lea ecx, [ebp - 0x40]
call fcn.004b2aa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret

Function at 0x4b3530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc08
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc04]
push 0xc00
push 0
push eax
call fcn.0058c8f0
add esp, 0xc
lea eax, [ebp - 0xc08]
push 0
push eax
push 0xc00
lea eax, [ebp - 0xc04]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
test eax, eax
jne 0x4b3584
call fcn.004b34f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret
Function at 0x4b3bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea486
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1d8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1c0], esi
mov dword [ebp - 0x1a4], edi
call fcn.004b2ff0
cmp dword [ebp - 0x1cc], 0
mov dword [ebp - 4], 0
jne 0x4b3c3e
xor eax, eax
jmp 0x4b3d00
push 0x62a144
mov ecx, esi
call fcn.004b50a0
push 0x62a144
mov ecx, edi
call fcn.004b50a0
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0
push 0
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 1
push SysReAllocString
push eax
call fcn.004b3700
mov edi, dword [ebp - 0x1b4]
add esp, 0xc
test eax, eax
js 0x4b3cc8
push 0
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1ac], 0
push eax
push 4
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x1a8], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b3d1c
call fcn.004b34f0
test eax, eax
jns 0x4b3d25
xor ebx, ebx
test edi, edi
je 0x4b3cd5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x1a4], 0
push eax
push 1
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x4b3cfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1a8], 4
jne 0x4b3cc8
mov esi, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1a0]
push 0x190
push 0
push eax
mov dword [ebp - 0x1b8], esi
call fcn.0058c8f0
push 1
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1a0]
push eax
push esi
lea eax, [ebp - 0x1b4]
push 4
push eax
call fcn.004b46f0
add esp, 0x24
test eax, eax
je 0x4b3cc8
mov ecx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0x1a0]
mov esi, dword [ebp - 0x1c0]
mov dword [ecx], eax
lea eax, [ebp - 0x190]
push eax
mov ecx, esi
call fcn.004b50a0
mov ecx, dword [ebp - 0x1a4]
lea eax, [ebp - 0x90]
push eax
call fcn.004b50a0
test ebx, ebx
je 0x4b3db7
mov eax, dword [ebp - 0x198]
mov dword [ebx], eax
mov eax, dword [ebp - 0x194]
mov dword [ebx + 4], eax
mov eax, dword [esi]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
setg bl
jmp 0x4b3cca
Function at 0x4b3dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea4c6
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1d8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1c0], edi
call fcn.004b2ff0
cmp dword [ebp - 0x1cc], 0
mov dword [ebp - 4], 0
je 0x4b3eb6
push 0x62a144
mov ecx, esi
call fcn.004b50a0
push 0x62a144
mov ecx, edi
call fcn.004b50a0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0
push 0
lea eax, [ebp - 0x1b0]
mov byte [ebp - 4], 1
push SysReAllocString
push eax
call fcn.004b3700
add esp, 0xc
test eax, eax
jns 0x4b3ebd
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x4b3e8d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 0
push eax
push 1
push dword [ebp - 0x1d0]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x4b3eb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x4b3fab
mov edi, dword [ebp - 0x1b0]
lea eax, [ebp - 0x1a4]
push 0
push eax
push 4
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x1a8], 0
push eax
push edi
mov dword [ebp - 0x1a4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b3fc7
call fcn.004b34f0
test eax, eax
js 0x4b3fd4
mov esi, dword [ebp - 0x1a8]
lea eax, [ebp - 0x1a0]
push 0x190
push 0
push eax
mov dword [ebp - 0x1b8], esi
call fcn.0058c8f0
push 1
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1a0]
push eax
push esi
lea eax, [ebp - 0x1b0]
push 4
push eax
call fcn.004b46f0
add esp, 0x24
test eax, eax
je 0x4b3fd4
mov esi, dword [ebp - 0x1bc]
lea eax, [ebp - 0x190]
push eax
mov ecx, esi
call fcn.004b50a0
mov ecx, dword [ebp - 0x1c0]
lea eax, [ebp - 0x90]
push eax
call fcn.004b50a0
test ebx, ebx
je 0x4b3f89
mov eax, dword [ebp - 0x198]
mov dword [ebx], eax
mov eax, dword [ebp - 0x194]
mov dword [ebx + 4], eax
mov eax, dword [esi]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
setg bl
test edi, edi
je 0x4b3f9e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1d8]
call fcn.004b31a0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1a4], 4
je 0x4b3f05
test edi, edi
je 0x4b3fdf
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1d8]
call fcn.004b31a0
xor eax, eax
jmp 0x4b3fab
Function at 0x4b46f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea5c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6670f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov esi, dword [ebp + 8]
push 0
push ecx
push eax
push dword [esi]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4b4759
call fcn.004b34f0
test eax, eax
jns 0x4b4759
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], 0
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ebx
mov dword [ebp - 4], 0
call fcn.004b3430
mov edi, dword [ebp + 0xc]
test al, al
je 0x4b479e
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b47bd
call fcn.004b34f0
test eax, eax
jns 0x4b47c2
xor ebx, ebx
push edi
call fcn.0050edcc
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x10], ebx
jne 0x4b479e
mov dword [ebp - 0x10], 0
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b3430
mov esi, dword [ebp - 0x10]
test al, al
je 0x4b482b
cmp dword [ebp + 0x1c], 0
je 0x4b47ea
mov eax, 0x667010
jmp 0x4b47ef
call fcn.0057e020
push dword [ebp + 0x18]
push esi
push eax
push ebx
push edi
call fcn.0057d3c0
add esp, 0x14
test eax, eax
je 0x4b482b
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
cmp eax, ebx
ja 0x4b482b
push eax
push esi
push dword [ebp + 0x14]
call fcn.0058bd80
add esp, 0xc
mov ebx, 1
push esi
call fcn.0050edcc
add esp, 4
jmp 0x4b47a0
push esi
xor ebx, ebx
call fcn.0050edcc
add esp, 4
jmp 0x4b47a0
Function at 0x4b5410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea6d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6670f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0
push ecx
push eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4b5479
call fcn.004b34f0
test eax, eax
jns 0x4b5479
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x1c], 0
je 0x4b5488
mov dword [ebp - 0x10], 0x667010
jmp 0x4b5490
call fcn.0057e020
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x14]
push edi
call fcn.0057db50
mov ebx, dword [ebp + 0x18]
add esp, 4
mov dword [ebp + 0xc], 0
mov dword [ebx], eax
push eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.004b3430
mov esi, dword [ebp + 0xc]
push ebx
push esi
push dword [ebp - 0x10]
push edi
push dword [ebp + 0x10]
call fcn.0057d840
add esp, 0x14
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebx]
mov eax, dword [ebp + 8]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b54ed
call fcn.004b34f0
mov edi, eax
jmp 0x4b54ef
xor edi, edi
not edi
push esi
shr edi, 0x1f
call fcn.0050edcc
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6e20
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea868
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add ecx, 4
test byte [eax], 0x10
je 0x4b6f19
xor edx, edx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], dx
cmp dword [ecx + 0x14], 8
mov dword [ebp - 4], edx
jb 0x4b6e76
mov ecx, dword [ecx]
add eax, 0x2c
push eax
push ecx
lea eax, [ebp - 0x28]
push 0x5ffa1c
push eax
call fcn.004b2b00
add esp, 0x10
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.004b6ff0
cmp dword [ebp - 0x14], 8
mov eax, 0x414
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x36], 0
mov dword [ebp - 0x32], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x2e], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4b6f19
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b6f0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b6f36
push edx
push ecx
call fcn.0050ed4e
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret 4
call fcn.005978c6
int3
Function at 0x4b7990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b79b4
cmp word [eax], 0
je 0x4b79b4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b79b4
test al, 0x10
jne 0x4b79b4
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x4b8350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
call fcn.004b8220
mov edi, dword [ebp + 0xc]
mov dword [esi], vtable.Toollib::TextFileWriter.0
mov dword [esi + 0x3c], edi
cmp dword [esi + 0x18], 0
je 0x4b839c
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x4b8380
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4b8402
sub edi, 2
je 0x4b83ee
sub edi, 1
je 0x4b83d0
sub edi, 1
jne 0x4b8402
push edi
lea ecx, [ebp + 8]
push ecx
push 2
push 0x5ffab8
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea ecx, [ebp + 8]
push ecx
push 2
push 0x5ffab4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea ecx, [ebp + 8]
push ecx
push 3
push 0x5ffabc
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4b85e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x18], 0
je 0x4b8683
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jne 0x4b8625
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
jb 0x4b8604
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x4b8683
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x4b8670
cmp ebx, 0xffffffff
je 0x4b8670
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push esi
push ebx
call fcn.004b8070
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
pop ebx
setne al
pop edi
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x20], eax
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4b9df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
test edx, edx
je 0x4b9ea2
cmp word [edx], 0
je 0x4b9ea2
push edi
mov edi, dword [esi + 4]
cmp edi, 0xffffffff
je case.default.0x4b9e2e
mov eax, dword [esi + 0x3c]
dec eax
cmp eax, 3
ja case.default.0x4b9e2e
jmp dword [eax*4 + 0x4b9eb4]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00581340
add esp, 8
lea ecx, [ebp - 0x20]
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push 0
push ecx
push dword [ebp - 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x1c]
call fcn.004b3140
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret 4
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b9e80
sub ecx, esi
lea eax, [ebp - 0x20]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret 4
Function at 0x4ba6d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [0x66705c]
mov edi, ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4ba759
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push 0
push dword [0x667060]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ba750
cmp dword [ebp - 8], eax
je 0x4ba750
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 4
push 0
push dword [0x667064]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4bc590
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x4ba8c0
mov dword [0x66a4c0], eax
call fcn.00597916
push 0x4ba8d0
call fcn.0058ccac
add esp, 8
xor eax, eax
mov word [0x669a98], ax
push 0x103
push 0x669a98
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x669a98
call fcn.0058cb87
add esp, 8
test eax, eax
je 0x4ba7b1
xor ecx, ecx
mov word [eax], cx
add eax, 2
push eax
push 0x669ca0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
push 0x669ea8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x669ea8
push 0x104
push 0x66a0b0
call fcn.005ad6ee
push 0x2e
push 0x669ea8
call fcn.0058cb87
add esp, 0x14
test eax, eax
je 0x4ba80e
push 0x5ffc5c
add eax, 2
push 4
push eax
call fcn.005ad6ee
add esp, 0xc
jmp 0x4ba839
push 0x6453c8
push 0x104
push 0x669ea8
call fcn.005ad7d4
push 0x5ffc5c
push 0x104
push 0x669ea8
call fcn.005ad7d4
add esp, 0x18
push 0x2e
push 0x66a0b0
call fcn.0058cb87
add esp, 8
test eax, eax
je 0x4ba861
push 0x5ffc64
add eax, 2
push 4
push eax
call fcn.005ad6ee
add esp, 0xc
jmp 0x4ba88c
push 0x6453c8
push 0x104
push 0x66a0b0
call fcn.005ad7d4
push 0x5ffc64
push 0x104
push 0x66a0b0
call fcn.005ad7d4
add esp, 0x18
mov eax, edi
mov byte [0x667030], 0
mov dword [0x66a4d4], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4bb8b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
xor bl, bl
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
jne 0x4bb8e8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.005ad9be
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4bb944
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x64528c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4bb944
mov edx, dword [ebp - 8]
mov bl, 1
mov ecx, dword [ebp + 0xc]
movzx eax, word [edx + 0xa]
mov word [ecx], ax
movzx eax, word [edx + 8]
mov word [ecx + 2], ax
movzx eax, word [edx + 0xe]
mov word [ecx + 4], ax
movzx eax, word [edx + 0xc]
mov word [ecx + 6], ax
test esi, esi
je 0x4bb951
push esi
call fcn.005ad75d
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdac0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4bdb19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4bdb19
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4bdb0a
cmp esi, edx
jae 0x4bdb19
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4bdaf8
cmp esi, edx
jae 0x4bdb19
cmp word [esi], 0
je 0x4bdb19
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret