joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fdb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x48fdec
call fcn.0048fd68
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.0048fc68
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x48fdcb
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48fee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x48ff8f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x48ff79
mov eax, dword [ebp + 8]
call fcn.0048fccc
test eax, eax
jne 0x48ff79
xor ebx, ebx
call fcn.0048fd68
xor edx, edx
mov dl, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
call fcn.0048fc68
xor eax, eax
mov al, bl
mov dl, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x48ff1c
mov bl, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x48ff67
mov eax, dword [ebp - 4]
call fcn.00407acc
call fcn.00407ad0
cmp bl, al
sete al
mov ebx, eax
jmp 0x48ff79
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ff96
lea eax, [ebp + 8]
call fcn.0040482c
ret

Function at 0x492374
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x4923c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4923a9
test al, 0x10
jne 0x4923ad
xor ebx, ebx
jmp 0x4923af
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4923cc
lea eax, [ebp - 4]
call fcn.0040482c
ret

Function at 0x492688
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4926b0
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404a94
jmp 0x4926b9
mov eax, ebx
xor edx, edx
call fcn.00404e68
add esp, 0x104
pop ebx
ret

Function at 0x4928dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x492934
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 0x10
jne 0x492918
test al, 1
jne 0x492918
test al, 4
jne 0x492918
test al, 2
je 0x49291c
xor ebx, ebx
jmp 0x49291e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49293b
lea eax, [ebp - 4]
call fcn.0040482c
ret
Function at 0x492dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404cdc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x492de9
test al, 0x10
jne 0x492ded
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x493b48
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x493b61
add esp, 0xfffffff0
call fcn.00403de4
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.00404ccc
mov eax, dword [ebp + 0xc]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x493c50
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x40], esi
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov eax, esi
mov dword [ebx + 0x5c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0x9c]
mov dword [ebx + 0x58], edx
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x60], 0x49c2b4
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x68], 0x49c4c4
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x50], 0x49c4e0
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x493bf9
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.0049a598
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x70]
call fcn.00404880
lea eax, [ebx + 0x3c]
mov edx, dword [ebp + 0xc]
call fcn.00404880
mov byte [ebx + 0x38], 1
jmp 0x493c10
lea eax, [ebx + 0x70]
mov edx, dword [ebp + 0xc]
call fcn.00404880
lea eax, [ebx + 0x3c]
call fcn.0040482c
mov byte [ebx + 0x38], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x70]
xor edx, edx
mov eax, ebx
call fcn.0049064c
mov ax, word [ebp + 8]
mov word [ebx + 0x4a], ax
mov byte [ebx + 0x48], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493c57
lea eax, [ebp - 8]
call fcn.0040482c
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404850
ret
Function at 0x49a598
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x49a68e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040482c
cmp dword [ebp - 4], 0
je 0x49a5f4
mov eax, dword [ebp - 4]
call fcn.00492374
test al, al
je 0x49a5f4
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.00409eb8
jmp 0x49a605
lea eax, [ebp - 0x109]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040a080
mov eax, dword [ebp - 0x110]
call fcn.00492374
test al, al
jne 0x49a641
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x109]
call fcn.0040a080
mov eax, dword [ebp - 0x114]
call fcn.00492b3c
lea eax, [ebp - 0x109]
push eax
push 0
push 0x49a69c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a695
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404850
lea eax, [ebp - 4]
call fcn.0040482c
ret
Function at 0x49c32c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
mov eax, dword [ebp + 0x14]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x49c4b3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0x10], 0
je 0x49c390
mov eax, dword [ebp - 4]
call fcn.0040989c
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
mov eax, dword [ebp + 0x14]
call fcn.00404cdc
push eax
call sub.kernel32.dll_MoveFileA_1
mov eax, dword [ebp + 0x14]
call fcn.0040989c
jmp 0x49c48d
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x490140]
call fcn.0049064c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x28], 0
jge 0x49c3ee
mov eax, dword [ebp - 8]
call fcn.00403a80
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
push 0
lea edx, [ebp - 0x14]
mov eax, 0x6293
call fcn.00409440
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4148b4]
call fcn.0040cf30
call fcn.0040424c
jmp 0x49c48d
xor eax, eax
push ebp
push 0x49c486
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov dword [ebx + 0x480], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x484], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x500], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x504], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x538], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x53c], eax
push 0
push 0
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 0x564]
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x40]
mov ecx, dword [edx + 0x50]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0xc], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c48d
mov eax, dword [ebp - 8]
call fcn.00403a80
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c4ba
lea eax, [ebp - 0x14]
call fcn.0040482c
lea eax, [ebp - 4]
call fcn.0040482c
lea eax, [ebp + 0x14]
call fcn.0040482c
ret
Function at 0x49c6e8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
xor ebx, ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x168], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x49c7da
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4410
push 0x160
lea eax, [ebp - 0x164]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00404a94
cmp dword [ebp - 0x168], 0
jne 0x49c7a5
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 4]
call fcn.00409b3c
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.00408d40
mov edx, dword [ebp - 0x16c]
mov eax, ebx
mov ecx, 0x49c7f0
call fcn.00404b30
mov eax, ebx
mov ecx, 1
mov edx, 1
call fcn.00404d7c
jmp 0x49c7b4
mov eax, ebx
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00404a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c7e1
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00404850
lea eax, [ebp - 4]
call fcn.0040482c
ret

Function at 0x49f3c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x49f488
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
test al, al
jne 0x49f3f7
cmp byte [esi + 0x45c], 0
je 0x49f3fd
mov byte [ebp - 5], 0
jmp 0x49f472
mov eax, dword [ebp - 4]
call fcn.004928dc
test al, al
jne 0x49f46e
mov byte [ebp - 5], 0
cmp word [esi + 0x3202], 0
je 0x49f450
lea eax, [ebp - 5]
push eax
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [esi + 0x3204]
call dword [esi + 0x3200]
cmp byte [ebp - 5], 0
je 0x49f472
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x49f472
push 0x49f4a0
push 0x62b6
mov ecx, 0x49f4ac
mov edx, dword [ebp - 4]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x98]
jmp 0x49f472
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f48f
lea eax, [ebp - 4]
call fcn.0040482c
ret
Function at 0x4a12d4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x4a13c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00499a08
test al, al
je 0x4a1397
xor edx, edx
push ebp
push 0x4a133e
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0049aae4
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
call fcn.00409750
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1348
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00499fbc
test al, al
jne 0x4a1371
push 0x4a13dc
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x31d8], 0
je 0x4a13ad
cmp dword [ebp + 8], 0x20
je 0x4a13ad
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4a13ad
mov eax, dword [ebp - 4]
add eax, 0x4c0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x31e0]
call fcn.00404880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a13ca
lea eax, [ebp - 0xc]
call fcn.0040482c
ret

Function at 0x4a1bb4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x4a1be0
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x51b838]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x4a1bba
pop esi
pop ebx
ret
Function at 0x4b927c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x140]
mov edx, 0x140
call fcn.00407ae0
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], 0x1ffff
mov dword [ebp - 0x138], 0x2ffff
mov dword [ebp - 0x130], 0x1fff
mov dword [ebp - 0x134], 0x52e5d0
lea eax, [ebp - 0x240]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x240]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x140]
push eax
call dword [0x5305d0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b94b8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b96e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
sub eax, 0x340
je 0x4b94ed
sub eax, 3
je 0x4b9520
jmp 0x4b96c1
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x45c], 0
jne 0x4b9516
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SetFileAttributesA
xor ebx, ebx
jmp 0x4b96c6
mov ebx, 1
jmp 0x4b96c6
xor eax, eax
push ebp
push 0x4b96a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52e5c4]
cmp word [eax + 0x3ca], 0
je 0x4b9664
mov byte [ebp - 5], 1
mov eax, dword [0x52e5c4]
mov ebx, dword [eax + 0x438]
dec ebx
test ebx, ebx
jl 0x4b9693
inc ebx
xor esi, esi
mov eax, dword [0x52e5c4]
add eax, 0x460
push eax
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov ecx, dword [ebp - 0xc]
mov edi, dword [0x52e5c4]
mov edx, dword [0x52e5c4]
mov eax, dword [edi + 0x3cc]
call dword [edi + 0x3c8]
cmp byte [ebp - 5], 0
je 0x4b95aa
mov eax, dword [0x52e5c4]
mov edx, dword [eax]
call dword [edx + 0x40]
test al, al
je 0x4b95db
push 0x4b96fc
push 0x6795
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [0x52e5c4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
jmp 0x4b9693
mov eax, dword [0x52e5c4]
cmp dword [eax + 0x460], 0
jne 0x4b9627
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x438]
dec eax
cmp esi, eax
jne 0x4b9627
push 0x4b96fc
push 0x679a
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [0x52e5c4]
mov edi, dword [eax]
call dword [edi + 0x98]
jmp 0x4b965a
mov eax, dword [0x52e5c4]
cmp dword [eax + 0x460], 0
je 0x4b965a
xor ebx, ebx
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x460]
call fcn.00404cdc
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dword [edx + 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b96c6
inc esi
dec ebx
jne 0x4b955c
jmp 0x4b9693
push 0x4b96fc
push 0x62b6
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx]
call fcn.00404a1c
mov edx, dword [ebp - 0x18]
mov ecx, 0x4b9708
mov eax, dword [0x52e5c4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b96c6
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b96e8
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404850
ret
Function at 0x4b9e14
Capabilities:
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x18]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x14]
dec eax
je 0x4b9e39
dec eax
je 0x4b9e66
dec eax
je 0x4b9e6f
jmp 0x4b9f66
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31f9], 0
je 0x4b9f66
cmp dword [ebp - 4], 1
sbb edx, edx
inc edx
mov ecx, pe_nt_image_headers32
mov eax, dword [0x52e5c4]
call fcn.004ba308
jmp 0x4b9f66
cmp dword [ebp - 0x18], 0
jmp 0x4b9f66
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31f8], 0
je 0x4b9f07
push 3
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x3200]
call fcn.00404cdc
push eax
call sub.kernel32.dll_MoveFileExA
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x3210], 0
jne 0x4b9ebd
call fcn.004b9d7c
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31d8], 0
jne 0x4b9ee8
push pe_nt_image_headers32
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4b9f4f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4b9f4f
mov eax, dword [0x52e5c4]
cmp byte [eax + 0x31d8], 0
jne 0x4b9f32
push pe_nt_image_headers32
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4b9f4f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [0x52e5c4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp dword [ebp - 4], 1
sbb edx, edx
inc edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
mov eax, dword [0x52e5c4]
call fcn.004ba308
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ba308
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a2], 0
je 0x4ba431
mov eax, dword [ebp - 4]
call fcn.00499a08
test al, al
je 0x4ba410
xor eax, eax
push ebp
push 0x4ba409
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0048fae0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4ba3af
xor eax, eax
push ebp
push 0x4ba3a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x31f0]
mov eax, dword [ebp - 4]
call fcn.0049aae4
mov edx, eax
mov eax, dword [ebp - 0x10]
call fcn.00409750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba3af
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x31d8], 0
je 0x4ba3dc
cmp dword [ebp - 0xc], 0x80
je 0x4ba3dc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba457
mov al, byte [ebp - 5]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c0]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3a4]
call dword [ebx + 0x3a0]
ret
mov al, byte [ebp - 5]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x31e0]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x3a4]
call dword [ebx + 0x3a0]
jmp 0x4ba457
cmp byte [ebp - 5], 0
jne 0x4ba457
push 0x4ba464
push 0x623f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4c0]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bbf6c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor edx, edx
push ebp
push 0x4bc0cd
push dword fs:[edx]
mov dword fs:[edx], esp
sub al, 1
jb 0x4bbf90
je 0x4bbfaa
dec al
je 0x4bbfc4
jmp 0x4bc07f
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x4bbff5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
call fcn.0040989c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x368]
call fcn.00409dd4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
test dword [eax + 0x1dfa], 0x200
jbe 0x4bc058
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
mov dl, 1
call fcn.004924fc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 0x4c0
call fcn.00404880
push 0
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4c0]
call fcn.00404cdc
push eax
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x5305f8]
mov esi, eax
jmp 0x4bc084
mov esi, 0xc
test esi, esi
je 0x4bc0b7
push 0x4bc0e4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, esi
call fcn.004bb160
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax + 0x31e0]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor ecx, ecx
mov ebx, dword [eax]
call dword [ebx + 0x98]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc0d4
lea eax, [ebp - 4]
call fcn.0040482c
ret

Function at 0x4caff8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ccc
xor eax, eax
push ebp
push 0x4cb0af
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4cb0c8
call fcn.00404e20
test eax, eax
jle 0x4cb04e
mov edx, dword [ebp - 4]
mov eax, 0x4cb0c8
call fcn.00404e20
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ae4
dec eax
cmp ebx, eax
jne 0x4cb04e
xor ebx, ebx
jmp 0x4cb091
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.00407ae0
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x4cb0d4
mov edx, dword [ebp - 4]
call fcn.00404b30
mov eax, dword [ebp - 0x28]
call fcn.00404cdc
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb0b6
lea eax, [ebp - 0x28]
call fcn.0040482c
lea eax, [ebp - 4]
call fcn.0040482c
ret