joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x4bb17d
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x4bb197
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.004a2fd0
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x4bb17f
jmp 0x4bb181
xor ebx, ebx
mov esi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x4bb21a
mov ebx, eax
cmp eax, 3
je 0x4bb205
cmp ebx, 1
ja 0x4bb21a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004a2fd0
add esp, 0x10
cmp eax, esi
jne 0x4bb21a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x4bb1a2
mov ebx, dword [ebp + 8]
jmp 0x4bb17f
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004a2fd0
add esp, 0x10
cmp eax, ebx
je 0x4bb1fd
xor esi, esi
dec esi
jmp 0x4bb181

Function at 0x4bb260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4bb289
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.004a2fd0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
test esi, esi
jle 0x4bb2b2
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x4bb2b4
inc edi
cmp esi, edi
mov eax, ebx
jne 0x4bb292
mov edi, esi
jmp 0x4bb2b4
xor edi, edi
mov eax, edi
add esp, 4
jmp 0x4bb282
Function at 0x4bb2c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x4bb30f
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x4bb327
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.004a2fd0
add esp, 0x10
cmp eax, 1
je 0x4bb311
xor esi, esi
dec esi
jmp 0x4bb311
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x4bb30a
mov ebx, eax
cmp eax, 3
je 0x4bb396
cmp ebx, 1
ja 0x4bb30a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004a2fd0
add esp, 0x10
cmp eax, esi
jne 0x4bb30a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x4bb332
movzx esi, word [ebp + 8]
jmp 0x4bb311
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004a2fd0
add esp, 0x10
cmp eax, ebx
jne 0x4bb30a
jmp 0x4bb38d
Function at 0x4c0200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x43f3e0
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x4c025f
movzx edx, word [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movzx edx, dx
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x4c0399
lea esi, [ebp - 0x2c]
mov ecx, eax
push esi
call fcn.0046bc00
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x52678c
call fcn.0046bfe0
mov esi, eax
mov ecx, dword [ebp - 0x2c]
xor edi, edi
dec edi
mov eax, edi
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x4c0298
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x2c]
push ebx
call eax
movzx edx, byte [ebp - 0x21]
test dl, dl
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov esi, edx
cmovs esi, eax
test esi, esi
je 0x4c03a3
mov esi, ebx
mov ebx, eax
mov dword [ebp - 0x34], edx
test dl, dl
mov dword [ebp - 0x20], edi
cmovns edi, esi
mov ecx, dword [ebp + 0xc]
mov eax, esi
test ecx, ecx
je 0x4c033e
movzx eax, word [edi]
mov esi, dword [ecx + 0x18]
cmp esi, dword [ecx + 0x1c]
je 0x4c0351
lea edx, [esi + 2]
mov dword [ecx + 0x18], edx
mov word [esi], ax
xor esi, esi
cmp ax, 0xffff
je 0x4c0307
mov esi, ecx
mov bl, byte [ebp - 0x21]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], esi
lea esi, [ebp - 0x2c]
add edi, 2
test bl, bl
mov eax, esi
mov dword [ebp - 0x20], edx
cmovs esi, edx
mov edx, edi
mov dword [ebp - 0x34], ebx
movzx edi, bl
mov ebx, ecx
cmovs edi, ecx
lea esi, [esi + edi*2]
mov edi, edx
cmp edx, esi
mov ecx, dword [ebp - 0x30]
jne 0x4c02e5
jmp 0x4c0371
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x20]
mov ecx, ebx
mov ebx, dword [ebp - 0x34]
mov esi, eax
jmp 0x4c0316
mov dword [ebp - 0x20], edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
movzx eax, ax
mov dword [ebp - 0x30], ecx
push eax
call edx
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x20]
jmp 0x4c02fd
mov edx, dword [ebp - 0x34]
shr dl, 7
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test dl, dl
je 0x4c038f
push edi
call fcn.0048b376
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
shr dl, 7
mov ecx, dword [ebp + 0xc]
jmp 0x4c037a
Function at 0x4c4920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x43f500
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.004b5620
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.0046bc00
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x52675c
call fcn.0046bfe0
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea edx, [esi + 0x84]
lea ecx, [esi + 3]
mov byte [ecx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push edx
push edi
push ebx
push dword [esi + 0x10]
push ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.004c3e10
add esp, 0x2c
test al, al
je 0x4c4a76
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x4c4ae2
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
cmp byte [esi + 3], 0
je 0x4c4a38
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.0046cc20
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ecx, [edi - 1]
cmp edx, ecx
jae 0x4c4a62
mov ecx, edx
not ecx
add ecx, edi
lea ebx, [edx + ecx]
cmp byte [edx], al
jne 0x4c4a62
inc edx
dec ecx
jne 0x4c4a58
mov edx, ebx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.0043c0d0
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.00466680
mov edi, dword [ebp + 8]
test al, al
je 0x4c4a8f
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x4c4aa8
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x4c4aca
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
jmp 0x4c4a1c
Function at 0x4ccc90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.0048b346
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4ccce0
push ecx
push ecx
call fcn.00499eb0
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4ccccf
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4d0790
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.00443eb0

Function at 0x4d07a0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x18a
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.0046ea80
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00474400
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4d0806
mov ecx, dword [edi + 4]
cmp ecx, 0x103
jbe 0x4d0812
xor ebx, ebx
jmp 0x4d0828
test al, al
jns 0x4d0818
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.00474460
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d0c70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xaa0
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0xa98], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xa50]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x250]
push 0x2d0
push str..._.._base_files_file_util_win.cc
push str.DevicePathToDriveLetterPath
push ebx
call fcn.0046ea80
add esp, 0x10
xor edi, edi
mov ecx, esi
push edi
push ebx
call fcn.00474400
push 0x800
push edi
push ebx
call fcn.0048ef90
add esp, 0xc
push ebx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4d0da7
lea esi, [esp + 0x48]
push 0x208
push 0xff
push esi
call fcn.0048ef90
add esp, 0xc
movzx eax, word [0x50cfd4]
mov word [esp + 0x44], ax
mov eax, dword [0x50cfd0]
mov dword [esp + 0x40], eax
movzx eax, word [esp + 0x250]
test ax, ax
je 0x4d0da7
lea edi, [esp + 0x34]
mov word [esp + 0x40], ax
push 0x104
push esi
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4d0d96
xor eax, eax
dec eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
push esi
call fcn.004a4ac6
add esp, 4
mov ecx, edi
push eax
push esi
call fcn.00440f40
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call fcn.004410a0
test al, al
jne 0x4d0dcd
mov ecx, edi
push esi
call fcn.004cce80
test al, al
jne 0x4d0dcd
mov ecx, edi
call fcn.0046dbe0
lea esi, [esp + 0x48]
cmp word [ebx], 0
lea ebx, [ebx + 2]
jne 0x4d0d96
movzx eax, word [ebx]
test ax, ax
jne 0x4d0d35
xor ebx, ebx
lea ecx, [esp + 0xa50]
call fcn.00474460
mov ecx, dword [esp + 0xa98]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0x48]
push eax
call fcn.004a4ac6
add esp, 4
lea edx, [esi + 0xc]
lea edi, [esp + 0xc]
mov ecx, edi
push edx
push 0xffffffffffffffff
push eax
push esi
call fcn.00440000
xor esi, esi
mov ecx, edi
lea eax, [esp + 0x40]
push eax
push esi
call fcn.004400c0
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [esp + 0x23]
test al, al
jns 0x4d0e28
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
jmp 0x4d0e2c
lea edx, [esp + 0x18]
mov esi, dword [ebp + 0xc]
lea edi, [esp + 0x28]
mov ecx, edi
push eax
push edx
call fcn.00440f40
mov ecx, esi
push edi
call fcn.00441060
mov ecx, edi
call fcn.0046dbe0
cmp byte [esp + 0x23], 0
jns 0x4d0e5e
push dword [esp + 0x18]
call fcn.0048b376
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x4d0e71
push dword [esp + 0xc]
call fcn.0048b376
add esp, 4
lea ecx, [esp + 0x34]
call fcn.0046dbe0
mov bl, 1
jmp 0x4d0da9
Function at 0x4d0e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x10]
push 0x3a2
push str..._.._base_files_file_util_win.cc
push 0x50cfdf
push ebx
call fcn.0046ea80
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push ebx
call fcn.00474400
cmp byte [edi + 0xb], 0
jns 0x4d0ef4
mov edi, dword [edi]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x5071b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea esi, [esp + 0x10]
mov dword [esi], ebx
mov ecx, esi
push eax
call fcn.0046db00
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x4d0f6a
xor esi, esi
dec esi
inc eax
cmp eax, 2
jb 0x4d0f4c
call fcn.0046eab0
push dword [esp + 0x10]
call fcn.00471760
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00474460
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor edi, edi
dec edi
lea ebx, [esp + 0xc]
mov dword [ebx], edi
push 0
push ebx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebx]
cmp ecx, esi
cmove edi, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edi
mov eax, dword [esp + 0x10]
jmp 0x4d0f35
Function at 0x4d0fc0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x20]
push 0x8d
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.0046ea80
add esp, 0x10
mov ecx, ebx
mov ebx, edi
push 0
push esi
call fcn.00474400
mov ecx, edi
call fcn.0046e7c0
test al, al
jne 0x4d103d
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.0046e7c0
test al, al
je 0x4d105d
xor ebx, ebx
lea ecx, [esp + 0x30]
call fcn.00474460
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4d1068
mov eax, dword [ebx + 4]
cmp eax, 0x103
ja 0x4d103d
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4d107a
mov eax, dword [edi + 4]
cmp eax, 0x103
ja 0x4d103d
mov dword [esp + 8], ebx
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9a
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.0046ea80
add esp, 0x10
mov ecx, ebx
push 0x527ae0
push esi
mov esi, edi
call fcn.004514e0
cmp byte [edi + 0xb], 0
jns 0x4d10c4
mov esi, dword [esi]
mov ecx, dword [esp + 8]
mov al, byte [ebp + 8]
movzx eax, al
cmp byte [ecx + 0xb], 0
jns 0x4d10d6
mov ecx, dword [ecx]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4d1119
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4d1105
mov eax, edi
and eax, 1
je 0x4d1105
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
lea ecx, [esp + 0x20]
call fcn.004515e0
jmp 0x4d103f
xor ebx, ebx
jmp 0x4d110b
Function at 0x4d1120
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.0048ef90
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.004db2b0
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.0044cbd0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4d118d
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x4d12f4
lea ebx, [ebp - 0x4f4]
xor esi, esi
push 0x250
push 0xff
push ebx
call fcn.0048ef90
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004db420
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x4d1222
mov ecx, ebx
call fcn.004db2a0
test al, al
je 0x4d1269
xor edi, edi
cmp byte [ebp + 8], 0
je 0x4d12a1
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.004d1120
add esp, 4
mov edi, eax
test eax, eax
jne 0x4d12a1
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
js 0x4d1323
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, 0
jmp 0x4d1287
cmp byte [ebp + 8], 0
je 0x4d124d
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x4d1240
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4d11c6
mov ecx, ebx
call fcn.004db2a0
test al, al
je 0x4d12e9
mov ecx, ebx
call fcn.004db2a0
xor edi, edi
test al, al
jne 0x4d12a1
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4d127e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
test eax, eax
jne 0x4d12a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove edi, eax
test esi, esi
cmovne edi, esi
mov ecx, ebx
call fcn.004b5620
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0044cbd0
lea ecx, [ebp - 0x500]
push ebx
call fcn.00441060
mov ecx, ebx
call fcn.0046dbe0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x4d12dd
mov eax, dword [ebp - 0x4fc]
mov esi, edi
test eax, eax
jne 0x4d119d
jmp 0x4d12f6
mov eax, dword [ebp - 0x4f4]
jmp 0x4d1228
xor edi, edi
lea ecx, [ebp - 0x500]
call fcn.0046dbe0
lea ecx, [ebp - 0x2a4]
call fcn.004db3b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, edi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x500]
jmp 0x4d1214
Function at 0x4d1920
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x4d1992
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4d1996
cmp byte [ebp + 0xc], 0
je 0x4d1972
cmp byte [esi + 4], 0
je 0x4d19e7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.004451e0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x4d1944
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4d19bc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4d19c0
xor ebx, ebx
jmp 0x4d197c
mov eax, dword [esi]
jmp 0x4d19a8
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x4d19ee
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4d1972
mov edi, dword [ebp - 0x14]
jmp 0x4d1972
mov eax, dword [esi]
jmp 0x4d1966
mov eax, dword [esi]
jmp 0x4d19d3

Function at 0x4d22d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x18
pop ebp
ret 4

Function at 0x4d2300
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov edx, dword [0x521014]
xor edx, ebp
mov dword [ebp - 8], edx
mov edx, 4
lea esi, [ebp + 0xc]
push edx
push esi
push edx
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8

Function at 0x4d25c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
add ecx, 0x10
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00437820
mov ecx, esi
push edi
call fcn.004d2a90
cmp byte [edi + 0xb], 0
jns 0x4d2614
push dword [ebp - 0x18]
call fcn.0048b376
add esp, 4
mov ecx, esi
call fcn.004d2b40
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret