joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x18c]
call fcn.004a4d2b
mov edi, dword [ebp + 8]
test eax, eax
jle 0x47b566
push ebx
lea ecx, [esi + 0x18c]
mov byte [ebp + 0xb], 0
call fcn.0047815a
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x47b5c4
lea ecx, [esi + 0x18c]
inc ebx
call fcn.004a4d2b
cmp ebx, eax
jl 0x47b52f
sub edi, 0x100
je 0x47b62a
sub edi, 4
je 0x47b5c8
dec edi
dec edi
jne 0x47b61f
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.00456342
pop ecx
mov ecx, dword [esi + 0x10c]
lea edx, [ebp + 8]
push reloc.OLEAUT32.dll_VariantCopyInd
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x47c6b8
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x47b61f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x47b621
cmp dword [esi + 0x110], 0
je 0x47b61f
xor eax, eax
lea edi, [ebp - 0x1c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x120]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x124]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.00479c6b
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x110]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x47b61f
mov ecx, dword [esi + 0x110]
test ecx, ecx
je 0x47b683
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x47b683
mov ecx, dword [esi + 0x110]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x47b683
mov ecx, dword [esi + 0x110]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.00457fc9
pop ecx
pop ecx
test eax, eax
je 0x47b683
mov ecx, dword [esi + 0x110]
call fcn.00487f92
test al, al
jne 0x47b61f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.0047c0d2
jmp 0x47b5c4
Function at 0x47be8d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx]
je 0x47beb4
cmp esi, dword [ebx + 0x110]
je 0x47beb4
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0x110]
cmp esi, eax
je 0x47bf8b
push edi
test eax, eax
je 0x47bf13
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x110]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor edi, edi
mov ecx, ebx
push edi
push edi
push edi
push str.killfocus
push dword [ebx + 0x110]
call fcn.0047bc72
mov dword [ebx + 0x110], edi
test esi, esi
je 0x47bf8a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x47bf8a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x47bf8a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x47bf8a
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x110], esi
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x110]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push str.setfocus
push dword [ebx + 0x110]
call fcn.0047bc72
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x489239
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x4d4], edi
je 0x4892a3
cmp dword [ebp + 8], 0x100
jne 0x489292
cmp word [ebp + 0xc], 0xd
jne 0x489292
cmp byte [esi + 0x4da], 0
je 0x489279
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x489292
cmp byte [esi + 0x4db], 0
jne 0x489292
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x48928e
push edi
push edi
push edi
push str.return
push esi
call fcn.0047bc72
xor eax, eax
jmp 0x4892a6
mov eax, dword [esi + 0x4d4]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4895f8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x559410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4896ae
movzx eax, word [esi]
test ax, ax
je 0x4896ae
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x489638
cmp ax, 0x5c
jne 0x48963a
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x48962c
cmp edi, esi
je 0x489681
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.00457f07
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4896be
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004895f8
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004fe60f
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004fe5e0
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00453c72
mov esp, ebp
pop ebp
ret
call fcn.004559ce
int3

Function at 0x489d39
Capabilities:
Get common file path

Disassembly:
push 8
mov eax, 0x520f41
call fcn.004592ed
mov ebx, ecx
lea esi, [ebx + 0x340]
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
cmp dword [ebx], 0
jne 0x489dcf
cmp dword [ebx + 4], 0xffffffff
jne 0x489dcf
lea edi, [ebx + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x523dbc
push edi
call fcn.004fe5e0
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
jne 0x489da0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x489da0
mov edi, 0x2000000
jmp 0x489dd4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0048c31a
add esp, 0x10
test eax, eax
jne 0x489dbe
mov edi, dword [ebp - 0x10]
jmp 0x489dd4
push eax
call fcn.0048ca21
mov edi, dword [0x564bf8]
pop ecx
mov dword [ebx], eax
jmp 0x489dd4
mov edi, 0x1000000
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
call fcn.004592bb
ret 0xc
Function at 0x48c427
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x48c45b
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48c456
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x48c482
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x48c46b
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004540d0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x48c5f5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x48c603
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x48c6be
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
dec edi
jne 0x48c621
pop edi
test esi, esi
je 0x48c6d7
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x530d20]
inc edx
dec esi
jne 0x48c6c2
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x48d691
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x51c55d
call fcn.00459320
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0048da24
call fcn.00479aa1
push eax
lea ecx, [ebp - 0x94]
call fcn.00477f29
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00479aa7
mov ecx, eax
call fcn.00478717
test al, al
je 0x48d7a7
push ebx
lea ecx, [ebp - 0x94]
call fcn.00478186
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x94]
call fcn.00479a82
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x48d718
push 0x5324e8
jmp 0x48d888
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x48d821
cmp edi, 0x400000
ja 0x48d832
and dword [ebp - 0x2c8], 0
push edi
call fcn.00452b71
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x48d790
push ebx
call fcn.00455c91
pop ecx
mov ecx, esi
call fcn.0048da24
push 0
push str.Could_not_read_file
jmp 0x48d888
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0048d8d7
push dword [ebp - 0x2cc]
jmp 0x48d8b6
call fcn.00479aa7
push eax
lea ecx, [ebp - 0x94]
call fcn.00478169
call fcn.00479b5e
test al, al
je 0x48d7c8
call fcn.00479aad
jmp 0x48d7df
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00479a82
push eax
call fcn.00489de5
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x48d7f0
push eax
push str.Error_opening_zip_file
jmp 0x48d888
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.00489776
add esp, 0x14
test eax, eax
je 0x48d817
push 0
push str.Could_not_find_ziped_file
jmp 0x48d888
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x48d82a
push 0
push str.File_is_empty
jmp 0x48d888
cmp ebx, 0x400000
jbe 0x48d83b
push 0
push str.File_too_large
jmp 0x48d888
push ebx
call fcn.00452b71
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.0048a251
add esp, 0x18
test eax, eax
je 0x48d893
cmp eax, 0x600
je 0x48d893
push dword [ebp - 0x2c8]
call fcn.00455c91
pop ecx
call fcn.00479b5e
test al, al
jne 0x48d881
push edi
call fcn.004895a8
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0048da4c
mov bl, al
jmp 0x48d8be
call fcn.00479b5e
test al, al
jne 0x48d8a3
push edi
call fcn.004895a8
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0048d8d7
push edi
mov bl, al
call fcn.00455c91
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00478065
mov al, bl
call fcn.004592cf
ret 8
Function at 0x497b9f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x497bc3
cmp dword [esi + 8], edi
jge 0x497bbb
push esi
call fcn.00495e98
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov ecx, dword [esi + 8]
xor edx, edx
test ecx, ecx
jle 0x497be9
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub ecx, 8
mov byte [ebp + edx + 8], al
inc edx
shr edi, 8
mov dword [esi + 0xc], edi
test ecx, ecx
jg 0x497bcf
mov dword [esi + 8], ecx
jmp 0x497c01
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x497bf4
xor eax, eax
jmp 0x497bfc
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
mov byte [ebp + edx + 8], al
inc edx
cmp edx, 4
jl 0x497be9
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x497c3b
push str.zlib_corrupt
call fcn.00495d53
add esp, 4
jmp 0x497c78
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x497c4b
push str.read_past_buffer
jmp 0x497c31
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x497c62
push edi
push esi
call fcn.00495d62
pop ecx
pop ecx
test eax, eax
je 0x497c78
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004540d0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x4ab362
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x559410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x4ab3cf
cmp dword [esi + 0x10], 0
je 0x4ab3cf
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00469dd0
mov ebx, esp
test ebx, ebx
je 0x4ab3cf
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1b8
call fcn.004780fd
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0047bc72
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453c72
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4acb40
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x51db98
call fcn.00459320
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x5b8], ebx
cmp dword [edi + 4], ebx
jne 0x4acbd2
lea eax, [ebp - 0xa8]
push eax
call fcn.004ac841
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00479a82
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.00477930
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00491cc2
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004797ca
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00478717
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00478065
mov esi, 0x5a8
test bl, bl
je 0x4acc11
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.004592cf
ret 4
Function at 0x4b397e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x564db1], 0
jne 0x4b3a2d
push esi
push 0x538108
call fcn.004bac69
mov dword [esp], 0x538248
call fcn.004bac69
mov dword [esp], 0x5381c0
call fcn.004bac69
mov dword [esp], 0x5381e4
call fcn.004bac69
mov dword [esp], 0x538284
call fcn.004bac69
mov esi, 0x5380e8
push esi
call fcn.004c6ed6
push esi
call fcn.004c6ed6
push 0x538228
call fcn.004c6ed6
push 0x5382a8
call fcn.004c6ed6
push 0x5383a8
call fcn.004c6ed6
push 0x538428
call fcn.004c6ed6
push 0x538448
call fcn.004c6ed6
push 0x538208
call fcn.004c6ed6
push 0x5382c8
call fcn.004c6ed6
add esp, 0x28
mov byte [0x564db1], 1
pop esi
jmp 0x4d1ffe
ret
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
dec esi
jne 0x4d2006
mov dword [edx*4 + 0x56bae0], ecx
inc edx
cmp edx, 0x100
jb 0x4d2001
mov esi, 0x800
jmp 0x4d204d
mov ecx, dword [edx*4 + 0x56b6e0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x56bae0]
mov dword [edx*4 + 0x56bae0], ecx
inc edx
cmp edx, esi
jb 0x4d2031
mov eax, 0x516040
mov esi, 0x515f60
mov dword [0x56bac0], eax
mov dword [0x56bab8], eax
mov dword [0x56babc], esi
call fcn.004e98d5
mov ecx, dword [0x56bab8]
test eax, eax
cmove ecx, esi
mov dword [0x56bab8], ecx
pop esi
ret

Function at 0x4b47d8
Capabilities:
Move file

Disassembly:
push 0x3c
mov eax, 0x51e327
call fcn.00459320
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x48], ebx
cmp dword [esi + 0x14], 8
jb 0x4b47f9
mov eax, dword [esi]
jmp 0x4b47fb
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x4b4805
mov ecx, dword [edi]
jmp 0x4b4807
mov ecx, edi
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4b4861
cmp dword [esi + 0x14], 8
jb 0x4b481d
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x40]
call fcn.00419370
and dword [ebp - 4], 0
xor esi, esi
inc esi
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x48], esi
jb 0x4b4838
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x28]
call fcn.00419370
push 3
pop ebx
lea eax, [ebp - 0x40]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x48], ebx
push eax
call fcn.004b47d8
mov byte [ebp - 0x41], 0
pop ecx
pop ecx
test al, al
je 0x4b4865
mov byte [ebp - 0x41], 1
test bl, 2
je 0x4b4879
push 0
push 1
lea ecx, [ebp - 0x28]
and ebx, 0xfffffffd
call fcn.00419650
test bl, 1
je 0x4b488c
xor esi, esi
lea ecx, [ebp - 0x40]
push 0
inc esi
push esi
call fcn.00419650
mov al, byte [ebp - 0x41]
call fcn.004592cf
ret

Function at 0x4b4b62
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4b4b70
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x4b4b81
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push 0x3c
mov eax, 0x51e408
call fcn.00459320
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x4b4c39
cmp dword [esi + 0x10], 0x104
ja 0x4b4c39
push esi
call fcn.004b4b62
pop ecx
test al, al
jne 0x4b4bb9
inc al
jmp 0x4b4c3b
push esi
lea ecx, [ebp - 0x28]
call fcn.0041b770
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
xor esi, esi
add eax, 2
push esi
push eax
mov dword [ebp - 4], esi
call fcn.004530c8
push 0x1e
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.00455160
mov eax, dword [ebp - 0x38]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x32], esi
or eax, 0x414
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2e], esi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
lea ecx, [ebp - 0x28]
neg ebx
push esi
sbb bl, bl
push 1
inc bl
call fcn.00419650
mov al, bl
jmp 0x4b4c3b
xor al, al
call fcn.004592cf
ret

Function at 0x4b6a00
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa8], 5
jne 0x4b6a27
cmp dword [ebp + 0xc], 0
je 0x4b6a27
mov ecx, esi
call fcn.004b6889
mov eax, 0x80004005
jmp 0x4b6b49
xor ecx, ecx
cmp dword [esi + 0x64], ecx
jne 0x4b6a53
push 0x538c3c
call fcn.00503ca1
pop ecx
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x4b6a4c
mov edx, dword [ecx]
lea eax, [esi + 0x24]
push eax
call dword [edx + 0x14]
xor eax, eax
jmp 0x4b6b49
push edi
cmp byte [esi + 0x74], cl
jne 0x4b6a69
cmp byte [esi + 0x80], cl
jne 0x4b6a69
cmp byte [esi + 0x8c], cl
je 0x4b6ad0
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 8
jb 0x4b6a74
mov eax, dword [eax]
push ecx
push 0x80
push 3
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b6ad0
xor edx, edx
lea ecx, [esi + 0x78]
cmp byte [esi + 0x74], dl
cmovne edx, ecx
xor eax, eax
cmp byte [esi + 0x80], al
lea ecx, [esi + 0x84]
push edx
cmovne eax, ecx
xor ecx, ecx
cmp byte [esi + 0x8c], cl
push eax
lea eax, [esi + 0x90]
cmovne ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x6d], 0
je 0x4b6aeb
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 8
jb 0x4b6ae1
mov eax, dword [eax]
push dword [esi + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edi, [esi + 0x54]
cmp dword [edi + 0x14], 8
jb 0x4b6af8
mov eax, dword [edi]
jmp 0x4b6afa
mov eax, edi
push eax
push str.FileDone:_s_n
call fcn.00503ca1
pop ecx
pop ecx
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x4b6b46
push dword [esi + 0xa4]
mov eax, dword [ecx]
push dword [esi + 0xa0]
push edi
call dword [eax + 0x1c]
test al, al
jne 0x4b6b2e
mov eax, 0x80004005
jmp 0x4b6b48
mov ecx, dword [esi + 0xac]
push dword [esi + 0xa4]
push dword [esi + 0xa0]
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8