joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469ee0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4ef05e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00402630
xor ebx, ebx
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x18], ebx
mov dword [esi], 0x503828
mov dword [esi + 8], ebx
call fcn.00466b10
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x18]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.00466b10
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x24]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.00466b10
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.00466b10
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x469ef7
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4ef05e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00402630
xor ebx, ebx
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x18], ebx
mov dword [esi], 0x503828
mov dword [esi + 8], ebx
call fcn.00466b10
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x18]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.00466b10
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x24]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.00466b10
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.00466b10
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46e6d0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x54c
mov eax, dword [0x54a2b0]
push ebp
push esi
mov esi, dword [esp + 0x558]
push edi
push 0x104
mov dword [esp + 0x558], eax
lea eax, [esp + 0x354]
push esi
push eax
call fcn.004c30d0
lea edi, [esp + 0x35c]
add esp, 0xc
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46e710
mov cx, word [0x503ac8]
mov dl, byte [0x503aca]
push 0x104
lea eax, [esp + 0x10]
mov word [edi], cx
push esi
push eax
mov byte [edi + 2], dl
call fcn.004c30d0
lea edi, [esp + 0x18]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46e743
mov cx, word [0x503acc]
lea edx, [esp + 0x210]
push edx
lea eax, [esp + 0x354]
push eax
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
xor eax, eax
cmp ebp, 0xffffffff
je 0x46e8c2
jmp 0x46e780
mov cl, byte [esp + eax + 0xc]
mov byte [esp + eax + 0x350], cl
inc eax
test cl, cl
jne 0x46e780
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x214]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x46e885
mov edi, 0x503ad0
lea esi, [esp + 0x240]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x46e797
mov edi, 0x503ad4
lea esi, [esp + 0x240]
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x46e797
lea eax, [esp + 0x240]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46e7e5
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46e7f3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [esp + 0x214]
and ecx, 3
test al, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x46e845
lea ecx, [esp + 0x10]
push ecx
call fcn.0046e6d0
add esp, 4
test eax, eax
je 0x46e890
lea edx, [esp + 0x10]
push edx
call ebx
xor eax, eax
mov cl, byte [esp + eax + 0x354]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x46e830
jmp 0x46e797
test al, 1
je 0x46e85b
lea eax, [esp + 0x10]
push 0x80
push eax
call fcn.004c308e
add esp, 8
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x46e890
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x354]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x46e870
jmp 0x46e797
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x46e8b0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x548]
call fcn.004c2e45
add esp, 0x54c
ret
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x560]
push edx
call ebx
pop ebx
mov ecx, dword [esp + 0x554]
pop edi
pop esi
pop ebp
call fcn.004c2e45
add esp, 0x54c
ret
Function at 0x479240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f0482
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
call fcn.00402630
xor edi, edi
mov dword [esi], 0x5063b0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
fld qword [0x52cad0]
lea ebx, [esi + 0x3c]
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
fstp qword [esi + 8]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov byte [esi + 0x18], 1
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x4792ab
push eax
call fcn.004c2c15
add esp, 4
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x4792c4
push eax
call fcn.004c2c15
add esp, 4
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov eax, dword [ebx + 4]
cmp eax, edi
je 0x4792f0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 8]
push ecx
push ebx
push edx
push eax
call fcn.0040df70
mov eax, dword [ebx + 4]
push eax
call fcn.004c2c15
add esp, 0x14
mov ecx, dword [esp + 0x14]
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x47a3e2
Capabilities:
Create directory
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
mov ebx, dword [eax]
cmp ebx, eax
mov dword [esp + 8], esi
je 0x47a456
push ebp
push edi
mov edi, dword [ebx + 8]
mov ecx, edi
call fcn.0047f3b0
test eax, eax
jle 0x47a44d
mov esi, 1
mov ebp, eax
lea esp, [esp]
push esi
mov ecx, edi
call fcn.0047f2b0
mov ecx, eax
call fcn.0047f200
test eax, eax
jle 0x47a445
push esi
mov ecx, edi
call fcn.0047f2b0
mov ecx, eax
call fcn.0047f220
test al, al
jne 0x47a445
push esi
mov ecx, edi
call fcn.0047f2b0
mov dword [eax + 4], 0
inc esi
dec ebp
jne 0x47a410
mov esi, dword [esp + 0x10]
mov ebx, dword [ebx]
cmp ebx, dword [esi + 0x7c]
jne 0x47a3f4
pop edi
pop ebp
call fcn.00483e50
pop esi
mov ecx, eax
pop ebx
add esp, 4
jmp fcn.00484b20
Function at 0x484b20
Capabilities:
Create directory
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
mov ecx, edi
call fcn.004839c0
call fcn.00473fc0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x84]
push eax
mov ecx, edi
call fcn.00483990
pop edi
mov ecx, esi
pop esi
jmp fcn.004844f0

Function at 0x484e30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f19d2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x54a2b0]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x30], eax
mov edi, ecx
mov eax, dword [edi + 4]
xor ebx, ebx
mov dword [edi + 0xc], ebx
mov esi, dword [eax]
cmp esi, eax
mov dword [esp + 0x3c], ebx
mov ebp, 8
je 0x484ede
mov edi, edi
mov ecx, dword [esi + 8]
lea eax, [esp + 0x14]
push eax
call fcn.00481300
cmp dword [esp + 0x5c], ebp
mov eax, dword [esp + 0x48]
mov byte [esp + 0x3c], 1
jae 0x484e90
lea eax, [esp + 0x48]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x28]
push ecx
push eax
push edx
push ebx
lea ecx, [esp + 0x24]
call fcn.00410890
test eax, eax
jne 0x484eaf
mov eax, dword [esi + 8]
mov dword [edi + 0xc], eax
cmp dword [esp + 0x2c], ebp
mov byte [esp + 0x3c], bl
jb 0x484ec6
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004c2c15
add esp, 4
mov esi, dword [esi]
cmp esi, dword [edi + 4]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
jne 0x484e70
mov ecx, dword [edi + 0xc]
cmp ecx, ebx
jne 0x484efc
cmp dword [esp + 0x5c], ebp
jb 0x484ef8
mov edx, dword [esp + 0x48]
push edx
call fcn.004c2c15
add esp, 4
xor al, al
jmp 0x484f27
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00481300
mov ecx, edi
call fcn.00484d80
cmp dword [esp + 0x5c], ebp
jb 0x484f25
mov ecx, dword [esp + 0x48]
push ecx
call fcn.004c2c15
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x30]
call fcn.004c2e45
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x1c
Function at 0x491b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f2c6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [0x54a2b0]
push ebx
push esi
push 0x29
mov esi, ecx
xor ebx, ebx
push str.IRIS_AND_GRENDOLINES_nFIREBALL_DEATHMATCH
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00401eb0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x54], ebx
call fcn.0040e540
add esp, 8
mov ecx, dword [esi + 0x12d4]
mov edx, dword [ecx]
lea eax, [esp + 8]
push eax
mov byte [esp + 0x50], 1
call dword [edx + 0x74]
cmp dword [esp + 0x20], 8
jb 0x491b96
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004c2c15
add esp, 4
cmp dword [esp + 0x3c], 0x10
pop esi
mov dword [esp + 0x18], ebx
mov word [esp + 8], bx
mov dword [esp + 0x1c], 7
pop ebx
jb 0x491bbd
mov edx, dword [esp + 0x20]
push edx
call fcn.004c2c15
add esp, 4
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38]
call fcn.004c2e45
add esp, 0x48
ret
Function at 0x49bfb0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4f39c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov eax, dword [0x54a2b0]
push ebx
push esi
push edi
mov dword [esp + 0x244], eax
call fcn.0041d540
push 0x16
xor ebx, ebx
push 0x50c1bc
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00401eb0
mov dword [esp + 0x250], ebx
call fcn.0041d540
lea eax, [esp + 0x28]
push eax
mov ecx, 0x54cba8
call fcn.0041d810
mov ecx, dword [eax + 0x18]
mov esi, 0x10
cmp ecx, esi
jb 0x49c02d
mov eax, dword [eax + 4]
jmp 0x49c030
add eax, 4
cmp dword [0x546d3c], esi
mov ecx, dword [0x546d28]
jae 0x49c043
mov ecx, 0x546d28
push eax
push 0x50c1d4
push ecx
lea ecx, [esp + 0x50]
push 0x50c1e4
push ecx
call fcn.004c2e53
mov eax, dword [esp + 0x54]
add esp, 0x14
cmp eax, esi
mov dword [esp + 0x250], 0xffffffff
jb 0x49c07c
mov edx, dword [esp + 0x2c]
push edx
call fcn.004c2c15
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x44]
push eax
call edi
call fcn.0041d540
push 0x16
push 0x50c1ec
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00401eb0
mov dword [esp + 0x250], 1
call fcn.0041d540
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x54cba8
call fcn.0041d810
cmp dword [eax + 0x18], esi
jb 0x49c0d7
mov eax, dword [eax + 4]
jmp 0x49c0da
add eax, 4
cmp dword [0x546d3c], esi
mov ecx, dword [0x546d28]
jae 0x49c0ed
mov ecx, 0x546d28
push eax
push 0x50c204
push ecx
lea edx, [esp + 0x50]
push 0x50c214
push edx
call fcn.004c2e53
mov eax, dword [esp + 0x38]
add esp, 0x14
cmp eax, esi
jb 0x49c11b
mov eax, dword [esp + 0x10]
push eax
call fcn.004c2c15
add esp, 4
lea ecx, [esp + 0x44]
push ecx
call edi
mov ecx, dword [esp + 0x248]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x23c]
pop ebx
call fcn.004c2e45
add esp, 0x248
ret
Function at 0x4a8930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f4cf5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push 0x1b
mov esi, ecx
xor ebx, ebx
push str.NARRATIVE_WAIT_CLICK_BUTTON
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00401eb0
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x34], ebx
call dword [eax + 0x60]
mov esi, eax
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x4a899c
mov edx, dword [esp + 0x10]
push edx
call fcn.004c2c15
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x34]
mov ecx, esi
call fcn.00406750
push 0x40
call fcn.004c14e8
add esp, 4
mov dword [esp + 8], eax
cmp eax, ebx
mov dword [esp + 0x30], 1
je 0x4a89f7
push 0xffffffffffffffff
push ebx
push ebx
push 0x1f4
push 0x1f4
push 0xc0
push 0xff
mov ecx, eax
call fcn.00414750
jmp 0x4a89f9
xor eax, eax
push 1
push eax
mov ecx, esi
mov dword [esp + 0x38], 0xffffffff
call fcn.004066a0
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4b81f0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4f5e88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, dword [0x54a2b0]
push esi
mov esi, dword [esp + 0x58]
test esi, 0x100
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x44], eax
je 0x4b830c
push ebx
xor ebx, ebx
mov eax, edi
push ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4b8240
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x38]
call fcn.00401eb0
push 1
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x64], ebx
mov byte [esp + 0x1c], 0x5c
call fcn.00428510
cmp eax, 0xffffffff
mov ebp, 0x10
je 0x4b82e6
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x3c]
lea esi, [eax + 1]
call fcn.004284d0
cmp dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x18]
jae 0x4b8299
lea eax, [esp + 0x18]
push eax
call fcn.004eb5d0
mov eax, dword [esp + 0x30]
add esp, 4
cmp eax, ebp
jb 0x4b82b7
mov edx, dword [esp + 0x18]
push edx
call fcn.004c2c15
add esp, 4
push 1
push esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x1c], 0x5c
call fcn.00428510
cmp eax, 0xffffffff
jne 0x4b8278
mov esi, dword [esp + 0x64]
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0x48]
or esi, 0x200
cmp eax, ebp
pop ebp
pop ebx
jb 0x4b830c
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004c2c15
add esp, 4
mov edx, dword [esp + 0x60]
push edx
push esi
push edi
call fcn.004c4710
mov ecx, dword [esp + 0x54]
add esp, 0xc
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x40]
pop esi
call fcn.004c2e45
add esp, 0x4c
ret
Function at 0x4b835d
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4f5e9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov eax, dword [0x54a2b0]
push esi
mov esi, ecx
mov dword [esp + 0x4c], eax
mov al, byte [esi + 0xc]
test al, al
je 0x4b8372
mov eax, 0xffffffff
jmp 0x4b8393
mov eax, dword [esp + 0x60]
cmp eax, 2
push ebx
jne 0x4b8416
mov al, byte [esi + 0xf]
test al, al
mov eax, dword [esp + 0x68]
je 0x4b83ae
mov ecx, dword [eax]
add dword [esi + 0x10], ecx
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4c]
pop esi
call fcn.004c2e45
add esp, 0x58
ret 8
mov edx, dword [eax]
add dword [esi + 0x14], edx
mov eax, dword [eax + 4]
push eax
add esi, 0x50
lea ecx, [esp + 0x38]
push esi
push ecx
call fcn.0040ddd0
add esp, 0xc
mov eax, dword [esp + 0x4c]
mov ebx, 0x10
cmp eax, ebx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x5c], 0
jae 0x4b83e5
lea eax, [esp + 0x38]
push 0x180
push 0x8121
push eax
call fcn.004b81f0
mov esi, eax
mov eax, dword [esp + 0x58]
add esp, 0xc
cmp eax, ebx
jb 0x4b840f
mov edx, dword [esp + 0x38]
push edx
call fcn.004c2c15
add esp, 4
mov eax, esi
jmp 0x4b8392
cmp eax, 3
jne 0x4b8390
push edi
mov edi, dword [esp + 0x6c]
mov eax, dword [edi + 0x14]
push eax
call fcn.004c3d70
mov ecx, dword [edi + 4]
push ecx
add esi, 0x34
lea edx, [esp + 0x24]
push esi
push edx
call fcn.0040ddd0
mov eax, dword [esp + 0x44]
mov ebx, 0x10
add esp, 0x10
cmp eax, ebx
mov eax, dword [esp + 0x20]
jae 0x4b8457
lea eax, [esp + 0x20]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4b84c2
xor ecx, ecx
mov cx, word [edi + 0x1a]
xor edx, edx
mov dx, word [edi + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, 1
jne 0x4b84bb
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, 1
jne 0x4b84bb
lea edx, [esp + 0xc]
push edx
push 0
mov eax, edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov cl, byte [edi + 0x1c]
pop edi
and ecx, 0x27
cmp eax, ebx
mov eax, dword [esp + 0x1c]
jae 0x4b84db
lea eax, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esp + 0x30], ebx
jb 0x4b84f6
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004c2c15
add esp, 4
mov eax, 1
jmp 0x4b8392
Function at 0x4b8960
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x48
mov eax, dword [0x54a2b0]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 0x18]
add eax, 4
cmp ecx, 0x10
mov dword [esp + 4], eax
jb 0x4b8981
mov eax, dword [eax]
push ebx
push esi
push 0x180
push eax
call fcn.004c308e
add esp, 8
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x4b89b5
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x44]
call fcn.004c2e45
add esp, 0x48
ret
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AllocateAndInitializeSid
push esi
call edi
push str.SetEntriesInAclA
push esi
mov ebp, eax
call edi
push str.InitializeSecurityDescriptor
push esi
mov dword [esp + 0x2c], eax
call edi
push str.SetSecurityDescriptorDacl
push esi
mov dword [esp + 0x24], eax
call edi
push str.SetFileSecurityA
push esi
mov dword [esp + 0x30], eax
call edi
push str.RegSetKeySecurity
push esi
mov dword [esp + 0x28], eax
call edi
push str.FreeSid
push esi
mov dword [esp + 0x18], eax
call edi
cmp ebp, ebx
mov edi, eax
je 0x4b8b6e
cmp dword [esp + 0x24], ebx
je 0x4b8b6e
cmp dword [esp + 0x1c], ebx
je 0x4b8b6e
cmp dword [esp + 0x28], ebx
je 0x4b8b6e
cmp dword [esp + 0x20], ebx
je 0x4b8b6e
cmp dword [esp + 0x10], ebx
je 0x4b8b6e
cmp edi, ebx
je 0x4b8b6e
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], bl
mov byte [esp + 0x7a], bl
mov byte [esp + 0x7b], bl
mov byte [esp + 0x7c], bl
mov byte [esp + 0x7d], 1
call ebp
test eax, eax
je 0x4b8b5b
mov eax, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x4c], edx
push ebx
lea edx, [esp + 0x34]
push edx
push 1
mov dword [esp + 0x3c], 0x1fffff
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 3
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], 5
mov dword [esp + 0x58], eax
mov dword [esp + 0x20], ebx
call dword [esp + 0x34]
test eax, eax
jne 0x4b8b54
push 0x14
call fcn.004c15cb
add esp, 4
mov esi, eax
push 1
push esi
call dword [esp + 0x24]
test eax, eax
je 0x4b8b40
mov eax, dword [esp + 0x10]
push ebx
push eax
push 1
push esi
call dword [esp + 0x38]
test eax, eax
je 0x4b8b40
mov ecx, dword [esp + 0x5c]
cmp dword [ecx + 0x18], 0x10
jb 0x4b8b2b
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
jmp 0x4b8b2f
mov eax, dword [esp + 0x14]
push esi
push 4
push eax
call dword [esp + 0x2c]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call fcn.004c2c15
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call edi
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x44]
call fcn.004c2e45
add esp, 0x48
ret
mov ecx, dword [esp + 0x54]
pop edi
pop ebp
pop esi
xor al, al
pop ebx
call fcn.004c2e45
add esp, 0x48
ret
Function at 0x4b95d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
push edi
xor edi, edi
push edi
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4b9690
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1f]
push ecx
push esi
mov dword [esp + 0x28], edi
call ebp
test eax, eax
setne al
test al, al
je 0x4b9641
cmp dword [esp + 0x14], 1
jne 0x4b964b
mov cl, byte [esp + 0x13]
test cl, cl
je 0x4b964b
push 0
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0x1f]
push eax
push esi
inc edi
call ebp
test eax, eax
setne al
test al, al
jne 0x4b9617
pop ebp
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret
test al, al
je 0x4b9641
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4b9641
inc edi
push edi
call fcn.004c15cb
mov ecx, dword [esp + 0x28]
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push esi
mov dword [ecx], eax
call ebp
test eax, eax
je 0x4b9641
cmp dword [esp + 0x14], edi
jne 0x4b9641
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret

Function at 0x4b96a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4b9713
push ebx
lea ecx, [esp + 0xc]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b9713
cmp dword [esp + 8], 4
jne 0x4b9713
mov ax, word [esp + 0xe]
movzx ecx, ah
movzx edx, al
mov eax, dword [esp + 0xc]
shl ecx, 8
add ecx, edx
movzx edx, ah
shl ecx, 8
add ecx, edx
mov edx, dword [esp + 0x1c]
movzx eax, al
shl ecx, 8
add ecx, eax
pop esi
mov dword [edx], ecx
mov al, 1
pop ebx
add esp, 8
ret
pop esi
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x4b9720
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4b977f
push ebx
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x14]
push edx
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b977f
cmp dword [esp + 0xc], 2
jne 0x4b977f
mov ax, word [esp + 8]
movzx ecx, ah
movzx edx, al
mov eax, dword [esp + 0x1c]
shl ecx, 8
add ecx, edx
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
add esp, 8
ret
pop esi
mov al, bl
pop ebx
add esp, 8
ret