joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e7410
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcdb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._swuauserv.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkwuauserv.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachewuauserv.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e74c7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e74ed
mov edi, 1
cmp ebx, 1
jne 0x4e7522
cmp edi, esi
jne 0x4e7606
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e7565
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e7596
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e759b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e75ba
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e75bf
mov esi, 1
cmp edi, 1
jne 0x4e75f0
test esi, esi
jne 0x4e75f0
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7640
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcdc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._smsdtc.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkmsdtc.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachemsdtc.exe
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e76f7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e771d
mov edi, 1
cmp ebx, 1
jne 0x4e7752
cmp edi, esi
jne 0x4e7836
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e7795
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e77c6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e77cb
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e77ea
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e77ef
mov esi, 1
cmp edi, 1
jne 0x4e7820
test esi, esi
jne 0x4e7820
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7870
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcdd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._sSCardSvr.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkSCardSvr.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcacheSCardSvr.exe
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e7927
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e794d
mov edi, 1
cmp ebx, 1
jne 0x4e7982
cmp edi, esi
jne 0x4e7a66
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e79c5
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e79f6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e79fb
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e7a1a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e7a1f
mov esi, 1
cmp edi, 1
jne 0x4e7a50
test esi, esi
jne 0x4e7a50
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7aa0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcde0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._s_tlntsvr.exe
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bk_tlntsvr.exe
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcache_tlntsvr.exe
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e7b57
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e7b7d
mov edi, 1
cmp ebx, 1
jne 0x4e7bb2
cmp edi, esi
jne 0x4e7c96
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e7bf5
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e7c26
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e7c2b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e7c4a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e7c4f
mov esi, 1
cmp edi, 1
jne 0x4e7c80
test esi, esi
jne 0x4e7c80
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7cd0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcdf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._sdriversdxapi.sys
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkdxapi.sys
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachedxapi.sys
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e7d87
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e7dad
mov edi, 1
cmp ebx, 1
jne 0x4e7de2
cmp edi, esi
jne 0x4e7ec6
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e7e25
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e7e56
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e7e5b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e7e7a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e7e7f
mov esi, 1
cmp edi, 1
jne 0x4e7eb0
test esi, esi
jne 0x4e7eb0
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7f00
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fce00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._sdriversdxg.sys
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkdxg.sys
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachedxg.sys
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e7fb7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e7fdd
mov edi, 1
cmp ebx, 1
jne 0x4e8012
cmp edi, esi
jne 0x4e80f6
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e8055
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e8086
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e808b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e80aa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e80af
mov esi, 1
cmp edi, 1
jne 0x4e80e0
test esi, esi
jne 0x4e80e0
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e8130
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fce10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._sdriversdxgthk.sys
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkdxgthk.sys
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachedxgthk.sys
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e81e7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e820d
mov edi, 1
cmp ebx, 1
jne 0x4e8242
cmp edi, esi
jne 0x4e8326
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e8285
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e82b6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e82bb
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e82da
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e82df
mov esi, 1
cmp edi, 1
jne 0x4e8310
test esi, esi
jne 0x4e8310
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e8360
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fce20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._sdrivers_tdi.sys
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bk_tdi.sys
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcache_tdi.sys
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e8417
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4e843d
mov edi, 1
cmp ebx, 1
jne 0x4e8472
cmp edi, esi
jne 0x4e8556
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4e84b5
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4e84e6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4e84eb
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4e850a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4e850f
mov esi, 1
cmp edi, 1
jne 0x4e8540
test esi, esi
jne 0x4e8540
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret