joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b687d
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x725b32
call fcn.006db31c
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [eax + 0x14], 0x10
push esi
mov dword [ebp - 0x10], ebx
jb 0x4b689e
mov eax, dword [eax]
push 0x7d576c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.006e62fb
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [esi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
cmp dword [ebp - 0x10], 0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
je 0x4b692e
push edi
push dword [ebp - 0x10]
call fcn.006e6497
push eax
call fcn.006e68f6
mov edi, eax
pop ecx
pop ecx
test edi, edi
jle 0x4b691e
push 0x7af994
push edi
call fcn.006db311
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4b691e
push dword [ebp - 0x10]
push edi
push 1
push ebx
call fcn.006e66a4
add esp, 0x10
cmp eax, edi
jne 0x4b6917
push edi
push ebx
mov ecx, esi
call fcn.004519c9
push ebx
call fcn.006db30c
pop ecx
cmp dword [ebp - 0x10], 0
pop edi
je 0x4b692e
push dword [ebp - 0x10]
call fcn.006e6467
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4bad1f
Capabilities:
Delete file

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
push dword [edi + 0xa0]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [edi + 0xa8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bad3b
sub ecx, edx
push 1
lea ebp, [ecx + 5]
push ebp
call fcn.006e6b64
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4bad7d
cmp byte [0x7ed364], al
je 0x4bad78
lea ecx, [esp + 0x10]
call fcn.004b831c
mov esi, eax
mov ecx, esi
call fcn.004ba5ff
push esi
call fcn.004cbae5
pop ecx
or eax, 0xffffffff
jmp 0x4bada2
push dword [edi + 0xa8]
push str._s.pem
push ebp
push esi
call fcn.004bb5ef
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.006e60fe
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4baede
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, 0x7ed160
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x7ed16c], eax
test eax, eax
je 0x4baf79
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x7ed168], eax
test eax, eax
je 0x4baf79
mov eax, dword [ebp + 8]
mov dword [0x7ed164], eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x4b9bc7
push edi
push edi
mov dword [ebp - 4], edi
call fcn.006e6d4e
add esp, 0x18
mov dword [0x7ed174], eax
test eax, eax
je 0x4baf79
push 0xea60
push dword [0x7ed16c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4baf79
cmp dword [0x7ed160], edi
jne 0x4baf79
mov ax, word [0x7ed170]
test ax, ax
je 0x4baf79
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4baf75
mov word [ecx], ax
xor eax, eax
jmp 0x4baf7c
or eax, 0xffffffff
pop edi
pop ebx
leave
ret
Function at 0x4bcc48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
sub esp, 0x10
shl eax, 5
add eax, 0x7e0f68
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ebp - 0x10]
push 0x10
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x10]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004bceef
mov edi, dword [ebp + 0x10]
lea ebx, [ebp - 0x10]
push 8
mov ecx, edi
lea edx, [ebp - 1]
sub ebx, edi
pop esi
mov al, byte [ebx + ecx]
xor al, byte [edx]
dec edx
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x4bcc83
mov esi, dword [edi]
mov edx, dword [edi + 4]
add esi, 0xa7ec752d
mov eax, esi
adc edx, 0
mov ecx, edx
shrd eax, ecx, 0x1d
shld edx, esi, 3
shr ecx, 0x1d
shl esi, 3
or ecx, edx
or eax, esi
mov dword [edi + 4], ecx
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4bceef
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
je 0x4bcf0e
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
sub esi, ecx
mov al, byte [esi + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x4bcf02
pop esi
xor eax, eax
ret 0xc

Function at 0x4bd17e
Capabilities:
Delete file

Disassembly:
mov eax, 0x725bc6
call fcn.006db31c
sub esp, 0x3bc
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x1c8]
call fcn.00452f6a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.004bc8ae
push 1
lea eax, [ebp - 0x90]
mov ecx, edi
push eax
call fcn.004bd4b1
mov esi, eax
test esi, esi
jne 0x4bd2e8
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x1ff
lea eax, [ebp - 0x3c8]
push esi
push eax
call fcn.004532b1
mov ecx, dword [ebp - 0x10]
add esp, 0x10
cmp byte [esi], 0
je 0x4bd205
mov al, byte [ebp + ecx - 0x3c9]
cmp al, 0x5c
je 0x4bd205
cmp al, 0x3a
je 0x4bd205
mov byte [ebp + ecx - 0x3c8], 0x5c
inc ecx
mov dword [ebp - 0x10], ecx
push 0
mov eax, 0x200
sub eax, ecx
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x3c8]
add eax, ecx
push eax
call fcn.004532b1
add esp, 0x10
lea eax, [ebp - 0x90]
mov ecx, edi
push eax
lea eax, [ebp - 0x3c8]
push eax
push 4
call fcn.004bd525
push 0
push 0x8000
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00452f79
test eax, eax
jne 0x4bd26a
cmp byte [ebp + 0xc], 1
jne 0x4bd26a
push str.file_already_exists
push 0xb7
jmp 0x4bd2c4
push 0x180
push 0x8302
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00452f79
mov ecx, edi
test eax, eax
je 0x4bd294
push str.could_not_open_output_file
push eax
jmp 0x4bd2c6
lea eax, [ebp - 0x1c8]
push eax
call fcn.004bcf13
lea ecx, [ebp - 0x1c8]
mov esi, eax
call fcn.00452fe5
test esi, esi
je 0x4bd2cf
lea eax, [ebp - 0x3c8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.could_not_decompress
push esi
mov ecx, edi
call fcn.004bd56a
mov esi, eax
jmp 0x4bd2e8
lea eax, [ebp - 0x90]
mov ecx, edi
push eax
lea eax, [ebp - 0x3c8]
push eax
push 8
call fcn.004bd525
xor esi, esi
lea ecx, [ebp - 0x1c8]
call fcn.00452f74
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4bd5a7
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xb8
xor eax, eax
mov dword [ebp + 0x30], 0x1a41534f
inc eax
mov dword [ebp + 0x34], 0x47863a90
mov word [ebp + 0x40], ax
xorps xmm0, xmm0
push ebx
xor eax, eax
mov dword [ebp + 0x3c], 0x38
mov word [ebp + 0x42], ax
mov ebx, ecx
push esi
push edi
movlpd qword [ebp + 0x48], xmm0
lea edi, [ebp + 0x50]
stosd dword es:[edi], eax
mov byte [ebp - 0x50], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x74]
mov dword [ebx + 0x138], eax
mov al, byte [ebp + 0x7c]
mov byte [ebx + 0x34c], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.006e7340
pop ecx
mov ecx, ebx
mov dword [ebx + 0x148], 0x7d3deb
call fcn.00452fe5
mov esi, dword [ebp + 0x70]
lea eax, [ebx + 0x14c]
xor edi, edi
push edi
push 0x100
push esi
push eax
call fcn.004532b1
mov eax, dword [ebx + 0x138]
add esp, 0x10
test eax, eax
jne 0x4bd6d2
push edi
push 0x8000
push esi
mov ecx, ebx
call fcn.00452f79
test eax, eax
jne 0x4bd67b
cmp byte [ebp + 0x78], 1
jne 0x4bd67b
mov ecx, ebx
call fcn.00452fe5
push str.archive_already_exists
push 0xb7
mov ecx, ebx
call fcn.004bd56a
jmp 0x4bd711
lea eax, [ebp - 0x50]
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea esi, [ebx + 0x24c]
push esi
push edi
push 0x72a950
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x180
push 0x8302
push esi
mov ecx, ebx
call fcn.00452f79
mov ecx, ebx
test eax, eax
je 0x4bd6c1
push str.could_not_open_archive
push eax
jmp 0x4bd671
call fcn.004bd98a
test eax, eax
je 0x4bd711
push str.could_not_write
push eax
jmp 0x4bd66f
cmp eax, 2
je 0x4bd6dc
cmp eax, 3
jne 0x4bd70f
push edi
push 0x8000
push esi
mov ecx, ebx
call fcn.00452f79
mov ecx, ebx
test eax, eax
jne 0x4bd6b9
call fcn.004bd82d
test eax, eax
jne 0x4bd711
lea eax, [ebp + 0x30]
mov ecx, ebx
push eax
call fcn.004bd71b
test eax, eax
je 0x4bd711
push str.could_not_read_header
jmp 0x4bd6cf
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10
Function at 0x4c6f80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x4c6ff8
push edi
call fcn.006db7db
mov esi, eax
pop ecx
test esi, esi
je 0x4c6ff8
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4c6fed
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0xc]
push eax
push 0x72aa80
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c6fed
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [eax + 8]
or edx, dword [eax + 0xc]
or ecx, ebx
mov eax, dword [ebp + 0xc]
mov bl, 1
mov dword [eax], edx
mov dword [eax + 4], ecx
push esi
call fcn.006db30c
pop ecx
mov al, bl
jmp 0x4c6ffa
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c7621
Capabilities:
Get session information
Get session user name

Disassembly:
mov eax, 0x725d6d
call fcn.006db31c
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 8]
push str.Unknown
mov dword [ebp - 4], esi
call fcn.004be31b
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 1
push eax
push 5
push dword [ebp + 0xc]
push esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x4c76a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4c7676
push 0x72ad74
jmp 0x4c76a4
cmp byte [0x7ed364], 0
je 0x4c76ac
lea ecx, [ebp - 0xd]
call fcn.004c208d
mov esi, eax
mov ecx, esi
call fcn.004cc3a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.004cbae5
pop ecx
pop ecx
jmp 0x4c76ac
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
call fcn.004cabc4
push dword [ebp - 0x14]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4c7bdb
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4c7c1f
cmp byte [0x7ed364], bl
je 0x4c7c18
lea ecx, [ebp - 1]
call fcn.004c329e
mov esi, eax
mov ecx, esi
call fcn.004ba567
push esi
call fcn.004cbae5
pop ecx
xor al, al
jmp 0x4c7d3d
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4c7c5c
cmp byte [0x7ed364], bl
je 0x4c7d34
lea ecx, [ebp - 1]
call fcn.004c3526
mov esi, eax
mov ecx, esi
call fcn.004ba5ff
jmp 0x4c7d2d
mov esi, dword [ebp + 0xc]
cmp dword [0x7e0fe0], 8
mov eax, 0x7e0fcc
cmovae eax, dword [0x7e0fcc]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.006e75a6
pop ecx
pop ecx
test eax, eax
jne 0x4c7cd3
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4c7d14
mov eax, dword [ebp + 8]
cmp dword [ebp - 8], eax
jne 0x4c7cd3
push dword [ebp - 0x22c]
push ebx
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi], eax
test eax, eax
je 0x4c7cf9
push eax
call fcn.004d7755
pop ecx
test al, al
je 0x4c7cea
cmp dword [esi], ebx
je 0x4c7cd3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x234]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c7c5f
jmp 0x4c7d34
mov ecx, dword [ebp + 0x10]
mov bl, 1
mov eax, dword [ebp - 0x22c]
mov dword [ecx], eax
jmp 0x4c7d34
cmp byte [0x7ed364], bl
je 0x4c7d34
lea ecx, [ebp - 1]
call fcn.004c5698
mov esi, eax
mov ecx, esi
call fcn.004ba541
jmp 0x4c7d2d
cmp byte [0x7ed364], bl
je 0x4c7d34
lea ecx, [ebp - 1]
call fcn.004c51bf
mov esi, eax
mov ecx, esi
call fcn.004ba671
push esi
call fcn.004cbae5
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c855b
Capabilities:
Create thread

Disassembly:
mov eax, 0x725df9
call fcn.006db31c
sub esp, 0x10
cmp dword [ebp + 8], 0
push esi
je 0x4c86d1
cmp dword [ebp + 8], 0xffffffff
je 0x4c86d1
push ebx
push edi
mov dword [ebp - 0x14], vtable.LockGuard.0
call fcn.004c8800
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x7ed394
mov dword [ebp - 4], ebx
call fcn.004bdd33
mov esi, eax
mov eax, dword [0x7ed394]
cmp esi, eax
je 0x4c8604
cmp dword [esi + 0x14], ebx
je 0x4c85ef
push ebx
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4c85ea
cmp byte [0x7ed364], bl
je 0x4c85e3
lea ecx, [ebp - 0xd]
call fcn.004c1eaf
mov esi, eax
mov ecx, esi
call fcn.004ba77b
push dword [ebp + 8]
push esi
call fcn.004cbae5
pop ecx
pop ecx
mov bl, 1
jmp 0x4c86c6
mov eax, dword [0x7ed394]
cmp esi, eax
je 0x4c8604
cmp dword [esi + 0x14], ebx
je 0x4c8604
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], ebx
push 0x7af994
push 8
call fcn.006db7e4
mov edi, eax
mov dword [ebp - 0x18], edi
pop ecx
pop ecx
test edi, edi
je 0x4c86a6
mov ecx, dword [ebp + 8]
push ebx
push ebx
push edi
push 0x4c8dad
mov dword [edi], ecx
mov ecx, dword [ebp + 0xc]
push ebx
push ebx
mov dword [edi + 4], ecx
call fcn.006e6d4e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4c866d
cmp byte [0x7ed364], bl
je 0x4c8662
lea ecx, [ebp - 0xd]
call fcn.004c3842
mov esi, eax
mov ecx, esi
call fcn.004cc1f2
push esi
call fcn.004cbae5
pop ecx
push 8
push edi
call fcn.006db2db
pop ecx
jmp 0x4c86c5
lea eax, [ebp + 8]
mov ecx, 0x7ed394
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004bdf2e
mov eax, dword [eax]
mov dword [eax + 0x14], esi
cmp byte [0x7ed364], bl
je 0x4c85e3
lea ecx, [ebp - 0xd]
call fcn.004c44ea
mov esi, eax
mov ecx, esi
call fcn.004ba72f
jmp 0x4c85d8
cmp byte [0x7ed364], bl
je 0x4c86c6
lea ecx, [ebp - 0xd]
call fcn.004c08f3
mov esi, eax
mov ecx, esi
call fcn.004cc264
push esi
call fcn.004cbae5
pop ecx
call fcn.004cb2aa
pop edi
mov al, bl
pop ebx
jmp 0x4c86f8
cmp byte [0x7ed364], 0
je 0x4c86f6
lea ecx, [ebp - 0xd]
call fcn.004bf092
mov esi, eax
mov ecx, esi
call fcn.004ba671
push dword [ebp + 8]
push esi
call fcn.004cbae5
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4c8705
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x7af994
push 4
call fcn.006db7e4
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4c8741
cmp byte [0x7ed364], al
je 0x4c8790
lea ecx, [ebp - 1]
call fcn.004c1a0b
mov esi, eax
mov ecx, esi
call fcn.004ba755
push esi
call fcn.004cbae5
pop ecx
jmp 0x4c8790
mov eax, dword [ebp + 8]
mov dword [edi], eax
xor eax, eax
push eax
push eax
push edi
push 0x4ca9c9
push eax
push eax
call fcn.006e6d4e
add esp, 0x18
test eax, eax
jne 0x4c8789
cmp byte [0x7ed364], al
je 0x4c877e
lea ecx, [ebp - 1]
call fcn.004bedf7
mov esi, eax
mov ecx, esi
call fcn.004ba625
push esi
call fcn.004cbae5
pop ecx
push 4
push edi
call fcn.006db2db
pop ecx
jmp 0x4c873e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x4c8b92
Capabilities:
Delete directory

Disassembly:
mov eax, 0x725e2a
call fcn.006db31c
sub esp, 0x68
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test byte [eax], 0x10
mov dword [ebp - 0x10], esp
je 0x4c8d9b
xor edi, edi
mov dword [ebp - 0x30], 7
xor ecx, ecx
mov dword [ebp - 0x44], edi
add eax, 0x2c
mov word [ebp - 0x44], cx
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], edi
call fcn.004b6b96
push 0x72b628
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], edi
call fcn.004b69dc
test al, al
jne 0x4c8d5e
push 0x72b62c
lea ecx, [ebp - 0x44]
call fcn.004b69dc
test al, al
jne 0x4c8d5e
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.004b6b96
push 0x72aa80
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004cbfb9
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push dword [ebp - 0x34]
cmovae eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004b6afb
push str.AppDataRoamingOpera_SoftwareOpera_Stable_
lea ecx, [ebp - 0x2c]
call fcn.004cbfb9
push str.Preferences
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004bdad8
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 2
push eax
call fcn.004c9f2d
push str.Extensionsmkndcbhcgphcfkkddanakjiepeknbgle
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004bdad8
add esp, 0x1c
cmp dword [ebp - 0x48], 8
lea ebx, [ebp - 0x5c]
mov byte [ebp - 4], 4
jb 0x4c8c9a
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x4c8cb9
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4c8c9f
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4c8cbd
mov eax, edi
jmp 0x4c8cd5
add esi, esi
mov eax, esi
call fcn.006db840
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.004c5fdc
push 1
push str.C_.____
push eax
call fcn.004532fd
add esp, 0xc
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4c8d01
lea ecx, [ebp - 0x5c]
call fcn.004b6a96
lea ecx, [ebp - 0x74]
call fcn.004b6a96
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4c8d4e
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x4c8d45
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00450606
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4c8d9b
mov ecx, dword [ebp - 0x44]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], ecx
mov dword [ebp + 0xc], eax
cmp eax, 0x1000
jb 0x4c8d92
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00450606
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
lea esp, [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c9e1b
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x725e6f
call fcn.006db31c
sub esp, 0x480
push esi
push 0x20a
xor esi, esi
lea eax, [ebp - 0x23c]
push esi
push eax
call fcn.006dca70
add esp, 0xc
mov dword [ebp - 0x18], 0x105
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
je 0x4c9f20
xor eax, eax
mov dword [ebp - 0x30], esi
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x20], esi
push eax
mov dword [ebp - 0x1c], 7
call fcn.004b6b96
push 0x72b620
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], esi
call fcn.004cbfb9
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x48c]
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c9ee3
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.004c8b92
pop ecx
pop ecx
lea eax, [ebp - 0x48c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4c9eb5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x1c]
cmp eax, 8
jb 0x4c9f20
mov ecx, dword [ebp - 0x30]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x4c9f17
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00450606
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4caa21
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x7ed390]
sub esp, 0x118
push ebx
push ebp
xor ebp, ebp
cmp byte [esp + 0x124], 0
push esi
je 0x4caac5
test eax, eax
jne 0x4caabc
push 3
lea eax, [esp + 0x28]
push str.Globalcsproxy_running
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], eax
call fcn.004b991c
push 1
push dword [esp + 0x24]
call fcn.004c6902
pop ecx
pop ecx
lea ecx, [esp + 0x24]
mov dword [0x7ed390], eax
cmp dword [esp + 0x20], ecx
je 0x4caa86
push dword [esp + 0x20]
call fcn.006e60fe
mov eax, dword [0x7ed390]
pop ecx
test eax, eax
jne 0x4caabc
cmp byte [0x7ed364], al
je 0x4caae2
lea ecx, [esp + 0x13]
call fcn.004c3aad
mov esi, eax
mov ecx, esi
call fcn.004ba697
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.004cbae5
mov eax, dword [0x7ed390]
pop ecx
pop ecx
test eax, eax
je 0x4caae2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4caae2
test eax, eax
je 0x4caae2
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x7ed390]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7ed390], ebp
push 0x2001f
push dword [0x7ed39c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
push reloc.WS2_32.dll_bind
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.004c8ab0
mov ebx, dword [esp + 0x14]
test eax, eax
jne 0x4cab87
mov ax, word [esp + 0x12c]
push edi
test ax, ax
je 0x4cab55
cmp byte [esp + 0x12c], 0
je 0x4cab55
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
pop edi
movzx eax, ax
push edi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push edi
push ebp
push str.cspp
push ebx
call esi
test eax, eax
jne 0x4cab86
mov dword [esp + 0x10], 1
jmp 0x4cab76
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x10]
push 4
pop edi
push edi
push eax
push edi
push ebp
push str.cspp
push ebx
mov dword [esp + 0x28], ebp
call esi
mov dword [esp + 0x10], ebp
push edi
lea eax, [esp + 0x14]
push eax
push edi
push ebp
push str.cspr
push ebx
call esi
pop edi
test ebx, ebx
je 0x4cab92
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
pop ebx
add esp, 0x118
ret