joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d834
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x47d89f
cmp byte [ebx + 0xcf], 0
jne 0x47d89f
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406584
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x47d88c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47d8ac
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406448
jmp 0x47d8ac
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406448
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x47eeb4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x47ef22
mov eax, esi
call fcn.0046574c
test al, al
je 0x47ef22
mov eax, dword [ebx + 0x80]
call fcn.004653a0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47ef22
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x47ef16
push 0
mov eax, dword [ebx + 0x80]
call fcn.004653a0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.0045c9a0
jmp 0x47ef22
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.0047ed00
pop esi
pop ebx
ret

Function at 0x480480
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4804c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00480414
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4804cd
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x4804d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4804ed
test al, 0x10
je 0x4804f1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x48051c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48053a
test al, 0x10
je 0x48053a
test ah, 4
je 0x48053e
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x480544
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00406430
xor eax, eax
push ebp
push 0x480639
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00406eb0
mov ebx, pe_nt_image_headers32
mov eax, edi
mov ecx, ebx
xor edx, edx
call fcn.00406584
cmp dword [ebp + 0xc], 0
je 0x4805c3
mov eax, dword [ebp + 0xc]
call fcn.004064d4
push eax
push ebx
mov eax, edi
call fcn.00406eb8
push eax
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov esi, eax
jmp 0x4805ee
push ebx
mov eax, edi
call fcn.00406eb8
push eax
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetProfileStringW
mov esi, eax
test esi, esi
je 0x480600
mov eax, dword [edi]
call fcn.004064d4
call fcn.0040e6fc
mov esi, eax
mov eax, ebx
sub eax, 8
cmp esi, eax
jl 0x480611
cmp ebx, 0x10000
jl 0x48061c
mov eax, edi
mov edx, esi
call fcn.004067bc
jmp 0x480623
add ebx, ebx
jmp 0x48057c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480640
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x48070c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
mov word [ebp - 0x10], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x480756
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004064d4
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x48077a
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetProfileStringW
push ebx
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcmpW
test eax, eax
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4807ec
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov word [esp], 0
test ebx, ebx
je 0x48082a
mov eax, ebx
call fcn.004064d4
push eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
push 0x48085c
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x480848
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x48085c
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetProfileStringW
cmp word [esp], 0
sete al
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x480c2c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x480cc3
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x480c77
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00406584
jmp 0x480cad
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x480c90
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040649c
jmp 0x480ca3
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00480a7c
mov ebx, eax
test esi, esi
je 0x480ca3
dec esi
jmp 0x480c7e
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480cca
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x4810a4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040eaa0
add esp, 0x208
pop ebx
ret

Function at 0x4810d0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040eaa0
add esp, 0x208
pop ebx
ret

Function at 0x4811a4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x481223
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x4811ff
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jb 0x4811ff
lea eax, [ebp - 8]
call fcn.004810d0
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0047fc20
lea eax, [ebp - 4]
mov edx, 0x48123c
call fcn.00406854
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.0048004c
jmp 0x481208
mov eax, esi
xor edx, edx
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48122a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x48148c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4815c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4815ae
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4814e9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4815ae
cmp dword [ebp - 0x14], 0
jne 0x481500
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406448
mov bl, 1
jmp 0x4815ae
cmp dword [ebp - 0x14], 0x70000000
jb 0x48150e
call fcn.004122d4
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00406584
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x4814b2
test eax, eax
jne 0x4815ae
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x48155c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4815ae
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x481564
dec esi
test esi, esi
je 0x481573
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x481563
cmp dword [ebp - 0x10], 7
jne 0x48157e
test esi, esi
je 0x48157e
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.004067bc
cmp dword [ebp - 0x10], 7
jne 0x4815a1
test esi, esi
je 0x4815a1
lea eax, [ebp - 4]
call fcn.00406eb8
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00406448
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4815cb
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x4815f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebp, eax
push 0
push 0
push 0
push 0
push esi
push ebp
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x48166c
test esi, esi
je 0x48161d
cmp word [esi], 0
jne 0x48166c
mov eax, dword [0x509070]
cmp dword [eax], 2
je 0x48166c
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call sub.advapi32.dll_RegEnumValueW
mov edi, eax
test edi, edi
je 0x48165a
cmp edi, 0xea
jne 0x48166c
test edi, edi
jne 0x481669
cmp word [esp], 0
jne 0x481669
mov bl, 1
jmp 0x48166c
inc esi
jmp 0x48162b
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4816d8
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x4816ec
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x50f1a4], 0
jne 0x48170f
push 0x481734
push 0x481754
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409620
mov dword [0x50f1a4], eax
cmp dword [0x50f1a4], 0
je 0x481729
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x50f1a4]
jmp 0x48172e
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x481770
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4818e3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x4817a4
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x4817ae
mov ebx, 0x57
jmp 0x4818cd
mov eax, dword [0x509070]
cmp dword [eax], 2
jne 0x4818bc
push 0
push 8
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movzx eax, byte [ebp - 5]
call fcn.004816b0
test eax, eax
jne 0x4818bc
xor eax, eax
push ebp
push 0x4818b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00406584
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x481809
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
cmp esi, 0xea
jne 0x481874
mov edi, dword [ebp - 4]
test edi, edi
je 0x481844
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x48189e
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x481863
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406584
jmp 0x4817fd
test esi, esi
jne 0x48189e
mov eax, dword [ebp - 4]
call fcn.004064d4
mov ecx, eax
mov edx, dword [ebp - 0x14]
movzx eax, byte [ebp - 5]
call fcn.00481770
test eax, eax
je 0x4817fd
inc dword [ebp - 0x18]
jmp 0x4817fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4818bc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movzx eax, byte [ebp - 5]
call fcn.004816d8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4818ea
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x48197c
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x509070]
cmp dword [eax], 2
je 0x481999
mov byte [ebp - 1], 1
jmp 0x481b67
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x507e14
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x481b67
xor eax, eax
push ebp
push 0x481b60
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x4819fb
push 0x481b74
push 0x481ba0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409620
mov ebx, eax
test ebx, ebx
je 0x481a22
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x481b49
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x481b49
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x481a73
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x481a54
call fcn.00404b68
jmp 0x481b67
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x481a73
call fcn.00404b68
jmp 0x481b67
xor eax, eax
push ebp
push 0x481b42
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x481ab6
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x481ab6
call fcn.00404b68
call fcn.00404b68
jmp 0x481b67
mov eax, dword [ebp - 0x14]
call fcn.00403018
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x481ae8
call fcn.00404b68
call fcn.00404b68
jmp 0x481b67
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x481b23
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x481b1f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x481b1f
mov byte [ebp - 1], 1
jmp 0x481b23
inc ebx
dec esi
jne 0x481af5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481b49
mov eax, dword [ebp - 0x18]
call fcn.00403034
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481b67
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x482624
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4826cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x509070]
cmp dword [eax], 2
jne 0x482667
push 1
mov eax, esi
call fcn.004064d4
push eax
mov eax, edi
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4826b5
mov eax, esi
call fcn.004064d4
mov edx, eax
lea eax, [ebp - 4]
call fcn.00406604
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x48269a
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x4826b5
mov eax, esi
call fcn.004064d4
push eax
mov eax, edi
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4826d2
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x4839dc
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x50f1c8
mov eax, esi
mov edx, 8
test al, 1
je 0x4839f8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4839fa
shr eax, 1
dec edx
jne 0x4839eb
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4839e4
pop esi
ret

Function at 0x483a10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x50f1c4], 0
jne 0x483a33
call fcn.004839dc
push 1
push 0x50f1c4
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x483a5e
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x50f1c8]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x483a39
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4847a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004064d4
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x484842
mov eax, ebx
call fcn.00403018
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48483b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x484825
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x484864
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x484825
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484859
mov eax, dword [ebp - 0x10]
call fcn.00403034
ret
mov eax, dword [0x509070]
cmp dword [eax], 1
je 0x484859
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004845c4
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484a6c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00484a20
test al, al
jne 0x484a8d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x484adb
xor eax, eax
push ebp
push 0x484acb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_CreateDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484ad2
lea eax, [ebp - 0xc]
call fcn.00484a5c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484ae4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00484a20
test al, al
jne 0x484b08
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x484b6e
xor eax, eax
push ebp
push 0x484b5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484b65
lea eax, [ebp - 0xc]
call fcn.00484a5c
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x484b7c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00484a20
test al, al
jne 0x484ba0
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x484bf8
xor eax, eax
push ebp
push 0x484be8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.004064d4
push eax
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484bef
lea eax, [ebp - 0xc]
call fcn.00484a5c
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4