joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3bd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
sub esp, 0x18
mov eax, 0x677ffc
call fcn.0062921c
sub esp, 0xf0
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp + 0x18], esi
mov ebx, dword [esi + 0x354]
call fcn.004e3d7e
mov esi, dword [esi + 0x140]
lea edi, [ebp + 4]
push 5
pop ecx
mov dword [ebp], 0x32716572
add esi, 8
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xfc]
call fcn.004651cd
and dword [ebp - 4], 0
lea eax, [ebp]
push 0x18
push eax
lea ecx, [ebp - 0xfc]
call fcn.00465169
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push 5
pop ecx
mov esi, ebx
lea edi, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov ecx, edi
mov eax, dword [ebx + ecx + 0x14]
xor dword [ebp + ecx - 0x74], eax
add ecx, 4
cmp ecx, 0x14
jb 0x4e3c38
movzx eax, byte [0x74d05c]
mov esi, dword [ebp + 0x18]
mov ecx, esi
shr eax, 2
not eax
mov dword [ebp - 0x58], edi
and eax, 1
mov dword [ebp - 0x60], edi
or al, 2
mov dword [ebp - 0x5c], edi
mov byte [ebp - 0x55], al
mov byte [ebx], al
lea eax, [ebp - 0x50]
push dword [esi + 0x140]
mov dword [ebp - 0x54], 0x44000000
push eax
call fcn.004ddfd1
mov eax, dword [esi + 0x140]
mov ecx, esi
push 0x14
add eax, 8
push eax
call fcn.004e4f94
lea eax, [ebx + 0xc]
push eax
push 0x54
lea eax, [ebp - 0x60]
push eax
call fcn.005651b4
lea eax, [ebx + 0x114]
mov dword [ebx + 5], edi
push eax
lea ecx, [ebx + 1]
push 8
push ecx
mov dword [ecx], edi
call fcn.005651b4
push edi
push 0x7c
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
call fcn.00475a54
lea ecx, [ebp - 0xfc]
call fcn.00409944
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x1c]
pop ebp
ret

Function at 0x4ea81f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x678381
call fcn.0062921c
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebx], 0x6aeb24
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x14]
push 5
pop ecx
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 1
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebx + 0x10], eax
push edi
call fcn.0048f232
mov ecx, eax
mov esi, edx
mov eax, dword [0x76d69c]
cdq
add ecx, eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x28], ecx
adc esi, edx
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], 0xea60
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
mov dword [ebx + 0x48], edi
lea esi, [ebx + 0x4c]
mov dword [esi], 0x6aea1c
push str.share
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.0046e056
push esi
push eax
lea ecx, [ebx + 0x50]
mov byte [ebp - 4], 4
call fcn.00534bd8
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.0042386b
push 0x1388
call fcn.0045b411
mov ecx, ebx
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x8c], edi
call fcn.004eba74
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4ecd36
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x140], 0
jne 0x4ecdab
mov ebx, 0x100
cmp dword [esi + 0x15c], ebx
jae 0x4ecdab
lea edx, [esi + 0x144]
mov byte [esi + 0x140], 1
xor eax, eax
mov edi, edx
push edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esi + 0x158]
mov ecx, dword [esi + 0x15c]
sub ebx, ecx
mov edx, dword [esi]
mov edi, dword [esp + 0x14]
push eax
lea eax, [esi + 0x160]
mov dword [esi + 0x154], edi
add eax, ecx
mov ecx, esi
push ebx
push eax
call dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4ecdb3
push edi
mov byte [esi + 0x140], 0
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov al, 1
pop edi
pop esi
pop ebx
ret 4
xor al, al
jmp 0x4ecdad
Function at 0x4f946f
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x678c9e
call fcn.0062921c
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x4f9498
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
jmp 0x4f949c
mov eax, ebx
mov edx, ebx
mov dword [esi], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x34]
push 7
pop edi
mov dword [esi + 4], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x4f94db
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0x4c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x4f94f0
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
mov al, byte [ebp + 0x2c]
mov byte [esi + 0x65], al
mov al, byte [esi + 0x66]
and al, 0xe1
mov byte [esi + 0x64], 8
or al, 0x40
mov word [esi + 0x67], bx
mov byte [esi + 0x66], al
lea eax, [esi + 0x6c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x4f951d
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ecx
mov byte [esi + 0x90], bl
mov dword [esi + 0x94], ebx
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.004f9d6e
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00423207
mov ecx, esi
call fcn.004fba59
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov ecx, dword [esi + 0x8c]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4f9598
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.004faa30
push eax
lea ecx, [ebp - 0x28]
call fcn.004232e6
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0042386b
lea eax, [ebp - 0x28]
push eax
call fcn.0045c3d1
test al, al
je 0x4f95c5
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4f95b1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
shl al, 5
xor al, byte [esi + 0x66]
and al, 0x20
xor byte [esi + 0x66], al
jmp 0x4f95c9
and byte [esi + 0x66], 0xdf
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0042386b
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x4fa03c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x689336
call fcn.0062921c
sub esp, 0x18
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, 0x9c
mov eax, dword [edi + 8]
sub eax, dword [edi + 4]
cdq
idiv ecx
test eax, eax
je 0x4fa0f9
push esi
xor esi, esi
mov eax, dword [edi + 4]
mov ecx, edi
add eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004faa30
and dword [ebp - 4], 0
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4fa089
lea eax, [ebp - 0x24]
push eax
call fcn.00455ae5
test al, al
jne 0x4fa09d
mov eax, dword [edi + 4]
and byte [esi + eax + 0x66], 0xdf
jmp 0x4fa0cf
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4fa0a9
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4fa0c7
mov ecx, dword [edi + 4]
shl al, 5
xor al, byte [esi + ecx + 0x66]
and al, 0x20
xor byte [esi + ecx + 0x66], al
jmp 0x4fa0cf
mov eax, dword [edi + 4]
or byte [esi + eax + 0x66], 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
push 0
push 1
call fcn.0042386b
mov eax, dword [edi + 8]
mov ecx, 0x9c
sub eax, dword [edi + 4]
inc ebx
cdq
add esi, ecx
idiv ecx
cmp ebx, eax
jb 0x4fa068
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4fa459
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
sub esp, 0x64
mov eax, 0x678dad
call fcn.0062921c
sub esp, 0x30
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [ecx + 8]
cmp esi, edi
je 0x4fa624
add ecx, 0x28
mov dword [ebp + 0x48], ecx
push ebx
push 0
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [ebp]
push eax
call fcn.0045b5b9
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x4fa49d
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0x4c]
call fcn.00424ff1
push 0
push 1
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.0042386b
mov edx, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x4c]
mov ebx, ecx
cmp edx, 8
jae 0x4fa4c6
lea ebx, [ebp + 0x4c]
mov eax, dword [ebp + 0x5c]
sub eax, dword [esi + 0x44]
lea ebx, [ebx + eax*2]
add ebx, 0xfffffffe
mov dword [ebp + 0x64], ebx
cmp edx, 8
jae 0x4fa4dd
lea ecx, [ebp + 0x4c]
push 0x5c
push ecx
call fcn.0062e51b
pop ecx
pop ecx
cmp eax, ebx
jb 0x4fa602
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x4fa500
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x4fa5f7
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
jne 0x4fa5f7
push str.thumbs.db
lea ecx, [ebp + 0x30]
call fcn.00424ff1
push 0
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045b5b9
cmp dword [eax + 0x14], 8
jb 0x4fa54c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x24]
push 0
push 1
setne bh
call fcn.0042386b
push 0
push 1
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 2
call fcn.0042386b
push str..DS_Store
lea ecx, [ebp + 0x18]
call fcn.00424ff1
push 0
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0045b5b9
cmp dword [eax + 0x14], 8
jb 0x4fa5a0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x3c]
push 0
push 1
setne bl
call fcn.0042386b
push 0
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 2
call fcn.0042386b
test bh, bh
jne 0x4fa5d0
test bl, bl
je 0x4fa602
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x4fa5dc
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x4fa5f4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
je 0x4fa602
mov ebx, dword [ebp + 0x64]
mov edx, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x4c]
jmp 0x4fa4d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x4c]
push 0
push 1
call fcn.0042386b
mov ecx, dword [ebp + 0x48]
add esi, 0x9c
cmp esi, edi
jne 0x4fa481
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
lea esp, [ebp + 0x68]
pop ebp
ret
Function at 0x4fa635
Capabilities:
Delete file

Disassembly:
mov eax, 0x678df5
call fcn.0062921c
sub esp, 0x78
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00455ae5
test al, al
je 0x4fa7d2
push ebx
xor ebx, ebx
push esi
cmp byte [ebp + 0xc], bl
je 0x4fa737
push edi
call fcn.0045c2c9
mov esi, eax
test esi, esi
je 0x4fa7d0
call fcn.0048d558
push eax
push 0x21
lea ecx, [ebp - 0x1c]
call fcn.0048cfd0
push edi
push str.fileName
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.0049386e
push esi
push str.error
lea ecx, [ebp - 0x1c]
call fcn.0049386e
lea eax, [ebp - 0x1c]
push eax
call fcn.0048ed37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0048d081
push esi
push edi
push str.Warning:_Delete_to_trash_failed_for__S._Error:__d._Deleting_permanently.
push 0x800
call fcn.00482bae
add esp, 0x10
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.0043f967
push eax
xor esi, esi
lea eax, [ebp - 0x3c]
push str._to_trash_:1___error_code_:
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.00424030
push ebx
push esi
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.0040abbf
push str.deletefail
lea ecx, [ebp - 0x24]
call fcn.0040a58f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x21
call fcn.004827b0
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.0040abbf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push ebx
push esi
call fcn.0040abbf
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4fa7d0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push esi
push edi
push str.Warning:_Delete_to_trash_failed_for__S._Error:__d._Deleting_permanently.
push 0x800
call fcn.00482bae
add esp, 0x10
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.00470bfb
push eax
push str._to_trash_:0___error_code_:
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 5
push eax
call fcn.00424030
push ebx
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.0040abbf
push str.deletefail
lea ecx, [ebp - 0x54]
call fcn.0040a58f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x21
call fcn.004827b0
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040abbf
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.0040abbf
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fb111
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, 0x9c
mov bl, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
test eax, eax
je 0x4fb1a3
push edi
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
test byte [eax + 0x66], 0x20
jne 0x4fb192
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.004faa30
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x4fb159
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
or eax, 1
cmp dword [esp + 0x24], 8
jae 0x4fb172
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
neg eax
lea ecx, [esp + 0x10]
push 0
sbb al, al
push 1
and bl, al
call fcn.0042386b
mov ecx, 0x9c
mov eax, dword [esi + 8]
inc ebp
sub eax, dword [esi + 4]
add edi, ecx
cdq
idiv ecx
cmp ebp, eax
jb 0x4fb132
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret

Function at 0x4fb1ac
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, 0x9c
mov bl, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
test eax, eax
je 0x4fb23e
push edi
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
test byte [eax + 0x66], 0x20
jne 0x4fb22d
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.004faa30
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x4fb1f4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
and eax, 0xfffffffe
cmp dword [esp + 0x24], 8
jae 0x4fb20d
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
neg eax
lea ecx, [esp + 0x10]
push 0
sbb al, al
push 1
and bl, al
call fcn.0042386b
mov ecx, 0x9c
mov eax, dword [esi + 8]
inc ebp
sub eax, dword [esi + 4]
add edi, ecx
cdq
idiv ecx
cmp ebp, eax
jb 0x4fb1cd
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret
Function at 0x4fb556
Capabilities:
Move file

Disassembly:
mov eax, 0x689336
call fcn.0062921c
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
call fcn.004fa1ad
imul ecx, dword [ebp + 8], 0x9c
mov eax, dword [ebx + 4]
add eax, ecx
mov dword [ebp + 8], ecx
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.004faa30
and dword [ebp - 4], edi
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4fb59a
lea eax, [ebp - 0x24]
push eax
call fcn.00455ae5
mov esi, dword [ebp + 0xc]
test al, al
je 0x4fb5d5
cmp dword [esi + 0x14], 8
jb 0x4fb5b1
mov ecx, dword [esi]
jmp 0x4fb5b3
mov ecx, esi
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x4fb5bf
lea eax, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x4fb5d5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
jmp 0x4fb5ee
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00423207
mov eax, dword [ebx + 4]
mov ecx, ebx
add eax, dword [ebp + 8]
push eax
call fcn.004fbab0
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fb60f
Capabilities:
Move file

Disassembly:
mov eax, 0x678e6a
call fcn.0062921c
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
and dword [ebp - 4], 0
xor ebx, ebx
push ebx
call fcn.004fa1ad
mov al, byte [esi + 0x89]
mov ecx, esi
test al, al
jne 0x4fb69a
call fcn.004fc3fb
mov edi, 0x70000001
test al, al
je 0x4fb670
mov edx, dword [esi + 4]
lea ecx, [esi + 0x28]
push 1
mov al, byte [edx + 0x66]
shr al, 2
and al, 1
movzx eax, al
push eax
lea eax, [ebp + 8]
push eax
push ecx
lea eax, [edx + 0x34]
push eax
push dword [ebp + 0x20]
call fcn.004fb247
mov ebx, eax
jmp 0x4fb672
mov ebx, edi
test ebx, ebx
je 0x4fb67e
cmp ebx, edi
jne 0x4fb798
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x20]
call fcn.00423207
push dword [esi + 4]
mov ecx, esi
call fcn.004fbab0
jmp 0x4fb77e
call fcn.004fc3fb
test al, al
je 0x4fb779
and dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
jae 0x4fb6c7
lea eax, [ebp + 8]
lea edi, [esi + 0x28]
cmp dword [edi + 0x14], 8
jb 0x4fb6d4
mov ecx, dword [edi]
jmp 0x4fb6d6
mov ecx, edi
push eax
push ecx
push str.Moving_files_from__s_to__s
call fcn.00477256
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x1c], 8
jae 0x4fb6f1
lea ecx, [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x4fb6fb
mov eax, dword [edi]
jmp 0x4fb6fd
mov eax, edi
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x4fb725
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x4fb737
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.004fb7ea
mov ebx, eax
test ebx, ebx
jne 0x4fb76b
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0042386b
jmp 0x4fb77e
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4fb743
lea eax, [ebp + 8]
push eax
call fcn.0045d180
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x4fb755
lea eax, [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x4fb75d
mov edi, dword [edi]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x4fb725
jmp 0x4fb714
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0042386b
jmp 0x4fb798
mov ebx, 0x70000001
call fcn.00472fb7
lea eax, [ebp + 8]
lea ecx, [esi + 0x28]
push eax
call fcn.004232e6
mov byte [ebp - 4], 2
call fcn.00472ff8
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4fb7ea
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x678e84
call fcn.0062921c
sub esp, 0x50
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, 0x9c
mov dword [ebp - 0x14], ebx
push edi
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
add eax, 1
je 0x4fb93c
lea edi, [esi + 0x28]
and dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
and dword [ebp - 4], eax
test ebx, ebx
jne 0x4fb869
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.0048e1ff
push eax
lea eax, [ebp - 0x5c]
push str._sPartFile__LX.dat
push eax
call fcn.004607f4
add esp, 0x14
lea ecx, [ebp - 0x2c]
push eax
call fcn.004232e6
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.0042386b
mov byte [ebp - 0x10], bl
jmp 0x4fb89a
imul edi, ebx, 0x9c
lea ecx, [ebp - 0x2c]
mov ebx, dword [esi + 4]
lea eax, [ebx - 0x68]
add eax, edi
cmp ecx, eax
je 0x4fb888
push 0xffffffffffffffff
push 0
push eax
call fcn.004239d7
mov al, byte [edi + ebx - 0x36]
lea edi, [esi + 0x28]
mov ebx, dword [ebp - 0x14]
shr al, 2
and al, 1
mov byte [ebp - 0x10], al
push 0
lea eax, [ebp - 0x2c]
push eax
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.00423207
lea eax, [ebp - 0x44]
push eax
call fcn.0045b712
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 1
jae 0x4fb8c6
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4fb8e9
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x4fb8de
lea ecx, [ebp - 0x44]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push dword [ebp + 8]
push edi
push eax
push eax
call fcn.004fb247
push 0
lea ecx, [ebp - 0x44]
mov edi, eax
push 1
call fcn.0042386b
lea ecx, [ebp - 0x2c]
push 0
push 1
test edi, edi
jne 0x4fb958
or dword [ebp - 4], 0xffffffff
call fcn.0042386b
mov eax, dword [esi + 8]
lea edi, [esi + 0x28]
sub eax, dword [esi + 4]
mov ecx, 0x9c
cdq
inc ebx
idiv ecx
mov dword [ebp - 0x14], ebx
inc eax
cmp ebx, eax
jne 0x4fb81b
mov ecx, esi
call fcn.004fa459
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0042386b
mov eax, edi
jmp 0x4fb945
Function at 0x4fc3fb
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov eax, 0x678f04
call fcn.0062921c
sub esp, 0x60
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
xor bl, bl
lea esi, [edi + 0x28]
cmp dword [esi + 0x14], 8
jb 0x4fc420
mov eax, dword [esi]
jmp 0x4fc422
mov eax, esi
push eax
call fcn.0045ba5a
push esi
test al, al
je 0x4fc43c
lea ecx, [ebp - 0x6c]
call fcn.00423207
mov ecx, eax
xor eax, eax
inc eax
jmp 0x4fc44a
lea eax, [ebp - 0x54]
push eax
call fcn.0046dffc
push 2
mov ecx, eax
pop eax
push ecx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], eax
call fcn.004231e5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
test al, 2
je 0x4fc479
push 0
and eax, 0xfffffffd
lea ecx, [ebp - 0x54]
push 1
mov dword [ebp - 0x10], eax
call fcn.0042386b
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
test al, 1
je 0x4fc48d
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.0042386b
lea eax, [ebp - 0x3c]
mov ecx, edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004faac9
xor esi, esi
cmp dword [ebp - 0x14], esi
jbe 0x4fc516
push esi
lea ecx, [ebp - 0x24]
call fcn.004f2484
cmp dword [eax + 0x14], 8
jb 0x4fc4b4
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov edx, dword [ebp - 0x14]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4fc4e1
test cl, 0x10
jne 0x4fc514
lea eax, [edx - 1]
cmp esi, eax
je 0x4fc4ec
test ecx, 0x1000
jne 0x4fc4e8
test ecx, 0x400
jne 0x4fc4e8
inc esi
cmp esi, edx
jb 0x4fc4a3
jmp 0x4fc516
xor bl, bl
jmp 0x4fc516
push esi
lea ecx, [ebp - 0x24]
call fcn.004f2484
cmp dword [eax + 0x14], 8
jb 0x4fc4fd
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
setne bl
jmp 0x4fc516
mov bl, 1
lea ecx, [ebp - 0x24]
call fcn.00470a8c
push 8
push 1
push dword [ebp - 0x24]
call fcn.00423768
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x3c]
push 0
push 1
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret