joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ced7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
call fcn.0045da48
mov ebx, eax
test ebx, ebx
je 0x45cf0d
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x45cf0d
cmp dword [ebp + 0x14], edi
jae 0x45cf16
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x45cf0d
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x45cf0d
push edi
push eax
push dword [ebp + 0x10]
call fcn.005683f0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
jmp 0x45cf0f

Function at 0x4673e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x78
pop ecx
mov ax, word [edi + 0x210]
add ax, word [ebp + 0xc]
cwde
cdq
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x210], dx
cdq
xor eax, edx
sub eax, edx
movzx esi, ax
xor eax, eax
cmp ax, si
jge 0x46748b
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
mov dword [ebp - 4], ecx
movzx eax, bx
push 0
mov dword [ebp - 8], eax
mov eax, dword [edi]
push ecx
push 1
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
je 0x46745a
mov ecx, edi
call fcn.00468c2c
mov ecx, dword [ebp - 4]
inc ebx
cmp bx, si
jl 0x46742f
jmp 0x467490
sub esi, dword [ebp - 8]
push dword [ebp + 0x14]
mov eax, esi
push dword [ebp + 0x10]
neg eax
cmp word [ebp + 0xc], 0
movzx ecx, ax
movzx eax, si
cmovg ecx, eax
movsx eax, cx
mov ecx, edi
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.00453dd5
jmp 0x467490
test si, si
je 0x4674ca
mov ecx, edi
call fcn.00451ace
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x46b4eb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x170]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, esi
test eax, eax
jne 0x46b511
call fcn.004547a1
jmp 0x46b53d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00453c33
mov eax, dword [esi + 0x180]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x46b53d
push 1
push ecx
push ecx
push eax
push 0x61c304
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 0xc
Function at 0x46d914
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00870b9c
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x46d96f
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x46d983
cmp byte [ebp - 6], 1
jne 0x46d983
cmp dword [ebp - 0x11c], 6
jne 0x46d983
xor eax, eax
inc eax
jmp 0x46d985
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00530cbe
leave
ret
Function at 0x47bef7
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x5c
mov eax, 0x5fd59c
call fcn.00872e45
mov esi, ecx
push esi
lea ecx, [ebp - 0x68]
call fcn.0044f5e8
mov dword [ebp - 0x68], 0x61e014
mov dword [ebp - 0x60], 0x61e028
mov eax, dword [esi]
lea ecx, [ebp - 0x68]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x40], 0
push ecx
mov ecx, esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], edi
call dword [eax + 0x94]
cmp dword [ebp - 0x40], 0
jne 0x47c0e3
cmp dword [ebp + 0x10], 0
je 0x47bf70
cmp edi, 0xffffffff
je 0x47c0b4
imul ecx, edi, 0xc
xor eax, eax
add ecx, dword [esi + 0x26c]
cmp dword [ecx + 8], eax
sete al
mov dword [ecx + 8], eax
jmp 0x47c0a6
cmp dword [esi + 0x264], 0
jne 0x47bf82
cmp dword [esi + 0x260], 0
je 0x47bf8f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x47bf4e
cmp dword [esi + 0x264], 0
jne 0x47bfa5
cmp dword [esi + 0x260], 0
je 0x47c03a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x47c03a
cmp edi, 0xffffffff
je 0x47c0b4
xor eax, eax
cmp ebx, 0xffffffff
cmovne eax, ebx
mov ebx, eax
mov eax, edi
cmp ebx, edi
mov dword [ebp + 8], ebx
mov ecx, ebx
cmovg eax, ebx
cmp eax, ebx
mov dword [ebp - 0x14], eax
cmove ecx, edi
and dword [ebp + 0x10], 0
mov dword [ebp - 0x10], ecx
mov ecx, esi
call fcn.0047b6db
test eax, eax
jle 0x47c0b4
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov ecx, dword [esi + 0x26c]
mov edx, dword [ecx + ebx + 8]
cmp edi, dword [ebp - 0x10]
jl 0x47c011
cmp edi, dword [ebp - 0x14]
jg 0x47c011
xor eax, eax
inc eax
jmp 0x47c013
xor eax, eax
mov dword [ecx + ebx + 8], eax
cmp edx, eax
je 0x47c023
push edi
mov ecx, esi
call fcn.0047c5cf
mov ecx, esi
inc edi
add ebx, 0xc
call fcn.0047b6db
cmp edi, eax
jl 0x47bff8
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
jmp 0x47c0b4
or dword [esi + 0x220], 0xffffffff
mov ecx, esi
and dword [ebp + 0x10], 0
call fcn.0047b6db
test eax, eax
jle 0x47c091
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + 0x26c]
cmp ebx, edi
je 0x47c079
cmp dword [eax + ecx + 8], 0
je 0x47c079
and dword [eax + ecx + 8], 0
mov ecx, esi
push ebx
call fcn.0047c5cf
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
inc ebx
mov dword [ebp + 0xc], ecx
mov ecx, esi
call fcn.0047b6db
mov ecx, dword [ebp + 0xc]
cmp ebx, eax
jl 0x47c058
mov ebx, dword [ebp + 8]
cmp edi, 0xffffffff
je 0x47c0b4
imul eax, edi, 0xc
add eax, dword [esi + 0x26c]
mov dword [eax + 8], 1
push edi
mov ecx, esi
mov dword [esi + 0x220], edi
call fcn.0047c5cf
push esi
lea ecx, [ebp - 0x3c]
call fcn.0044f5e8
mov dword [ebp - 0x3c], 0x61e098
mov dword [ebp - 0x34], 0x61e0ac
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
call dword [eax + 0x94]
call fcn.00853c29
ret 0xc
Function at 0x4801e3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov edi, ecx
sub eax, 9
je 0x480243
sub eax, 1
je 0x480226
sub eax, 3
je 0x480226
test dword [edi + 0x370], 0x2000
je 0x48025b
push esi
call fcn.005a3e40
pop ecx
test eax, eax
jne 0x48025b
cmp esi, 0x2d
je 0x48025b
cmp esi, 0x2e
je 0x48025b
cmp esi, 0x2c
je 0x48025b
jmp 0x480276
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x48025b
test dword [edi + 0x370], 0x1000
je 0x480276
jmp 0x48025b
test byte [edi + 0x374], 0x80
jne 0x48025b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x480276
mov eax, dword [edi + 0x380]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x480561
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x2c
mov eax, 0x5fd953
call fcn.00872e45
mov esi, ecx
push esi
lea ecx, [ebp - 0x38]
call fcn.0044f5e8
mov dword [ebp - 0x38], 0x61e700
mov dword [ebp - 0x30], 0x61e714
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
mov dword [ebp - 0x18], edi
call dword [eax + 0x94]
cmp byte [ebp - 0x10], bl
jne 0x4805e9
cmp edi, 0xd
jne 0x4805cd
test dword [esi + 0x370], 0x1000
jne 0x4805cd
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x4805e9
mov eax, dword [esi + 0x380]
push ebx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
jmp 0x4805ec
mov dword [esi + 0x10], ebx
call fcn.00853c29
ret 0xc
Function at 0x482e99
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x28
mov eax, 0x5fdc0f
call fcn.00872e45
mov ebx, ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
push 0x11
mov edi, eax
call esi
and eax, 0x8000
push 0x10
mov dword [ebp - 0x10], eax
call esi
and eax, 0x8000
lea esi, [ebx + 0x170]
and edi, 0x8000
jne 0x482f02
cmp dword [ebp - 0x10], 0
jne 0x482eec
test eax, eax
jne 0x482ee5
inc eax
xor ecx, ecx
jmp 0x482f2e
push 2
pop eax
push 4
jmp 0x482f2d
test eax, eax
jne 0x482ef7
push 4
pop eax
push 2
jmp 0x482f2d
push 6
pop eax
push 0x10
mov word [esi], ax
pop eax
jmp 0x482f31
cmp dword [ebp - 0x10], 0
jne 0x482f1b
test eax, eax
jne 0x482f14
push 8
xor ecx, ecx
pop eax
inc ecx
jmp 0x482f2e
push 0x20
pop eax
push 5
jmp 0x482f2d
test eax, eax
jne 0x482f26
push 0x40
pop eax
push 3
jmp 0x482f2d
mov eax, 0x80
push 7
pop ecx
mov word [esi], cx
test word [ebx + 0x174], ax
je 0x482f44
mov ax, word [ebx + 0x176]
mov word [esi], ax
push ebx
lea ecx, [ebp - 0x34]
call fcn.0044f5e8
mov dword [ebp - 0x34], 0x61ef5c
mov dword [ebp - 0x2c], 0x61ef70
mov ax, word [esi]
lea ecx, [ebp - 0x34]
and dword [ebp - 4], 0
mov word [ebp - 0x12], ax
mov ax, word [ebx + 0x172]
mov word [ebp - 0x14], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x94]
call fcn.00853c29
ret

Function at 0x49d404
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
jne 0x49d43c
push dword [ecx + 4]
call fcn.00462d60
pop ecx
test eax, eax
je 0x49d428
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x98]
test al, 2
jne 0x49d43c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x49d43c
xor eax, eax
inc eax
jmp 0x49d43e
xor eax, eax
pop ebp
ret 4
Function at 0x49d557
Capabilities:
Log keystrokes via polling

Disassembly:
push 4
mov eax, 0x5ff66d
call fcn.00872e45
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
call fcn.0049d404
test eax, eax
je 0x49d592
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call fcn.0049ce77
xor eax, eax
inc eax
jmp 0x49d686
push dword [ebx + 4]
call fcn.00462d60
mov esi, eax
mov dword [ebp - 0x10], esi
pop ecx
test esi, esi
je 0x49d630
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
je 0x49d630
cmp edi, 0x25
je 0x49d5cb
cmp edi, 0x27
je 0x49d5c7
cmp edi, 0x26
je 0x49d5cb
cmp edi, 0x28
jne 0x49d630
push 3
jmp 0x49d5cd
push 2
pop edi
jmp 0x49d5db
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x49d61a
push edi
mov ecx, esi
call fcn.004523a2
mov esi, eax
test esi, esi
jne 0x49d5d0
mov ecx, dword [ebp - 0x10]
cmp edi, 3
setne al
push eax
call fcn.0045209f
mov ecx, eax
jmp 0x49d60a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x49d61a
push edi
mov ecx, esi
call fcn.004523a2
mov esi, eax
test esi, esi
jne 0x49d5fc
jmp 0x49d58a
push 1
mov ecx, esi
call fcn.004522d1
push eax
mov ecx, ebx
call fcn.0049d97a
jmp 0x49d58a
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp + 8]
and al, 1
movzx eax, al
push eax
push edi
call fcn.0049fb1c
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.0049d6da
xor ebx, ebx
lea ecx, [ebp + 8]
test al, al
setne bl
call fcn.0049fb75
mov eax, ebx
call fcn.00853c29
ret 4
Function at 0x49fc6f
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push 4
mov eax, 0x5ff922
call fcn.00872e45
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x68700c]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
and dword [ebp - 4], 0
inc ebx
movzx edx, cx
mov dword [ebp - 0x10], ebx
push 2
pop edi
cmp edx, 0x25
ja 0x49fd18
je 0x49fd0e
mov eax, edx
sub eax, 0xd
je 0x49fd04
sub eax, 0xe
je 0x49fcfa
sub eax, 5
je 0x49fcf0
sub eax, ebx
je 0x49fce6
sub eax, ebx
je 0x49fcdc
sub eax, ebx
je 0x49fcd2
sub eax, ebx
jne 0x49fd4f
push str.Home
jmp 0x49fe70
push 0x622464
jmp 0x49fe70
push str.PageDown
jmp 0x49fe70
push str.PageUp
jmp 0x49fe70
push str.Space
jmp 0x49fe70
push 0x622418
jmp 0x49fe70
push 0x622420
jmp 0x49fe70
push str.Left
jmp 0x49fe70
mov eax, edx
sub eax, 0x26
je 0x49fe6b
sub eax, 1
je 0x49fe64
sub eax, 1
je 0x49fe5d
sub eax, edi
je 0x49fe56
sub eax, 3
je 0x49fe4f
sub eax, 1
je 0x49fe48
cmp cx, 0x30
jb 0x49fd5b
cmp cx, 0x39
jbe 0x49fd64
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x49fd7b
movzx eax, cx
mov ecx, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.0041b380
jmp 0x49fe77
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x49fd9f
lea eax, [edx - 0x60]
push eax
push str.Num__d
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00443744
add esp, 0x10
mov dword [ebp - 4], ebx
jmp 0x49fdf1
cmp cx, 0x6a
jne 0x49fdaf
push 0x6224d8
jmp 0x49fe70
cmp cx, 0x6b
jne 0x49fdbf
push str.Num_
jmp 0x49fe70
cmp cx, 0x6e
jne 0x49fdcf
push str.Num_Del
jmp 0x49fe70
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x49fe06
lea eax, [edx - 0x6f]
push eax
push 0x622500
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00443744
add esp, 0x10
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x687008]
je 0x49fe77
call fcn.008030b1
jmp 0x49fe77
push edi
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp al, 0x3d
jg 0x49fe26
je 0x49fe32
cmp al, 0x27
je 0x49fe32
cmp al, 0x2b
jle 0x49fe77
cmp al, 0x2f
jle 0x49fe32
cmp al, 0x3b
je 0x49fe32
jmp 0x49fe77
cmp al, 0x5b
jl 0x49fe77
cmp al, 0x5d
jle 0x49fe32
cmp al, 0x60
jne 0x49fe77
cbw
mov ecx, esi
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.0045cc2a
jmp 0x49fe77
push str.Delete
jmp 0x49fe70
push str.Insert
jmp 0x49fe70
push str.Print
jmp 0x49fe70
push str.Down
jmp 0x49fe70
push str.Right
jmp 0x49fe70
push 0x62242c
mov ecx, esi
call fcn.0041aec0
mov eax, esi
call fcn.00853c29
ret

Function at 0x4a7322
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a738a
mov ecx, esi
call fcn.004a738f
push 0
push dword [esi + 0x248]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x3ac]
test ecx, ecx
je 0x4a7365
push 0
call fcn.00454b39
and dword [esi + 0x3ac], 0
mov ecx, dword [0x6909e0]
lea ecx, [ecx + 8]
call fcn.004a84b2
mov ecx, dword [esi + 0x3a4]
test ecx, ecx
je 0x4a738a
pop esi
mov ecx, dword [ecx + 0x174]
pop ebp
jmp fcn.004a8226
pop esi
pop ebp
ret 4
Function at 0x4aec5f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x6909f7], 0
jne 0x4aed0e
push esi
push 0x623a3c
call fcn.004be608
mov dword [esp], 0x623a18
call fcn.004be608
mov dword [esp], 0x623b5c
call fcn.004be608
mov dword [esp], 0x623bd8
call fcn.004be608
mov dword [esp], 0x623b38
call fcn.004be608
mov esi, 0x623ca8
push esi
call fcn.004c98b9
push esi
call fcn.004c98b9
push 0x623cc8
call fcn.004c98b9
push 0x623ce8
call fcn.004c98b9
push 0x623ae0
call fcn.004c98b9
push 0x623c68
call fcn.004c98b9
push 0x623c88
call fcn.004c98b9
push 0x623b80
call fcn.004c98b9
push 0x623ba0
call fcn.004c98b9
add esp, 0x28
mov byte [0x6909f7], 1
pop esi
jmp 0x4d2909
ret
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x4d2911
mov dword [edx*4 + 0x6a4b80], ecx
inc edx
cmp edx, 0x100
jb 0x4d290c
mov esi, 0x800
jmp 0x4d2959
mov ecx, dword [edx*4 + 0x6a4780]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x6a4b80]
mov dword [edx*4 + 0x6a4b80], ecx
inc edx
cmp edx, esi
jb 0x4d293d
mov eax, 0x5f3530
mov esi, 0x5f3450
mov dword [0x6a4b7c], eax
mov dword [0x6a4b74], eax
mov dword [0x6a4b78], esi
call fcn.004eed56
mov ecx, dword [0x6a4b74]
test eax, eax
cmove ecx, esi
mov dword [0x6a4b74], ecx
pop esi
ret

Function at 0x4b07f3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4b0801
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x4b0810
Capabilities:
Copy file
Delete file

Disassembly:
push 0x44
mov eax, 0x6012d6
call fcn.005569b7
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x4b0901
cmp dword [esi + 0x10], 0x104
ja 0x4b0901
push esi
call fcn.004b07f3
pop ecx
test al, al
jne 0x4b0848
inc al
jmp 0x4b0903
xor edi, edi
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.004a9b01
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edi
add eax, 2
mov dword [ebp - 4], edi
push eax
call fcn.004b0da2
push 0x1e
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.00870b9c
mov eax, dword [ebp - 0x40]
add esp, 0xc
and eax, 0xffbf
mov dword [ebp - 0x3a], edi
or eax, 0x414
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x36], edi
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 0x14]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp ecx, 8
jb 0x4b08fd
mov eax, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
cmp ecx, 0x1000
jb 0x4b08f4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0073c969
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push ecx
push eax
call fcn.0085363c
pop ecx
pop ecx
mov al, bl
jmp 0x4b0903
xor al, al
call fcn.00556966
ret
Function at 0x4b3822
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa8], 5
jne 0x4b3849
cmp dword [ebp + 0xc], 0
je 0x4b3849
mov ecx, esi
call fcn.004b36b0
mov eax, 0x80004005
jmp 0x4b396b
xor ecx, ecx
push edi
cmp dword [esi + 0x64], ecx
jne 0x4b3878
push 0x62469c
call fcn.004b3b1e
pop ecx
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x4b3968
mov edx, dword [ecx]
lea eax, [esi + 0x24]
push eax
call dword [edx + 0x14]
jmp 0x4b3968
cmp byte [esi + 0x74], cl
jne 0x4b388d
cmp byte [esi + 0x80], cl
jne 0x4b388d
cmp byte [esi + 0x8c], cl
je 0x4b38f4
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 8
jb 0x4b3898
mov eax, dword [eax]
push ecx
push 0x80
push 3
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b38f4
xor edx, edx
lea ecx, [esi + 0x78]
cmp byte [esi + 0x74], dl
cmovne edx, ecx
xor eax, eax
cmp byte [esi + 0x80], al
lea ecx, [esi + 0x84]
push edx
cmovne eax, ecx
xor ecx, ecx
cmp byte [esi + 0x8c], cl
push eax
lea eax, [esi + 0x90]
cmovne ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x6d], 0
je 0x4b390f
lea eax, [esi + 0x54]
cmp dword [eax + 0x14], 8
jb 0x4b3905
mov eax, dword [eax]
push dword [esi + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edi, [esi + 0x54]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b391c
mov eax, dword [edi]
push eax
push str.FileDone:_s_n
call fcn.004b3b1e
pop ecx
pop ecx
mov ecx, dword [esi + 0xac]
test ecx, ecx
je 0x4b3968
push dword [esi + 0xa4]
mov eax, dword [ecx]
push dword [esi + 0xa0]
push edi
call dword [eax + 0x1c]
test al, al
jne 0x4b3950
mov eax, 0x80004005
jmp 0x4b396a
mov ecx, dword [esi + 0xac]
push dword [esi + 0xa4]
push dword [esi + 0xa0]
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x4c5233
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60259c
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x687640]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x30]
mov dword [esi], vtable.NCompress::NLzma::CDecoder.0
push 0x6874e8
push eax
mov dword [esi + 4], vtable.NCompress::NLzma::CDecoder.1.0
mov dword [esi + 8], vtable.NCompress::NLzma::CDecoder.2.0
mov dword [esi + 0xc], vtable.NCompress::NLzma::CDecoder.3.0
mov dword [esi + 0x10], vtable.NCompress::NLzma::CDecoder.4.0
mov dword [esi + 0x14], vtable.NCompress::NLzma::CDecoder.5.0
mov dword [esi + 0x18], vtable.NCompress::NLzma::CDecoder.6.0
call fcn.004e7da3
push dword [esi + 0x24]
call fcn.004c3f6d
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4c52b2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x4cc681
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
and dword [edi + 0x2cb0], 0
cmp dword [edi + 0x2cb8], 2
jne 0x4cc6c7
push 1
lea ecx, [edi + 0x38]
call fcn.004cc5ef
test eax, eax
je 0x4cc6c0
push dword [edi + 0x80]
mov ecx, edi
push dword [edi + 0x7c]
call fcn.004cbe63
jmp 0x4cc887
and dword [edi + 0x2cb8], 0
mov edx, dword [edi + 0x38]
mov eax, dword [edi + 0x3c]
push ebx
push 8
pop ecx
sub ecx, edx
mov dword [ebp - 0x10], edx
shr eax, cl
shr eax, 0x10
cmp dword [edi + 0x2ca0], 0x25
movzx eax, al
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x2cac]
jae 0x4cc703
test eax, eax
mov ebx, 0x626984
mov ecx, 0x626974
mov eax, 0x6269b4
jmp 0x4cc714
test eax, eax
mov ebx, 0x6269a4
mov ecx, 0x626994
mov eax, 0x6269f0
cmove ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [eax]
mov ecx, ebx
xor eax, dword [ebp - 8]
mov edx, 0xff
push esi
xor esi, esi
mov cl, byte [ecx]
sar edx, cl
not edx
test eax, edx
je 0x4cc750
mov edi, dword [ebp - 4]
inc esi
mov edx, 0xff
mov cl, byte [esi + ebx]
mov eax, dword [edi + esi*4]
xor eax, dword [ebp - 8]
sar edx, cl
not edx
test eax, edx
jne 0x4cc736
mov edi, dword [ebp - 0xc]
movzx eax, byte [esi + ebx]
lea ebx, [edi + 0x38]
add eax, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebx], eax
call fcn.004cc564
cmp esi, 9
jb 0x4cc806
jne 0x4cc782
push dword [edi + 0x80]
inc dword [edi + 0x2cb8]
push dword [edi + 0x7c]
jmp 0x4cc87e
and dword [edi + 0x2cb8], 0
mov ecx, edi
cmp esi, 0xe
jne 0x4cc7b5
push 0x626830
call fcn.004cbefb
push 0xf
mov ecx, ebx
lea esi, [eax + 5]
call fcn.004cc5ef
add eax, 0x7fff
push esi
mov dword [edi + 0x7c], eax
push eax
jmp 0x4cc878
mov eax, dword [edi + 0x78]
sub eax, esi
inc eax
and eax, 3
push 0x6267f8
mov ebx, dword [edi + eax*4 + 0x68]
call fcn.004cbefb
add eax, 2
cmp eax, 0x101
jne 0x4cc7e9
cmp esi, 0xa
jne 0x4cc7e9
xor dword [edi + 0x2cac], 1
xor eax, eax
jmp 0x4cc885
cmp ebx, 0x100
lea ecx, [eax + 1]
cmovb ecx, eax
mov eax, dword [edi + 0x2cc8]
dec eax
cmp ebx, eax
lea esi, [ecx + 1]
cmovb esi, ecx
jmp 0x4cc862
mov ecx, dword [edi + 0x2ca0]
and dword [edi + 0x2cb8], 0
add ecx, esi
mov eax, ecx
shr eax, 4
sub ecx, eax
mov dword [edi + 0x2ca0], ecx
mov ecx, edi
push 0x6268d8
call fcn.004cbefb
movzx ecx, al
mov ebx, dword [edi + ecx*4 + 0x494]
test al, al
je 0x4cc85f
dec dword [edi + ebx*4 + 0x1494]
mov eax, dword [edi + ecx*4 + 0x490]
inc dword [edi + eax*4 + 0x1494]
mov dword [edi + ecx*4 + 0x494], eax
mov dword [edi + ecx*4 + 0x490], ebx
add esi, 2
mov eax, dword [edi + 0x78]
push esi
push ebx
mov dword [edi + eax*4 + 0x68], ebx
mov eax, dword [edi + 0x78]
inc eax
mov dword [edi + 0x7c], ebx
and eax, 3
mov dword [edi + 0x78], eax
mov dword [edi + 0x80], esi
mov ecx, edi
call fcn.004cbe63
pop esi
pop ebx
pop edi
leave
ret