joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4720f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4d925e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
fld dword [0x4f00bc]
push ebp
mov ebp, dword [esp + 0x2c]
lea ecx, [ebp + 8]
mov dword [ebp], vtable.BkSkinPool.0
fstp dword [ecx + 0xc]
fld dword [0x4f00c0]
push esi
xor esi, esi
fstp dword [ecx + 0x10]
fld dword [0x4f00c4]
push edi
fstp dword [ecx + 0x14]
mov dword [ecx], esi
mov dword [ecx + 4], esi
mov dword [ecx + 8], 0x11
mov dword [ecx + 0x18], 0xffffffff
mov dword [ecx + 0x1c], esi
mov dword [ecx + 0x20], esi
mov dword [ecx + 0x24], 0xa
mov dword [ecx + 0x28], esi
mov dword [ecx + 0x2c], esi
call fcn.0045b1a0
mov dword [esp + 0x2c], esi
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
lea edi, [ebp + 0x38]
call edx
add eax, 0x10
mov dword [edi], eax
push esi
lea eax, [esp + 0x14]
mov byte [esp + 0x30], 1
push eax
lea ecx, [ebp + 4]
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call sub.gdiplus.dll_GdiplusStartup
lea esi, [esp + 0xc]
call fcn.0040bcd0
mov byte [esp + 0x2c], 2
call fcn.00403880
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4721dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov eax, ebp
mov dword fs:[0], ecx
pop ebp
add esp, 0x24
ret 4
Function at 0x472c10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4d7bb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
fldz
push esi
mov esi, dword [esp + 0x18]
fst dword [esi + 4]
fst dword [esi + 8]
push edi
fst dword [esi + 0xc]
xor edi, edi
fstp dword [esi + 0x10]
mov ecx, 0x507fec
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi], vtable.CBkRichtextObjBase.0
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.CBkRichtextObj.0
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 1
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
Function at 0x47bb00
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp ebx, 0xf
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
mov ebp, 1
jne 0x47bb36
mov dword [esi + 0xc0], ebp
mov dword [edi], 0
cmp dword [esi + 0xc0], 0
je 0x47bb85
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 0x14
cmp ebx, 2
jne 0x47bba4
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push eax
push ecx
mov dword [esi + 0xc0], ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x47bb69
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47bb69
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [edi], 0
cmp dword [esi + 0xc0], 0
jne 0x47bb2d
mov ebx, dword [esp + 0x18]
cmp dword [esi + 0xc0], 0
jne 0x47bb2d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edi
push eax
push ecx
push ebx
push edx
mov ecx, esi
call fcn.0048a880
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
cmp ebx, 0x47
jne 0x47bbc0
mov edx, dword [esp + 0x20]
push edx
mov eax, esi
mov dword [esi + 0xc0], ebp
call fcn.0047bbe0
jmp 0x47bb1e
cmp ebx, 0x18
jne 0x47bb7c
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xc0], ebp
call fcn.0047bcf0
jmp 0x47bb1e
Function at 0x47eaa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d86f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
push ebx
push ebp
push esi
push edi
mov ecx, 0x507fec
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x30]
xor esi, esi
push 0x50
push esi
push eax
mov dword [esp + 0x30], esi
call fcn.004a4620
mov ecx, dword [esp + 0x38]
add esp, 0xc
xor ebp, ebp
add ecx, 0xf0
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], ecx
lea esp, [esp]
mov eax, dword [esp + 0x2c]
push 0x4e32a8
lea edx, [esp + 0x1c]
push edx
push eax
lea ebx, [esp + 0x20]
call fcn.0045ed80
mov byte [esp + 0x24], 1
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x47eb6f
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47eb5e
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x47eb5e
call fcn.00403c80
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x47eb55
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebx + 0x10]
mov dword [esp + 0x10], edi
jmp 0x47eb6f
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x14]
call fcn.00403b90
mov edi, dword [esp + 0x10]
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47eb94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [edi - 0xc], 0
je 0x47ebb2
cmp ebp, 0x14
jae 0x47ebbd
push edi
call fcn.004a15ac
mov ecx, dword [esp + 0x34]
add esp, 4
mov dword [ecx + ebp*4], eax
add ebp, 1
cmp dword [esp + 0x14], 0
jg 0x47eb00
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
pop edi
pop esi
pop ebp
pop ebx
jg 0x47ebe5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x48ae80
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d7148
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [ebx], vtable.CBkWindow.0
call fcn.0048afb0
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
lea edi, [ebx + 0x14]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [ebx + 0x24], esi
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x3c], esi
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], esi
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [ebx + 0x48], eax
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [ebx + 0x4c], eax
or eax, 0xffffffff
push edi
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], esi
mov word [ebx + 0x5c], si
mov dword [ebx + 0x60], esi
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], esi
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xa4], esi
mov dword [ebx + 0xa8], esi
mov dword [ebx + 0xac], 1
mov dword [ebx + 0xb0], esi
mov dword [ebx + 0xb4], esi
mov dword [ebx + 0xb8], esi
mov dword [ebx + 0xbc], esi
mov dword [ebx + 0xc0], esi
mov dword [ebx + 0xc4], esi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x48d200
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4d9418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004034e0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
je 0x48d275
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x48d25f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x48d2e5
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x48d2e5
lea ecx, [esp + 0x10]
call fcn.0048d150
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
je 0x48d2c7
push eax
call fcn.0048d200
add esp, 4
test eax, eax
je 0x48d2c7
push 0
push esi
call edi
test eax, eax
jne 0x48d2e5
call ebx
cmp eax, 0xb7
je 0x48d2e5
lea ecx, [esp + 0x10]
call fcn.00403580
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x48d306
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x48d320
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d7128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
push esi
push edi
push 0x40
xor ebx, ebx
lea eax, [esp + 0x2c]
push ebx
push eax
mov esi, ecx
xor ebp, ebp
call fcn.004a4620
mov edx, dword [0x507fec]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x507fec
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
push ecx
push edx
push str.__s___s
lea edi, [esp + 0x1c]
mov dword [esp + 0x88], ebx
call fcn.00404190
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
neg esi
push ebx
sbb esi, esi
push ebx
and esi, 0xa
mov word [esp + 0x70], si
mov esi, dword [esp + 0x2c]
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x48d3fb
mov eax, dword [esp + 0x8c]
cmp eax, ebx
je 0x48d3f6
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x48d410
push eax
call edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x48d41f
push eax
call edi
mov dword [esp + 0x18], ebx
lea eax, [esi - 0x10]
mov dword [esp + 0x7c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d443
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x74]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x70
ret
Function at 0x48d5e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d7108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push ebp
push esi
mov esi, edx
xor ebp, ebp
cmp esi, ebp
push edi
mov ebx, ecx
jne 0x48d61b
xor eax, eax
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x88]
push eax
push esi
push str.__s___s
lea edi, [esp + 0x24]
mov dword [esp + 0x8c], ebp
call fcn.00404190
xor edi, edi
add esp, 0xc
lea esi, [esp + 0x14]
mov dword [esp + 0x14], edi
call fcn.00412e30
test eax, eax
jne 0x48d77d
push 0x40
lea ecx, [esp + 0x34]
push edi
push ecx
mov dword [esp + 0x38], 0x44
call fcn.004a4620
xor eax, eax
add esp, 0xc
neg ebx
sbb ebx, ebx
and ebx, 5
push str.userenv.dll
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x60], bx
mov dword [esp + 0x38], str.Winsta0Default
lea ebp, [edi + 0x30]
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x48d6fe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push ebx
call edi
push str.DestroyEnvironmentBlock
push ebx
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x48d6fe
mov edx, dword [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x18]
push eax
call esi
test eax, eax
je 0x48d6f6
mov ebp, 0x430
jmp 0x48d6fe
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x1c]
push 0
push eax
push ebp
push 0
push 0
push 0
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebp, eax
test ebp, ebp
mov eax, dword [esp + 0x1c]
je 0x48d74d
test eax, eax
je 0x48d758
mov ecx, dword [esp + 0x8c]
test ecx, ecx
jbe 0x48d74d
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x48d758
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x48d767
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x48d772
mov eax, dword [esp + 0x10]
push eax
call edi
test ebx, ebx
je 0x48d77d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48d78c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d7b7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x78]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x74
ret
Function at 0x48dcc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f84c8
push 0x4d49b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp ebx, esi
je 0x48dd98
cmp dword [ebp + 8], esi
je 0x48dd98
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
cmp edi, 1
jb 0x48dd98
cmp edi, 0x103
ja 0x48dd98
mov dword [ebp - 4], esi
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049f25a
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x48dd91
lea eax, [edi + edi]
push eax
push 0
push esi
call fcn.004a4620
add esp, 0xc
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x48dd91
cmp eax, 0x103
ja 0x48dd91
push eax
push esi
push 0x103
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a3638
add esp, 0x10
mov dword [ebp - 0x1c], 1
jmp 0x48dd91
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x48dda8
push eax
call fcn.0049f9d0
add esp, 4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ddc0
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d89e8
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
push 7
push str._access
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x20], 0
call fcn.004038e0
mov edi, dword [esp + 0x1c]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
test esi, esi
je 0x48de15
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x48de1c
call ebx
cmp eax, 5
je 0x48de21
mov esi, 1
lea eax, [edi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48de45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x48dee0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor edi, edi
push edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc]
push eax
push 0x4dc984
push 1
push edi
push 0x4dc9a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jl 0x48dfa4
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
cmp ebx, edi
je 0x48df44
cmp word [ebx], di
je 0x48df44
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push ebx
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 5
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x4dc9b4
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x48df8f
mov ecx, ebp
call fcn.0048de60
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebp
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
cmp esi, edi
setge al
mov edi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x48f430
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9a4b
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
je 0x48f486
mov eax, dword [esi + 8]
push eax
call ebx
test eax, eax
je 0x48f486
mov ecx, dword [esi + 8]
call fcn.0048e1d0
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x220
ret
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [esi + 8]
lea ecx, [esp + 0x14]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48f4c7
test dx, dx
je 0x48f4c3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48f4c7
add eax, 4
add ecx, 4
test dx, dx
jne 0x48f4a1
xor eax, eax
jmp 0x48f4cc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x48f4e1
push edi
call fcn.0040ef60
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 8]
push eax
call ebx
test eax, eax
je 0x48f584
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x48f584
mov edx, dword [0x507fec]
mov eax, dword [edx + 0xc]
mov ecx, 0x507fec
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 8]
push eax
push ecx
push str._s__d_del
lea edi, [esp + 0x1c]
call fcn.00404190
mov eax, dword [esi + 8]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
push 1
push esi
push eax
call edi
test eax, eax
je 0x48f55d
push 4
push 0
push esi
call edi
lea eax, [esi - 0x10]
mov dword [esp + 0x228], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48f584
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x220]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x220
ret
Function at 0x48f452
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9a4b
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
je 0x48f486
mov eax, dword [esi + 8]
push eax
call ebx
test eax, eax
je 0x48f486
mov ecx, dword [esi + 8]
call fcn.0048e1d0
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x220
ret
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [esi + 8]
lea ecx, [esp + 0x14]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48f4c7
test dx, dx
je 0x48f4c3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48f4c7
add eax, 4
add ecx, 4
test dx, dx
jne 0x48f4a1
xor eax, eax
jmp 0x48f4cc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x48f4e1
push edi
call fcn.0040ef60
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 8]
push eax
call ebx
test eax, eax
je 0x48f584
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x48f584
mov edx, dword [0x507fec]
mov eax, dword [edx + 0xc]
mov ecx, 0x507fec
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 8]
push eax
push ecx
push str._s__d_del
lea edi, [esp + 0x1c]
call fcn.00404190
mov eax, dword [esi + 8]
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
push 1
push esi
push eax
call edi
test eax, eax
je 0x48f55d
push 4
push 0
push esi
call edi
lea eax, [esi - 0x10]
mov dword [esp + 0x228], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48f584
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x220]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x220
ret