joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce9dc
Capabilities:
Get file version info

Disassembly:
push 0x22c
mov eax, 0x6e4a67
call fcn.00682c92
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x238], eax
test eax, eax
jne 0x4cea02
xor eax, eax
jmp 0x4ceba7
push ecx
xor esi, esi
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4ce9fb
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push esi
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
push edi
test eax, eax
jne 0x4cea4c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ce9fb
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], esi
push eax
lea eax, [ebp - 0x21c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4ce9fb
push ebx
call fcn.00682d64
pop ecx
mov edi, eax
lea eax, [ebp - 0x21c]
push edi
push ebx
push dword [ebp - 0x22c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4ce9fb
lea eax, [ebp - 0x228]
mov dword [ebp - 0x230], esi
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x228], esi
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test dword [ebp - 0x228], 0xfffffffc
mov ebx, esi
jbe 0x4ceb9e
lea ecx, [ebp - 0x224]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], esi
movzx eax, word [ecx + ebx*4 + 2]
push eax
movzx eax, word [ecx + ebx*4]
push eax
lea eax, [ebp - 0x224]
push str.StringFileInfo_04x_04xCompanyName
push eax
call sym.txupd.exe_public:_void___cdecl_CTXStringW::Format_wchar_t_const__
add esp, 0x10
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], esi
lea ecx, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4ceb4d
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x220]
push eax
push str.StringFileInfo040904e4CompanyName
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4ceb6d
cmp dword [ebp - 0x220], 0
je 0x4ceb6d
push dword [ebp - 0x238]
push dword [ebp - 0x220]
call fcn.00689cc8
pop ecx
pop ecx
test eax, eax
jne 0x4ceb90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, dword [ebp - 0x228]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x4ceacd
jmp 0x4ceb9e
xor esi, esi
lea ecx, [ebp - 0x224]
inc esi
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push edi
call fcn.00682d6d
pop ecx
mov eax, esi
call fcn.00682c3c
ret
Function at 0x4cef04
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
push edi
mov edi, ecx
lea eax, [ebp - 0x118]
push eax
mov dword [edi], vtable.CProcessUtil.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4cf07d
cmp dword [ebp - 0x108], 2
push esi
je 0x4cf007
cmp dword [ebp - 0x108], 1
jne 0x4cf07c
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [edi + 8], eax
test eax, eax
je 0x4cf07c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6ff8e8
push eax
call esi
push 0x6ff904
push dword [edi + 8]
mov dword [edi + 0x20], eax
call esi
push 0x6ff914
push dword [edi + 8]
mov dword [edi + 0x24], eax
call esi
push str.Module32First
push dword [edi + 8]
mov dword [edi + 0x28], eax
call esi
push str.Module32Next
push dword [edi + 8]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
cmp dword [edi + 0x28], ebx
je 0x4cf070
cmp dword [edi + 0x24], ebx
je 0x4cf070
test eax, eax
je 0x4cf070
cmp dword [edi + 0x2c], ebx
je 0x4cf070
cmp dword [edi + 0x20], ebx
je 0x4cf070
xor eax, eax
inc eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], eax
jmp 0x4cf07c
push 0x6ff874
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 8], eax
test eax, eax
je 0x4cf07c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push eax
call esi
push str.EnumProcessModules
push dword [edi + 8]
mov dword [edi + 0x10], eax
call esi
push str.GetModuleBaseNameW
push dword [edi + 8]
mov dword [edi + 0x14], eax
call esi
push 0x6ff8c0
push dword [edi + 8]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x1c], eax
cmp dword [edi + 0x10], ebx
je 0x4cf070
cmp dword [edi + 0x14], ebx
je 0x4cf070
cmp dword [edi + 0x18], ebx
je 0x4cf070
test eax, eax
je 0x4cf070
mov dword [edi + 4], 1
mov dword [edi + 0xc], ebx
jmp 0x4cf07c
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi + 8], ebx
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x4cf3b6
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x65c], eax
mov ebx, 0x22c
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x658]
push 0
push eax
call fcn.00689b00
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4cf40b
xor eax, eax
jmp 0x4cf4db
lea eax, [ebp - 0x658]
mov dword [ebp - 0x658], ebx
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4cf42f
test esi, esi
je 0x4cf404
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4cf404
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x650]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4cf44f
push eax
call edi
jmp 0x4cf4bb
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x428
push eax
push ebx
call sub.KERNEL32.dll_Module32FirstW
jmp 0x4cf496
push dword [ebp - 0x65c]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4cf49c
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x428
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4cf468
jmp 0x4cf4ae
mov ecx, dword [ebp - 0x660]
lea eax, [ebp - 0x424]
push eax
call fcn.004d006a
push ebx
call edi
mov dword [ebp - 0x658], 0x22c
lea eax, [ebp - 0x658]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4cf436
test esi, esi
je 0x4cf4d7
push esi
call edi
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x4d04cc
Capabilities:
Get hostname

Disassembly:
push 0x648
push 0x77f1c0
call fcn.00683df0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x644], eax
xor esi, esi
mov dword [ebp - 0x63c], esi
mov edi, esi
mov dword [ebp - 0x638], edi
mov dword [ebp - 0x640], esi
mov ebx, 0x208
push ebx
push esi
lea eax, [ebp - 0x42c]
push eax
call fcn.00689b00
push ebx
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.00689b00
mov ebx, 0x104
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x650], ebx
push 0x208
push esi
lea eax, [ebp - 0x634]
push eax
call fcn.00689b00
add esp, 0x24
mov dword [ebp - 0x654], ebx
mov ebx, esi
mov dword [ebp - 0x648], ebx
mov dword [ebp - 4], esi
lea eax, [ebp - 0x63c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4d0573
mov edi, esi
jmp 0x4d06be
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
push esi
push 1
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4d059e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4d056c
mov dword [ebp - 0x648], esi
push dword [ebp - 0x640]
call fcn.006a66fd
pop ecx
mov ebx, eax
mov dword [ebp - 0x648], ebx
test ebx, ebx
je 0x4d056c
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
push ebx
push 1
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4d056c
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x42c]
push eax
push dword [ebx]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x4d06c4
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x4d068b
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.006aecc5
pop ecx
pop ecx
test eax, eax
je 0x4d068b
cmp word [ebp - 0x224], 0
jne 0x4d064f
mov eax, esi
jmp 0x4d065c
lea eax, [ebp - 0x224]
push eax
call fcn.006a37ec
pop ecx
push eax
lea eax, [ebp - 0x224]
push eax
mov edi, dword [ebp - 0x644]
mov ecx, edi
call fcn.00474507
push 0x6fdc28
call fcn.006a37ec
pop ecx
push eax
push 0x6fdc28
mov ecx, edi
call fcn.004d0c8c
jmp 0x4d0691
mov edi, dword [ebp - 0x644]
cmp word [ebp - 0x42c], 0
jne 0x4d069f
mov eax, esi
jmp 0x4d06ac
lea eax, [ebp - 0x42c]
push eax
call fcn.006a37ec
pop ecx
push eax
lea eax, [ebp - 0x42c]
push eax
mov ecx, edi
call fcn.004d0c8c
xor edi, edi
inc edi
mov dword [ebp - 0x638], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.004d06e6
mov eax, edi
call fcn.00683e39
ret
Function at 0x4d070d
Capabilities:
List groups for user account

Disassembly:
push 0x30
mov eax, 0x6e4b1a
call fcn.00682c92
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
xor edx, edx
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], edx
push ecx
push 1
push edx
push eax
push edx
mov ebx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], edx
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x4d07ad
mov esi, dword [ebp - 0x30]
inc ebx
mov dword [ebp - 0x3c], ebx
test esi, esi
je 0x4d07ba
mov eax, dword [ebp - 0x2c]
xor edi, edi
test eax, eax
je 0x4d07b0
mov ebx, dword [ebp - 0x38]
test esi, esi
je 0x4d07aa
cmp dword [esi], 0
je 0x4d07a2
push dword [esi]
lea ecx, [ebp - 0x28]
call fcn.00473e20
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.004d0d30
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0042292c
mov eax, dword [ebp - 0x2c]
add esi, 4
inc edi
cmp edi, eax
jb 0x4d076d
mov ebx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x4d07ba
push esi
call sub.NETAPI32.dll_NetApiBufferFree
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0042292c
mov eax, ebx
call fcn.00682c3c
ret
Function at 0x4d0967
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x16c], 1
push 0x110
lea eax, [ebp - 0x158]
mov dword [ebp - 0x160], ebx
push ebx
push eax
mov esi, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x15c], 0x114
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4d0aa5
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4d0aa5
cmp dword [ebp - 0x158], 6
jb 0x4d0a47
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x168]
push eax
push 4
lea eax, [ebp - 0x170]
push eax
push 0x12
push dword [ebp - 0x160]
call edi
test eax, eax
je 0x4d0aa5
cmp dword [ebp - 0x170], 3
jne 0x4d0a47
lea eax, [ebp - 0x168]
push eax
push 4
lea eax, [ebp - 0x164]
push eax
push 0x13
push dword [ebp - 0x160]
call edi
test eax, eax
je 0x4d0aa5
cmp dword [ebp - 0x164], ebx
jne 0x4d0a68
lea eax, [ebp - 0x164]
push eax
push 1
push dword [ebp - 0x160]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x4d0aa5
lea eax, [ebp - 0x168]
mov dword [ebp - 0x168], 0x44
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x4d0aa5
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x164]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4d0aad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x160], ebx
je 0x4d0ac9
push dword [ebp - 0x160]
call edi
mov dword [ebp - 0x160], ebx
cmp dword [ebp - 0x164], ebx
je 0x4d0adf
push dword [ebp - 0x164]
call edi
mov dword [ebp - 0x164], ebx
test esi, esi
je 0x4d0b0f
push esi
mov edi, str.Util::ACL::IsUserAdmin_Failed:_d_n
push edi
push 0x6ffe74
push 2
push str.Util::ACL::IsUserAdmin
push 0x1f4
push str.E:FixReplayAttackscoding_baseutilfunutilacl.cpp
call fcn.004ce9b9
push esi
push edi
call fcn.0047380a
add esp, 0x24
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x16c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x4d0eec
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [ebp + 0xc]
call sym.txupd.exe_public:_bool___thiscall_CTXStringW::IsEmpty_void_const
test al, al
je 0x4d0f19
xor eax, eax
jmp 0x4d0f9a
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00689b00
lea eax, [ebp - 0x210]
push eax
call fcn.004d0e93
add esp, 0x10
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push 0x103
lea eax, [ebp - 0x20c]
mov ebx, str.lyh_____
push eax
push ebx
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.TXUpdate
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.006aeefe
pop ecx
pop ecx
pop ebx
test eax, eax
je 0x4d0f12
lea eax, [ebp - 0x20c]
push eax
call fcn.006aca8f
mov dword [edi], eax
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00682c16
mov esp, ebp
pop ebp
ret

Function at 0x4d0faa
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
mov edi, dword [ebp + 0xc]
call sym.txupd.exe_public:_bool___thiscall_CTXStringW::IsEmpty_void_const
test al, al
je 0x4d0fd7
xor eax, eax
jmp 0x4d1057
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00689b00
lea eax, [ebp - 0x210]
push eax
call fcn.004d0e93
add esp, 0x10
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push 0x103
lea eax, [ebp - 0x20c]
mov ebx, str.lyh_____
push eax
push ebx
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.TXUpdate
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.006aeefe
pop ecx
pop ecx
pop ebx
test eax, eax
je 0x4d0fd0
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x4d11a9
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 4
mov eax, 0x6e4c10
call fcn.00682c5e
cmp dword [ebp + 8], 0
jne 0x4d11c2
xor eax, eax
jmp 0x4d1280
push dword [ebp + 8]
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
xor esi, esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call sym.txupd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
test eax, eax
jle 0x4d1276
lea edi, [eax - 1]
push edi
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_wchar_t___thiscall_CTXStringW::GetAt_int_const
push 0x5c
pop ebx
cmp ax, bx
jne 0x4d1201
push 1
push edi
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::Delete_int__int_
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d1219
test al, 0x10
jne 0x4d1273
cmp dword [ebp + 0xc], esi
je 0x4d1276
push ebx
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const
cmp eax, 0xffffffff
je 0x4d1276
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.004d11a9
pop ecx
pop ecx
push esi
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x10]
test eax, eax
jne 0x4d126e
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
jmp 0x4d1276
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor esi, esi
inc esi
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, esi
call fcn.00682c27
ret
Function at 0x4d135e
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x26c
mov eax, 0x6e4c91
call fcn.00682c92
xor ebx, ebx
mov dword [ebp - 0x270], ebx
and dword [ebp - 4], ebx
lea eax, [ebp - 0x260]
push 0x250
push ebx
xor esi, esi
push eax
inc esi
call fcn.00689b00
push 0x7002dc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0x18
lea ecx, [ebp - 0x260]
push ecx
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [ebp - 0x26c]
mov edi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
cmp edi, 0xffffffff
je 0x4d14e5
test esi, esi
je 0x4d14de
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x268]
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0xc
test byte [ebp - 0x260], 0x10
mov byte [ebp - 4], 1
jne 0x4d14ba
mov esi, 0x70041c
push esi
call fcn.006a37ec
pop ecx
push eax
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x268]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Right_int_
or ebx, 1
mov byte [ebp - 4], 2
push esi
mov ecx, eax
mov dword [ebp - 0x270], ebx
call sym.txupd.exe_public:_int___thiscall_CTXStringW::CompareNoCase_wchar_t_const__const
test eax, eax
je 0x4d1470
mov esi, 0x700428
push esi
call fcn.006a37ec
pop ecx
push eax
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x268]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Right_int_
push esi
mov ecx, eax
or ebx, 2
call sym.txupd.exe_public:_int___thiscall_CTXStringW::CompareNoCase_wchar_t_const__const
mov byte [ebp - 0x261], 0
test eax, eax
jne 0x4d1477
mov byte [ebp - 0x261], 1
test bl, 2
je 0x4d148a
lea ecx, [ebp - 0x274]
and ebx, 0xfffffffd
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 0x278]
mov dword [ebp - 4], 1
and ebx, 0xfffffffe
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
cmp byte [ebp - 0x261], 0
je 0x4d14ba
lea ecx, [ebp - 0x268]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
jmp 0x4d13d0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
call fcn.00682c3c
ret
Function at 0x4d14f3
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x284
mov eax, 0x6e4cc9
call fcn.00682c92
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x4d1703
test esi, esi
je 0x4d1703
push 1
push esi
call fcn.004d11a9
pop ecx
pop ecx
test eax, eax
je 0x4d1703
xor ecx, ecx
mov dword [ebp - 0x2c], 7
xor eax, eax
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x40], ax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
push edi
call fcn.00473e20
mov ebx, 0x70040c
mov byte [ebp - 4], 1
push ebx
call fcn.006a37ec
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.004d0c8c
push 0x250
xor edx, edx
lea eax, [ebp - 0x290]
push edx
push eax
call fcn.00689b00
add esp, 0xc
lea ecx, [ebp - 0x290]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d15a2
xor ebx, ebx
mov esi, ebx
jmp 0x4d16e9
xor eax, eax
cmp word [esi], ax
je 0x4d15b0
push esi
call fcn.006a37ec
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.00474507
push 0x5c
push 1
lea ecx, [ebp - 0x40]
call fcn.0047447e
cmp word [ebp - 0x264], 0
jne 0x4d15d6
xor edx, edx
mov eax, edx
jmp 0x4d15e3
lea eax, [ebp - 0x264]
push eax
call fcn.006a37ec
pop ecx
push eax
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x40]
call fcn.004d0c8c
xor eax, eax
cmp word [edi], ax
je 0x4d1601
push edi
call fcn.006a37ec
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00474507
push 0x5c
push 1
lea ecx, [ebp - 0x28]
call fcn.0047447e
cmp word [ebp - 0x264], 0
jne 0x4d1625
xor eax, eax
jmp 0x4d1632
lea eax, [ebp - 0x264]
push eax
call fcn.006a37ec
pop ecx
push eax
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x28]
call fcn.004d0c8c
test byte [ebp - 0x290], 0x10
je 0x4d169a
lea eax, [ebp - 0x264]
push 0x700418
push eax
call fcn.006aeefe
pop ecx
pop ecx
test eax, eax
je 0x4d16c7
lea eax, [ebp - 0x264]
push 0x771540
push eax
call fcn.006aeefe
pop ecx
pop ecx
test eax, eax
je 0x4d16c7
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004d14f3
pop ecx
pop ecx
jmp 0x4d16c7
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
xor edx, edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4d16c7
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x290]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4d15a2
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
inc esi
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0042292c
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0042292c
mov eax, esi
jmp 0x4d1705
xor eax, eax
call fcn.00682c3c
ret