joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482bd7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0047470e
xor ebx, ebx
cmp dword [0x4f2038], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x482cad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x482d8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x482d8d
push eax
call fcn.004746a0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4f2038], eax
call esi
push eax
call fcn.004746a0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4f203c], eax
call esi
push eax
call fcn.004746a0
mov dword [0x4f2040], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004761e2
test eax, eax
pop ecx
pop ecx
je 0x482c7b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0046f67c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x482cad
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004746a0
cmp eax, ebx
pop ecx
mov dword [0x4f2048], eax
je 0x482cad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004746a0
pop ecx
mov dword [0x4f2044], eax
mov eax, dword [0x4f2044]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x482d32
cmp dword [0x4f2048], ecx
je 0x482d32
push eax
call fcn.00474717
push dword [0x4f2048]
mov esi, eax
call fcn.00474717
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x482d32
cmp edi, ebx
je 0x482d32
call esi
cmp eax, ebx
je 0x482cff
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x482cff
test byte [ebp - 0x18], 1
jne 0x482d32
lea eax, [ebp - 0x10]
push eax
call fcn.00476219
test eax, eax
pop ecx
je 0x482d1a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0046f67c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x482d29
or dword [ebp + 0x10], 0x200000
jmp 0x482d6d
or dword [ebp + 0x10], 0x40000
jmp 0x482d6d
mov eax, dword [0x4f203c]
cmp eax, dword [ebp - 8]
je 0x482d6d
push eax
call fcn.00474717
cmp eax, ebx
pop ecx
je 0x482d6d
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x482d6d
mov eax, dword [0x4f2040]
cmp eax, dword [ebp - 8]
je 0x482d6d
push eax
call fcn.00474717
cmp eax, ebx
pop ecx
je 0x482d6d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f2038]
call fcn.00474717
cmp eax, ebx
pop ecx
je 0x482d8d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x482d8f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48e2e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x4ed3dc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x438], ecx
mov dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x431], 0
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x48e31f
xor eax, eax
jmp 0x48e397
mov dword [ebp - 0x430], 0x428
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x48e341
xor eax, eax
jmp 0x48e397
mov eax, dword [str.SogouPY.ime]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.00470391
add esp, 8
test eax, eax
jne 0x48e363
mov byte [ebp - 0x431], 1
jmp 0x48e377
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x48e341
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 0x431]
test edx, edx
je 0x48e395
mov eax, 1
jmp 0x48e397
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046ec29
mov esp, ebp
pop ebp
ret 4
Function at 0x48e520
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x4ed3dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x244], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x23c], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
jne 0x48e564
xor eax, eax
jmp 0x48e6bf
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x48e599
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x48e6bf
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x23c]
je 0x48e692
mov ecx, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x244]
call fcn.0048e2e0
test eax, eax
je 0x48e692
lea edx, [ebp - 0x214]
test edx, edx
jne 0x48e5d4
jmp 0x48e692
cmp dword [str._System_Process_], 0
je 0x48e680
mov eax, dword [str._System_Process_]
mov dword [ebp - 0x248], eax
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
mov ax, word [edx]
mov word [ebp - 0x24e], ax
mov ecx, dword [ebp - 0x248]
cmp ax, word [ecx]
jne 0x48e65e
cmp word [ebp - 0x24e], 0
je 0x48e652
mov edx, dword [ebp - 0x24c]
mov ax, word [edx + 2]
mov word [ebp - 0x250], ax
mov ecx, dword [ebp - 0x248]
cmp ax, word [ecx + 2]
jne 0x48e65e
add dword [ebp - 0x24c], 4
add dword [ebp - 0x248], 4
cmp word [ebp - 0x250], 0
jne 0x48e5f8
mov dword [ebp - 0x254], 0
jmp 0x48e669
sbb edx, edx
sbb edx, 0xffffffff
mov dword [ebp - 0x254], edx
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x48e680
jmp 0x48e692
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x244]
call fcn.0048e470
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x240]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48e599
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ec29
mov esp, ebp
pop ebp
ret
Function at 0x492590
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x58], 0
mov eax, 1
pop ebp
ret

Function at 0x495930
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x495974
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x495974
xor eax, eax
jmp 0x495977
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4959f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x495a57
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00499a40
push eax
push 0x4d56c8
mov ecx, dword [ebp + 8]
call fcn.0049ce30
mov ecx, eax
call fcn.0049ccb0
mov ecx, eax
call fcn.0049ccb0
mov ecx, eax
call fcn.00401c00
jmp 0x495a6d
cmp dword [ebp + 0x14], 0
je 0x495a65
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
call fcn.00401c10
mov esp, ebp
pop ebp
ret 0x10

Function at 0x495a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0x10], 0
jne 0x495ab3
cmp dword [ebp + 0x14], 0
je 0x495aa6
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
call fcn.00401c10
jmp 0x495b4e
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x495b09
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00499a60
push eax
push 0x4d5698
mov ecx, dword [ebp + 8]
call fcn.0049ce30
mov ecx, eax
call fcn.0049ccb0
mov ecx, eax
call fcn.0049ccb0
mov ecx, eax
call fcn.00401c00
jmp 0x495b4e
cmp dword [ebp + 0x14], 0
je 0x495b17
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
jne 0x495b46
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00499a60
push eax
push 0x4d56a8
mov ecx, dword [ebp + 8]
call fcn.00401c20
mov ecx, eax
call fcn.0049ccb0
mov ecx, eax
call fcn.00401c00
jmp 0x495b4e
mov ecx, dword [ebp + 8]
call fcn.00401c10
mov esp, ebp
pop ebp
ret 0x10
Function at 0x496460
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4964a3
xor al, al
jmp 0x49654f
mov edx, dword [ebp - 0x10]
push edx
call fcn.0046ef1b
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4964cd
jmp 0x49653a
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x4d5d40
mov edx, dword [ebp - 0xc]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4964eb
jmp 0x49653a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
shr edx, 0x10
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
and edx, 0xffff
mov eax, dword [ebp + 0xc]
mov word [eax + 2], dx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
mov eax, dword [ebp + 0xc]
mov word [eax + 4], dx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
mov eax, dword [ebp + 0xc]
mov word [eax + 6], dx
mov byte [ebp - 5], 1
cmp dword [ebp - 0xc], 0
je 0x49654c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0046f0cc
add esp, 4
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4968b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
test eax, eax
je 0x4969c6
mov ecx, dword [ebp - 0xc]
add ecx, 1
cmp ecx, dword [ebp + 0xc]
jl 0x4968f1
or eax, 0xffffffff
jmp 0x4969d1
mov word [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x496909
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 4
jge 0x49699c
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
test ecx, ecx
jne 0x496925
or eax, 0xffffffff
jmp 0x4969d1
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x61
jl 0x496949
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x7a
jg 0x496949
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
sub ecx, 0x61
mov dword [ebp - 0x14], ecx
jmp 0x496972
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x30
jl 0x49696d
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x39
jg 0x49696d
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
sub ecx, 0x16
mov dword [ebp - 0x14], ecx
jmp 0x496972
or eax, 0xffffffff
jmp 0x4969d1
mov dx, word [ebp - 0x18]
shl dx, 5
mov word [ebp - 0x18], dx
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 4]
movzx ecx, word [ebp - 0x18]
add ecx, eax
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x10], edx
jmp 0x496900
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov dx, word [ebp - 0x18]
mov word [ecx], dx
mov eax, dword [ebp - 8]
add eax, 2
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x4968d0
mov edx, dword [ebp - 8]
mov word [edx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x496ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0x10], 0
jne 0x496ae4
or eax, 0xffffffff
jmp 0x496c26
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
mov ax, word [edx]
mov word [ebp - 0x22], ax
add dword [ebp - 0x1c], 2
cmp word [ebp - 0x22], 0
jne 0x496af3
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x20]
sar ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 2
jge 0x496b27
or eax, 0xffffffff
jmp 0x496c26
mov eax, dword [ebp - 8]
and eax, 0x80000001
jns 0x496b36
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x496b42
or eax, 0xffffffff
jmp 0x496c26
mov eax, dword [ebp - 8]
cdq
sub eax, edx
sar eax, 1
sub eax, 1
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
jmp 0x496b66
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jg 0x496c16
mov eax, dword [ebp - 0xc]
shl eax, 1
mov ecx, dword [ebp + 0x10]
mov dx, word [ecx + eax*2]
mov word [ebp - 0x18], dx
mov eax, dword [ebp - 0xc]
shl eax, 1
mov ecx, dword [ebp + 0x10]
mov dx, word [ecx + eax*2 + 2]
mov word [ebp - 0x10], dx
movzx eax, word [ebp - 0x18]
cmp eax, 0x7a
jg 0x496ba5
movzx ecx, word [ebp - 0x18]
cmp ecx, 0x61
jge 0x496baa
or eax, 0xffffffff
jmp 0x496c26
movzx edx, word [ebp - 0x10]
cmp edx, 0x7a
jg 0x496bbc
movzx eax, word [ebp - 0x10]
cmp eax, 0x61
jge 0x496bc1
or eax, 0xffffffff
jmp 0x496c26
movzx ecx, word [ebp - 0x18]
sub ecx, 0x61
mov word [ebp - 0x18], cx
movzx edx, word [ebp - 0x10]
sub edx, 0x61
mov word [ebp - 0x10], dx
movzx eax, word [ebp - 0x18]
shl eax, 4
movzx ecx, word [ebp - 0x10]
add eax, ecx
mov byte [ebp - 0x11], al
movzx edx, byte [ebp - 0x11]
movzx eax, byte [ebp - 1]
xor eax, edx
mov byte [ebp - 1], al
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jge 0x496c11
movzx edx, word [ebp - 0x18]
shl edx, 4
movzx eax, word [ebp - 0x10]
add edx, eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
mov byte [ecx], dl
jmp 0x496b5d
movzx edx, byte [ebp - 1]
test edx, edx
je 0x496c23
or eax, 0xffffffff
jmp 0x496c26
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x496c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ed3dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00470e10
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x496c7c
xor al, al
jmp 0x496cf6
push 0x4d5d44
lea edx, [ebp - 0x210]
push edx
call fcn.00401130
add esp, 8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00496460
add esp, 8
movzx edx, al
test edx, edx
jne 0x496cb1
xor al, al
jmp 0x496cf6
mov eax, dword [ebp + 8]
mov dword [eax], 0x114
movzx ecx, word [ebp - 0x218]
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
movzx eax, word [ebp - 0x216]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
movzx edx, word [ebp - 0x214]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 2
mov edx, dword [ebp + 8]
mov word [edx + 0x14], 0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ec29
mov esp, ebp
pop ebp
ret

Function at 0x496d10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ed3dc]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00496450
movzx eax, al
test eax, eax
je 0x496d31
jmp 0x496d80
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.00496560
add esp, 8
cmp eax, 1
jne 0x496d6a
push 5
push 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
push 0x4d5c8c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x496d80
push 5
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ec29
mov esp, ebp
pop ebp
ret
Function at 0x496d90
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4ed3dc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
push 0x4f51b0
mov eax, dword [ebp + 8]
push eax
call fcn.00474132
add esp, 8
test eax, eax
je 0x496dc6
xor eax, eax
jmp 0x496fc0
movzx ecx, word [0x4f51b6]
and ecx, 0x4000
je 0x496fb0
mov edx, dword [ebp + 8]
push edx
push str._s.
lea edx, [ebp - 0x808]
call fcn.0040b1c0
add esp, 8
push 0x4f4f60
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x496fa1
mov dword [ebp - 0x810], 0x4d5bc4
mov dword [ebp - 0x814], 0x4f4f8c
mov ecx, dword [ebp - 0x814]
mov dx, word [ecx]
mov word [ebp - 0x816], dx
mov eax, dword [ebp - 0x810]
cmp dx, word [eax]
jne 0x496e8f
cmp word [ebp - 0x816], 0
je 0x496e83
mov ecx, dword [ebp - 0x814]
mov dx, word [ecx + 2]
mov word [ebp - 0x818], dx
mov eax, dword [ebp - 0x810]
cmp dx, word [eax + 2]
jne 0x496e8f
add dword [ebp - 0x814], 4
add dword [ebp - 0x810], 4
cmp word [ebp - 0x818], 0
jne 0x496e29
mov dword [ebp - 0x81c], 0
jmp 0x496e9a
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x81c], ecx
mov edx, dword [ebp - 0x81c]
mov dword [ebp - 0x820], edx
cmp dword [ebp - 0x820], 0
je 0x496f4d
mov dword [ebp - 0x824], 0x4d5bc8
mov dword [ebp - 0x828], 0x4f4f8c
mov eax, dword [ebp - 0x828]
mov cx, word [eax]
mov word [ebp - 0x82a], cx
mov edx, dword [ebp - 0x824]
cmp cx, word [edx]
jne 0x496f2d
cmp word [ebp - 0x82a], 0
je 0x496f21
mov eax, dword [ebp - 0x828]
mov cx, word [eax + 2]
mov word [ebp - 0x82c], cx
mov edx, dword [ebp - 0x824]
cmp cx, word [edx + 2]
jne 0x496f2d
add dword [ebp - 0x828], 4
add dword [ebp - 0x824], 4
cmp word [ebp - 0x82c], 0
jne 0x496ec7
mov dword [ebp - 0x830], 0
jmp 0x496f38
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x830], eax
mov ecx, dword [ebp - 0x830]
mov dword [ebp - 0x834], ecx
cmp dword [ebp - 0x834], 0
jne 0x496f4f
jmp 0x496f7a
push 0x4f4f8c
mov edx, dword [ebp + 8]
push edx
push 0x4d5bd0
lea edx, [ebp - 0x808]
call fcn.0040b1c0
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call fcn.00496d90
add esp, 4
push 0x4f4f60
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x496e15
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], eax
jmp 0x496fbd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046ec29
mov esp, ebp
pop ebp
ret
Function at 0x496fd0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4ed3dc]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x4f5430
mov eax, dword [ebp + 8]
push eax
call fcn.00474132
add esp, 8
test eax, eax
je 0x496fff
xor eax, eax
jmp 0x49720b
movzx ecx, word [0x4f5436]
and ecx, 0x4000
je 0x4971f7
mov edx, dword [ebp + 8]
push edx
push 0x4d5b8c
lea edx, [ebp - 0x808]
call fcn.0040b1c0
add esp, 8
push 0x4f51e0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x4971f7
mov dword [ebp - 0x810], 0x4d5b9c
mov dword [ebp - 0x814], 0x4f520c
mov ecx, dword [ebp - 0x814]
mov dx, word [ecx]
mov word [ebp - 0x816], dx
mov eax, dword [ebp - 0x810]
cmp dx, word [eax]
jne 0x4970c8
cmp word [ebp - 0x816], 0
je 0x4970bc
mov ecx, dword [ebp - 0x814]
mov dx, word [ecx + 2]
mov word [ebp - 0x818], dx
mov eax, dword [ebp - 0x810]
cmp dx, word [eax + 2]
jne 0x4970c8
add dword [ebp - 0x814], 4
add dword [ebp - 0x810], 4
cmp word [ebp - 0x818], 0
jne 0x497062
mov dword [ebp - 0x81c], 0
jmp 0x4970d3
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x81c], ecx
mov edx, dword [ebp - 0x81c]
mov dword [ebp - 0x820], edx
cmp dword [ebp - 0x820], 0
je 0x497186
mov dword [ebp - 0x824], 0x4d5ba0
mov dword [ebp - 0x828], 0x4f520c
mov eax, dword [ebp - 0x828]
mov cx, word [eax]
mov word [ebp - 0x82a], cx
mov edx, dword [ebp - 0x824]
cmp cx, word [edx]
jne 0x497166
cmp word [ebp - 0x82a], 0
je 0x49715a
mov eax, dword [ebp - 0x828]
mov cx, word [eax + 2]
mov word [ebp - 0x82c], cx
mov edx, dword [ebp - 0x824]
cmp cx, word [edx + 2]
jne 0x497166
add dword [ebp - 0x828], 4
add dword [ebp - 0x824], 4
cmp word [ebp - 0x82c], 0
jne 0x497100
mov dword [ebp - 0x830], 0
jmp 0x497171
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x830], eax
mov ecx, dword [ebp - 0x830]
mov dword [ebp - 0x834], ecx
cmp dword [ebp - 0x834], 0
jne 0x497188
jmp 0x4971d0
push 0x4f520c
mov edx, dword [ebp + 8]
push edx
push 0x4d5ba8
lea edx, [ebp - 0x808]
call fcn.0040b1c0
add esp, 0xc
mov eax, dword [0x4f51e0]
and eax, 0x10
je 0x4971bf
lea ecx, [ebp - 0x808]
push ecx
call fcn.00496fd0
add esp, 4
jmp 0x4971d0
push 4
push 0
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x4f51e0
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x49704e
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046ec29
mov esp, ebp
pop ebp
ret
Function at 0x497d10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
mov edx, dword [ebp - 0x10]
add edx, 0x84
mov eax, 0x103
call fcn.00409640
mov edx, dword [ebp - 0x10]
add edx, 0x84
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x1a], dx
add dword [ebp - 0x14], 2
cmp word [ebp - 0x1a], 0
jne 0x497d52
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
sar eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x497d8a
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x497db9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov ax, word [edx + ecx*2 + 0x84]
push eax
call fcn.004745f7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov word [edx + ecx*2 + 0x28c], ax
jmp 0x497d81
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov word [ecx + eax*2 + 0x28c], 0
mov ecx, dword [ebp + 8]
call fcn.00401c10
mov esp, ebp
pop ebp
ret 4

Function at 0x498360
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x1a
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x2c
call fcn.00499af0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x4983aa
mov ecx, dword [ebp - 4]
add ecx, 0x2c
call fcn.0041d900
push 0x4d60f8
mov ecx, dword [ebp + 8]
call fcn.00401c20
mov ecx, eax
call fcn.00401c00
jmp 0x4983bd
mov ecx, dword [ebp - 4]
add ecx, 0x2c
call fcn.0049a540
mov ecx, dword [ebp + 8]
call fcn.00401c10
mov esp, ebp
pop ebp
ret 4