joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dcc40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4dcc51
xor eax, eax
jmp 0x4dcda5
push 1
push 0x44
call fcn.004b73c0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4dcc6d
xor eax, eax
jmp 0x4dcda5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 5]
mov byte [eax + 5], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004dc894
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.004dc9cc
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.004dc720
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.004dc894
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.004dc720
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.004dc894
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.004dcc40
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
call fcn.004dc720
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.004dc720
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 6]
mov byte [edx + 6], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 7]
mov byte [edx + 7], cl
mov edx, dword [ebp - 4]
mov byte [edx + 8], 0
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4c9560
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x563d54]
test eax, eax
jne 0x4c966c
push ebx
push esi
push edi
mov edi, dword [0x53d290]
push 0x8001
mov dword [0x563d54], 1
call edi
push str.imm32.dll
mov ebx, eax
call dword [0x53d294]
push ebx
mov esi, eax
call edi
test esi, esi
je 0x4c9669
mov edi, dword [0x53d298]
push str.ImmGetContext
push esi
call edi
test eax, eax
mov dword [0x563d58], eax
je 0x4c9669
push str.ImmReleaseContext
push esi
call edi
test eax, eax
mov dword [0x563d5c], eax
je 0x4c9669
push str.ImmSetCompositionWindow
push esi
call edi
test eax, eax
mov dword [0x563d60], eax
je 0x4c9669
push str.ImmSetCompositionFontA
push esi
call edi
test eax, eax
mov dword [0x563d64], eax
je 0x4c9669
push str.ImmGetCompositionStringW
push esi
call edi
push str.ImmGetOpenStatus
push esi
mov dword [0x563d68], eax
call edi
push str.ImmSetOpenStatus
push esi
mov dword [0x563d6c], eax
call edi
push str.ImmGetConversionStatus
push esi
mov dword [0x563d70], eax
call edi
push str.ImmSetConversionStatus
push esi
mov dword [0x563d74], eax
call edi
push str.ImmSetCompositionStringW
push esi
mov dword [0x563d78], eax
call edi
push str.ImmNotifyIME
push esi
mov dword [0x563d7c], eax
call edi
push str.ImmGetCandidateListW
push esi
mov dword [0x563d80], eax
call edi
mov dword [0x563d84], eax
mov dword [0x563d54], 2
pop edi
pop esi
pop ebx
ret

Function at 0x4c9670
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0xc
push esi
call dword [0x53d288]
push eax
call dword [0x53d47c]
push 7
lea ecx, [esp + 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
xor esi, esi
call dword [0x53d28c]
test eax, eax
je 0x4c96ba
push esi
push 0xa
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00495250
add esp, 0x10
test eax, eax
mov eax, dword [esp + 4]
jne 0x4c96bc
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x4c9760
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [0x563d54]
sub esp, 8
test eax, eax
push edi
mov edi, str.UNKNOWN
jne 0x4c9777
call fcn.004c9560
push 0
call dword [0x53d47c]
cmp dword [0x563d54], 2
jne 0x4c9898
mov eax, dword [0x563d74]
test eax, eax
je 0x4c9898
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [0x563d58]
mov esi, eax
test esi, esi
je 0x4c9897
push ebx
call fcn.004c9670
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
mov ebx, eax
call dword [0x563d74]
test eax, eax
je case.0x4c9810.17
mov eax, dword [esp + 0xc]
cmp eax, 0x400
jbe 0x4c97e0
sub eax, 0x400
lea ecx, [ebx - 0x3a4]
cmp ecx, 0x12
ja case.0x4c9810.17
movzx ecx, byte [ecx + 0x4c98b0]
jmp dword [ecx*4 + 0x4c98a0]
add eax, 0xfffffff0
cmp eax, 0xb
ja case.0x4c9810.17
movzx edx, byte [eax + 0x4c98dc]
jmp dword [edx*4 + 0x4c98c4]
pop ebx
mov edi, str.ALPHANUMERIC_FULL
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_KATAKANA_FULL
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_KATAKANA_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_HIRAGANA
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4c9810.17
movzx eax, byte [eax + 0x4c98f8]
jmp dword [eax*4 + 0x4c98e8]
pop ebx
mov edi, str.ALPHANUMERIC_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.KOREAN
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4c9810.17
movzx ecx, byte [eax + 0x4c9914]
jmp dword [ecx*4 + 0x4c9904]
mov edi, str.CHINESE
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x4ca240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 4]
push eax
push 0x20019
xor esi, esi
push esi
push ecx
push edx
mov dword [esp + 0x18], 0
call dword [0x53d008]
test eax, eax
jne 0x4ca2bf
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [0x53d004]
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
push edi
push ecx
call ebx
test eax, eax
jne 0x4ca2bd
mov edx, dword [esp + 0x10]
push edx
call fcn.0052b380
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push edi
push ecx
call ebx
test eax, eax
je 0x4ca2bd
push esi
call fcn.00439d00
add esp, 4
xor esi, esi
pop edi
pop ebx
mov eax, dword [esp + 4]
test eax, eax
je 0x4ca2ce
push eax
call dword [section..rdata]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x4ca390
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x54
push ebx
push ebp
push esi
push edi
push str._shellopencommand
push eax
xor ebp, ebp
xor esi, esi
xor edi, edi
call fcn.00435600
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4ca420
push edi
push ebx
push 0x80000000
call fcn.004ca240
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4ca420
mov ecx, dword [esp + 0x6c]
push ecx
push esi
call fcn.004ca2e0
mov edi, eax
add esp, 8
test edi, edi
je 0x4ca420
lea edx, [esp + 0x20]
push edx
call dword [0x53d270]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edi
push ebp
call dword [0x53d274]
test eax, eax
je 0x4ca420
mov edx, dword [esp + 0x10]
push edx
mov ebp, 1
call dword [0x53d278]
mov eax, dword [esp + 0x14]
push eax
call dword [0x53d278]
push ebx
call fcn.00439d00
push esi
call fcn.00439d00
push edi
call fcn.00439d00
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x54
ret

Function at 0x4cb130
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [0x53d2b4]
mov eax, dword [esp + 0x14]
dec eax
je 0x4cb1a1
dec eax
jne 0x4cb1bf
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4cb18d
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x4cb17a
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x4cb1bf
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x4cb1bf
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x4cb1b8
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x4cb1bf
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret
Function at 0x4cdb40
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc5c]
test eax, eax
je 0x4cdba3
mov eax, dword [edi]
call dword [eax + 0xd4]
test eax, eax
jne 0x4cdb69
mov dword [edi + 0x658], 1
pop edi
pop esi
ret 0xc
mov esi, dword [edi + 0xc5c]
mov dword [esi + 0x18], eax
mov dword [edi + 0xc5c], 0
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4cc140
push 0
push 0
call dword [0x53d160]
test eax, eax
je 0x4cdb9e
push eax
call dword [0x53d278]
pop edi
pop esi
ret 0xc
push 0x1c
push 0x40
call dword [0x53d15c]
mov esi, eax
test esi, esi
je 0x4cdb9e
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00435680
mov edx, dword [esp + 0x14]
push edx
mov dword [esi], eax
call fcn.00435680
mov dword [esi + 4], eax
mov al, byte [esp + 0x1c]
add esp, 8
mov byte [esi + 8], al
call fcn.004cb0e0
mov byte [esi + 9], al
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xd8]
mov dword [esi + 0x14], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd4]
mov ecx, edi
mov dword [esi + 0x18], eax
call fcn.004cb510
test al, al
je 0x4cdc0e
mov ecx, dword [edi + 0xae8]
mov dword [esi + 0xc], ecx
jmp 0x4cdc15
mov dword [esi + 0xc], 0
mov edx, dword [edi]
push ebx
push ebp
mov ecx, edi
call dword [edx + 0xd8]
mov ebx, eax
call fcn.004cb0e0
test al, al
mov ebp, dword [0x53d138]
je 0x4cdc5b
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [0x53d158]
jmp 0x4cdc82
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [0x53d154]
push eax
push ebx
call dword [0x53d150]
push eax
call dword [0x53d14c]
test eax, eax
pop ebp
mov dword [esi + 0x10], eax
pop ebx
je 0x4cdb9e
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4cdb7c
mov dword [edi + 0xc5c], esi
mov dword [edi + 0x658], 1
pop edi
pop esi
ret 0xc
Function at 0x4cef80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf08f
cmp byte [esi], 0
je 0x4cf08f
mov ecx, dword [esp + 0x18]
push ebx
or ebx, 0xffffffff
test ecx, ecx
push edi
je 0x4cf079
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf044
push 0x5481a0
lea ecx, [esp + 0x10]
call fcn.00435980
push esi
lea ecx, [esp + 0x10]
call fcn.00435140
cmp edi, 5
jle 0x4cefec
mov eax, dword [esp + 0xc]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf014
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf02a
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf02a
push esi
call dword [0x53d148]
push esi
mov ebx, eax
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00439d00
add esp, 4
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cf079
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf082
push esi
call dword [0x53d144]
push esi
mov ebx, eax
call fcn.00439d00
add esp, 4
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
push esi
call dword [0x53d144]
mov ebx, eax
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret

Function at 0x4cf0a0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf1ab
cmp byte [esi], 0
je 0x4cf1ab
mov ecx, dword [esp + 0x18]
push ebx
xor bl, bl
test ecx, ecx
push edi
je 0x4cf196
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf162
push 0x5481a0
lea ecx, [esp + 0x10]
call fcn.00435980
push esi
lea ecx, [esp + 0x10]
call fcn.00435140
cmp edi, 5
jle 0x4cf10b
mov eax, dword [esp + 0xc]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf133
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf14c
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf14c
push esi
call dword [0x53d174]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cf196
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf1a2
push esi
call dword [0x53d170]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
push esi
call dword [0x53d170]
test eax, eax
setne bl
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret
Function at 0x4cf1c0
Capabilities:
Move file

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4cf38c
cmp byte [esi], 0
je 0x4cf38c
push ebp
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4cf384
cmp byte [ebp], 0
je 0x4cf384
mov ecx, dword [esp + 0x2c]
test ecx, ecx
push edi
mov byte [esp + 0x28], 0
je 0x4cf36a
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf317
push ebx
push 0x5481a0
lea ecx, [esp + 0x20]
call fcn.00435980
push esi
lea ecx, [esp + 0x20]
call fcn.00435140
cmp edi, 5
jle 0x4cf245
mov eax, dword [esp + 0x1c]
push eax
call fcn.004b8000
add esp, 4
mov ebx, eax
jmp 0x4cf271
mov ecx, dword [esp + 0x1c]
push 0
push 6
push ecx
call fcn.004b8440
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4cf2fe
push esi
call fcn.004b8000
push esi
mov ebx, eax
call fcn.00439d00
add esp, 8
test ebx, ebx
je 0x4cf2fe
push 0x5481a0
lea ecx, [esp + 0x14]
call fcn.00435980
push ebp
lea ecx, [esp + 0x14]
call fcn.00435140
cmp edi, 5
jle 0x4cf2a7
mov edx, dword [esp + 0x10]
push edx
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf2cf
mov eax, dword [esp + 0x10]
push 0
push 6
push eax
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf2eb
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf2eb
push ebx
push esi
call dword [0x53d2dc]
test eax, eax
push esi
setne byte [esp + 0x30]
call fcn.00439d00
add esp, 4
push ebx
call fcn.00439d00
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00439d00
add esp, 8
mov edx, dword [esp + 0x1c]
push edx
call fcn.00439d00
mov al, byte [esp + 0x30]
add esp, 4
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x18
ret
cmp edi, 5
jle 0x4cf36a
push 0
push ebp
call fcn.004d9d70
mov edi, eax
add esp, 8
test edi, edi
je 0x4cf379
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf356
push esi
push edi
call dword [0x53d178]
test eax, eax
push esi
setne byte [esp + 0x2c]
call fcn.00439d00
add esp, 4
push edi
call fcn.00439d00
mov al, byte [esp + 0x2c]
add esp, 4
pop edi
pop ebp
pop esi
add esp, 0x18
ret
push esi
push ebp
call dword [0x53d178]
test eax, eax
setne byte [esp + 0x28]
mov al, byte [esp + 0x28]
pop edi
pop ebp
pop esi
add esp, 0x18
ret
pop ebp
xor al, al
pop esi
add esp, 0x18
ret
xor al, al
pop esi
add esp, 0x18
ret
Function at 0x4cf3a0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf4ab
cmp byte [esi], 0
je 0x4cf4ab
mov ecx, dword [esp + 0x18]
push ebx
xor bl, bl
test ecx, ecx
push edi
je 0x4cf496
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf462
push 0x5481a0
lea ecx, [esp + 0x10]
call fcn.00435980
push esi
lea ecx, [esp + 0x10]
call fcn.00435140
cmp edi, 5
jle 0x4cf40b
mov eax, dword [esp + 0xc]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf433
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf44c
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf44c
push esi
call dword [0x53d184]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cf496
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf4a2
push esi
call dword [0x53d180]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
push esi
call dword [0x53d180]
test eax, eax
setne bl
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret

Function at 0x4cf4c0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf570
cmp byte [esi], 0
je 0x4cf570
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4cf5af
push edi
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf575
push 0x5481a0
lea ecx, [esp + 0xc]
call fcn.00435980
push esi
lea ecx, [esp + 0xc]
call fcn.00435140
cmp edi, 5
jle 0x4cf524
mov eax, dword [esp + 8]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf54c
mov ecx, dword [esp + 8]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf562
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf562
push 0
push esi
call dword [0x53d18c]
push esi
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 8]
push edx
call fcn.00439d00
add esp, 4
pop edi
pop esi
add esp, 0xc
ret
cmp edi, 5
push 0
push esi
jle 0x4cf5a3
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf56f
push 0
push esi
call dword [0x53d188]
push esi
call fcn.00439d00
add esp, 4
pop edi
pop esi
add esp, 0xc
ret
call dword [0x53d188]
pop edi
pop esi
add esp, 0xc
ret
push 0
push esi
call dword [0x53d188]
pop esi
add esp, 0xc
ret
Function at 0x4cfa00
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [0x53d198]
mov eax, dword [esp]
pop ecx
ret

Function at 0x4cfa30
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [0x53d19c]
mov eax, dword [esp]
pop ecx
ret

Function at 0x4cfa60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push esi
mov esi, dword [esp + 0x418]
test esi, esi
jne 0x4cfa7c
xor al, al
pop esi
add esp, 0x410
ret
mov ecx, dword [esp + 0x41c]
test ecx, ecx
push ebx
push edi
je 0x4cfbfd
call fcn.00497d20
mov ebx, eax
call fcn.004cb0e0
test al, al
je 0x4cfb5f
lea eax, [esp + 0x214]
push eax
push 0x104
call dword [0x53d1ac]
test eax, eax
jbe 0x4cfc56
lea ecx, [esp + 0xc]
push ecx
push 0
push str.flash
lea edx, [esp + 0x220]
push edx
call dword [0x53d1a8]
test eax, eax
jbe 0x4cfc56
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004b8350
mov edi, eax
add esp, 8
test edi, edi
je 0x4cfc56
cmp ebx, 5
jle 0x4cfb1f
mov edx, esi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4cfb00
push edi
call fcn.00439d00
add esp, 4
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x410
ret
push 0
push edi
call fcn.004d9d70
push edi
mov ebx, eax
call fcn.00439d00
add esp, 0xc
test ebx, ebx
je 0x4cfc56
mov edx, esi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4cfb40
push ebx
call fcn.00439d00
add esp, 4
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x410
ret
lea ecx, [esp + 0x214]
push ecx
push 0x104
call dword [0x53d1a4]
test eax, eax
jbe 0x4cfc56
lea edx, [esp + 0xc]
push edx
push 0
push 0x548210
lea eax, [esp + 0x220]
push eax
call dword [0x53d1a0]
test eax, eax
jbe 0x4cfc56
cmp ebx, 5
lea ecx, [esp + 0xc]
jle 0x4cfbdf
push 0
push 6
push ecx
call fcn.004b8440
add esp, 0xc
test eax, eax
je 0x4cfc56
mov ecx, eax
sub esi, eax
mov edi, edi
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x4cfbc0
push eax
call fcn.00439d00
add esp, 4
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x410
ret
mov edx, esi
lea eax, [esp + 0xc]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4cfbe7
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x410
ret
lea edx, [esp + 0x214]
push edx
push 0x104
call dword [0x53d1a4]
test eax, eax
jbe 0x4cfc56
lea eax, [esp + 0xc]
push eax
push 0
push 0x548210
lea ecx, [esp + 0x220]
push ecx
call dword [0x53d1a0]
test eax, eax
jbe 0x4cfc56
lea eax, [esp + 0xc]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4cfc40
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x410
ret
pop edi
pop ebx
xor al, al
pop esi
add esp, 0x410
ret
Function at 0x4cfe40
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov ecx, dword [esp + 0x814]
test ecx, ecx
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 2
je 0x4cffe0
call fcn.00497d20
mov ebx, eax
call fcn.004cb0e0
test al, al
je 0x4cff3f
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [0x53d010]
mov esi, eax
test esi, esi
jne 0x4d0049
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
push str.AppData
push ecx
mov dword [esp + 0x28], 0x400
call dword [0x53d00c]
mov esi, eax
test esi, esi
jne 0x4d003e
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.004b8350
mov edi, eax
add esp, 8
test edi, edi
je 0x4d003e
cmp ebx, 5
jle 0x4cff09
mov ecx, dword [esp + 0x81c]
push edi
call fcn.00435020
push edi
call fcn.00439d00
add esp, 4
jmp 0x4d003e
push 0
push edi
call fcn.004d9d70
push edi
mov ebx, eax
call fcn.00439d00
add esp, 0xc
test ebx, ebx
je 0x4d003e
mov ecx, dword [esp + 0x81c]
push ebx
call fcn.00435020
push ebx
call fcn.00439d00
add esp, 4
jmp 0x4d003e
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push 0x548230
push 0x80000001
call dword [0x53d008]
mov esi, eax
test esi, esi
jne 0x4d0049
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
push 0x548224
push edx
mov dword [esp + 0x28], 0x400
call dword [0x53d004]
mov esi, eax
test esi, esi
jne 0x4cffd9
cmp ebx, 5
jle 0x4cffc8
push eax
lea eax, [esp + 0x1c]
push 6
push eax
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cffd9
mov ecx, dword [esp + 0x81c]
push edi
call fcn.00435020
push edi
call fcn.00439d00
mov edx, dword [esp + 0x10]
add esp, 4
push edx
jmp 0x4d0043
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x820]
call fcn.00435020
mov edx, dword [esp + 0xc]
push edx
jmp 0x4d0043
lea eax, [esp + 0xc]
push eax
push 1
push 0
push 0x548230
push 0x80000001
call dword [0x53d008]
mov esi, eax
test esi, esi
jne 0x4d0049
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
push 0x548224
push ecx
mov dword [esp + 0x28], 0x400
call dword [0x53d004]
mov esi, eax
test esi, esi
jne 0x4d003e
mov ecx, dword [esp + 0x81c]
lea edx, [esp + 0x18]
push edx
call fcn.00435020
mov eax, dword [esp + 0xc]
push eax
call dword [section..rdata]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
add esp, 0x80c
ret