joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5eb0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x628]
sub esp, 0x628
push 0xffffffffffffffff
push 0x4fef50
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x53a098]
xor eax, ebp
mov dword [ebp + 0x624], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x630]
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp + 0x634]
call fcn.00404d40
mov dword [ebp - 4], 0
mov eax, dword [0x53d150]
mov dword [ebp], 0
mov dword [ebp], 0x53d150
test eax, eax
je 0x4a5f24
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x53d138
call fcn.00404c10
test al, al
jne 0x4a5f68
mov ecx, 0x53d138
call fcn.00404e90
lea ecx, [ebp - 0x24]
cmp ecx, eax
je 0x4a601d
mov ecx, 0x53d138
call fcn.00404e90
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4a5f5f
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x4a6015
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.004c5400
add esp, 0xc
lea eax, [ebp + 0x418]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4a60b9
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 4]
push eax
call fcn.004c5400
add esp, 0xc
lea eax, [ebp + 4]
push 0x208
push eax
lea eax, [ebp + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4a5ffe
test eax, eax
je 0x4a5ffe
add eax, eax
cmp eax, 0x412
jae 0x4a610c
xor ecx, ecx
mov word [ebp + eax + 4], cx
lea eax, [ebp + 4]
push eax
call fcn.004051b0
add esp, 4
push eax
lea eax, [ebp + 4]
jmp 0x4a6014
lea eax, [ebp + 0x418]
push eax
call fcn.004051b0
add esp, 4
push eax
lea eax, [ebp + 0x418]
push eax
lea ecx, [ebp - 0x24]
call fcn.00405050
mov byte [ebp - 4], 0
mov eax, dword [0x53d150]
test eax, eax
je 0x4a6031
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x24]
mov dword [ebp], 0
push eax
mov ecx, esi
call fcn.004a5e40
test al, al
je 0x4a6050
mov bl, 1
jmp 0x4a60d6
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.004c5400
add esp, 0xc
lea eax, [ebp + 0x418]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4a60d4
xor eax, eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 0x418]
push eax
call fcn.004051b0
add esp, 4
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp + 0x418]
push eax
call fcn.00405050
push ebx
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004a5e40
mov bl, al
jmp 0x4a60d6
mov byte [ebp - 4], 0
mov eax, dword [0x53d150]
test eax, eax
je 0x4a60cd
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004049a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x624]
xor ecx, ebp
call fcn.004c2d85
lea esp, [ebp + 0x628]
pop ebp
ret 8
call fcn.004c3513
int3
Function at 0x4a7f00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff25f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.004049a0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.004049a0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.004049a0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004049a0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004049a0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004049a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4a7f90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff25f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.004049a0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.004049a0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.004049a0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004049a0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004049a0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004049a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a9230
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff42f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00405a70
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00405a70
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00405a70
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00405a70
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00405a70
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00405a70
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4aaaf0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff66f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00404d60
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00404d60
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00404d60
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00404d60
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00404d60
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00404d60
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4abc60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff94f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00404d40
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00404d40
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00404d40
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00404d40
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00404d40
mov byte [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00404d40
mov byte [ebp - 4], 5
mov byte [esi + 0x60], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4abdd0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x535640
push 0x4c45a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x53a098]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00404e90
mov dword [ebp - 0x24], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x4abe42
mov eax, dword [eax]
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00405420
add esp, 8
mov edx, esi
mov ecx, edi
call fcn.004abf30
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x4abe81
test bl, bl
jne 0x4abf04
cmp edi, 0x1a
jne 0x4abf04
mov ecx, esi
call fcn.00404e90
mov dword [ebp - 0x20], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x4abea7
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00405420
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.004c5400
add esp, 0x14
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
call fcn.004051b0
add esp, 4
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00405050
mov ecx, esi
call fcn.00404c10
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004c2d85
lea esp, [ebp + 0x414]
pop ebp
ret

Function at 0x4ac0d0
Capabilities:
Query environment variable

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1a
jmp fcn.004abdd0
Function at 0x4accc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x53a098]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4acd42
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4acd42
test ecx, ecx
je 0x4acd3e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4acd00
xor eax, eax
jmp 0x4acd47
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4acd51
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c2d85
add esp, 0xc
ret 0xc
Function at 0x4b1210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5000e8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x53a098]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.004b0730
test al, al
jne 0x4b127f
xor bl, bl
jmp 0x4b13e3
lea ecx, [ebp - 0x5c]
call fcn.004ae9c0
mov byte [ebp - 4], 1
add esi, 0x24
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x4b12bc
push esi
lea ecx, [ebp - 0x5c]
call fcn.004b28f0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x50]
call fcn.004b28f0
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.004b28f0
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004afec0
test al, al
jne 0x4b12d4
xor bl, bl
jmp 0x4b13d7
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x5c]
call fcn.004af550
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x4b13c9
mov ecx, edi
call fcn.00418d60
test al, al
je 0x4b13c9
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x24]
sub ecx, eax
push edx
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x18], 0
call fcn.00418ba0
test al, al
je 0x4b13c9
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], eax
jne 0x4b13c9
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
sub esi, ebx
mov eax, dword [edi]
mov dword [ebp - 0x34], esi
test eax, eax
je 0x4b13c9
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4b13c9
push 0
lea ecx, [ebp - 0x18]
push ecx
push 4
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b13c9
cmp dword [ebp - 0x18], 4
jne 0x4b13c9
cmp ebx, dword [ebp - 0x2c]
je 0x4b13a1
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
push esi
push ebx
call fcn.00418ba0
test al, al
je 0x4b13c9
cmp dword [ebp - 0x18], esi
jne 0x4b13c9
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
push eax
mov ecx, edi
movlpd qword [ebp - 0x64], xmm0
call fcn.00418c20
test al, al
je 0x4b13c5
push dword [ebp - 0x60]
mov ecx, edi
push dword [ebp - 0x64]
call fcn.00418db0
mov bl, 1
jmp 0x4b13cb
xor bl, bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004223f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.004b1680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004223f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c2d85
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1530
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500168
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x53a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push 0x80
push dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp + 0x14]
push esi
push edi
call fcn.00418a70
mov bl, al
test bl, bl
jne 0x4b165b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, 0x50000000
je 0x4b160e
call eax
cmp eax, 5
jne 0x4b1609
push 0x80
mov ecx, edi
call fcn.00404c20
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
test eax, eax
jne 0x4b15ee
lea ecx, [ebp - 0x28]
call fcn.00404d40
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0041d9b0
test al, al
je 0x4b15df
push 0x80
lea ecx, [ebp - 0x28]
call fcn.00404c20
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049a0
mov ecx, dword [ebp - 0x2c]
push 0x80
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push edi
call fcn.00418a70
mov bl, al
test bl, bl
jne 0x4b165b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x21
je 0x4b161a
cmp eax, 0x20
jne 0x4b165b
xor esi, esi
nop dword [eax]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2c]
push 0x80
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.00418a70
mov bl, al
test bl, bl
jne 0x4b165b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x4b1655
cmp eax, 0x20
jne 0x4b165b
inc esi
cmp esi, 0x28
jb 0x4b1620
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2d85
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4b9d80
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x53a098]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4b9de5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b9dc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b9de5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004c2d85
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004c2d85
add esp, 8
ret 4
Function at 0x4b9f60
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501308
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x53a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x4b9fa9
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x4ba0fb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x4ba0c6
test eax, eax
je 0x4ba0c6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x4ba0c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x4ba04b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ba03f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4ba04b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x4ba059
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00404d60
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x4ba0c6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x4ba004
jmp 0x4ba0c9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x4ba0f2
test edx, edx
je 0x4ba0ee
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x4b9fc0
mov al, 1
jmp 0x4ba0fd
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4ba0fb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2d85
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4bba50
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501670
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x53a098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp + 8]
call fcn.00404c10
movzx eax, al
test eax, eax
jne 0x4bba9d
mov ecx, dword [ebp + 8]
push ecx
call fcn.00409cc0
add esp, 4
movzx edx, al
test edx, edx
jne 0x4bbaa2
jmp 0x4bbb46
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404d60
mov dword [ebp - 4], 0
push 0x10
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040cad0
add esp, 8
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp - 0x44]
call fcn.004bca90
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040aef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004049a0
push 0x10
lea edx, [ebp - 0x28]
push edx
call fcn.0040cad0
add esp, 8
lea eax, [ebp - 0x28]
push eax
call fcn.00409cc0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x4bbb37
lea edx, [ebp - 0x28]
push edx
call fcn.00409d60
add esp, 4
movzx eax, al
test eax, eax
je 0x4bbb37
lea ecx, [ebp - 0x28]
call fcn.00404c20
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2d85
mov esp, ebp
pop ebp
ret 4

Function at 0x4bccb0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.00404c10
movzx eax, al
test eax, eax
jne 0x4bcd12
mov ecx, dword [ebp + 8]
push ecx
call fcn.00409cc0
add esp, 4
movzx edx, al
test edx, edx
je 0x4bcd12
mov eax, dword [ebp + 8]
push eax
call fcn.00414a50
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00409cc0
add esp, 4
movzx edx, al
test edx, edx
je 0x4bcd12
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
call fcn.00404c20
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret 4
Function at 0x4bdad0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x41c
mov eax, dword [0x53a098]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
mov ebx, dword [esp + 0x424]
push esi
mov esi, dword [esp + 0x42c]
push edi
mov edi, ecx
test ebx, ebx
jne 0x4bdaff
xor al, al
jmp 0x4bdb37
mov eax, dword [edi + 4]
lea ecx, [esp + 0xc]
push ecx
or eax, 0x20019
mov dword [esp + 0x10], 0
push eax
push esi
push ebx
mov ecx, edi
call fcn.004bdc60
test al, al
je 0x4bdb35
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0
je 0x4bdb51
mov byte [edi + 1], 1
mov al, 1
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c2d85
add esp, 0x41c
ret 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4bdb5b
mov eax, dword [esi]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x4bdb35
cmp dword [esi + 0x14], 8
jb 0x4bdb6f
mov esi, dword [esi]
push 0x412
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004c5400
lea ecx, [esp + 0x1c]
add esp, 0xc
mov eax, ecx
mov edx, 0x208
sub esi, eax
lea eax, [edx + 0x7ffffdf6]
test eax, eax
je 0x4bdbae
movzx eax, word [esi + ecx]
test ax, ax
je 0x4bdbae
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4bdb90
push dword [edi + 4]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004bdf10
add esp, 0xc
test eax, eax
setne al
jmp 0x4bdb37