joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487570
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x742040]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edx, 0x20019
or edx, dword [ebp + 0x10]
push esi
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48762d
xor eax, eax
lea edx, [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [esi]
sub esp, 0x30
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x48764d
mov eax, dword [ebp - 0x1c]
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
jne 0x487633
lea edx, [esi + 8]
lea edi, [ebp - 0x14]
mov dword [edi], 0x104
xor edi, edi
dec edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
xor edi, edi
lea ebx, [ebp - 0x1c]
push ebx
push edi
push edi
push edi
lea edi, [ebp - 0x14]
push edi
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x487639
jmp 0x487633
mov dword [esi], 0
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48762d

Function at 0x487680
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x4876f1
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
sete dh
or dh, dl
jne 0x4876f1
lea edi, [esi + 8]
lea edx, [ebp - 0x14]
mov dword [edx], 0x104
xor ebx, ebx
dec ebx
lea edx, [ebp - 0x1c]
mov dword [edx], ebx
mov dword [edx + 4], ebx
xor ebx, ebx
push edx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x14]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4876f1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [esi + 8], 0
jmp 0x4876df

Function at 0x4881f0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x4c], eax
pcmpeqd xmm0, xmm0
mov eax, esp
movdqa xmmword [eax], xmm0
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
mov dword [eax], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x48824e
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x4c]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call fcn.005bf980
xor esi, esi
xor edi, edi
jmp 0x488238
Function at 0x488260
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0xce
push 0x6d1758
push 0x6d177a
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e8e00
xor esi, esi
dec esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], esi
cmp byte [edi + 0xb], 0
jns 0x4882d4
mov edi, dword [edi]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x50]
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x48831f
mov esi, dword [esp + 4]
test esi, esi
js 0x4882f7
mov edi, dword [esp]
jmp 0x4882ff
xor edi, edi
dec edi
mov esi, SysReAllocString
lea ecx, [esp + 0x10]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, edi
mov edx, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, esi
jmp 0x4882ff

Function at 0x488ab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x488aeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x488b02
lea eax, [ebx + 1]
cmp eax, 2
jb 0x488ae4
mov dword [esi], ebx
call fcn.004f2b80
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x488b19
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004f2b80
push dword [esi]
call fcn.004e4b30
add esp, 4
mov dword [esi], 0
jmp 0x488ad5
int3

Function at 0x488b20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x488b41
call fcn.004f2b80
mov dword [esi], 0
test edi, edi
je 0x488b71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x488b92
cmp ebx, 2
jb 0x488b68
mov dword [esi], edi
call fcn.004f2b80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x488ba9
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004f2b80
push dword [esi]
call fcn.004e4b30
add esp, 4
mov dword [esi], 0
jmp 0x488b5c
call fcn.004e03a0
jmp 0x488b86
Function at 0x488be0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x488c01
call fcn.004f2b80
cmp dword [esi], edi
je 0x488c2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x488c4c
cmp ebx, 2
jb 0x488c22
mov dword [esi], edi
call fcn.004f2b80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x488c63
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004f2b80
push dword [esi]
call fcn.004e4b30
add esp, 4
mov dword [esi], 0
jmp 0x488c16
call fcn.004e03a0
jmp 0x488c40
Function at 0x48a260
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x1c
push 0x6d1a64
push 0x6d1a8f
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.004e8e00
mov ecx, esi
call fcn.004e5c00
test al, al
je 0x48a3a4
mov ecx, esi
call fcn.0048a660
sub esp, 0x18
movq xmm0, qword [0x6d1a50]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x48a320
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x48a388
lea eax, [edi + 1]
cmp eax, 2
jb 0x48a316
mov dword [esi + 0x24], edi
call fcn.004f2b80
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x24]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x48a3a4
sub esp, 0x14
movd xmm0, dword [0x6d1a60]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x48a3a4
mov edi, eax
mov ecx, esp
mov dword [ecx], fcn.00573fc0
mov dword [ecx + 4], eax
call fcn.004ab1c0
mov eax, dword [eax + 0x50]
test eax, eax
setne bl
je 0x48a368
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
lea ecx, [esp + 0x10]
call fcn.004e8e70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004f2b80
push dword [esi + 0x24]
call fcn.004e4b30
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x48a306
xor ebx, ebx
jmp 0x48a368
Function at 0x48a3b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x42
push 0x6d1a64
push 0x6d1aa0
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.004e8e00
mov ecx, esi
call fcn.004e5c00
xor ebx, ebx
test al, al
je 0x48a4f5
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x48a535
mov edi, 2
mov dword [esp + 4], 4
mov ecx, esi
call fcn.0048a660
xor ecx, ecx
push ecx
push ebx
push ecx
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x48a476
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x48a519
mov eax, edi
inc eax
cmp eax, 2
jb 0x48a46c
mov dword [esi + 0x24], edi
call fcn.004f2b80
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
inc edi
cmp edi, 2
jb 0x48a515
mov dword [esp + 0xc], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [0x6d2744]
xor edx, ecx
mov edi, dword [0x6d2740]
xor edi, eax
or edi, edx
mov edx, dword [ebx + 8]
jne 0x48a56c
cmp edx, dword [0x6d2748]
jne 0x48a56c
mov ecx, esi
call fcn.0048a750
mov edi, eax
add eax, 0xffffffff
adc edx, 0xffffffff
xor ebx, ebx
cmp eax, 0xffffffff
sbb edx, 0
jae 0x48a4f5
xor ecx, ecx
xor eax, eax
mov edx, dword [esp + 4]
push eax
push ebx
push ecx
push edx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x48a515
add eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov bl, 1
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
jmp 0x48a4f5
call fcn.004f2b80
push dword [esi + 0x24]
call fcn.004e4b30
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x48a45c
dec eax
cmp eax, 3
ja case.default.0x48a53f
jmp dword [eax*4 + 0x6d1ab8]
sub esp, 4
mov ecx, esi
call fcn.0048a260
mov ebx, eax
jmp 0x48a4f5
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 8]
mov edi, 4
mov dword [esp + 4], 2
jmp 0x48a42b
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
lea ebx, [esp + 8]
mov dword [ebx], edi
lea edi, [esp + 0xc]
push edi
push ebx
lea edi, [esp + 0x18]
push edi
push edx
push ecx
push eax
call fcn.004958e0
add esp, 0x18
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
lea eax, [esp + 0xc]
mov eax, dword [eax]
mov ecx, eax
sar ecx, 0x1f
add eax, edi
adc ecx, 0
mov edx, ecx
and edx, 1
neg edx
xor ecx, edx
setne bl
ret
mov ecx, dword [esp + 0x14]
test ecx, ecx
js 0x48a515
test bl, bl
jne 0x48a515
test edx, edx
js 0x48a515
test eax, eax
je 0x48a515
mov ebx, dword [esp + 0x10]
jmp 0x48a4d4
mov edi, 8
xor eax, eax
inc eax
mov dword [esp + 4], eax
jmp 0x48a42b
xor eax, eax
dec eax
mov dword [esp + 4], eax
xor edi, edi
jmp 0x48a42b
Function at 0x48a670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x97
push 0x6d1ac8
push 0x6d1b4b
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.004e8e00
test ebx, ebx
js 0x48a730
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00501820
test al, al
jne 0x48a735
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
push 0
push edi
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [edi]
lea ecx, [esp + 0x10]
call fcn.005018b0
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x48a710
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push 0x6d1b5d
call fcn.0062e360
jmp 0x48a6e5

Function at 0x48a750
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xac
push 0x6d1ac8
push 0x6d1b75
push edi
call fcn.004f2b50
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.004e8e00
mov dword [edi + 4], 0xffffffff
mov dword [edi], esi
call fcn.00501820
test al, al
jne 0x48a808
xor eax, eax
dec eax
lea ebx, [esp + 8]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [ebx + 4]
or edi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.005018b0
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
push esi
push esi
push dword [esp + 0xc]
push 0x6d1b7f
call fcn.0062e360
jmp 0x48a7ba
Function at 0x48a820
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x30]
push 0xb9
push 0x6d1ac8
push 0x6d1b8f
push esi
call fcn.004f2b50
add esp, 0x10
xor ebx, ebx
mov ecx, edi
push ebx
push esi
call fcn.004e8e00
mov dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call fcn.00501820
test al, al
jne 0x48a977
xor eax, eax
dec eax
lea ecx, [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x48a94e
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 4], xmm0
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x48a94e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
je 0x48a94e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea ecx, [esp + 0x30]
call fcn.005018b0
lea ecx, [esp + 0x40]
call fcn.004e8e70
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x30]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push 0x6d1b99
call fcn.0062e360
jmp 0x48a891
Function at 0x48abe0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x171
push 0x6d1ac8
push 0x6d1bd1
push esi
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.004e8e00
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x48ae01
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x48adf0
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x48ad0d
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x48ad55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x48adc9
mov eax, edi
inc eax
cmp eax, 2
jb 0x48ad4c
mov dword [ebx], edi
call fcn.004f2b80
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x48ada1
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x48adb5
test cl, 0xa
je 0x48ad7d
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x48ade3
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048aac0
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x48ad83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x48ad7d
call fcn.004f2b80
push dword [ebx]
call fcn.004e4b30
add esp, 4
mov dword [ebx], 0
jmp 0x48ad3d
push dword [ebp + 8]
call fcn.0048c9c0
add esp, 4
jmp 0x48ad83
bt ebx, 0x15
jb 0x48ae1e
or edx, 0x20000000
jmp 0x48ac9e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.005bf980
jmp 0x48ad83
int3
Function at 0x48aef0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x48af25
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x48af2c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x48af1e
mov dword [esi], ebx
call fcn.004f2b80
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004f2b80
push dword [esi]
call fcn.004e4b30
add esp, 4
mov dword [esi], 0
jmp 0x48af0f

Function at 0x48b020
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.0048b030
Function at 0x48b2b0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.0048b030

Function at 0x48b2c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea eax, [esp + 0x250]
push 0x1de
push 0x6d1c40
push 0x6d1c77
push eax
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
lea esi, [esp + 0x250]
push 0
push esi
call fcn.004e8e00
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push esi
call fcn.00544260
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x48b348
mov eax, dword [ebx]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.004ed6e0
add esp, 0xc
push esi
call fcn.004d1940
add esp, 4
lea esi, [esp + 0x48]
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push esi
call fcn.00544260
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x48b384
mov eax, dword [edi]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.004ed6e0
add esp, 0xc
push esi
call fcn.004d1940
add esp, 4
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x48b3a7
mov eax, dword [ebx]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x48b3b1
mov ecx, dword [edi]
sub esp, 0x18
movsd xmm0, qword [0x6d1c20]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x48b42e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0048aac0
add esp, 4
mov dword [esp + 0xc], eax
cmp byte [edi + 0xb], 0
jns 0x48b3ed
mov edi, dword [edi]
mov esi, dword [ebp + 0x10]
cmp byte [ebx + 0xb], 0
jns 0x48b3f8
mov ebx, dword [ebx]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test esi, esi
je 0x48b40d
test eax, eax
je 0x48b432
lea ecx, [esp + 0x10]
call fcn.004e8e70
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x48b40d
cmp dword [esp + 0xc], 0xfffffffc
jne 0x48b442
call fcn.005ba020
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi], eax
xor ebx, ebx
jmp 0x48b40d