joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c518
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x1888540]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x18266f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004946e8
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00495910
mov eax, dword [esi]
call fcn.0048303c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x49c58a
mov eax, dword [esi]
call fcn.0048303c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00483048
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x49c5ae
mov eax, dword [esi]
call fcn.00483048
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00483030
cmp eax, dword [ebp - 0x18]
jle 0x49c5c4
mov eax, dword [esi]
call fcn.00483030
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00483024
cmp eax, dword [ebp - 0xc]
jle 0x49c5da
mov eax, dword [esi]
call fcn.00483024
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0049aea0
push eax
call fcn.00407bd0
call fcn.00407130
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x49c6a1
mov eax, ebx
call fcn.0040477c
cmp eax, 0x64
jge 0x49c6a1
cmp dword [0x1882450], 0
je 0x49c6a1
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00407c20
cmp dword [ebp - 8], 0
je 0x49c6a1
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00407c20
cmp dword [ebp - 8], 0
je 0x49c664
mov bl, 2
jmp 0x49c67f
lea edx, [ebp - 0x20]
mov eax, dword [0x189083c]
call fcn.0049f7b0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x49c67d
xor ebx, ebx
jmp 0x49c67f
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x1882558]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.0049aea0
push eax
call dword [0x1882450]
mov eax, dword [0x1888370]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.004985d4
push 4
mov eax, dword [ebp - 4]
call fcn.0049aea0
push eax
call fcn.00407c18
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x18266f8
call fcn.00407130
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4ae088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jbe 0x4ae0ac
mov eax, 1
mov ebx, ecx
add ebx, eax
dec ebx
mov bl, byte [ebx]
mov edi, edx
add edi, eax
dec edi
xor byte [edi], bl
inc eax
dec esi
jne 0x4ae09a
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4ae43c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4ae461
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x14]
mov eax, edi
call fcn.004ae3fc
mov ax, word [esi + ebp*2 + 0x16]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x18]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1a]
lea eax, [edi + 6]
call fcn.004ae3fc
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1c]
lea eax, [edi + 4]
call fcn.004ae3fc
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x1e]
lea eax, [edi + 2]
call fcn.004ae3fc
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4ae47d
mov dx, word [esi + 0x74]
mov eax, edi
call fcn.004ae3fc
mov ax, word [esi + 0x76]
add word [edi + 4], ax
mov ax, word [esi + 0x78]
add word [edi + 2], ax
mov dx, word [esi + 0x7a]
lea eax, [edi + 6]
call fcn.004ae3fc
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ae5cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4ae5f1
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x7c]
mov eax, edi
call fcn.004ae3fc
mov ax, word [esi + ebp*2 + 0x7e]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x80]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x82]
lea eax, [edi + 6]
call fcn.004ae3fc
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x84]
lea eax, [edi + 4]
call fcn.004ae3fc
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x86]
lea eax, [edi + 2]
call fcn.004ae3fc
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4ae60d
mov dx, word [esi + 0xdc]
mov eax, edi
call fcn.004ae3fc
mov ax, word [esi + 0xde]
add word [edi + 4], ax
mov ax, word [esi + 0xe0]
add word [edi + 2], ax
mov dx, word [esi + 0xe2]
lea eax, [edi + 6]
call fcn.004ae3fc
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bd604
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov eax, dword [eax + 0x78]
add eax, ebx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0xc]
cmp edx, 0xffff
jbe 0x4bd694
test esi, esi
jbe 0x4bd6b7
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.0040a138
test eax, eax
jne 0x4bd686
mov eax, dword [ebp - 8]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4bd6b7
add ebx, dword [ebp - 4]
mov dword [ebp - 4], ebx
jmp 0x4bd6b7
add dword [ebp - 8], 2
add edi, 4
dec esi
test esi, esi
ja 0x4bd657
jmp 0x4bd6b7
mov esi, edx
sub esi, dword [eax + 0x10]
cmp esi, dword [eax + 0x14]
jae 0x4bd6b7
mov eax, esi
shl eax, 2
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4bd6b7
add ebx, dword [ebp - 4]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c828c
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x54fdde
jmp 0x4c8070

Function at 0x4c82ac
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x5498ae
jmp 0x4c2154

Function at 0x4c8354
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x54c9f9
jmp 0x4c73a4

Function at 0x4c835c
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x545a1d
jmp 0x4c73ac

Function at 0x4c8364
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x541fac
jmp 0x4c7620

Function at 0x4c836c
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x546f99
jmp 0x4c7c44
Function at 0x4cc454
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x4cc485
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cc46d
add dl, dl
jne 0x4cc490
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cc4e1
xor eax, eax
add dl, dl
jne 0x4cc49d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cc57e
add dl, dl
jne 0x4cc4ac
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cc4b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cc4c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cc4cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4cc4d7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4cc47c
mov eax, 1
add dl, dl
jne 0x4cc4ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cc4fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cc4e6
sub eax, ebx
mov ebx, 1
jne 0x4cc52d
mov ecx, 1
add dl, dl
jne 0x4cc513
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4cc51e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cc50a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cc47c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4cc544
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4cc54f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cc53b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cc47c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4cc59f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4cc47c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4cdfd4
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x4ce005
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cdfed
add dl, dl
jne 0x4ce010
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ce061
xor eax, eax
add dl, dl
jne 0x4ce01d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ce0fe
add dl, dl
jne 0x4ce02c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ce037
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ce042
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ce04d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4ce057
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4cdffc
mov eax, 1
add dl, dl
jne 0x4ce06f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ce07a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ce066
sub eax, ebx
mov ebx, 1
jne 0x4ce0ad
mov ecx, 1
add dl, dl
jne 0x4ce093
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ce09e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ce08a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cdffc
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4ce0c4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ce0cf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ce0bb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cdffc
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4ce11f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4cdffc
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4cfaf4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x1859d05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404bc8
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4cfb2f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4cfb48
lea eax, [ebp - 0xc]
mov edx, dword [0x1888514]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404c28
jmp 0x4cfb5b
lea eax, [ebp - 0xc]
mov edx, dword [0x1888514]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404c28
lea eax, [ebp - 0xc]
mov edx, ebx
sar edx, 1
jns 0x4cfb67
adc edx, 0
mov edx, dword [edx*4 + 0x1886d54]
call fcn.00404e34
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.00404e18
push eax
call fcn.00406e88
mov esi, eax
cmp esi, 0xffffffff
je 0x4cfcd7
mov eax, 0x40
call fcn.00402a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00407260
test eax, eax
je 0x4cfcca
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4cfcca
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.004072c0
mov eax, edi
call fcn.00402ab0
mov eax, 0x18
call fcn.00402a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00407260
test eax, eax
je 0x4cfcca
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4cfcca
add eax, 4
cmp byte [ebp - 1], 0
je 0x4cfc6e
cmp word [eax], 0x8664
jne 0x4cfc6e
mov eax, edi
call fcn.00402ab0
mov eax, 0xf0
call fcn.00402a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00407260
test eax, eax
je 0x4cfcca
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4cfcca
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404c04
jmp 0x4cfcca
cmp byte [ebp - 1], 0
jne 0x4cfcca
cmp word [eax], 0x14c
jb 0x4cfcca
cmp word [eax], 0x150
ja 0x4cfcca
mov eax, edi
call fcn.00402ab0
mov eax, 0xe0
call fcn.00402a80
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00407260
test eax, eax
je 0x4cfcca
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4cfcca
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404c04
mov eax, edi
call fcn.00402ab0
push esi
call fcn.00406e40
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404f44
jne 0x4cfcef
inc ebx
cmp ebx, 0x19
jne 0x4cfb21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1859d0c
lea eax, [ebp - 0xc]
inc ebp
hlt
call fcn.00404bc8
ret
Function at 0x4cffc8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.004072c0
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.00407260
test eax, eax
je 0x4d0065
cmp word [esi], 0x5a4d
jne 0x4d0065
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.004072c0
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00407260
test eax, eax
je 0x4d0065
cmp dword [ebp - 0x1c], 0x4550
jne 0x4d0065
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.00407cbc
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0x4d0065
cmp ax, 0x150
ja 0x4d0065
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.00407260
test eax, eax
je 0x4d0065
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d5dcc
Capabilities:
Parse pe header

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
je 0x4d5df4
mov ebx, edx
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4d5df4
add ebx, dword [eax + 0x3c]
mov eax, ebx
cmp dword [eax], 0x4550
jne 0x4d5df4
cmp word [eax + 0x18], 0x20b
sete cl
mov eax, ecx
pop ebx
ret

Function at 0x4d5df8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
test esi, esi
je 0x4d5e51
mov edi, esi
push 0x40
push edi
call fcn.004071d0
test eax, eax
jne 0x4d5e51
cmp word [edi], 0x5a4d
jne 0x4d5e51
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x4d5e51
cmp eax, 0x10000
jge 0x4d5e51
add esi, eax
push 0x120
push esi
call fcn.004071d0
test eax, eax
jne 0x4d5e51
cmp dword [esi], 0x4550
jne 0x4d5e51
mov ax, word [esi + 0x18]
cmp ax, 0x10b
je 0x4d5e4f
cmp ax, 0x20b
jne 0x4d5e51
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4052f3
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x405301
and edx, 0x3fff
jmp fcn.00405265

Function at 0x405306
Capabilities:
Delete directory

Disassembly:
mov eax, 0x43d4f0
call fcn.0043cb80
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00408087
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x405335
push edi
call esi
test eax, eax
je 0x405335
mov al, 1
jmp 0x405379
test ebx, ebx
je 0x405377
lea ecx, [ebp - 0x18]
call fcn.00402bec
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00408190
test al, al
push dword [ebp - 0x18]
je 0x405371
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401c49
test esi, esi
pop ecx
setne al
jmp 0x405379
call fcn.00401c49
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405388
Capabilities:
Move file

Disassembly:
mov eax, 0x43d50c
call fcn.0043cb80
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call fcn.00408087
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.00408087
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp esi, ebx
je 0x4053d1
cmp eax, ebx
je 0x4053d1
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x4053d1
mov al, bl
jmp 0x405448
test esi, esi
jne 0x4053da
cmp dword [ebp - 0x14], esi
je 0x405446
lea ecx, [ebp - 0x30]
call fcn.00402bec
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00402bec
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x4053fa
cmp dword [ebp - 0x14], ebx
jne 0x4053fc
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00408703
test al, al
push dword [ebp - 0x24]
je 0x405437
push dword [ebp - 0x30]
call edi
mov esi, eax
push dword [ebp - 0x24]
call fcn.00401c49
push dword [ebp - 0x30]
call fcn.00401c49
pop ecx
test esi, esi
pop ecx
setne al
jmp 0x405448
call fcn.00401c49
push dword [ebp - 0x30]
call fcn.00401c49
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405553
Capabilities:
Create directory

Disassembly:
mov eax, 0x43d53c
call fcn.0043cb80
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00408087
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x405591
push 0
push edi
call esi
test eax, eax
je 0x405584
mov al, 1
jmp 0x4055da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4055d8
test ebx, ebx
je 0x4055d8
lea ecx, [ebp - 0x18]
call fcn.00402bec
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.00408190
test al, al
je 0x4055cf
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401c49
test esi, esi
pop ecx
setne al
jmp 0x4055da
push dword [ebp - 0x18]
call fcn.00401c49
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret