joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f048
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x46f13d
cmp byte [ebp + 8], 0
je 0x46f085
xor ecx, ecx
inc ecx
mov word [ebp + 8], cx
xor ecx, ecx
push 4
mov word [ebp + 0xa], cx
lea ecx, [ebp + 8]
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test byte [esi + 0xe], 0x20
je 0x46f10f
mov eax, dword [esi + 0x50]
push ebx
xor ebx, ebx
cmp eax, ebx
jge 0x46f0a0
neg eax
mov dword [ebp + 8], eax
jmp 0x46f0a3
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x64]
cmp eax, ebx
jge 0x46f0b1
neg eax
mov dword [ebp - 4], eax
jmp 0x46f0b4
mov dword [ebp - 4], ebx
cmp dword [esi + 0xc0], ebx
push edi
jle 0x46f0e0
lea edi, [esi + 0xac]
cmp dword [edi], 0
je 0x46f0d4
mov eax, dword [ebp + 8]
mov ecx, dword [edi]
cdq
add dword [ecx + 0x28], eax
adc dword [ecx + 0x2c], edx
inc ebx
add edi, 4
cmp ebx, dword [esi + 0xc0]
jl 0x46f0c3
xor ebx, ebx
cmp dword [esi + 0xc0], ebx
jle 0x46f10d
lea edi, [esi + 0xac]
cmp dword [edi], 0
je 0x46f101
mov eax, dword [ebp - 4]
mov ecx, dword [edi]
cdq
add dword [ecx + 0x30], eax
adc dword [ecx + 0x34], edx
inc ebx
add edi, 4
cmp ebx, dword [esi + 0xc0]
jl 0x46f0f0
pop edi
pop ebx
mov ecx, dword [esi + 4]
call fcn.0046e2e0
or dword [esi + 4], 0xffffffff
test byte [esi + 0xe], 0x20
je 0x46f13d
cmp byte [esi + 0x18], 6
jb 0x46f13d
push 2
push 0x40
mov ecx, esi
call fcn.0046de53
push 2
push 0x40
mov ecx, esi
call fcn.0046de34
and byte [esi + 0xe], 0xdf
test byte [esi + 0xe], 0x80
je 0x46f168
lea eax, [esi + 0xc4]
mov esi, dword [eax]
and dword [eax], 0
test esi, esi
je 0x46f168
mov ecx, esi
call fcn.004e3e02
push 0
xor edx, edx
mov ecx, esi
call fcn.004e1de5
pop esi
leave
ret 4
Function at 0x470a36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push esi
mov ecx, 0x549148
call fcn.0046ecfd
push esi
mov ecx, 0x548dc0
call fcn.0046ecfd
push esi
mov ecx, 0x548f1c
call fcn.0046ecfd
push esi
mov ecx, 0x548f8c
call fcn.0046ecfd
push esi
mov ecx, 0x548f54
call fcn.0046ecfd
push esi
mov ecx, 0x548ea0
call fcn.0046ecfd
push esi
mov ecx, 0x5490d8
call fcn.0046ecfd
push esi
mov ecx, 0x548e68
call fcn.0046ecfd
push esi
mov ecx, 0x5491b8
call fcn.0046ecfd
push esi
mov ecx, 0x549110
call fcn.0046ecfd
push esi
mov ecx, 0x548df8
call fcn.0046ecfd
push esi
mov ecx, 0x548e30
call fcn.0046ecfd
push esi
mov ecx, 0x548ed8
call fcn.0046ecfd
push esi
mov ecx, 0x549020
call fcn.0046ecfd
push esi
mov ecx, 0x5490a0
call fcn.0046ecfd
push esi
mov ecx, 0x549180
call fcn.0046ecfd
push esi
mov ecx, 0x549058
call fcn.0046ecfd
pop esi
ret
push ecx
mov eax, dword [0x548a9c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
jmp 0x470a51
mov dword [eax + 0x10], ebp
mov dword [eax + 0x14], ebp
mov eax, dword [eax + 0x38]
cmp eax, ebp
jne 0x470a48
xor edi, edi
cmp dword [0x548f18], ebp
je 0x470af2
mov eax, dword [0x548f10]
mov eax, dword [eax + edi*4]
cmp eax, ebp
je 0x470ae5
test byte [eax + 0xe], 0x20
je 0x470ae5
cmp byte [eax + 0x18], 6
jne 0x470ae5
cmp dword [eax + 0xc0], ebp
je 0x470ae5
mov edx, dword [eax + 0x84]
mov ecx, dword [eax + 0x88]
mov esi, edx
or esi, ecx
je 0x470ab3
cmp dword [0x548aa4], ecx
jl 0x470ab3
jg 0x470aa7
cmp dword [0x548aa0], edx
jb 0x470ab3
mov dword [eax + 0x84], ebp
mov dword [eax + 0x88], ebp
xor esi, esi
cmp dword [eax + 0xc0], ebp
jle 0x470ae5
lea edx, [eax + 0xac]
mov ecx, dword [edx]
mov ebx, dword [eax + 0x60]
add dword [ecx + 0x10], ebx
adc dword [ecx + 0x14], ebp
mov ecx, dword [edx]
mov ebx, dword [eax + 0x60]
add dword [ecx + 0x18], ebx
adc dword [ecx + 0x1c], ebp
inc esi
add edx, 4
cmp esi, dword [eax + 0xc0]
jl 0x470ac3
inc edi
cmp edi, dword [0x548f18]
jne 0x470a63
xor ebx, ebx
cmp dword [0x548f18], ebp
je 0x470b4b
mov eax, dword [0x548f10]
mov esi, dword [eax + ebx*4]
mov al, byte [esi + 0xe]
test al, 0x20
je 0x470b42
and al, 6
xor edi, edi
cmp al, 2
jne 0x470b1f
mov eax, dword [esi + 0x3c]
mov edi, dword [esi + 0x78]
cmp eax, edi
jae 0x470b1f
mov edi, eax
cmp byte [esi + 0x18], 6
mov ecx, esi
sete al
movzx eax, al
push eax
mov eax, dword [esi]
call dword [eax + 0x20]
movzx eax, al
push eax
push dword [esp + 0x18]
lea ecx, [esi + 0x48]
push edi
call fcn.0046eaae
inc ebx
cmp ebx, dword [0x548f18]
jne 0x470afc
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp 0x46edca
Function at 0x471e9e
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
and dword [esp + 0xc], 0
cmp byte [esi], 0
mov edi, eax
mov dword [esp + 8], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
je 0x472046
push ebx
push ebp
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x19
pop esi
call ebx
cmp byte [0x54901c], 0
jne 0x471ee7
call fcn.004b4964
test al, al
je 0x471ef0
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
xor esi, esi
mov ecx, esi
call fcn.0046e225
mov ebp, eax
call fcn.004a3b83
mov dword [0x548aa0], eax
mov dword [0x548aa4], edx
call ebx
mov esi, eax
sub eax, edi
test eax, eax
jle 0x471f19
mov dword [esp + 0x18], eax
jmp 0x471f1e
and dword [esp + 0x18], 0
mov ecx, esi
sub ecx, dword [esp + 0x10]
mov eax, 0x3e8
xor bl, bl
mov edi, esi
cmp ecx, eax
jb 0x471f48
add dword [esp + 0x10], eax
mov eax, esi
sub eax, dword [esp + 0x10]
inc bl
cmp eax, 0x7d0
jb 0x471f48
mov dword [esp + 0x10], esi
call fcn.0046e3c9
mov ecx, ebp
call fcn.00471e52
cmp byte [0x548db8], 0
jne 0x471f6d
call fcn.004e3d14
mov ecx, dword [0x549d98]
call fcn.0049df8d
mov ebp, esi
sub ebp, dword [esp + 0x1c]
cmp ebp, 0x32
jb 0x471fdc
call fcn.004a3b83
mov dword [0x548aa0], eax
xor eax, eax
mov dword [0x548aa4], edx
mov dword [esp + 0x1c], eax
cmp dword [0x548f18], eax
jbe 0x471fbb
mov ecx, dword [0x548f10]
mov ecx, dword [ecx + eax*4]
test byte [ecx + 0xe], 0x20
je 0x471faa
call fcn.00470b5b
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [0x548f18]
jb 0x471f96
mov ecx, ebp
call fcn.0046f77f
mov ecx, ebp
call fcn.0046fb48
mov ecx, dword [esp + 0x18]
movzx eax, bl
cdq
push edx
push eax
mov dword [esp + 0x24], esi
call fcn.0046e468
test bl, bl
je 0x47201c
cmp byte [0x548db8], 0
jne 0x471fee
call fcn.004200d9
mov ecx, esi
sub ecx, dword [esp + 0x20]
call fcn.00470a36
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1e
mov dword [esp + 0x20], esi
jne 0x47201c
call fcn.0046f409
call fcn.004236db
call fcn.004a2e70
and dword [esp + 0x14], 0
mov cl, bl
call fcn.004709dc
mov ecx, dword [esp + 0x18]
movzx eax, bl
cdq
push edx
push eax
call fcn.00471e00
call fcn.0046e3e5
mov eax, dword [esp + 0x24]
cmp byte [eax], 0
jne 0x471eca
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x472219
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47222d
test al, 0x10
jne 0x47222d
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x472230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x472244
test al, 0x10
je 0x472244
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x472575
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push esi
push edi
mov edi, edx
mov esi, 0x104
test ecx, ecx
jne 0x47259f
lea eax, [ebp - 0x618]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea ecx, [ebp - 0x618]
lea eax, [ebp - 0x208]
push eax
push 0
push 0x504344
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x4725d9
call sub.MSVCRT.dll_rand
push eax
call sub.MSVCRT.dll_rand
push eax
push str.c:_u_u.tmp
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0048d35b
add esp, 0x14
test edi, edi
je 0x47261e
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4725e2
sub eax, edx
sar eax, 1
mov ecx, 0x103
sub ecx, eax
push ecx
lea edx, [ebp - 0x208]
lea ecx, [ebp - 0x410]
call fcn.004225b2
mov eax, edi
lea ecx, [ebp - 0x410]
call fcn.004720ae
lea ecx, [ebp - 0x410]
jmp 0x472624
lea ecx, [ebp - 0x208]
call fcn.00422199
pop edi
pop esi
leave
ret

Function at 0x4726be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x10]
mov edi, edx
push dword [ebp + 0xc]
mov ebx, ecx
call fcn.00472183
test eax, eax
jne 0x47270e
push esi
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4726f4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x47270d
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x47270b
sub esi, eax
push esi
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x4727e8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
mov eax, edx
push esi
mov ebx, ecx
push edi
mov edx, 0x50434c
mov ecx, eax
call fcn.004a307f
mov esi, eax
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dl, 1
mov ecx, esi
mov edi, eax
call fcn.0046b197
cmp edi, 0xffffffff
je 0x472869
cmp byte [ebp + 8], 0
jne 0x472834
cmp word [ebp - 0x224], 0x2e
je 0x472850
lea ecx, [ebp - 0x224]
call fcn.00422199
push 4
mov ecx, ebx
mov esi, eax
call fcn.0048eeeb
test eax, eax
je 0x472850
mov dword [eax], esi
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x472824
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x472935
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x148
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 4]
mov ecx, ebx
mov dword [edi], 0x504354
call fcn.0044502c
lea ecx, [edi + 8]
call fcn.0044502c
lea ecx, [edi + 0xc]
call fcn.0044502c
lea ecx, [edi + 0x10]
call fcn.0044502c
lea eax, [ebp - 0xd0]
push eax
mov dword [ebp - 0xd0], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x472a48
push dword [ebp - 0xc4]
lea eax, [ebp + 0x70]
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
push str._d._d._d
push eax
call fcn.0048ee07
movzx eax, byte [ebp + 0x4a]
add esp, 0x14
dec eax
mov esi, str.unknown
je 0x4729d8
dec eax
je 0x4729cf
dec eax
je 0x4729c6
mov dword [ebp + 0x74], esi
jmp 0x4729df
mov dword [ebp + 0x74], str.server
jmp 0x4729df
mov dword [ebp + 0x74], str.domaincontroller
jmp 0x4729df
mov dword [ebp + 0x74], str.workstation
push str.Windows
mov ecx, ebx
call fcn.0048e740
push dword [ebp + 0x74]
lea ecx, [edi + 8]
call fcn.0048e740
push dword [ebp + 0x70]
lea ecx, [edi + 0xc]
call fcn.0048e740
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
movzx eax, word [ebp + 0x4c]
test eax, eax
je 0x472a31
cmp eax, 6
je 0x472a2a
lea ecx, [edi + 0x10]
cmp eax, 9
je 0x472a23
push esi
jmp 0x472a39
push str.amd64
jmp 0x472a39
push str.itanium
jmp 0x472a36
push 0x504358
lea ecx, [edi + 0x10]
call fcn.0048e740
lea ecx, [ebp + 0x70]
call fcn.0048e50a
jmp 0x472a7f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.0042ebe6
add esp, 4
mov esi, str.unknown
push esi
mov ecx, ebx
call fcn.0048e740
push esi
lea ecx, [edi + 8]
call fcn.0048e740
push esi
lea ecx, [edi + 0xc]
call fcn.0048e740
push esi
lea ecx, [edi + 0x10]
call fcn.0048e740
lea ecx, [edi + 0x10]
call fcn.0048e720
push eax
lea ecx, [edi + 0xc]
call fcn.0048e720
push eax
lea ecx, [edi + 8]
call fcn.0048e720
push eax
mov ecx, ebx
call fcn.0048e720
push eax
call fcn.0042ebe6
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x475d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x10c
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x238]
push edi
mov dword [ebp + 0x74], esi
call fcn.00473f7e
mov esi, dword [esi + 0x10c]
push 5
pop ecx
mov dword [ebp + 0x5c], 0x32716572
lea edi, [ebp + 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x94]
call fcn.004e64ac
push 0x18
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x94]
call fcn.004e7793
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0xc]
rep movsd dword es:[edi], dword [esi]
push 5
pop ecx
mov esi, ebx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor eax, eax
mov ecx, dword [ebx + eax + 0x14]
xor dword [ebp + eax - 0xc], ecx
add eax, 4
cmp eax, 0x14
jb 0x475da3
mov al, byte [0x5373bd]
mov esi, dword [ebp + 0x74]
shr al, 2
not al
and al, 1
or al, 2
mov dword [ebp + 0x10], edi
mov byte [ebp + 0x13], al
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
mov byte [ebx], al
push dword [esi + 0x10c]
xor eax, eax
mov word [ebp + 0x14], ax
mov eax, 0x4400
mov word [ebp + 0x16], ax
lea eax, [ebp + 0x18]
push eax
mov ecx, esi
call fcn.00473f2e
push 0x14
push dword [esi + 0x10c]
mov ecx, esi
call fcn.00475c67
lea eax, [ebp + 8]
push eax
push eax
push 0x54
lea eax, [ebx + 9]
push eax
call fcn.00484918
lea eax, [ebx + 1]
push eax
push eax
mov dword [ebx + 5], edi
push 8
add ebx, 0x10b
push ebx
mov dword [eax], edi
call fcn.00484918
push edi
push 0x7c
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0047032d
lea ecx, [ebp - 0x94]
call fcn.004e64d1
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x477fab
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xac
push ebx
push esi
mov esi, dword [ebp + 0x7c]
mov ebx, ecx
mov edx, dword [ebx + 0x238]
push edi
mov dword [ebp + 0x6c], edx
push 5
lea eax, [esi + 0x14]
sub edx, esi
lea ecx, [ebp + 0x3c]
pop esi
mov edi, dword [edx + eax]
xor edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
dec esi
jne 0x477fd2
and dword [ebp + 0x70], esi
cmp dword [0x549c00], esi
je 0x478043
mov eax, dword [0x549bf8]
mov ecx, dword [ebp + 0x70]
mov esi, dword [eax + ecx*4]
push 5
pop ecx
mov dword [ebp + 0x50], 0x32716572
lea edi, [ebp + 0x54]
mov dword [ebp + 0x68], esi
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x38]
call fcn.004e64ac
push 0x18
lea eax, [ebp + 0x50]
push eax
lea ecx, [ebp - 0x38]
call fcn.004e7793
push eax
lea ecx, [ebp + 0x3c]
call fcn.004078c3
lea ecx, [ebp - 0x38]
test al, al
jne 0x47804d
call fcn.004e64d1
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [0x549c00]
jne 0x477fed
push str.No_such_torrent
jmp 0x4780d7
call fcn.004e64d1
push 0x14
push dword [ebp + 0x68]
mov ecx, ebx
call fcn.00475c67
mov edi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x6c]
and dword [ebx + 0xa4], 0
lea esi, [edi + 0x28]
push esi
push esi
add eax, 9
push 0xe
mov dword [ebx + 0xa0], eax
or byte [ebx + 0xe], 0x40
push eax
call fcn.00484918
mov ax, word [edi + 0x34]
rol ax, 8
cmp dword [esi], 0
movzx edx, ax
jne 0x4780d2
cmp dword [edi + 0x2c], 0
jne 0x4780d2
cmp edx, 0x200
ja 0x4780d2
mov al, byte [edi + 0x33]
mov ecx, dword [ebp + 0x6c]
mov byte [ecx], al
test al, 2
je 0x4780c1
test byte [0x5373bd], 4
jne 0x4780bc
test al, 1
jne 0x4780c1
mov byte [ecx], 2
jmp 0x4780c5
and al, 1
mov byte [ecx], al
add edx, 2
mov dword [ebx + 0x1ec], edx
mov al, 1
jmp 0x4780e0
push str.Error_in_DH_header_3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
xor al, al
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4

Function at 0x47f5ba
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
inc dword [esi + 0xbc]
mov eax, dword [esi + 0xbc]
cmp eax, dword [esi + 0xb8]
jb 0x47f5d5
xor al, al
pop esi
ret
push edi
lea edi, [esi + 0x98]
mov ecx, dword [edi]
call fcn.00447ca6
and dword [edi], 0
lea ecx, [esi + 0x9c]
call fcn.004720fd
lea edi, [esi + 0xa0]
mov ecx, edi
call fcn.0048e806
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, edi
call fcn.0048e540
mov ecx, dword [esi + 0xbc]
imul ecx, ecx, 0x1c
add ecx, dword [esi + 0xb0]
call fcn.0048e720
push eax
mov ecx, esi
call fcn.004835f9
pop edi
mov al, 1
pop esi
ret
Function at 0x484918
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x4849a0
push ebp
push ebx
push esi
push edi
push eax
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
movzx eax, byte [ebp]
movzx ebx, byte [ebp + 1]
mov edi, dword [esp + 0x24]
inc al
add ebp, 2
lea edx, [edx + esi - 1]
mov dword [esp], edx
movzx ecx, byte [ebp + eax]
sub edi, esi
jmp 0x484958
add ebx, ecx
and ebx, 0xff
movzx edx, byte [ebp + ebx]
mov byte [ebp + ebx], cl
mov byte [ebp + eax], dl
add edx, ecx
and edx, 0xff
movzx edx, byte [ebp + edx]
add eax, 1
and eax, 0xff
xor dl, byte [esi]
movzx ecx, byte [ebp + eax]
cmp esi, dword [esp]
mov byte [esi + edi], dl
lea esi, [esi + 1]
jb 0x484958
dec eax
pop ecx
mov byte [ebp - 1], bl
mov byte [ebp - 2], al
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4875a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp dword [0x54977c], ebx
je 0x487612
push esi
mov dword [ebp - 8], ebx
push edi
mov eax, dword [0x549774]
mov ecx, dword [ebp - 8]
lea edi, [ecx + eax]
cmp dword [edi + 0x24], ebx
je 0x4875fe
mov dword [ebp - 4], ebx
mov esi, dword [edi + 0x1c]
add esi, dword [ebp - 4]
push dword [edi + 0x10]
mov edx, dword [esi + 8]
mov ecx, dword [esi + 4]
call fcn.0048682e
add dword [ebp - 4], 0x54
add al, al
xor al, byte [esi + 0x3c]
and al, 2
xor byte [esi + 0x3c], al
inc ebx
cmp ebx, dword [edi + 0x24]
jne 0x4875d4
xor ebx, ebx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], 0x2c
cmp eax, dword [0x54977c]
jne 0x4875c1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x490cfc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [0x54bc15], 0
mov byte [ebp - 4], dl
mov dword [ebp - 0xc], ecx
jne 0x490d15
xor eax, eax
leave
ret
push ebx
push esi
lea ecx, [ebp - 8]
call fcn.0048fc38
mov ecx, eax
call fcn.0048e806
mov ecx, eax
call fcn.00472230
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 8]
inc bl
call fcn.0048e50a
test bl, bl
je 0x490d7f
push 0
lea ecx, [ebp - 8]
call fcn.0048fc38
mov ecx, eax
call fcn.0048e806
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.0048e50a
test esi, esi
jne 0x490d7f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x490d7f
test eax, eax
je 0x490d7f
xor eax, eax
jmp 0x490ef1
cmp byte [ebp - 0xc], 0
mov eax, dword [0x548aa4]
mov ecx, dword [0x548aa0]
mov edx, dword [0x549b18]
jne 0x490db0
cmp byte [ebp - 4], 0
jne 0x490dc2
cmp eax, dword [0x549a34]
jg 0x490db6
jl 0x490dba
cmp ecx, dword [0x549a30]
jae 0x490db6
jmp 0x490dba
cmp byte [ebp - 4], 0
jne 0x490dc2
test edx, edx
je 0x490dc2
push 2
pop eax
jmp 0x490ef1
add ecx, 0x258
push 0
pop esi
adc eax, esi
mov dword [0x549a30], ecx
mov dword [0x549a34], eax
cmp edx, esi
je 0x490dec
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x549b18], esi
jne 0x490ddc
call fcn.0046e3c9
lea ecx, [ebp - 0x34]
call fcn.00406e8a
lea ecx, [ebp - 0x34]
call fcn.00484c94
call fcn.0046e3e5
push str.global_resume.dat
lea ecx, [ebp - 8]
call fcn.0048e7e6
lea edx, [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.0048fc51
lea ecx, [ebp - 8]
call fcn.0048e50a
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x34]
xor bl, bl
call fcn.0048fc8b
test eax, eax
jne 0x490e39
inc bl
cmp dword [0x549c00], 0
push edi
mov edi, 0x4f2330
je 0x490ed6
call fcn.0046e3c9
lea ecx, [ebp - 0x24]
call fcn.00406e8a
mov eax, dword [0x549bf8]
push dword [eax + esi*4]
lea eax, [ebp - 0x14]
push str._H.dat
push eax
call fcn.0048ee25
add esp, 0xc
mov edx, eax
lea ecx, [ebp - 8]
call fcn.0048fc51
lea ecx, [ebp - 0x14]
call fcn.0048e50a
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x549bf8]
mov ecx, dword [eax + esi*4]
call fcn.00413b27
call fcn.0046e3e5
lea edx, [ebp - 8]
lea ecx, [ebp - 0x24]
call fcn.0048fc8b
test eax, eax
jne 0x490eae
mov bl, 1
lea ecx, [ebp - 0x24]
call fcn.0040680c
lea ecx, [ebp - 8]
call fcn.0048e50a
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], edi
call fcn.0040674f
inc esi
cmp esi, dword [0x549c00]
jne 0x490e4c
lea ecx, [ebp - 0x10]
call fcn.0048e50a
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], edi
call fcn.0040674f
xor eax, eax
test bl, bl
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x499ccd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x44]
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x499ce4
sub eax, edi
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, 0xbb7
sub eax, edi
push eax
lea eax, [ebx + edi]
push eax
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
mov eax, dword [ebp - 8]
je 0x499d19
mov byte [ebp - 1], 1
test eax, eax
jne 0x499d1d
mov byte [ebp - 1], 0
add edi, eax
mov byte [edi + esi + 0x44], 0
mov eax, dword [ebp - 8]
add dword [esi + 0xc], eax
push 0xa
push ebx
adc dword [esi + 0x10], 0
call sub.MSVCRT.dll_strchr
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x499d4f
push 0xd
push ebx
call sub.MSVCRT.dll_strchr
pop ecx
pop ecx
mov edi, eax
jmp 0x499e17
mov eax, edi
sub eax, esi
sub eax, 0x44
push eax
push 0
push ebx
lea ecx, [ebp - 0xc]
call fcn.0048e6d2
jmp 0x499d69
cmp al, 0x20
jae 0x499d6f
inc edi
mov al, byte [edi]
test al, al
jne 0x499d64
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x499d74
sub eax, ecx
inc eax
push eax
push edi
push ebx
call sub.MSVCRT.dll_memmove
push 0xa
push ebx
call sub.MSVCRT.dll_strchr
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x499da5
push 0xd
push ebx
call sub.MSVCRT.dll_strchr
pop ecx
mov edi, eax
pop ecx
test edi, edi
setne al
movzx eax, al
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [esi + 0x34]
call fcn.00440a1a
lea ecx, [esi + 0x34]
call fcn.004406e5
fmul qword [0x4f4d18]
call fcn.00401030
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
test eax, eax
je 0x499e0f
xor ecx, ecx
call fcn.0046be79
mov ecx, eax
mov eax, dword [ebp + 8]
sub ecx, dword [eax + 0x14]
sbb edx, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
fild qword [ebp - 0x14]
lea ecx, [esi + 0x34]
fstp qword [ebp - 0x1c]
call fcn.004406e5
fdiv qword [0x4f23e8]
fdivr qword [ebp - 0x1c]
call fcn.00401030
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0xc]
call fcn.0048e50a
test edi, edi
jne 0x499d4f
cmp byte [ebp - 1], 0
jne 0x499cdf
pop edi
pop esi
pop ebx
leave
ret 4