joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4881d8
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2b0
push ebx
push esi
mov byte [ebp - 1], al
mov dword [0x4c98a4], 1
test dl, dl
je 0x48835f
lea eax, [ebp - 0x410]
mov edx, 0x400
call fcn.00464700
lea eax, [ebp - 0x410]
call fcn.0040c35c
lea edx, [ebp - 0x410]
lea ecx, [ebp - 0x810]
push edx
push str._sRar_
push ecx
call fcn.0049bdcc
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetSystemTimeAsFileTime
lea edx, [ebp - 0x950]
push edx
lea ecx, [ebp - 0x810]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp eax, 0xffffffff
sete al
and eax, 1
jmp 0x488348
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x410]
sub edx, dword [ebp - 0x948]
push eax
cmp edx, 8
lea edx, [ebp - 0xd50]
setae bl
and ebx, 1
push edx
call fcn.00498e7c
add esp, 8
lea ecx, [ebp - 0x924]
push ecx
lea eax, [ebp - 0xd50]
push eax
call fcn.00498da0
add esp, 8
test byte [ebp - 0x950], 0x10
je 0x48831a
push 6
push str.Rar_DI
lea edx, [ebp - 0x924]
push edx
call fcn.00498f08
add esp, 0xc
test eax, eax
jne 0x4882c5
call fcn.004107bc
cmp eax, 4
jne 0x4882c9
xor ecx, ecx
jmp 0x4882ce
mov ecx, 1
mov byte [ebp - 0xd], cl
lea eax, [ebp - 0xd50]
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
jne 0x488333
test bl, bl
je 0x4882eb
cmp byte [ebp - 1], 0
je 0x4882f1
cmp byte [ebp - 0xd], 0
je 0x488333
lea eax, [ebp - 0xd50]
call fcn.004644f8
test al, al
je 0x488333
lea eax, [ebp - 0xd50]
xor edx, edx
call fcn.0040ac64
lea eax, [ebp - 0xd50]
call fcn.00463ca0
jmp 0x488333
lea eax, [ebp - 0xd50]
xor edx, edx
call fcn.0040ac64
lea ecx, [ebp - 0xd50]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x950]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
sete al
and eax, 1
test eax, eax
jne 0x488359
cmp dword [0x4c98a4], 1
je 0x48825a
push esi
call sub.KERNEL32.DLL_FindClose
cmp byte [ebp - 1], 0
jne 0x48839c
cmp byte [0x4b41ac], 0
je 0x48839c
push 0
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
mov al, 1
call fcn.004883ac
mov byte [0x4b41ac], al
cmp byte [0x4b41ac], 0
jne 0x48839c
mov eax, 0x4af1b4
xor edx, edx
call fcn.004437e0
xor ecx, ecx
mov dword [0x4c98a4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488548
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff7d0
push ebx
cmp dword [0x4c988c], 0
je 0x4886f6
lea edx, [ebp - 0x404]
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d7c
mov edx, str.History
mov eax, 0x4aed2d
mov ecx, 1
call fcn.00461bc4
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x4885b7
push 0x4ae7a0
push 0x400
lea ecx, [ebp - 0x804]
mov edx, str.SaveArcFolder
mov eax, str.InterfaceMisc
call fcn.004619ec
cmp byte [ebp - 0x804], 0
jne 0x4885cb
lea eax, [ebp - 0x804]
call fcn.00463c28
lea edx, [ebp - 0x804]
push edx
lea ecx, [ebp - 0x1008]
push ecx
call fcn.00498e7c
add esp, 8
lea eax, [ebp - 0x1008]
call fcn.0040c35c
lea eax, [ebp - 0x404]
call fcn.0040be48
push eax
lea edx, [ebp - 0x1008]
push edx
call fcn.00498da0
add esp, 8
push 0
push 1
mov eax, 0x5af
call fcn.004129c8
mov edx, eax
lea ecx, [ebp - 0x1008]
mov eax, dword [0x4c6eec]
call fcn.0044dbd0
test al, al
je 0x4886f6
lea edx, [ebp - 0x804]
lea eax, [ebp - 0x1008]
mov ecx, 0x400
call fcn.0040c3a4
test bl, bl
je 0x48865e
lea ecx, [ebp - 0x804]
mov edx, str.SaveArcFolder
mov eax, str.InterfaceMisc
call fcn.004617c8
lea eax, [ebp - 0x404]
push eax
call fcn.00498eac
pop ecx
lea edx, [ebp - 0x1008]
mov byte [ebp + eax - 0x403], 0
push edx
call fcn.00498eac
pop ecx
mov byte [ebp + eax - 0x1007], 0
push 0x1e
push 0
lea ecx, [ebp - 0x1830]
push ecx
call fcn.00498cfc
mov dword [ebp - 0x182c], 2
add esp, 0xc
lea eax, [ebp - 0x404]
mov dword [ebp - 0x1828], eax
lea edx, [ebp - 0x1008]
mov dword [ebp - 0x1824], edx
lea ecx, [ebp - 0x1830]
push ecx
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
je 0x4886f6
push dword [ebp - 0x1824]
push dword [ebp - 0x1828]
mov eax, 0x5b0
call fcn.004129c8
push eax
call fcn.00487828
add esp, 0xc
mov eax, 0x4b3b9c
call fcn.0042dd14
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f732
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
mov eax, edx
call fcn.0048f89c
push 0xc
push ebx
lea edx, [ebp - 0xc]
push edx
call fcn.00498c8c
add esp, 0xc
xor ebx, ebx
call fcn.0048f800
xor byte [ebp + ebx - 0xc], al
mov al, byte [ebp + ebx - 0xc]
and eax, 0xff
call fcn.0048f824
inc ebx
cmp ebx, 0xc
jl 0x48f754
mov edx, dword [0x4d7e18]
xor eax, eax
mov al, byte [ebp - 1]
test byte [edx + 0x28], 2
je 0x48f78e
movzx ecx, word [0x4e7e7e]
sar ecx, 8
jmp 0x48f79a
mov ecx, dword [0x4e7e84]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x48f7a6
or eax, 0xffffffff
jmp 0x48f7fa
mov eax, dword [0x4e7e2c]
cdq
cmp edx, dword [0x4d72f0]
jne 0x48f7bf
cmp eax, dword [0x4d72ec]
jbe 0x48f7cb
jmp 0x48f7c1
jle 0x48f7cb
mov eax, dword [0x4d72ec]
mov ebx, eax
jmp 0x48f7d3
mov eax, dword [0x4e7e2c]
mov ebx, eax
mov esi, dword [0x4e7e28]
jmp 0x48f7ef
call fcn.0048f800
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0048f824
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x48f7db
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f824
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x4e8144]
xor edx, eax
and edx, 0xff
mov ecx, dword [edx*4 + 0x4b5aec]
mov edx, dword [0x4e8144]
shr edx, 8
xor ecx, edx
mov dword [0x4e8144], ecx
mov ecx, dword [0x4e8144]
and ecx, 0xff
add dword [0x4e8148], ecx
imul edx, dword [0x4e8148], 0x8088405
inc edx
mov dword [0x4e8148], edx
mov edx, dword [0x4e8148]
shr edx, 0x18
xor edx, dword [0x4e814c]
and edx, 0xff
mov ecx, dword [edx*4 + 0x4b5aec]
mov edx, dword [0x4e814c]
shr edx, 8
xor ecx, edx
mov dword [0x4e814c], ecx
ret

Function at 0x48fbc9
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, 0x4e81c8
push ebx
mov ecx, dword [edx]
mov ebx, dword [edx]
xor ecx, eax
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4b5aec]
xor ecx, ebx
mov dword [edx], ecx
mov ecx, dword [edx]
and ecx, 0xff
add dword [edx + 4], ecx
imul ecx, dword [edx + 4], 0x8088405
inc ecx
mov dword [edx + 4], ecx
mov ecx, dword [edx + 4]
mov ebx, dword [edx + 8]
shr ecx, 0x18
xor ecx, dword [edx + 8]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [ecx*4 + 0x4b5aec]
xor ecx, ebx
mov dword [edx + 8], ecx
pop ebx
ret

Function at 0x48fd3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x4bd658], 0
je 0x48fd81
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
test esi, esi
je 0x48fd81
call fcn.0048fba8
mov edi, eax
xor eax, eax
mov al, byte [ebx]
call fcn.0048fbc9
mov edx, edi
dec esi
xor dl, byte [ebx]
mov byte [ebx], dl
inc ebx
test esi, esi
jne 0x48fd65
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0049b1c4
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48fed3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 0x4e81ec
mov edi, 0x4e81e4
xor ebx, ebx
mov dword [0x4e81e8], 2
jmp 0x49007e
mov eax, dword [0x4afcc0]
mov edx, dword [esi]
xor ecx, ecx
mov cl, byte [eax + edx + 2]
mov eax, dword [edi]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [edi], ecx
mov edx, dword [0x4e81d4]
mov ecx, dword [edi]
movzx eax, word [edx + ecx*2]
mov dword [ebp - 4], eax
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4afcc4]
mov word [ecx + edx*2], ax
mov eax, dword [0x4e81d4]
mov edx, dword [edi]
mov cx, word [esi]
mov word [eax + edx*2], cx
cmp dword [ebp - 4], 0
je 0x48ff6a
mov eax, dword [esi]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0x48ff6a
mov eax, dword [ebp - 4]
call fcn.004902f0
mov ebx, eax
cmp ebx, dword [0x4e81f8]
jbe 0x48ff6a
mov ebx, dword [0x4e81f8]
cmp ebx, 3
jb 0x49001f
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4e81f0]
call fcn.00491fa0
sub dword [0x4e81f8], ebx
cmp ebx, dword [0x4e8200]
ja 0x48ffef
dec ebx
inc dword [esi]
mov edx, dword [esi]
mov ecx, dword [0x4afcc0]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov edx, dword [edi]
mov ecx, dword [0x4e81d4]
movzx ecx, word [ecx + edx*2]
mov dword [ebp - 4], ecx
push ecx
mov edx, dword [esi]
mov ecx, dword [0x4afcc4]
and edx, 0x7fff
dec ebx
lea ecx, [ecx + edx*2]
pop edx
mov word [ecx], dx
mov ecx, dword [edi]
mov edx, dword [0x4e81d4]
lea ecx, [edx + ecx*2]
mov dx, word [esi]
mov word [ecx], dx
jne 0x48ff94
inc dword [esi]
jmp 0x49003a
add dword [esi], ebx
xor ebx, ebx
mov edx, dword [0x4afcc0]
mov ecx, dword [esi]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ecx, dword [0x4afcc0]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 1]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x49003a
mov eax, dword [0x4afcc0]
mov ecx, dword [esi]
xor edx, edx
mov dl, byte [eax + ecx]
xor eax, eax
call fcn.00491fa0
dec dword [0x4e81f8]
inc dword [esi]
test eax, eax
je 0x49006d
mov edx, dword [esi]
sub edx, dword [0x4e81dc]
cmp dword [0x4e81dc], 0
jl 0x49005c
mov eax, dword [0x4afcc0]
add eax, dword [0x4e81dc]
jmp 0x49005e
xor eax, eax
xor ecx, ecx
call fcn.00491dbc
mov edx, dword [esi]
mov dword [0x4e81dc], edx
cmp dword [0x4e81f8], 0x106
jae 0x49007e
call fcn.0048fda0
cmp dword [0x4e81f8], 0
jne 0x48fef5
mov edx, dword [esi]
sub edx, dword [0x4e81dc]
cmp dword [0x4e81dc], 0
jl 0x4900a9
mov eax, dword [0x4afcc0]
add eax, dword [0x4e81dc]
jmp 0x4900ab
xor eax, eax
mov ecx, 1
call fcn.00491dbc
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4900bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov esi, 0x4e81e4
cmp ebx, 1
jl 0x4900d2
cmp ebx, 9
jle 0x4900dc
mov eax, 0x4afd18
call fcn.00493fd4
xor edx, edx
mov dword [0x4e81e0], edx
cmp dword [0x4e81d8], 0
jne 0x490101
mov dword [0x4e81e0], 1
mov dword [0x4e81d8], 0x10000
cmp dword [0x4afcc0], 0
jne 0x490140
push 2
push 0x8000
call fcn.0049748c
add esp, 8
mov dword [0x4afcc0], eax
cmp dword [0x4afcc0], 0
jne 0x490140
mov eax, 0x4b3b9c
call fcn.0042db00
mov edx, 0x4afd18
mov eax, 4
call fcn.00493e3c
cmp dword [0x4afcc4], 0
jne 0x4901a3
push 2
push 0x8000
call fcn.0049748c
add esp, 8
mov dword [0x4afcc4], eax
push 2
push 0x8000
call fcn.0049748c
add esp, 8
mov dword [0x4e81d4], eax
cmp dword [0x4afcc4], 0
je 0x490183
cmp dword [0x4e81d4], 0
jne 0x4901a3
mov eax, 0x1ff
call fcn.004129c8
push eax
call fcn.00487828
pop ecx
mov edx, 0x4afd18
mov eax, 4
call fcn.00493e3c
mov edx, dword [0x4e81d4]
mov word [edx + 0xfffe], 0
push 0xfffe
push 0
push dword [0x4e81d4]
call fcn.00498cfc
movzx ecx, word [ebx*8 + 0x4afcca]
mov dword [0x4e8200], ecx
add esp, 0xc
movzx eax, word [ebx*8 + 0x4afcc8]
mov dword [0x4e8204], eax
cmp ebx, 2
movzx edx, word [ebx*8 + 0x4afccc]
mov dword [0x4e8208], edx
movzx ecx, word [ebx*8 + 0x4afcce]
mov dword [0x4e81fc], ecx
jg 0x490209
or word [edi], 4
jmp 0x490212
cmp ebx, 8
jl 0x490212
or word [edi], 2
xor eax, eax
xor edx, edx
mov dword [0x4e81ec], eax
mov ebx, 0x8000
mov dword [0x4e81dc], edx
add ebx, ebx
mov edx, ebx
mov eax, dword [0x4afcc0]
call dword [0x4b01d8]
mov dword [0x4e81f8], eax
cmp dword [0x4e81f8], 0
je 0x49024c
cmp dword [0x4e81f8], 0xffffffff
jne 0x490260
mov dword [0x4e81f4], 1
xor ecx, ecx
mov dword [0x4e81f8], ecx
jmp 0x49029d
xor eax, eax
mov dword [0x4e81f4], eax
cmp dword [0x4e81f8], 0x106
jae 0x490278
call fcn.0048fda0
xor edx, edx
xor ebx, ebx
mov dword [esi], edx
mov edx, dword [0x4afcc0]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x49027e
pop edi
pop esi
pop ebx
ret
Function at 0x4986d8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x499ef4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x499f10
call fcn.0049b650
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x499f2c
test bl, 1
je 0x499f2c
call fcn.0049f71c
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x49a110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0049b20c
test byte [ebp + 0xd], 0xc0
jne 0x49a134
mov eax, dword [0x4b0ce0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x49a141
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x49a16e
je 0x49a180
sub ecx, 0x100
je 0x49a18e
sub ecx, 0x100
je 0x49a195
sub ecx, 0x100
je 0x49a187
jmp 0x49a19c
sub ecx, 0x600
je 0x49a195
sub ecx, 0x100
je 0x49a180
jmp 0x49a19c
mov edi, 1
jmp 0x49a1a1
mov edi, 2
jmp 0x49a1a1
mov edi, 4
jmp 0x49a1a1
mov edi, 5
jmp 0x49a1a1
mov edi, 3
test byte [ebp + 0xd], 1
je 0x49a1c8
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4b0758]
test al, 0x80
je 0x49a1c1
mov ebx, 0x80
jmp 0x49a1da
mov ebx, 1
jmp 0x49a1da
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x49a1da
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x49a1ec
je 0x49a1f5
dec eax
je 0x49a1fe
jmp 0x49a207
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x49a216
mov dword [ebp - 4], 0x40000000
jmp 0x49a216
mov dword [ebp - 4], 0xc0000000
jmp 0x49a216
push 1
call fcn.0049b5e4
pop ecx
mov ebx, eax
jmp 0x49a302
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x49a232
sub eax, 0x10
je 0x49a239
sub eax, 0x10
je 0x49a242
sub eax, 0x10
je 0x49a24b
jmp 0x49a24b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x49a252
mov dword [ebp - 8], 1
jmp 0x49a252
mov dword [ebp - 8], 2
jmp 0x49a252
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x49a2bb
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x49a2b0
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x49a2b0
add ebx, 0xffffffb2
push ebx
call fcn.0049b5e4
pop ecx
mov ebx, eax
jmp 0x49a302
mov edi, esi
push edi
call fcn.0049a074
pop ecx
test eax, eax
je 0x49a2cf
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x49a2db
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0049b30c
add esp, 8
mov ebx, eax
inc eax
jne 0x49a302
push 4
call fcn.0049b5e4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0049b240
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a80c
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x49a828
call fcn.0049b650
jmp 0x49a897
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x49a844
call fcn.0049b650
jmp 0x49a897
cmp dword [0x4ec110], 1
je 0x49a895
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0049f5f0
pop ecx
cmp al, 0x41
jl 0x49a895
cmp al, 0x5a
jg 0x49a895
cmp byte [ebp - 0x107], 0x3a
jne 0x49a895
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x49a895
call fcn.0049b650
jmp 0x49a897
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49f6b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x49f716
call fcn.0049f664
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00498eac
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00498eac
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49f794
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4b1c38], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x49f86e
cmp dword [0x4b1c34], 0
jne 0x49f86e
cmp dword [0x4b1e60], 0
je 0x49f828
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0049f598
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49f80e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0049f598
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49f80e
lea ebx, [ebp - 0x84]
jmp 0x49f80f
inc ebx
call fcn.0049f750
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x49f8a9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4b1c3c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00498eac
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4b1c3f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x49f8a9
cmp dword [0x4b1c34], 0
je 0x49f888
cmp dword [0x4b1c34], 0xffffffff
je 0x49f8a9
push esi
call dword [0x4b1c34]
pop ecx
mov eax, dword [0x4b1c38]
test eax, eax
je 0x49f8a9
cmp dword [0x4b1c38], 0xffffffff
je 0x49f8a9
cmp byte [eax], 0
je 0x49f8a9
push esi
push eax
call fcn.0049f6b4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1034
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x4a105a
test esi, esi
je 0x4a105a
call fcn.0049f71c
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x4a10cc
call fcn.004a0d4c
mov ebx, eax
test eax, eax
jne 0x4a1075
call fcn.0049f71c
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x4a10cc
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x4a0f90
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x4a10c0
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x4a10b9
push 0x59
call fcn.0049b5e4
pop ecx
jmp 0x4a10cc
call fcn.0049b650
jmp 0x4a10cc
mov dword [ebx + 8], eax
test edi, edi
je 0x4a10cc
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6c508d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
jmp 0x6c50a0
movzx ebx, byte [eax]
movzx edx, byte [eax + 1]
movzx edi, byte [eax + 5]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 2]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 6]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 7]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 4]
movzx edi, byte [eax + 9]
mov dword [ebp - 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xa]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xb]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 8]
movzx edi, byte [eax + 0xd]
mov dword [ebp - 0x10], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
xor ebx, dword [ecx]
shl edx, 8
xor edx, edi
mov edi, dword [ebp - 0x10]
shl edx, 8
xor edx, eax
xor edx, dword [ecx + 0xc]
shr edi, 8
mov dword [ebp - 0x14], edx
shr edx, 0x10
mov eax, 0xff
and edx, eax
mov edx, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
and edi, eax
xor edx, dword [edi*4 + reloc.KERNEL32_GetModuleHandleA]
mov edi, ebx
shr edi, 0x18
xor edx, dword [edi*4 + reloc.KERNEL32_GetModuleHandleA]
mov edi, dword [ebp - 4]
and edi, eax
xor edx, dword [edi*4 + reloc.KERNEL32_GetModuleHandleA]
mov edi, ebx
xor edx, dword [ecx + 0x10]
shr edi, 0x10
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, eax
and edi, eax
mov dword [ebp - 8], edi
mov edi, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
mov edx, dword [ebp - 8]
xor edi, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
mov edx, dword [ebp - 4]
shr edx, 0x18
xor edi, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
and edx, eax
xor edi, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
mov edx, dword [ebp - 4]
shr edx, 0x10
shr ebx, 8
and edx, eax
mov edx, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
and ebx, eax
xor edx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
mov ebx, dword [ebp - 0x10]
shr ebx, 0x18
xor edx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
mov ebx, dword [ebp - 0x14]
and ebx, eax
xor edx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
mov ebx, dword [ebp - 4]
xor edx, dword [ecx + 0x18]
xor edi, dword [ecx + 0x14]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
shr edx, 0x10
shr ebx, 8
and edx, eax
mov edx, dword [edx*4 + reloc.KERNEL32_GetModuleHandleA]
and ebx, eax
xor edx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
mov ebx, dword [ebp - 0x14]
shr ebx, 0x18
xor edx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
mov ebx, dword [ebp - 0x18]
and ebx, eax
xor edx, dword [ebx*4 + reloc.KERNEL32_GetModuleHandleA]
mov ebx, dword [ebp + 8]
xor edx, dword [ecx + 0x1c]
sar ebx, 1
add ecx, 0x20
dec ebx
mov dword [ebp + 8], ebx
jmp 0x6c5410