joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479510
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x56b377
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
mov dword [esp + 0x14], esi
call fcn.00478d60
lea ebp, [esi + 8]
push 0
mov ecx, ebp
mov dword [esp + 0x30], 0
call fcn.00478d60
lea edi, [esi + 0x10]
push 0
mov ecx, edi
mov byte [esp + 0x30], 1
call fcn.00478d60
lea ebx, [esi + 0x18]
push 0
mov ecx, ebx
mov byte [esp + 0x30], 2
call fcn.00478d60
push 0
lea ecx, [esi + 0x20]
mov byte [esp + 0x30], 3
call fcn.00478d60
push 0
lea ecx, [esi + 0x28]
mov byte [esp + 0x30], 4
call fcn.00478d60
mov eax, dword [esp + 0x34]
mov ecx, edi
push eax
mov byte [esp + 0x30], 5
call fcn.00478dc0
push 1
lea ecx, [esp + 0x18]
mov dword [esi + 0x30], 0
call fcn.00478d60
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 6
push ecx
mov ecx, esi
call fcn.00478dc0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call fcn.00478e10
mov edx, dword [esp + 0x34]
sub esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00478da0
mov ecx, esi
call fcn.00478c90
test eax, eax
jge 0x4795fa
push esi
mov ecx, esi
call fcn.00478e40
inc dword [esi + 0x30]
jmp 0x4795cf
push edi
lea eax, [esp + 0x20]
push esi
push eax
call fcn.00478fb0
push edi
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x44], 7
call fcn.00479240
add esp, 0x18
push eax
mov ecx, ebp
mov byte [esp + 0x30], 8
call fcn.00478dc0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 7
call fcn.00478e10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 5
call fcn.00478e10
push esi
lea edx, [esp + 0x18]
push edi
push edx
call fcn.00479240
push eax
lea eax, [esp + 0x2c]
push esi
push eax
mov byte [esp + 0x44], 9
call fcn.00478fb0
add esp, 0x18
push eax
mov ecx, ebx
mov byte [esp + 0x30], 0xa
call fcn.00478dc0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 9
call fcn.00478e10
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call fcn.00478e10
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 4

Function at 0x479890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b427
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x54]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00479510
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
push ecx
push edx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x50], 1
call fcn.00479760
mov dword [esp + 4], 1
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 6
call fcn.00478e10
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 5
call fcn.00478e10
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
call fcn.00478e10
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 3
call fcn.00478e10
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 2
call fcn.00478e10
lea ecx, [esp + 8]
mov byte [esp + 0x44], 0
call fcn.00478e10
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x479b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56b4af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x24]
push esi
push edi
mov esi, ecx
push eax
push 0x73
mov dword [esp + 0x10], esi
call fcn.00532af3
lea edi, [esi + 0x5c]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.0052d5f5
mov dword [edi], vtable.CStatic.0
mov edx, dword [0x5d2d10]
lea ecx, [esi + 0x9c]
mov dword [ecx], edx
mov eax, dword [0x5d2d10]
lea edi, [esi + 0xa0]
mov dword [edi], eax
mov edx, dword [esp + 0x1c]
mov byte [esp + 0x14], 3
push edx
mov dword [esi], method.CDialog.virtual_0
call fcn.00532f94
mov eax, dword [esp + 0x20]
mov ecx, edi
push eax
call fcn.00532f94
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov dword [esi + 0xa4], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xac], eax
mov dword [esi + 0xa8], edx
mov dword [esi + 0x98], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x480510
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x48055d
mov esi, dword [esp + 0xc]
push 8
push esi
call fcn.004805e0
add esp, 8
cmp edi, 8
jle 0x48055d
add edi, 0xfffffff7
add esi, 8
shr edi, 3
inc edi
xor eax, eax
mov cl, byte [esi + eax - 8]
mov dl, byte [esi + eax]
xor dl, cl
mov byte [esi + eax], dl
inc eax
cmp eax, 8
jl 0x48053a
push 8
push esi
call fcn.004805e0
add esp, 8
add esi, 8
dec edi
jne 0x480538
pop edi
pop esi
ret

Function at 0x480560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
xor ebx, ebx
cmp eax, ebx
mov byte [esp + 4], bl
mov byte [esp + 5], bl
mov byte [esp + 6], bl
mov byte [esp + 7], bl
mov byte [esp + 8], bl
mov byte [esp + 9], bl
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], bl
jle 0x4805d9
push esi
mov esi, dword [esp + 0x1c]
push edi
lea edi, [eax - 1]
shr edi, 3
inc edi
mov eax, esi
push 8
push esi
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
call fcn.00480610
add esp, 8
xor eax, eax
mov cl, byte [esp + eax + 0xc]
mov dl, byte [esi + eax]
xor dl, cl
mov byte [esi + eax], dl
mov dl, byte [esp + eax + 0x14]
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jl 0x4805b7
add esi, 8
dec edi
jne 0x48059b
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x480fa0
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ecx
push ebx
push ebp
movsx ebp, word [esp + 0x14]
push esi
mov ebx, dword [esp + 0x14]
push edi
mov ecx, 0x12
mov esi, 0x5caab0
mov edi, 0x66bde0
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x400
mov esi, 0x5caaf8
mov edi, 0x66ade0
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], 0x66bde0
mov dword [esp + 0x10], 0x12
movsx esi, dx
xor eax, eax
xor ecx, ecx
mov al, byte [esi + ebx]
mov edi, eax
lea eax, [esi + 1]
cdq
idiv ebp
lea eax, [esi + 2]
shl edi, 0x18
and edi, 0xff00ffff
mov cl, byte [edx + ebx]
cdq
idiv ebp
shl ecx, 0x10
xor ecx, edi
xor eax, eax
and ecx, 0xffff0000
mov ah, byte [edx + ebx]
xor eax, ecx
xor ecx, ecx
mov dword [esp + 0x18], eax
lea eax, [esi + 3]
cdq
idiv ebp
mov eax, dword [esp + 0x18]
mov cl, byte [edx + ebx]
or eax, ecx
mov ecx, dword [esp + 0x1c]
mov edi, dword [ecx]
add ecx, 4
xor edi, eax
lea eax, [esi + 4]
cdq
idiv ebp
mov eax, dword [esp + 0x10]
mov dword [ecx - 4], edi
dec eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
jne 0x480fe2
xor eax, eax
mov esi, 0x66bde4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov edi, 9
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00480640
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esi - 4], ecx
mov dword [esi], edx
add esp, 8
add esi, 8
dec edi
jne 0x481064
mov esi, 0x66ade4
mov ebx, 4
mov edi, 0x80
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00480640
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 8
add esi, 8
dec edi
jne 0x481098
dec ebx
jne 0x481093
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
pop ecx
ret
Function at 0x4816b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
call fcn.004ef390
mov ebx, eax
add ebx, 0xa
push ebx
call fcn.00531c00
mov ecx, ebx
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 8
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
test edx, edx
je 0x481705
mov cl, byte [edx]
test cl, cl
je 0x481705
xor byte [eax + esi], cl
inc eax
cmp eax, 0xa
jl 0x4816fd
xor eax, eax
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x4816f2
test ebp, ebp
je 0x481722
mov al, byte [ebp]
test al, al
je 0x481722
lea ecx, [esi + 0xa]
mov dl, byte [ecx]
xor dl, al
mov byte [ecx], dl
mov al, byte [ebp + 1]
inc ecx
inc ebp
test al, al
jne 0x481713
mov eax, dword [esp + 0x1c]
push eax
push ebx
push esi
call fcn.004efbb0
push esi
call fcn.00531c29
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4853a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x56c810
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
lea eax, [esp + 4]
push esi
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
je 0x4853ed
mov esi, dword [esp + 0x134]
push 0x5d7b88
mov ecx, esi
call fcn.00530bfd
jmp 0x4854f8
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
je 0x48541e
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov esi, dword [esp + 0x134]
push 0x5d7b88
mov ecx, esi
call fcn.00530bfd
jmp 0x4854f8
mov eax, dword [0x5d2d10]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x138]
lea ecx, [esp + 4]
push ecx
push edx
push 0
mov dword [esp + 0x138], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4854a9
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 8]
mov ecx, dword [eax]
push 0x8000
push edx
push eax
call dword [ecx + 0x2c]
test eax, eax
jne 0x4854a9
mov ecx, dword [esp + 4]
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.00485520
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 2
call fcn.00530cc8
lea ecx, [esp + 0x18]
mov byte [esp + 0x12c], 1
call fcn.00530b8f
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov esi, dword [esp + 0x134]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00530904
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 1
mov byte [esp + 0x12c], 0
call fcn.00530b8f
mov ecx, dword [esp + 0x124]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x12c
ret 8
Function at 0x4871a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x56cba5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, dword [0x5d2d10]
push esi
push edi
mov dword [esp + 0xc], eax
mov cl, byte [0x5d7b88]
xor eax, eax
mov byte [esp + 0x1c], cl
mov ecx, 0x40
lea edi, [esp + 0x1d]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
mov dword [esp + 0x12c], 1
stosb byte es:[edi], al
mov dword [esp + 0x14], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
je 0x487222
mov esi, dword [esp + 0x130]
push 0x5d7b88
mov ecx, esi
call fcn.00530bfd
mov dword [esp + 0x18], 1
jmp 0x48728a
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 0x10
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x487257
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0xc]
push edx
call fcn.00530d18
mov esi, dword [esp + 0x130]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00530904
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], bl
call fcn.00530b8f
mov ecx, dword [esp + 0x120]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret 4
Function at 0x4907f0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x56dcc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push str.SoftwareGlobalSCAPECuteFTP_7_Professional
lea ecx, [esp + 8]
call fcn.00530bfd
mov eax, dword [esp + 0x20]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x1c], 0
call fcn.00530f6b
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 4]
push ecx
push edx
push SysReAllocStringLen
mov ecx, esi
call fcn.0052a0f7
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4908e2
mov edx, dword [0x5d2d10]
mov dword [esp + 0x20], edx
mov eax, dword [esi + 0xb0]
lea ecx, [esp + 0x20]
push eax
push str._s_ShowAlways
push ecx
mov byte [esp + 0x24], 1
call fcn.00528823
mov ecx, dword [esp + 0x2c]
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0xc]
push eax
push 0
push 0
push ecx
push edx
mov dword [esp + 0x24], 4
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4908c9
mov eax, dword [esp + 0x24]
mov dword [esi + 0xb4], eax
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00530b8f
push 0
push 1
mov ecx, esi
call fcn.0053b47d
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8

Function at 0x496050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56e684
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov eax, dword [0x5d2d10]
lea ecx, [esi + 4]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [ecx], eax
mov edx, dword [0x5d2d10]
mov dword [esi + 8], edx
mov eax, dword [0x5d2d10]
mov dword [esi + 0xc], eax
mov dword [esi + 0x30], 0x58a78c
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov edx, dword [esp + 0x1c]
mov byte [esp + 0x14], 4
push edx
mov dword [esi], method.CCommandLineInfo.virtual_0
call fcn.00530d18
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x20], eax
mov eax, 1
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x14]
xor edx, edx
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov dword [eax], edx
pop edi
mov word [eax + 4], dx
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x49bcf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56ee18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [0x5d2d10]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov ebx, dword [esi + 0x3dc]
xor ecx, ecx
test ebx, ebx
setne cl
add ecx, 0xc6
mov dword [esp + 0x48], 0
push ecx
lea ecx, [esp + 0x10]
call fcn.00532f94
mov edx, dword [esp + 0xc]
lea edi, [esi + 0xd4]
push edx
mov ecx, edi
call fcn.0053144b
mov ecx, dword [esi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
mov eax, dword [esi + 0x78]
lea edx, [esp + 0x20]
push edx
push eax
call ebx
mov edx, dword [esi + 0x168]
lea ecx, [esp + 0x30]
push ecx
push edx
call ebx
mov edx, dword [esi + 0x3dc]
xor eax, eax
test edx, edx
sete al
test eax, eax
mov dword [esi + 0x3dc], eax
je 0x49bdc7
lea edi, [esi + 0x198]
push 5
mov ecx, edi
call fcn.00531575
mov eax, dword [esi + 0x3e0]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 1
push eax
mov eax, dword [esp + 0x18]
sub ecx, eax
push ecx
push edx
push eax
mov ecx, esi
call fcn.005314e5
mov ecx, edi
call fcn.004aeac0
jmp 0x49be08
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub ecx, eax
sub edx, eax
push 1
mov dword [esi + 0x3e0], ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, esi
call fcn.005314e5
push 0
lea ecx, [esi + 0x198]
call fcn.00531575
mov ecx, edi
call fcn.005315de
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x49caa0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x49cb1a
mov esi, dword [esp + 0x14]
test esi, esi
je 0x49cb1a
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x49cb1a
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x49cb1a
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x49cb08
mov edx, esi
cmp edi, ebx
jb 0x49cb12
add edx, ebx
cmp edi, edx
jbe 0x49cb24
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x49cafa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x49cb40
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str._nESP_dump:_n
call fcn.0049cd40
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 4
xor edi, edi
mov esi, dword [ebp + 0xc4]
push 4
push esi
call ebx
test eax, eax
jne 0x49cb85
mov eax, dword [esi]
push eax
push str._0x_04x
call fcn.0049cd40
add esp, 8
add esi, 4
inc edi
cmp edi, 0x32
jl 0x49cb63
push str._n_nEBP_dump:_n
call fcn.0049cd40
mov esi, dword [ebp + 0xb4]
add esp, 4
xor edi, edi
push 4
push esi
call ebx
test eax, eax
jne 0x49cbbc
mov ecx, dword [esi]
push ecx
push str._0x_04x
call fcn.0049cd40
add esp, 8
add esi, 4
inc edi
cmp edi, 0x32
jl 0x49cb9a
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 0x5c5a64
jmp fcn.0049cd40

Function at 0x49cbd0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push str._nIP_dump:_n
call fcn.0049cd40
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 4
xor edi, edi
mov esi, dword [eax + 0xb8]
mov dword [esp + 0x14], edi
push 4
push esi
call ebx
test eax, eax
jne 0x49cc36
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov cx, word [esp + 0xe]
mov byte [esp + 0x14], ch
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], ah
mov byte [esp + 0x17], al
mov ecx, dword [esp + 0x14]
push ecx
push str._0x_08x
call fcn.0049cd40
add esp, 8
add esi, 4
inc edi
cmp edi, 0x32
jl 0x49cbf7
pop edi
pop esi
pop ebx
mov dword [esp + 8], 0x5c5a64
add esp, 4
jmp fcn.0049cd40

Function at 0x49cd40
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
lea edx, [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
mov edx, dword [0x66c804]
mov esi, eax
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
add esp, 0x404
ret
Function at 0x49e1f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x49e216
cmp byte [eax], 0
je 0x49e216
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x49e216
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
mov eax, ecx
ret
xor eax, eax
ret

Function at 0x49e220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x49e246
cmp byte [eax], 0
je 0x49e246
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x49e246
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
sete cl
mov eax, ecx
ret
xor eax, eax
ret

Function at 0x49e320
Capabilities:
Create directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56f380
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0xc
test eax, eax
push ebx
je 0x49e3c5
cmp byte [eax], 0
je 0x49e3c5
push eax
lea ecx, [esp + 0x24]
call fcn.00530bfd
mov eax, dword [0x5d2d10]
mov dword [esp + 0x18], 0
mov dword [esp + 4], eax
mov bl, 1
push 0x5c
push 0x2f
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], bl
call fcn.005280b2
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x5c
je 0x49e395
push 0x5c
lea ecx, [esp + 0x24]
call fcn.00530f92
mov eax, dword [esp + 0x20]
push 0x5c4800
push eax
call fcn.00514e99
add esp, 8
test eax, eax
jne 0x49e3d7
lea ecx, [esp + 4]
mov byte [esp + 0x18], al
call fcn.00530b8f
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00530b8f
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
push edi
push 0x5c
lea ecx, [esp + 0x30]
call fcn.00531056
mov edi, eax
lea ecx, [esp + 0x14]
lea esi, [edi + 1]
push esi
push ecx
lea ecx, [esp + 0x34]
call fcn.005283d8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.00530fa7
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], bl
call fcn.00530b8f
mov edx, dword [esp + 0x10]
push edx
call fcn.0049e220
add esp, 4
test eax, eax
jne 0x49e434
push eax
mov eax, dword [esp + 0x14]
push eax
call ebp
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx - 8]
dec eax
cmp edi, eax
je 0x49e470
lea edx, [esp + 0x18]
push esi
push edx
lea ecx, [esp + 0x34]
call fcn.005282a3
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 3
call fcn.00530cc8
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], bl
call fcn.00530b8f
jmp 0x49e3e0
mov eax, dword [esp + 0x10]
push eax
call fcn.0049e220
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0x24], 0
call fcn.00530b8f
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x49e4c0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x49e4f5
cmp byte [esi], 0
je 0x49e4f5
push esi
call fcn.0049e500
add esp, 4
test eax, eax
je 0x49e4f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret
xor eax, eax
pop esi
ret