joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487180
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.00487140
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4871f0
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x4871c9
cmp eax, 3
jbe 0x4871e1
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4871d6
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x487200
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4872a0
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x48727b
cmp eax, 3
jbe 0x487293
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x487288
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x4872c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.00486ee0
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.00486ea0
cmp edi, 1
jne 0x487305
cmp word [esi + 6], 0xffff
jne 0x48730b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x4874c0
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret

Function at 0x48d61c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x40], 0x6c
mov byte [ebp - 0x3f], 0xb0
mov byte [ebp - 0x3e], 0x4b
mov byte [ebp - 0x3d], 0xa0
mov byte [ebp - 0x3c], 0xad
mov byte [ebp - 0x3b], 0xef
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x38], 0xa3
mov byte [ebp - 0x37], 0x2f
mov byte [ebp - 0x36], 0x90
mov byte [ebp - 0x35], 0xd2
mov byte [ebp - 0x34], 0xb0
mov byte [ebp - 0x33], 0x45
mov byte [ebp - 0x32], 0xa2
mov byte [ebp - 0x31], 0x75
mov byte [ebp - 0x30], 0x85
mov byte [ebp - 0x2f], 0xe8
mov byte [ebp - 0x2e], 0xa3
mov byte [ebp - 0x2d], 0xfb
mov byte [ebp - 0x2c], 0x7b
mov byte [ebp - 0x2b], 0xd4
mov byte [ebp - 0x2a], 0x81
mov byte [ebp - 0x29], 0x38
mov byte [ebp - 0x28], 0xd6
mov byte [ebp - 0x27], 0xf5
mov byte [ebp - 0x26], 0xdc
mov byte [ebp - 0x25], 0xa4
mov byte [ebp - 0x24], 0xba
mov byte [ebp - 0x23], 0x4c
mov byte [ebp - 0x22], 0xf8
mov byte [ebp - 0x21], 0xb9
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x83
mov byte [ebp - 0x1e], 0x8a
mov byte [ebp - 0x1d], 0x7f
mov byte [ebp - 0x1c], 0xa6
mov byte [ebp - 0x1b], 0x18
mov byte [ebp - 0x1a], 0xac
mov byte [ebp - 0x19], 0x17
mov byte [ebp - 0x18], 0xb9
mov byte [ebp - 0x17], 0x88
mov byte [ebp - 0x16], 0x11
mov byte [ebp - 0x15], 0xaa
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x13], 0x47
mov byte [ebp - 0x12], 0xf3
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0x10], 0x37
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 2
mov byte [ebp - 0xd], 0xa
mov byte [ebp - 0xc], 0x1d
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x9c
mov byte [ebp - 9], 0x69
mov dword [ebp - 8], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
ja 0x48d733
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00496a80
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x48d73c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x48d781
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48eaac
Capabilities:
Link many functions at runtime

Disassembly:
lea esi, [0x51c818]
push esi
mov eax, dword [0x51c408]
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x51c82d], eax
mov dword [0x51c0f5], 1
mov eax, 0x4000
push eax
lea eax, [0x51c333]
push eax
lea eax, [0x51c0e1]
push eax
lea esi, [0x51c5cf]
call dword [esi]
cmp eax, 0xffffffff
jne 0x48eaf8
mov dword [0x51c0f5], 0
cmp dword [0x51c0f5], 0
je 0x48eb6e
mov eax, 0x4000
push eax
lea eax, [0x51c333]
push eax
lea eax, [0x51c0ca]
push eax
lea esi, [0x51c5cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x48eb6e
lea eax, [0x51c0ca]
push eax
call dword [0x51c1f3]
mov dword [0x51c0ed], eax
cmp eax, 0
je 0x48eb6e
lea edx, [0x51c0f9]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x48eb6e
mov dword [0x51c14b], eax
mov eax, dword [0x51c0ed]
lea edx, [0x51c130]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x48eb6e
mov dword [0x51c14f], eax
jmp 0x48ebe6
mov eax, 0x4000
push eax
lea eax, [0x51c333]
push eax
lea eax, [0x51c0d7]
push eax
lea esi, [0x51c5cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x48ebdb
lea eax, [0x51c0d7]
push eax
call dword [0x51c1f3]
mov dword [0x51c0f1], eax
cmp eax, 0
je 0x48ebdb
lea edx, [0x51c115]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x48ebdb
mov dword [0x51c14b], eax
mov eax, dword [0x51c0f1]
lea edx, [0x51c13e]
push edx
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp eax, 0
je 0x48ebdb
mov dword [0x51c14f], eax
jmp 0x48ebf1
mov dword [0x51c153], 0
ret
mov dword [0x51c153], 1
ret
mov dword [0x51c153], 2
ret

Function at 0x48ef09
Capabilities:
Packed with generic packer

Disassembly:
pushal
push eax
push ecx
push edx
test ax, 1
je 0x48ef26
push ecx
push edx
call dword [0x51c763]
cmp eax, 0
je 0x48ef26
pop edx
pop ecx
pop eax
stc
jmp 0x48ef41
pop edx
pop ecx
pop eax
test ax, 2
je 0x48ef40
push ecx
push edx
call dword [0x51c775]
cmp ax, 0
je 0x48ef40
stc
jmp 0x48ef41
clc
popal
ret
Function at 0x48fd74
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 8]
mov dword [esp + 0x14], 0xc
mov edx, dword [edi + 4]
add edx, ecx
mov ecx, dword [edi]
mov dword [edi + 4], edx
mov edx, dword [eax + 4]
add ecx, edx
mov dword [edi], ecx
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
mov esi, ebx
mov edx, ebx
shr esi, 4
xor edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
add ebp, 8
shr eax, cl
mov ecx, esi
shl edx, cl
mov ecx, 0x20
or eax, edx
mov edx, dword [ebp - 8]
sub eax, edx
mov edx, eax
mov dword [edi + 4], eax
shr edx, 7
and edx, 0x1f
xor eax, ebx
sub ecx, edx
mov esi, eax
shr esi, cl
mov ecx, edx
mov edx, dword [ebp - 4]
shl eax, cl
or esi, eax
mov eax, dword [esp + 0x14]
add esi, edx
dec eax
mov dword [edi], esi
mov dword [esp + 0x14], eax
jne 0x48fd9e
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x48fdfd
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 0x60]
mov dword [esp + 0x14], 0xc
mov ebx, dword [edi + 4]
mov edx, dword [edi]
mov ecx, dword [ebp + 4]
mov esi, ebx
shr esi, 7
sub edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
sub ebp, 8
shl eax, cl
mov ecx, esi
shr edx, cl
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov ecx, dword [ebp + 8]
mov edx, eax
shr edx, 4
lea esi, [ebx + ecx]
and edx, 0x1f
mov ecx, 0x20
mov ebx, esi
sub ecx, edx
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [edi + 4], ebx
mov dword [esp + 0x14], eax
jne 0x48fe14
mov eax, dword [esp + 0x18]
mov esi, dword [edi]
mov ecx, ebx
mov edx, dword [eax + 4]
sub esi, edx
mov dword [edi], esi
mov eax, dword [eax]
sub ecx, eax
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x48fe88
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
mov eax, dword [esp + 0x90]
push ebx
push esi
mov esi, dword [esp + 0x94]
lea ebx, [eax + 7]
shr ebx, 3
and eax, 7
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
jne 0x48feb9
mov dword [esp + 0x10], 8
push ebp
push edi
lea eax, [ebx - 1]
xor edx, edx
xor ecx, ecx
xor edi, edi
test eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edi
jbe 0x48ff89
mov ebp, dword [esi]
xor ebp, ecx
mov ecx, dword [esi + 4]
xor ecx, edx
mov dword [esi], ebp
test edi, edi
mov dword [esi + 4], ecx
jne 0x48ff5b
cmp ebx, 2
push edi
jbe 0x48ff4e
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.004902b9
mov edi, dword [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x30], edi
lea eax, [esp + 0x30]
mov ebx, 0x19
mov ecx, dword [eax]
mov edx, dword [esp + 0x2c]
add ecx, edx
mov ebp, edi
mov dword [eax + 4], ecx
mov edx, dword [eax]
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
add eax, 4
shl ebp, cl
mov ecx, edx
mov edx, ebp
mov ebp, edi
shr ebp, cl
or edx, ebp
mov ebp, dword [esp + 0x34]
xor ebp, edx
dec ebx
mov dword [esp + 0x34], ebp
jne 0x48ff0f
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jmp 0x48ff69
push 0
push esi
call fcn.004902b9
add esp, 0xc
jmp 0x48ff69
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0048fd74
add esp, 8
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
inc edi
lea eax, [ebx - 1]
mov dword [esp + 0x10], ecx
cmp edi, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
jb 0x48fed8
mov eax, dword [esp + 0x18]
xor edi, edi
test eax, eax
jbe 0x48ffb4
mov ebp, esi
lea ecx, [esp + 0x10]
sub ebp, ecx
mov cl, byte [esp + edi + 0x10]
lea eax, [esp + edi + 0x10]
mov dl, byte [ebp + eax]
xor cl, dl
inc edi
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp edi, eax
jb 0x48ff9b
pop edi
cmp ebx, 2
pop ebp
jbe 0x48ffcf
lea eax, [esp + 0x28]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0048fd74
add esp, 8
jmp 0x48fff2
cmp ebx, 1
jne 0x48ffe1
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
push 0
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.004902b9
add esp, 0xc
cmp ebx, 1
jbe 0x490026
mov ecx, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
jbe 0x49000d
mov dl, byte [esi + eax - 8]
mov byte [esi + eax], dl
inc eax
cmp eax, ecx
jb 0x490001
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi - 8], eax
mov dword [esi - 4], ecx
pop esi
xor eax, eax
pop ebx
add esp, 0x88
ret
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi], edx
mov dword [esi + 4], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x88
ret
Function at 0x49003e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
mov eax, dword [esp + 0x98]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
lea ebp, [eax + 7]
push esi
shr ebp, 3
and eax, 7
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], eax
jne 0x490071
mov dword [esp + 0x20], 8
xor edx, edx
cmp ebp, 1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
jbe 0x49015a
lea eax, [ebp - 2]
xor esi, esi
cmp eax, edx
mov dword [esp + 0x24], esi
jbe 0x49015a
jmp 0x4900a1
xor edx, edx
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
cmp esi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jne 0x490111
push edx
lea edx, [esp + 0x34]
push edx
push ebx
call fcn.004902b9
mov esi, dword [esp + 0x3c]
add esp, 0xc
mov dword [esp + 0x38], esi
lea eax, [esp + 0x38]
mov edi, 0x19
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
add ecx, edx
mov ebp, esi
mov dword [eax + 4], ecx
mov edx, dword [eax]
and edx, 0x1f
mov ecx, 0x20
sub ecx, edx
add eax, 4
shl ebp, cl
mov ecx, edx
mov edx, ebp
mov ebp, esi
shr ebp, cl
or edx, ebp
mov ebp, dword [esp + 0x3c]
xor ebp, edx
dec edi
mov dword [esp + 0x3c], ebp
jne 0x4900d2
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
jmp 0x49011f
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0048fdfd
add esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
xor edx, ecx
mov dword [ebx], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor eax, edx
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
add ebx, 8
inc esi
lea eax, [ebp - 2]
cmp esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], esi
jb 0x49009f
xor edx, edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
cmp ecx, edx
mov dword [esp + 0x14], edx
jbe 0x49017f
mov eax, ecx
lea esi, [ebx + 8]
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebp, 1
jne 0x490194
push edx
push edx
push ebx
call fcn.004902b9
add esp, 0xc
jmp 0x49021c
cmp ebp, 2
jne 0x4901a6
push edx
push edx
push ebx
call fcn.004902b9
add esp, 0xc
jmp 0x4901b9
lea ecx, [esp + 0x38]
push ecx
push ebx
call fcn.0048fdfd
add esp, 8
cmp ebp, 1
jbe 0x49021c
mov edx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x20]
xor esi, edx
mov edx, dword [esp + 0x14]
xor edx, eax
xor eax, eax
test edi, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
jbe 0x4901fa
mov ecx, ebx
lea edx, [esp + 0x10]
sub ecx, edx
mov dl, byte [eax + ebx + 8]
lea esi, [esp + eax + 0x10]
inc eax
mov byte [esi + ecx], dl
mov dl, byte [esi]
mov byte [eax + ebx + 7], dl
cmp eax, edi
jb 0x4901e4
cmp ebp, 2
jne 0x49020e
push 0
push 0
push ebx
call fcn.004902b9
add esp, 0xc
jmp 0x49021c
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0048fdfd
add esp, 8
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
xor edx, ecx
mov dword [ebx], edx
mov edx, dword [esp + 0x1c]
xor eax, edx
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret
Function at 0x492be0
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x18
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret

Function at 0x496f0b
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x4f1018
call fcn.0049b9e8
mov eax, dword [0x503270]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x497018
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x496fc9
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00497b90
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x496fb6
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x497018
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x497018
mov al, byte [edi]
cmp al, 0x5c
je 0x496fd7
cmp al, 0x2f
jne 0x496fdc
cmp al, byte [edi + 1]
je 0x497012
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.0049bb3d
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x497018
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004980db
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x497034
push edi
call fcn.00497557
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
call fcn.0049bcd6
call fcn.0049ba23
ret

Function at 0x49704e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x49706e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004980db
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x497091
test byte [esp + 8], 2
je 0x497091
call fcn.004980c9
mov dword [eax], 0xd
call fcn.004980d2
mov dword [eax], 5
jmp 0x49706a
xor eax, eax
ret

Function at 0x497149
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x497177
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x49717c
cmp eax, 1
je 0x49717c
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x497180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x503270]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x4971f8
push ebx
call fcn.00497149
test eax, eax
pop ecx
jne 0x4971c7
call fcn.004980d2
mov dword [eax], 0xf
call fcn.004980c9
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0049bcd6
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x49720a
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4971ba
inc eax
cmp eax, 0x104
ja 0x4971ba
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x497242
cmp eax, dword [ebp + 0x10]
jg 0x497225
mov eax, dword [ebp + 0x10]
push eax
call fcn.004978fc
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x497257
call fcn.004980c9
mov dword [eax], 0xc
jmp 0x4971ba
cmp eax, dword [ebp + 0x10]
jle 0x497257
call fcn.004980c9
mov dword [eax], 0x22
jmp 0x4971ba
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.00496980
pop ecx
pop ecx
jmp 0x4971bc
Function at 0x497ca5
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x4f10c8
call fcn.0049b9e8
mov edi, 0x94
mov eax, edi
call fcn.00497b90
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x511d48], ecx
mov eax, dword [esi + 4]
mov dword [0x511d54], eax
mov edx, dword [esi + 8]
mov dword [0x511d58], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x511d4c], esi
cmp ecx, 2
je 0x497d05
or esi, 0x8000
mov dword [0x511d4c], esi
shl eax, 8
add eax, edx
mov dword [0x511d50], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x497d3e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x497d3e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x497d56
cmp eax, 0x20b
je 0x497d43
mov dword [ebp - 0x1c], edi
jmp 0x497d6a
cmp dword [ecx + 0x84], 0xe
jbe 0x497d3e
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x497d64
cmp dword [ecx + 0x74], 0xe
jbe 0x497d3e
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0049cbec
pop ecx
test eax, eax
jne 0x497d7e
push 0x1c
call fcn.00497c2b
pop ecx
call fcn.0049edf8
test eax, eax
jne 0x497d8f
push 0x10
call fcn.00497c2b
pop ecx
call fcn.0049eb44
mov dword [ebp - 4], edi
call fcn.0049dfeb
test eax, eax
jge 0x497da8
push 0x1b
call fcn.00497c06
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x51b584], eax
call fcn.0049ea22
mov dword [0x511d34], eax
call fcn.0049e980
test eax, eax
jge 0x497dce
push 8
call fcn.00497c06
pop ecx
call fcn.0049e74d
test eax, eax
jge 0x497ddf
push 9
call fcn.00497c06
pop ecx
push 1
call fcn.0049876c
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x497df5
push eax
call fcn.00497c06
pop ecx
mov eax, dword [0x511d68]
mov dword [0x511d6c], eax
push eax
push dword [0x511d60]
push dword [0x511d5c]
call fcn.004a89c0
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x497e24
push esi
call fcn.00498899
call fcn.004988bb
jmp 0x497e56
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.0049ba23
ret
Function at 0x4987d6
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4f1100
call fcn.0049b9e8
push 8
call fcn.0049b9b6
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x511d88], esi
jne 0x49880a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x511d84], esi
mov al, byte [ebp + 0x10]
mov byte [0x511d80], al
cmp dword [ebp + 0xc], edi
jne 0x498854
cmp dword [0x51a55c], edi
je 0x498844
mov eax, dword [0x51a558]
sub eax, 4
mov dword [0x51a558], eax
cmp eax, dword [0x51a55c]
jb 0x498844
mov eax, dword [eax]
cmp eax, edi
je 0x498825
call eax
jmp 0x498825
push 0x4f7028
mov eax, 0x4f7020
call fcn.00498736
pop ecx
push 0x4f7030
mov eax, 0x4f702c
call fcn.00498736
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x498885
cmp dword [ebp + 0x10], edi
jne 0x498893
mov dword [0x511d88], esi
push dword [ebp + 8]
call fcn.004986f4
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x498892
push 8
call fcn.0049b8e9
pop ecx
ret
call fcn.0049ba23
ret