joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480460
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 4], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x480475
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00497652
push edi
mov esi, eax
push 0x4ab4fc
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0
push esi
push fcn.0047f950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x481ad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b8d3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4cc99c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x4d6580
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], ebx
mov dword [ecx], 0x4d6580
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x4ab7d8
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.00481070
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x482ad0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4cc99c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x64], eax
mov ecx, 0x11
mov eax, 9
mov esi, 1
push edi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0xd
mov dword [ebp - 0x24], 0xb
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x14], 0x3a
mov dword [ebp - 0x10], 0x1a
mov dword [ebp - 0xc], 0x5e
mov dword [ebp - 8], 0xc
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x44], 0x13
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0x34
mov dword [ebp - 0x38], 0x1d
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x2328
idiv ecx
lea ebx, [edx - 0x18]
mov edx, dword [ebp + 0xc]
lea eax, [edx + edx + 2]
push eax
and ebx, 0xff
call fcn.00497652
add esp, 4
cmp dword [ebp + 0xc], 0
mov edi, eax
mov ecx, ebx
mov byte [edi], bl
mov dword [ebp - 0x5c], 0
jle 0x482c53
mov eax, dword [ebp + 8]
mov edx, esi
sub edx, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], edx
jmp 0x482bc0
xor edx, edx
mov eax, ecx
mov ebx, 0x96
div ebx
test edx, edx
jne 0x482bfa
nop
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x2328
idiv ecx
mov ebx, 0x96
inc esi
lea eax, [edx - 0x18]
and eax, 0xff
xor edx, edx
mov byte [esi + edi - 1], al
mov ecx, eax
div ebx
test edx, edx
je 0x482bd0
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov al, dl
add dl, dl
add dl, dl
add al, dl
add al, al
sub cl, al
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x60]
mov ebx, 0xa
cdq
idiv ebx
movzx ecx, cl
mov al, byte [ebp + ecx*4 - 0x54]
mov ecx, dword [ebp - 0x58]
movzx edx, dl
add al, byte [ebp + edx*4 - 0x2c]
add al, byte [ecx]
movzx ecx, al
cmp ecx, 0x100
jge 0x482c70
inc dword [ebp - 0x58]
mov byte [esi + edi], al
mov eax, dword [ebp - 0x5c]
inc eax
inc esi
mov dword [ebp - 0x5c], eax
cmp eax, dword [ebp + 0xc]
jl 0x482bc0
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov dword [edx], esi
mov byte [esi + edi], 0
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497792
mov esp, ebp
pop ebp
ret
jmp 0x482c70
Function at 0x482c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x482dde
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x482dde
cmp dword [ebp + 0x14], 0
je 0x482dde
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [edi + 2]
test ecx, ecx
js 0x482dd6
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x482dd6
mov ecx, ebx
cmp edi, 2
jle 0x482d4f
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
mov edi, edi
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
add eax, eax
shr ebx, 4
movzx eax, byte [ebx + eax*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
add esi, 3
dec edx
jne 0x482cf0
mov ebx, dword [ebp + 0x10]
test edi, edi
je 0x482dc5
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
cmp edi, 1
jle 0x482daa
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
add edx, edx
movzx edx, byte [eax + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
movzx eax, byte [esi + 1]
and eax, 0xf
movzx edx, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov edx, dword [ebp + 0x14]
mov byte [ecx + 3], 0x3d
add ecx, 4
mov eax, ecx
pop edi
sub eax, ebx
pop esi
mov dword [edx], eax
mov byte [ecx], 0
pop ebx
pop ebp
ret
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
mov word [ecx + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0x14]
mov eax, ecx
pop edi
sub eax, ebx
pop esi
mov dword [edx], eax
mov byte [ecx], 0
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x486820
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4cc99c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
push esi
call fcn.0048a740
add esp, 8
cmp dword [0x4d89d0], 0
jne 0x48687d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x486870
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d89d0], eax
cmp dword [0x4d89d0], 0
je 0x486902
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push esi
call fcn.0048a3d0
add esp, 0xc
lea edx, [ebp - 0x424]
push edx
movsx edx, byte [ebp - 0x404]
lea eax, [ebp - 0x42c]
push eax
neg edx
lea ecx, [ebp - 0x40c]
sbb edx, edx
lea eax, [ebp - 0x404]
push ecx
and edx, eax
push edx
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x40c], 0
call dword [0x4d89d0]
test eax, eax
je 0x486902
mov edx, dword [ebp - 0x408]
cmp edx, dword [ebp - 0x420]
ja 0x486902
xor eax, eax
xor esi, esi
add eax, dword [ebp - 0x40c]
adc edx, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497792
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x410]
push eax
movsx eax, byte [ebp - 0x404]
lea ecx, [ebp - 0x418]
push ecx
neg eax
lea edx, [ebp - 0x414]
sbb eax, eax
lea ecx, [ebp - 0x404]
push edx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x486952
mov eax, 0x163e00
xor edx, edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497792
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x414]
imul eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 4]
mul dword [ebp - 0x410]
xor ecx, ebp
pop esi
call fcn.00497792
mov esp, ebp
pop ebp
ret

Function at 0x486980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.0048c7d0
test eax, eax
je 0x4869aa
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4869aa
cmp word [eax], 0
je 0x4869aa
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x4869f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.0048c7d0
test eax, eax
je 0x486a12
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x486a12
cmp word [eax], 0
je 0x486a12
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ebp
ret

Function at 0x486a20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.0048c7d0
test eax, eax
je 0x486a4b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x486a4b
cmp word [eax], 0
je 0x486a4b
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret
Function at 0x486af0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
neg eax
sbb eax, eax
inc eax
pop ebp
ret

Function at 0x487290
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x16], 0
mov dword [edi + 0xc18], 0
mov al, 1
jne 0x4872ad
mov al, byte [ebp + 0x10]
cmp byte [ebp + 0x14], 0
mov dword [ebp + 0x10], SysReAllocString
je 0x4872c1
mov dword [ebp + 0x10], 0xc0000000
mov ebx, 1
test al, al
je 0x4872cf
mov ebx, 3
xor eax, eax
cmp byte [edi + 0x15], al
setne al
lea esi, [eax - 1]
and esi, 0x8000000
call fcn.0048c7d0
test eax, eax
je 0x48730e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48730e
cmp word [eax], 0
je 0x48730e
mov ecx, dword [ebp + 0x10]
push 0
push esi
push 3
push 0
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp + 8]
jmp 0x487324
mov edx, dword [ebp + 0x10]
push 0
push esi
push 3
push 0
push ebx
mov ebx, dword [ebp + 8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x487340
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x487340
mov dword [edi + 0xc18], 1
cmp esi, 0xffffffff
setne al
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov byte [ebp + 0x13], al
test al, al
je 0x4873e6
mov dword [edi + 4], esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x48737c
lea eax, [edi + 0x418]
push esi
push eax
call fcn.00489690
add esp, 8
jmp 0x487385
xor ecx, ecx
mov word [edi + 0x418], cx
test ebx, ebx
je 0x48739d
mov edx, edi
mov eax, ebx
sub edx, ebx
nop
mov cl, byte [eax]
mov byte [edx + eax + 0x17], cl
inc eax
test cl, cl
jne 0x487390
jmp 0x4873af
push 0x1000000
lea eax, [edi + 0x17]
push eax
push esi
call fcn.00489460
add esp, 0xc
cmp dword [edi + 4], 0xffffffff
je 0x4873e3
xor eax, eax
jmp 0x4873c0
cmp dword [eax*4 + 0x4d8598], 0
je 0x4873dc
inc eax
cmp eax, 0x100
jb 0x4873c0
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov dword [eax*4 + 0x4d8598], edi
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x487580
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x48758d
xor al, al
pop esi
ret
cmp dword [esi + 4], 0xffffffff
je 0x487598
call fcn.00486650
cmp byte [esi + 0x13], 0
je 0x487589
add esi, 0x17
push esi
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
neg eax
sbb eax, eax
inc eax
pop esi
ret
Function at 0x4875c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [ebp + 0xc]
jne 0x4875e9
cmp edi, 0x4e20
jle 0x4875de
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48765b
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x487637
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x48761b
cmp eax, 3
jne 0x487637
cmp edi, 0x4e20
jle 0x487637
push 0x4e20
push ebx
mov ecx, esi
call fcn.004875c0
pop edi
pop esi
pop ebx
pop ebp
ret 8
cmp dword [esi + 0xc], 1
jne 0x487651
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x487651
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x487850
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00487670

Function at 0x487860
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x418]
call fcn.0048c7d0
test eax, eax
je 0x487891
test esi, esi
je 0x487891
cmp word [esi], 0
je 0x487891
mov eax, dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
push ecx
add edi, 0x17
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x487940
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
inc dword [0x4d89cc]
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 1], 1
xor edi, edi
mov eax, dword [edi + 0x4d8598]
cmp eax, ebx
je 0x4879ae
mov byte [eax + 0x14], bl
mov esi, dword [edi + 0x4d8598]
cmp byte [esi + 0x12], bl
je 0x487998
cmp dword [esi + 0xc], ebx
jne 0x4879ab
cmp dword [esi + 4], 0xffffffff
je 0x48797f
mov ecx, esi
call fcn.00486650
cmp byte [esi + 0x13], bl
je 0x4879ab
add esi, 0x17
push esi
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
sete al
jmp 0x48799f
mov ecx, esi
call fcn.00486650
cmp al, bl
je 0x4879ab
mov dword [edi + 0x4d8598], ebx
jmp 0x4879ae
mov byte [ebp - 1], bl
add edi, 4
cmp edi, 0x400
jb 0x487955
dec dword [0x4d89cc]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4879d0
Capabilities:
Check if file exists
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.0048c7d0
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x4879f9
test esi, esi
je 0x4879f9
cmp word [esi], 0
je 0x4879f9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x487a02
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x487a3b
call fcn.0048c7d0
test eax, eax
je 0x487a2a
test esi, esi
je 0x487a2a
cmp word [esi], 0
je 0x487a2a
mov eax, dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x487a50
cmp eax, 3
mov eax, 1
jne 0x487a55
mov eax, 2
pop edi
pop esi
pop ebp
ret
Function at 0x487c80
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4cc99c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x81c], esi
mov dword [ebp - 0x814], ecx
call fcn.0048c7d0
test eax, eax
je 0x487e77
test ebx, ebx
je 0x487cda
cmp dword [ebx], 0
mov byte [ebp - 0x806], 1
jne 0x487ce1
mov byte [ebp - 0x806], 0
test esi, esi
je 0x487cf1
cmp dword [esi], 0
mov byte [ebp - 0x805], 1
jne 0x487cf8
mov byte [ebp - 0x805], 0
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x487d0e
cmp dword [eax], 0
mov byte [ebp - 0x807], 1
jne 0x487d15
mov byte [ebp - 0x807], 0
call fcn.0048c7d0
test eax, eax
je 0x487d3d
test edi, edi
je 0x487d3d
cmp word [edi], 0
je 0x487d3d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [ebp - 0x810]
mov dword [ebp - 0x80c], eax
jmp 0x487d50
mov esi, dword [ebp - 0x810]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x80c], eax
cmp eax, 0xffffffff
je 0x487d79
test al, 1
je 0x487d79
mov bl, 1
call fcn.0048c7d0
test eax, eax
je 0x487d7d
test edi, edi
je 0x487d7d
cmp word [edi], 0
je 0x487d7d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x487d86
xor bl, bl
jmp 0x487d86
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x804]
push edx
push edi
push esi
call fcn.0048a890
add esp, 0xc
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x487e77
cmp byte [ebp - 0x806], 0
je 0x487ddc
lea ecx, [ebp - 0x834]
push ecx
mov ecx, dword [ebp - 0x818]
call fcn.00486cc0
cmp byte [ebp - 0x805], 0
je 0x487df7
mov ecx, dword [ebp - 0x81c]
lea edx, [ebp - 0x82c]
push edx
call fcn.00486cc0
cmp byte [ebp - 0x807], 0
je 0x487e12
mov ecx, dword [ebp - 0x814]
lea eax, [ebp - 0x824]
push eax
call fcn.00486cc0
movzx ecx, byte [ebp - 0x806]
movzx eax, byte [ebp - 0x807]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x834]
and ecx, edx
movzx edx, byte [ebp - 0x805]
neg eax
push ecx
sbb eax, eax
lea ecx, [ebp - 0x824]
and eax, ecx
push eax
neg edx
sbb edx, edx
lea eax, [ebp - 0x82c]
and edx, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x487e77
mov ecx, dword [ebp - 0x80c]
mov edx, dword [ebp - 0x810]
push ecx
push edi
push edx
call fcn.00486a20
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497792
mov esp, ebp
pop ebp
ret
Function at 0x487e90
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.0048c7d0
test eax, eax
je 0x487eb4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x487eb4
cmp word [eax], 0
je 0x487eb4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop ebp
ret

Function at 0x488260
Capabilities:
Delete file

Disassembly:
cmp dword [ecx + 4], 0xffffffff
mov dword [ecx], vtable.File.0
je 0x488282
cmp byte [ecx + 0x10], 0
jne 0x488282
cmp byte [ecx + 0x12], 0
je 0x48827d
jmp fcn.00487580
jmp fcn.00486650
ret
Function at 0x488d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
je 0x488f17
mov eax, dword [esi + 0xc]
test eax, eax
je 0x488d7b
dec eax
je 0x488d70
dec eax
jne 0x488d7b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push edi
jmp 0x488d83
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push edi
jmp 0x488d83
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x488dd4
cmp ebx, edi
jle 0x488df5
mov eax, ebx
cmp ebx, 0x4000
jl 0x488da0
mov eax, 0x4000
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
je 0x488df5
add edi, 0x4000
sub ebx, 0x4000
cmp edi, dword [ebp + 0xc]
jl 0x488d91
jmp 0x488ded
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
push edi
lea edx, [ebp - 4]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
jne 0x488f12
cmp byte [esi + 0x14], 0
je 0x488f12
cmp dword [esi + 0xc], 0
jne 0x488f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.004866e0
mov dword [ebp - 0x14], eax
lea eax, [esi + 0x17]
push eax
mov dword [ebp - 0x10], edx
call fcn.00486820
add esp, 4
push edi
mov dword [ebp - 0x1c], eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
cdq
cmp ebx, edx
jl 0x488e7b
jg 0x488e45
cmp dword [ebp - 0x1c], eax
jbe 0x488e7b
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ebx, edi
sub ebx, eax
sbb ecx, edx
test ecx, ecx
jg 0x488e7b
jl 0x488e5c
cmp ebx, 0xffffffff
ja 0x488e7b
add eax, edi
adc edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
js 0x488e7b
jg 0x488e6d
cmp eax, 0xffffffff
jbe 0x488e7b
lea eax, [esi + 0x17]
push eax
mov ecx, 0x4d9ef8
call fcn.0048c480
lea edi, [esi + 0x17]
push edi
mov ecx, 0x4d9ef8
call fcn.0048c1e0
test al, al
je 0x488f02
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x488d80
test eax, eax
je 0x488d80
mov ecx, esi
call fcn.004866e0
mov ecx, dword [esi + 4]
xor ebx, ebx
sub eax, dword [ebp - 4]
sbb edx, ebx
cmp ecx, 0xffffffff
je 0x488d80
mov ebx, edx
push 0
mov dword [ebp - 8], edx
lea edx, [ebp - 8]
push edx
push eax
push ecx
sar ebx, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x488d80
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x488d80
cmp byte [esi + 0x14], 0
je 0x488d80
push edi
mov ecx, 0x4d9ef8
call fcn.0048c4d0
jmp 0x488d80
lea eax, [esi + 0x17]
push eax
push 0
mov ecx, 0x4d9ef8
call fcn.0048c690
mov byte [esi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x489a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4d89dc], 0
jne 0x489a61
call fcn.004899c0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
je 0x489a8b
test dl, 7
je 0x489a8b
movzx ecx, byte [edx]
movzx edi, al
xor ecx, edi
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
inc edx
dec esi
jne 0x489a70
cmp esi, 8
jb 0x489b0f
mov edi, esi
shr edi, 3
xor eax, dword [edx]
add edx, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
sub esi, 8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
mov ecx, eax
movzx eax, cl
mov eax, dword [eax*4 + 0x4d89d8]
xor eax, dword [edx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4d89d8]
dec edi
jne 0x489a95
xor ecx, ecx
test esi, esi
je 0x489b2f
push ebx
movzx edi, byte [ecx + edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4d89d8]
inc ecx
cmp ecx, esi
jb 0x489b16
pop ebx
pop edi
pop esi
pop ebp
ret