joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a7c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7988
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x53f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.00408d90
test al, al
jne 0x44a81a
cmp byte [ebp + 8], al
jne 0x44a821
mov eax, dword [ebx]
test eax, eax
je 0x44a97f
cmp byte [eax + 0xa5], 0
je 0x44a97f
xor al, al
jmp 0x44a993
mov ecx, esi
call fcn.00408d90
test al, al
jne 0x44a97f
mov ecx, esi
call fcn.00427f70
test al, al
je 0x44a847
push esi
push edi
call fcn.0044a3f0
jmp 0x44a97b
push 0xb
mov ecx, esi
call fcn.00408da0
push eax
mov ecx, edi
call fcn.00408da0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x44a86c
mov al, 1
jmp 0x44a97b
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.00408f40
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.00444b10
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.00408f40
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00444b10
test al, al
jne 0x44a8b9
cmp byte [ebp - 0x60], al
je 0x44a8f5
push 0xb
lea ecx, [ebp - 0x40]
call fcn.00408da0
push eax
lea ecx, [ebp - 0x58]
call fcn.00408da0
push eax
call ebx
test eax, eax
je 0x44a8f5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00408e60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00408e60
mov al, 1
jmp 0x44a97b
mov ecx, esi
call fcn.00444510
cmp eax, 0xffffffff
je 0x44a95e
push esi
lea ecx, [ebp - 0x28]
call fcn.00408f60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004448d0
test al, al
je 0x44a952
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004445b0
test al, al
je 0x44a952
mov edx, esi
mov ecx, edi
call fcn.004445b0
lea ecx, [ebp - 0x28]
test al, al
je 0x44a94b
call fcn.004446c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00408e60
jmp 0x44a8d3
mov edx, esi
call fcn.004445b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00408e60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00408e60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00408e60
xor al, al
test al, al
jne 0x44a991
mov ecx, edi
call fcn.00427f70
test al, al
je 0x44a991
mov ecx, edi
call fcn.004446c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9ebd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x460620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3058
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x53f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.00408f60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00427150
lea ecx, [ebp - 0x28]
call fcn.00409670
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x460749
call fcn.00409460
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x46068c
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x4606a6
mov ecx, esi
cmp eax, 8
jb 0x46069b
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x4607c4
mov ecx, esi
cmp eax, 8
jb 0x4606af
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x4606c5
mov ecx, esi
cmp eax, 8
jb 0x4606be
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x46071a
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.00426f30
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x4606e3
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x46071a
mov ecx, esi
cmp eax, 8
jb 0x4606f3
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x46071a
mov ecx, esi
cmp eax, 8
jb 0x460703
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x46071a
cmp eax, 8
jb 0x460710
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x4607a5
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408e60
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9ebd
mov esp, ebp
pop ebp
ret
call fcn.00409670
cmp eax, 2
jne 0x46071a
lea ecx, [ebp - 0x28]
call fcn.00409460
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x460767
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x46071a
mov edx, eax
cmp ecx, 8
jb 0x460777
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x46071a
cmp ecx, 8
jb 0x460784
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x46071a
push 0x51b024
call fcn.00409e30
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x51b024
call fcn.00409cb0
lea ecx, [ebp - 0x28]
call fcn.00408da0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46071a
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x46071c
Function at 0x4611a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x542770], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x542470], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x542670], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x542570], al
inc esi
cmp esi, 0x100
jl 0x4612b0
pop esi
add esp, 0x80
ret
Function at 0x465ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb508
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x53f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call fcn.004d268a
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x465c7a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.0045e2a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00408d90
test al, al
jne 0x465c6b
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x38]
call fcn.00408da0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x465c6b
test esi, esi
je 0x465c6b
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00408e60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9ebd
mov esp, ebp
pop ebp
ret 4

Function at 0x469e50
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fba3b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x53f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0045e660
mov dword [edi], eax
mov dword [ebp - 4], 2
lea ecx, [edi + 8]
call fcn.00408600
mov byte [ebp - 4], 3
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046d330
mov dword [esi], eax
mov byte [ebp - 4], 6
lea ecx, [edi + 0x18]
call fcn.00408600
mov byte [ebp - 4], 7
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046d290
mov dword [esi], eax
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046d1f0
mov dword [esi], eax
mov byte [ebp - 4], 0xd
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046d1f0
mov dword [esi], eax
mov byte [ebp - 4], 0x10
lea esi, [edi + 0x38]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0046d1f0
mov dword [esi], eax
mov byte [ebp - 4], 0x13
lea ecx, [edi + 0x40]
call fcn.0041997d
mov byte [ebp - 4], 0x14
lea ecx, [edi + 0x78]
call fcn.00408f40
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46a010
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbb5b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 8
lea ecx, [ebx + 0x78]
call fcn.00408e60
mov byte [ebp - 4], 7
lea ecx, [ebx + 0x40]
call fcn.00408e60
mov byte [ebp - 4], 6
lea esi, [ebx + 0x38]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.0046cc10
mov byte [ebp - 4], 6
push 0x38
push dword [esi]
call fcn.004c9ffc
add esp, 8
mov byte [ebp - 4], 5
lea esi, [ebx + 0x30]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xc
mov ecx, esi
call fcn.0046cc10
mov byte [ebp - 4], 5
push 0x38
push dword [esi]
call fcn.004c9ffc
add esp, 8
mov byte [ebp - 4], 4
lea esi, [ebx + 0x28]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xe
mov ecx, esi
call fcn.0046cd10
mov byte [ebp - 4], 4
push 0x38
push dword [esi]
call fcn.004c9ffc
add esp, 8
mov byte [ebp - 4], 3
lea edi, [ebx + 0x20]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x11
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.0046d0b0
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 3
push 0x40
push dword [edi]
call fcn.004c9ffc
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x18]
call fcn.004026f0
mov byte [ebp - 4], 1
lea esi, [ebx + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x14
mov ecx, esi
call fcn.0046ce80
mov byte [ebp - 4], 1
push 0x28
push dword [esi]
call fcn.004c9ffc
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.004026f0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0x16
mov ecx, ebx
call fcn.0045e4b0
mov dword [ebp - 4], 0xffffffff
push 0x54
push dword [ebx]
call fcn.004c9ffc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a290
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbbe8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 8]
call fcn.004084b0
lea ecx, [ebx + 0x18]
call fcn.004084b0
lea ecx, [ebx + 0x10]
call fcn.0046ce80
mov esi, dword [ebx + 0x20]
lea ecx, [ebx + 0x20]
push dword [esi + 4]
call fcn.0046d0b0
mov eax, dword [ebx + 0x20]
lea ecx, [ebx + 0x28]
mov dword [eax + 4], esi
mov eax, dword [ebx + 0x20]
mov dword [eax], esi
mov eax, dword [ebx + 0x20]
mov dword [eax + 8], esi
mov dword [ebx + 0x24], 0
call fcn.0046cd10
lea ecx, [ebx + 0x30]
call fcn.0046cc10
push 0
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.0045e660
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 2
lea eax, [ebp - 0x14]
cmp ebx, eax
je 0x46a344
mov eax, dword [ebx]
lea edx, [ebp - 0x10]
mov dword [ebx], ecx
lea ecx, [ebx + 4]
mov dword [ebp - 0x14], eax
call fcn.0042075b
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0045e4b0
mov dword [ebp - 4], 0xffffffff
push 0x54
push dword [ebp - 0x14]
call fcn.004c9ffc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500e2b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x53f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x25c], ebx
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x268], edi
call fcn.00408ad0
mov eax, dword [ebx]
test eax, eax
je 0x4944a3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51c0bc
push eax
call esi
push 0x51c10c
push dword [ebx]
mov dword [ebp - 0x264], eax
call esi
mov ecx, dword [ebp - 0x25c]
mov ebx, eax
push 0x51c0cc
mov dword [ebp - 0x260], ebx
push dword [ecx]
call esi
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x26c], eax
test ecx, ecx
je 0x4944a3
test ebx, ebx
je 0x4944a3
test eax, eax
je 0x4944a3
xor eax, eax
mov dword [ebp - 0x48], 0x6f0053
mov word [ebp - 0x14], ax
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x258]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], 0x740066
push eax
push 0x80000002
mov dword [ebp - 0x40], 0x610077
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], 0x4d005c
mov dword [ebp - 0x34], 0x630069
mov dword [ebp - 0x30], 0x6f0072
mov dword [ebp - 0x2c], 0x6f0073
mov dword [ebp - 0x28], 0x740066
mov dword [ebp - 0x24], 0x43005c
mov dword [ebp - 0x20], 0x460054
mov dword [ebp - 0x1c], 0x54005c
mov dword [ebp - 0x18], 0x500049
call ecx
test eax, eax
jne 0x4944a3
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x250]
push ebx
push eax
call fcn.004ccc90
add esp, 0xc
mov dword [ebp - 0x254], 0x104
lea eax, [ebp - 0x254]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push dword [ebp - 0x258]
call dword [ebp - 0x260]
test eax, eax
jne 0x494497
lea eax, [ebp - 0x284]
push eax
call fcn.0040ade0
add esp, 4
mov dword [ebp - 0x25c], eax
mov ecx, edi
call fcn.00409450
mov esi, eax
nop word [eax + eax]
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x284]
call fcn.00408ef0
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004095e0
mov ecx, dword [ebp - 0x25c]
test al, al
je 0x494440
call fcn.00409460
mov ecx, eax
call fcn.00409460
push dword [esi]
mov edi, eax
push 0x18
call fcn.00402430
add esp, 8
mov ecx, edi
mov edx, eax
call fcn.00409460
push eax
mov ecx, edx
call fcn.00408eb0
add dword [esi], 0x18
mov edi, dword [ebp - 0x268]
jmp 0x49444f
call fcn.00409460
push eax
push dword [esi]
mov ecx, edi
call fcn.004195eb
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.00408e60
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x104
push eax
lea eax, [ebp - 0x250]
inc ebx
push eax
push ebx
push dword [ebp - 0x258]
call dword [ebp - 0x260]
test eax, eax
je 0x4943e0
push dword [ebp - 0x258]
call dword [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9ebd
mov esp, ebp
pop ebp
ret 4
Function at 0x494bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500f78
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x53f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [eax]
xor edi, edi
test eax, eax
je 0x494d60
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51c0bc
push eax
call esi
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x64]
push 0x51c0d8
push dword [eax]
call esi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
push 0x51c0cc
push dword [eax]
call esi
mov esi, eax
cmp dword [ebp - 0x58], edi
je 0x494d60
cmp dword [ebp - 0x68], edi
je 0x494d60
test esi, esi
je 0x494d60
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x40], 0x65004b
mov dword [ebp - 0x3c], 0x620079
mov dword [ebp - 0x38], 0x61006f
mov dword [ebp - 0x34], 0x640072
mov dword [ebp - 0x30], 0x4c0020
mov dword [ebp - 0x2c], 0x790061
mov dword [ebp - 0x28], 0x75006f
mov dword [ebp - 0x24], 0x5c0074
mov dword [ebp - 0x20], 0x720050
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x61006f
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x60], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x5c], edi
push eax
push 0x20019
lea ecx, [ebp - 0x60]
call fcn.004ba320
push eax
call dword [ebp - 0x58]
test eax, eax
jne 0x494d36
mov dword [ebp - 0x44], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x14
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push 0x51b0b4
push dword [ebp - 0x5c]
movups xmmword [ebp - 0x54], xmm0
call dword [ebp - 0x68]
test eax, eax
jne 0x494d31
push 0x10
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004d8612
add esp, 0xc
mov edi, eax
push dword [ebp - 0x5c]
call esi
lea ecx, [ebp - 0x60]
call fcn.004ba4b0
test edi, edi
je 0x494d4d
mov ecx, dword [ebp - 0x64]
push edi
call fcn.00494d80
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004ba4b0
mov eax, edi
jmp 0x494d62
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9ebd
mov esp, ebp
pop ebp
ret
Function at 0x494d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500fb0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x53f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [eax]
mov edi, dword [ebp + 8]
test eax, eax
je 0x494f34
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51c0bc
push eax
call esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x80]
push 0x51c0d8
push dword [eax]
call esi
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x80]
push 0x51c0cc
push dword [eax]
call esi
cmp dword [ebp - 0x60], 0
mov esi, eax
je 0x494f34
cmp dword [ebp - 0x84], 0
je 0x494f34
test esi, esi
je 0x494f34
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x48], 0x65004b
mov dword [ebp - 0x44], 0x620079
mov dword [ebp - 0x40], 0x61006f
mov dword [ebp - 0x3c], 0x640072
mov dword [ebp - 0x38], 0x4c0020
mov dword [ebp - 0x34], 0x790061
mov dword [ebp - 0x30], 0x75006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x750053
mov dword [ebp - 0x24], 0x730062
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x73
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x7c], 0
push eax
push 0x20019
lea ecx, [ebp - 0x80]
call fcn.004ba320
push eax
call dword [ebp - 0x60]
test eax, eax
je 0x494f25
lea ecx, [ebp - 0x78]
call fcn.00408f40
mov byte [ebp - 4], 1
lea eax, [ebp - 0x78]
push edi
push str._08x
push eax
call fcn.00427420
add esp, 0xc
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x14
xorps xmm0, xmm0
lea ecx, [ebp - 0x78]
movups xmmword [ebp - 0x5c], xmm0
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
call fcn.00408da0
push eax
push dword [ebp - 0x7c]
call dword [ebp - 0x84]
test eax, eax
jne 0x494f14
push 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004d8612
add esp, 0xc
mov edi, eax
push dword [ebp - 0x7c]
call esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.00408e60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.004ba4b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9ebd
mov esp, ebp
pop ebp
ret 4

Function at 0x494f60
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x53f00c]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.004ccc90
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x494fbc
cmp dword [esp + 4], 6
jb 0x494fbc
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c9ebd
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.004c9ebd
add esp, 0x118
ret
Function at 0x495900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x230
mov eax, dword [0x53f00c]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
mov ebx, dword [esp + 0x240]
push ebp
mov ebp, dword [esp + 0x240]
push edi
mov edi, dword [esp + 0x240]
test edi, edi
je 0x495a38
mov eax, dword [ecx]
test eax, eax
je 0x495a38
push esi
push 0x51c0d8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x495a37
push 0x208
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004ccc90
add esp, 0xc
mov dword [esp + 0x10], 0x208
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
call fcn.00408da0
push eax
push edi
call esi
lea eax, [esp + 0x34]
push eax
call fcn.00409e30
add esp, 4
lea ecx, [ebx + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00409680
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push str.Profile
push edi
call esi
lea eax, [esp + 0x34]
push eax
call fcn.00409e30
add esp, 4
lea ecx, [ebx + 0x50]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00409680
xor eax, eax
mov dword [esp + 0x14], 0x65004b
mov word [esp + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebx
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], 0x620079
push eax
push edi
mov dword [esp + 0x34], 0x61006f
mov dword [esp + 0x38], 0x640072
mov dword [esp + 0x3c], 0x61004c
mov dword [esp + 0x40], 0x6f0079
mov dword [esp + 0x44], 0x740075
mov dword [esp + 0x28], 4
call esi
pop esi
mov ecx, dword [esp + 0x238]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c9ebd
add esp, 0x230
ret 0xc