joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472240
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x56a260]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x41c]
test ebx, ebx
push esi
mov esi, dword [esp + 0x424]
je 0x47227d
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47227d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [esi]
test ax, ax
je 0x472330
mov ecx, esi
mov edx, esi
movzx eax, ax
cmp ax, 0x2f
je 0x47229c
cmp ax, 0x5c
jne 0x47229e
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x472290
cmp ecx, esi
je 0x4722e2
sub ecx, esi
sar ecx, 1
push edi
add ecx, ecx
mov edi, ecx
push edi
lea eax, [esp + 0x218]
push esi
push eax
call fcn.004f5c90
lea ecx, [esp + 0x220]
push ecx
push ebx
mov word [esp + edi + 0x228], 0
call fcn.00472240
add esp, 0x14
pop edi
test ebx, ebx
mov word [esp + 8], 0
je 0x472300
push ebx
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.004f2e08
add esp, 0xc
push esi
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004f7452
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x472330
push 0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x418]
pop esi
pop ebx
xor ecx, esp
call fcn.004f2ac1
add esp, 0x414
ret
Function at 0x4785a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x4785af
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x10]
push edi
push 0xc
push ebp
call fcn.0043fd50
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0xc], edi
jne 0x4785cf
pop edi
pop ebp
pop ebx
pop ecx
ret
test byte [esp + 0x1c], 1
mov dword [edi + 4], 0
mov eax, dword [ebx]
mov dword [edi], eax
jne 0x4785f6
mov ecx, dword [ebx]
mov eax, 1
cmp ecx, eax
jle 0x4785f6
lea esp, [esp]
add eax, eax
cmp eax, ecx
jl 0x4785f0
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
push esi
add eax, eax
push eax
push ebp
call fcn.0043fd50
mov esi, eax
add esp, 8
test esi, esi
mov dword [edi + 8], esi
jne 0x478625
push edi
push ebp
call fcn.0043f760
add esp, 8
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [ebx + 8]
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [ecx], ebx
jle 0x478692
mov edx, dword [esp + 0x20]
mov eax, dword [edi]
push 0
push edx
push eax
push ebp
call fcn.0047a450
mov dword [esi], eax
mov eax, dword [edi + 4]
push eax
push ebp
call fcn.0043fed0
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
push ecx
push ebp
call fcn.0043fed0
mov dword [esi + 8], eax
mov dl, byte [edi + 0xc]
and dword [esi + 0x10], 0xfffffffe
mov eax, dword [esi + 0x10]
mov byte [esi + 0xc], dl
mov ecx, dword [edi + 0x10]
xor ecx, eax
and ecx, 2
xor ecx, eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
add ebx, 1
add esp, 0x20
add esi, 0x18
add edi, 0x18
cmp ebx, dword [eax]
jl 0x478632
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4790a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 8]
lea edx, [esi + 0x78]
mov dword [esp + 0x10], eax
xor ecx, ecx
mov eax, edx
lea ecx, [ecx]
cmp dword [eax + 0x10], 0
jle 0x4790cf
cmp dword [eax], ebx
jne 0x4790cf
cmp dword [eax + 4], ebp
je 0x479111
add ecx, 1
add eax, 0x18
cmp ecx, 0xa
jl 0x4790c0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x24]
push edi
push ebp
push ebx
push edx
push eax
call fcn.00479000
mov eax, dword [esp + 0x3c]
add esp, 0x14
test al, al
je 0x47913d
mov ecx, dword [esp + 0x14]
push eax
push ecx
call fcn.00458230
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x74]
mov dword [eax + 0x14], ecx
add dword [esi + 0x74], 1
mov esi, dword [eax + 0x10]
lea ecx, [edx + 8]
mov edx, 0xa
cmp dword [ecx + 8], esi
jne 0x47912e
mov byte [ecx], 0
add ecx, 0x18
sub edx, 1
jne 0x479126
mov eax, dword [eax + 0x10]
pop esi
pop ebp
pop ebx
ret
push edi
push ebp
push ebx
push esi
call fcn.00478e20
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x49baa0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov edx, ecx
mov ebp, ebx
mov dword [esp + 0xc], edx
lea ecx, [ebp + 1]
mov al, byte [ebp]
add ebp, 1
test al, al
jne 0x49bab4
sub ebp, ecx
je 0x49bca2
xor ecx, ecx
push esi
add edx, 8
push edi
mov dword [esp + 0x1c], edx
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], 6
lea ecx, [ecx]
xor edx, edx
mov eax, ecx
div ebp
add ecx, 1
mov eax, ecx
and edi, 0xffffff
add ecx, 1
movsx esi, byte [edx + ebx]
xor edx, edx
div ebp
shl esi, 0x18
or esi, edi
movsx eax, byte [edx + ebx]
shl eax, 0x10
xor eax, esi
and eax, 0xff0000
xor esi, eax
xor edx, edx
mov eax, ecx
div ebp
add ecx, 1
mov eax, ecx
add ecx, 1
movsx edx, byte [edx + ebx]
shl edx, 8
xor edx, esi
and edx, 0xff00
xor esi, edx
xor edx, edx
div ebp
movzx eax, byte [edx + ebx]
xor eax, esi
and eax, 0xff
xor esi, eax
mov eax, dword [esp + 0x1c]
xor dword [eax - 8], esi
xor edx, edx
mov eax, ecx
div ebp
add ecx, 1
mov eax, ecx
and esi, 0xffffff
add ecx, 1
movsx edi, byte [edx + ebx]
xor edx, edx
div ebp
shl edi, 0x18
or edi, esi
mov eax, ecx
add ecx, 1
mov esi, dword [esp + 0x1c]
movsx edx, byte [edx + ebx]
shl edx, 0x10
xor edx, edi
and edx, 0xff0000
xor edi, edx
xor edx, edx
div ebp
movsx eax, byte [edx + ebx]
shl eax, 8
xor eax, edi
and eax, 0xff00
xor edi, eax
xor edx, edx
mov eax, ecx
div ebp
add ecx, 1
mov eax, ecx
movzx edx, byte [edx + ebx]
xor edx, edi
and edx, 0xff
xor edi, edx
xor edx, edx
div ebp
xor dword [esi - 4], edi
and edi, 0xffffff
movsx eax, byte [edx + ebx]
shl eax, 0x18
or edi, eax
add ecx, 1
mov eax, ecx
xor edx, edx
div ebp
add ecx, 1
mov eax, ecx
add ecx, 1
add esi, 0xc
mov dword [esp + 0x1c], esi
movsx edx, byte [edx + ebx]
shl edx, 0x10
xor edx, edi
and edx, 0xff0000
xor edi, edx
xor edx, edx
div ebp
movsx eax, byte [edx + ebx]
shl eax, 8
xor eax, edi
and eax, 0xff00
xor edi, eax
xor edx, edx
mov eax, ecx
div ebp
add ecx, 1
movzx edx, byte [edx + ebx]
xor edx, edi
and edx, 0xff
xor edi, edx
xor dword [esi - 0xc], edi
sub dword [esp + 0x10], 1
jne 0x49bae0
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], esi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
call fcn.004986d0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [edi + esi*4], edx
mov dword [edi + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jb 0x49bc32
mov ebx, edi
lea esi, [ebx + 0x4c]
mov ebp, 4
jmp 0x49bc70
mov edi, 0x80
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
call fcn.004986d0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov dword [esi - 4], eax
mov dword [esi], ecx
add esi, 8
sub edi, 1
jne 0x49bc75
sub ebp, 1
jne 0x49bc70
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x49d230
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [eax]
push edi
lea ecx, [esp + 0x10]
push ecx
mov edi, 1
call fcn.004a6760
mov edx, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0xf003f
push eax
push 0
push esi
push edx
call fcn.0049d170
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49d275
pop edi
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x49d298
xor edi, edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x49d2b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [eax]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 8], 4
call fcn.004a6760
mov edx, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push esi
push edx
call fcn.0049d170
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop esi
jne 0x49d320
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
lea ecx, [esp]
push ecx
push edx
push 0
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x49d326
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x10
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x10

Function at 0x49d340
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [eax]
push edi
lea ecx, [esp + 0x10]
push ecx
mov edi, 1
call fcn.004a6760
mov edx, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0xf003f
push eax
push 0
push esi
push edx
call fcn.0049d170
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49d385
pop edi
xor eax, eax
pop esi
ret 0xc
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x49d39d
xor edi, edi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x49d3b0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [eax]
push edi
lea ecx, [esp + 0x10]
push ecx
mov edi, 1
call fcn.004a6760
mov edx, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0xf003f
push eax
push 0
push esi
push edx
call fcn.0049d170
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49d3f5
pop edi
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
test ecx, ecx
je 0x49d404
mov edx, dword [ecx - 4]
jmp 0x49d406
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
add edx, edx
push edx
push ecx
push 1
push 0
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x49d426
xor edi, edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x49d440
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [eax]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 8], 0
call fcn.004a6760
mov edx, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push esi
push edx
call fcn.0049d170
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49d488
xor eax, eax
pop esi
pop ecx
ret 0x10
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0
push eax
push edx
call ebx
test eax, eax
jne 0x49d50a
mov eax, dword [esp + 0xc]
test eax, eax
ja 0x49d4e7
mov esi, dword [esp + 0x20]
push 0
mov ecx, esi
call fcn.00402700
cmp eax, 1
jne 0x49d4d0
mov ecx, dword [esi]
mov dword [ecx - 4], 0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, 1
pop esi
pop ecx
ret 0x10
push eax
call fcn.004d37a6
mov edx, dword [esp + 0x1c]
add esp, 4
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
mov eax, dword [edi]
push esi
push 0
push 0
push eax
push edx
call ebx
test eax, eax
je 0x49d51e
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0x10
mov ecx, dword [esp + 0x20]
push esi
call fcn.00402060
push esi
call fcn.004d37ab
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, 1
pop esi
pop ecx
ret 0x10
Function at 0x49d6c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 0xffffffffffffffff
push 0x519378
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x1c]
mov dword [edi], 0
call fcn.004a61c0
mov eax, dword [esp + 0x54]
push 0
push 0
push 0
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x5c], 0
call fcn.004a6200
test eax, eax
jne 0x49d741
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4c], 0xffffffff
call fcn.004a6120
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov eax, dword [esp + 0x38]
test eax, eax
mov ecx, dword [esp + 0x34]
mov ebx, ecx
mov dword [esp + 0x18], eax
jg 0x49d759
jl 0x49d71a
test ecx, ecx
jbe 0x49d71a
push 0x8000
call fcn.004d37a6
add esp, 4
mov ebp, eax
mov dword [esp + 0x58], 1
cmp dword [esp + 0x18], 0
jl 0x49d788
jg 0x49d781
cmp ebx, 0x8000
jbe 0x49d788
mov esi, 0x8000
jmp 0x49d78a
mov esi, ebx
push esi
push ebp
lea ecx, [esp + 0x24]
call fcn.004a5fb0
test eax, eax
je 0x49d7e0
xor ecx, ecx
test esi, esi
jle 0x49d7c1
nop
movzx edx, byte [ecx + ebp]
mov eax, dword [edi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x567240]
add ecx, 1
cmp ecx, esi
mov dword [edi], eax
jl 0x49d7a0
mov eax, esi
cdq
sub ebx, eax
mov eax, dword [esp + 0x18]
sbb eax, edx
test eax, eax
mov dword [esp + 0x18], eax
jg 0x49d770
jl 0x49d7da
test ebx, ebx
ja 0x49d770
mov esi, dword [esp + 0x58]
jmp 0x49d7e2
xor esi, esi
push ebp
call fcn.004d37ab
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4c], 0xffffffff
call fcn.004a6120
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret

Function at 0x49d820
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push esi
push 0
push 0x2000000
push 3
push 0
push 3
push DirectSoundEnumerateW
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49d84b
xor eax, eax
pop esi
ret
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
xor eax, eax
or ecx, eax
mov eax, dword [esp + 0x10]
xor edx, edx
or edx, edi
mov dword [eax + 4], ecx
mov ecx, edx
or ecx, dword [eax + 4]
mov dword [eax], edx
pop edi
je 0x49d847
mov eax, 1
pop esi
ret
Function at 0x49d8e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x210
mov eax, dword [0x56a260]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x220]
mov ebx, dword [edi]
mov dword [esp + 0xc], 0
mov edx, 4
mov eax, 0x53161c
mov ecx, ebx
push ebp
mov esi, dword [ecx]
cmp esi, dword [eax]
jne 0x49d92d
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x49d915
test edx, edx
je 0x49d98a
movzx ebp, byte [eax]
movzx esi, byte [ecx]
sub esi, ebp
jne 0x49d97c
sub edx, 1
add eax, 1
add ecx, 1
test edx, edx
je 0x49d98a
movzx ebp, byte [eax]
movzx esi, byte [ecx]
sub esi, ebp
jne 0x49d97c
sub edx, 1
add eax, 1
add ecx, 1
test edx, edx
je 0x49d98a
movzx ebp, byte [eax]
movzx esi, byte [ecx]
sub esi, ebp
jne 0x49d97c
sub edx, 1
add eax, 1
add ecx, 1
test edx, edx
je 0x49d98a
movzx eax, byte [eax]
movzx esi, byte [ecx]
sub esi, eax
je 0x49d98a
test esi, esi
mov eax, 1
jg 0x49d98c
or eax, 0xffffffff
jmp 0x49d98c
xor eax, eax
test eax, eax
pop ebp
mov eax, 2
je 0x49d99a
mov eax, dword [esp + 0xc]
lea ecx, [ebx + eax*2]
push 0x5c
push ecx
mov word [esp + 0x18], 0
call fcn.004f2495
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 8
test eax, eax
je 0x49da1a
lea esp, [esp]
mov ecx, dword [edi]
sub eax, ecx
sar eax, 1
mov esi, eax
push esi
push ecx
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.004f2c24
lea eax, [esp + 0x20]
push 0
push eax
mov word [esp + esi*2 + 0x28], 0
call fcn.004f7a72
add esp, 0x18
cmp eax, 0xffffffff
jne 0x49da05
push 0
lea ecx, [esp + 0x14]
push ecx
call ebx
test eax, eax
je 0x49da93
mov eax, dword [edi]
lea edx, [eax + esi*2 + 2]
push 0x5c
push edx
call fcn.004f2495
add esp, 8
test eax, eax
jne 0x49d9c0
mov edi, dword [edi]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49da21
sub eax, edx
lea ecx, [esp + 0x10]
sar eax, 1
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x49da37
sub ecx, esi
sar ecx, 1
cmp eax, ecx
je 0x49da76
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0046ff60
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.004f7a72
add esp, 0x10
cmp eax, 0xffffffff
jne 0x49da76
push 0
lea edx, [esp + 0x14]
push edx
call ebx
test eax, eax
je 0x49da93
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004f2ac1
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004f2ac1
add esp, 0x210
ret
Function at 0x49e090
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x519458
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x34]
cmp edi, ebx
jne 0x49e0eb
mov esi, dword [esp + 0x30]
push 0x543e10
mov ecx, esi
call fcn.00401f50
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea eax, [esp + 0x14]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
push ebx
lea ecx, [esp + 0x38]
mov esi, eax
mov dword [esp + 0x38], ebx
call fcn.00402700
cmp eax, 1
mov ebp, dword [esp + 0x34]
jne 0x49e112
mov dword [ebp - 4], ebx
cmp esi, ebx
mov dword [esp + 0x28], ebx
jbe 0x49e1b9
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d37a6
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, 1
jne 0x49e1a8
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x54e4a8
push ebx
call sub.VERSION.dll_VerQueryValueW
cmp eax, 1
jne 0x49e1ae
mov edi, dword [esp + 0x38]
test edi, edi
mov eax, dword [esp + 0x18]
je 0x49e17c
mov ecx, 0xd
mov esi, eax
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
lea eax, [esp + 0x44]
push 0x543b80
push eax
call fcn.00402230
mov ebp, dword [esp + 0x4c]
add esp, 0x18
jmp 0x49e1ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call fcn.004d37ab
add esp, 4
xor ebx, ebx
cmp ebp, ebx
mov edi, dword [esp + 0x30]
mov dword [edi], ebx
je 0x49e1c8
mov esi, dword [ebp - 4]
jmp 0x49e1ca
xor esi, esi
push esi
mov ecx, edi
call fcn.00402700
cmp eax, 1
jne 0x49e1ec
mov edx, dword [edi]
push ebp
lea ecx, [esi + 1]
push ecx
push edx
call fcn.004f2e08
mov eax, dword [edi]
add esp, 0xc
mov dword [eax - 4], esi
cmp ebp, ebx
je 0x49e1fc
add ebp, 0xfffffff8
push ebp
call fcn.004d37ab
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x49e330
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x5194d8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
mov eax, dword [edi]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
mov esi, 1
call ebp
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.004f76b4
xor ebx, ebx
add esp, 8
cmp eax, ebx
je 0x49e398
cmp eax, 0xffffffff
jne 0x49e42a
call fcn.004f7d19
cmp dword [eax], 2
je 0x49e42a
push ebx
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], ebx
call fcn.00402700
cmp eax, 1
jne 0x49e3b2
mov edx, dword [esp + 0x54]
mov dword [edx - 4], ebx
mov dword [esp + 0x4c], ebx
mov eax, dword [edi]
push ebx
push eax
lea ecx, [esp + 0x5c]
push str._s.tmp_d
push ecx
call fcn.00402230
mov esi, dword [esp + 0x64]
add esp, 0x10
push esi
call ebp
lea edx, [esp + 0x14]
push edx
push esi
call fcn.004f76b4
add esp, 8
cmp eax, 0xffffffff
jne 0x49e3f0
call fcn.004f7d19
cmp dword [eax], 2
je 0x49e3f8
add ebx, 1
cmp ebx, 0x64
jl 0x49e3b6
mov edi, dword [edi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test esi, esi
mov edi, eax
je 0x49e414
add esi, 0xfffffff8
push esi
call fcn.004d37ab
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x49f540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5196f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x56a260]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.00401bd0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
push 0x2d
mov dword [esp + 0x38], 0
call fcn.00402100
cmp dword [esp + 0x14], 2
je 0x49f5c3
lea ecx, [esp + 0xc]
call fcn.00425530
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004d37ab
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
mov esi, dword [eax]
cmp esi, eax
jne 0x49f5d2
call fcn.004f2608
mov eax, dword [esi + 8]
push 0x10
push 0
push eax
call fcn.004f7f7d
add esp, 0xc
cmp esi, dword [esp + 0x10]
mov edi, eax
jne 0x49f5ef
call fcn.004f2608
mov esi, dword [esi]
cmp esi, dword [esp + 0x10]
jne 0x49f5fc
call fcn.004f2608
mov eax, dword [esi + 8]
push 0x10
push 0
push eax
call fcn.004f7f7d
xor ecx, ecx
xor edx, edx
or eax, edx
or ecx, edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
mov eax, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.004f7538
add esp, 0x14
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [esp + 0xc]
add esi, 1
call fcn.00425530
mov edx, dword [esp + 0x10]
push edx
call fcn.004d37ab
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret

Function at 0x4a3200
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
push esi
push 0x44
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
call fcn.004f5b00
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
or dword [esp + 0x4c], 0x101
add esp, 0xc
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], eax
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x4a3285
mov edx, dword [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret 8