joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492860
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x5622d8
mov dword [0x562050], 0
call fcn.00496af0
test al, al
je 0x492880
xor edx, edx
jmp 0x49288f
push 0
push str.DiskPartSetupWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov edx, eax
mov ecx, 0x562058
mov dword [0x562054], edx
push esi
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4928a0
sub ecx, esi
sar ecx, 1
jne 0x4928bc
call fcn.00491e50
mov edx, dword [0x562054]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
test edx, edx
je 0x492909
push 0
push 0
push 0x7e9
push edx
call esi
mov eax, dword [0x562050]
add eax, 1
mov dword [0x562050], eax
jns 0x4928e5
xor eax, eax
jmp 0x4928ef
cmp eax, 0x64
jle 0x4928f4
mov eax, 0x64
mov dword [0x562050], eax
mov ecx, dword [0x562054]
test ecx, ecx
je 0x492909
push eax
push 0
push 0x7e8
push ecx
call esi
push edi
push 0
mov dword [0x562264], 0
mov dword [0x562268], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
push 0xcd
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x492963
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x492963
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov dword [0x562264], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x562268], eax
jmp 0x492968
mov eax, dword [0x562268]
cmp dword [0x562264], 0
pop edi
jne 0x49297f
mov eax, dword [0x562054]
test eax, eax
je 0x492998
push 8
jmp 0x49298e
test eax, eax
jne 0x4929b7
mov eax, dword [0x562054]
test eax, eax
je 0x492998
push 9
push 0
push 0x7e9
push eax
call esi
call fcn.00481d30
push str.runInstaller_openEmbeddedFilesArchive_false
push str.Diskpart___SetupHelper
push eax
call fcn.00481ee0
add esp, 0xc
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x5622d8
call fcn.00496af0
push 0
test al, al
je 0x4929d3
call fcn.00490690
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push fcn.00490690
push 0
push 0
call fcn.004e4b20
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x492a00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50de62
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x558384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x562058
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492a30
sub ecx, edx
sar ecx, 1
jne 0x492a46
call fcn.00491e50
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x562058
call esi
test eax, eax
je 0x492a8e
lea eax, [ebp - 0x10]
push eax
call fcn.00491ac0
add esp, 4
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x492a73
mov byte [0x562260], 1
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x492a8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x5622d8
call fcn.00496af0
test al, al
je 0x492afe
call fcn.00481d30
push str.runSetup_silent
push str.Diskpart___SetupHelper
push eax
call fcn.00481ee0
add esp, 0xc
call fcn.00492070
test al, al
je 0x492ae7
call fcn.00481d30
push str.runSetup_isLowerSetup
push str.Diskpart___SetupHelper
push eax
call fcn.00481ee0
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00492860
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00481d30
push str.runSetup_window
push str.Diskpart___SetupHelper
push eax
call fcn.00481ee0
add esp, 0xc
push 0
push str.DiskPartSetupWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x492b57
push eax
call fcn.00483490
call fcn.00481d30
push str.runSetup_window_already_exist
push str.Diskpart___SetupHelper
push eax
call fcn.00481ee0
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x56469c
push 0x28
call fcn.004bd1fd
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x492b7f
mov ecx, eax
call fcn.004b1ea0
mov esi, eax
jmp 0x492b81
xor esi, esi
push 0
push 0
push 0x86020000
push 0x529860
push 0
push esi
push str.SetupWnd.xml
push str.SetupWnd
mov dword [ebp - 4], 0xffffffff
call fcn.004039e0
add esp, 0x20
test eax, eax
jne 0x492bce
test esi, esi
je 0x492bbc
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x494ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e076
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x558384]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x494b8c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x494b8c
call fcn.00487860
mov edi, eax
jmp 0x494cab
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x494baf
call fcn.00487860
jmp 0x494c9e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x494bcd
call fcn.00487860
jmp 0x494c9e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x494bee
mov edi, 0x8007000e
jmp 0x494ca0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x494ce4
jb 0x494c0c
cmp eax, 0xffffffff
ja 0x494ce4
cmp eax, 0x400
jbe 0x494c21
push eax
lea ecx, [ebp - 0x418]
call fcn.00493cd0
jmp 0x494c47
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x494c47
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x494c5e
mov edi, 0x8007000e
jmp 0x494ca0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x494c7e
call fcn.00487860
jmp 0x494c9e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00494940
mov edi, eax
test esi, esi
je 0x494cab
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x494cc4
lea ecx, [ebp - 0x418]
call fcn.00494030
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bd1b9
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004818f0
int3
Function at 0x4962c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e198
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x558384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push esi
push 0x516d28
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.0048c7b0
add esp, 0xc
mov ecx, esi
xor edi, edi
call fcn.00496730
test al, al
je 0x496469
xor eax, eax
mov dword [ebp - 0x44], vtable.WTL::CMessageLoop.0
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov edi, dword [0x562274]
add edi, 0x10
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x5622d0]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [esi + 8]
push 4
inc eax
push eax
push dword [esi]
call fcn.004e4dd3
add esp, 0xc
test eax, eax
je 0x4963b7
mov dword [esi], eax
mov eax, dword [esi + 8]
push 4
inc eax
push eax
push dword [esi + 4]
call fcn.004e4dd3
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4963b7
mov eax, dword [esi + 8]
mov dword [esi + 4], ecx
lea edx, [eax*4]
mov eax, dword [esi]
add eax, edx
je 0x4963a8
mov dword [eax], ebx
mov ecx, dword [esi + 4]
lea eax, [edx + ecx]
test eax, eax
je 0x4963b4
lea ecx, [ebp - 0x44]
mov dword [eax], ecx
inc dword [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
xor esi, esi
mov ebx, 1
jmp 0x4963d0
test ebx, ebx
je 0x4963f9
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x4963f9
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
push esi
inc esi
mov edx, dword [eax + 8]
call edx
test eax, eax
jne 0x4963d4
xor ebx, ebx
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x4963d0
test eax, eax
je 0x49644d
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x44]
call dword [eax + 4]
test eax, eax
jne 0x496437
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x44]
call dword [eax + 0xc]
test eax, eax
je 0x4963d0
jmp 0x4963c4
mov edi, dword [ebp - 0x20]
mov ecx, 0x56229c
call fcn.00496190
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.00496010
call fcn.0040e6b0
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a02f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx + 9]
push eax
lea ecx, [esi + 0x44]
mov dword [ebp - 4], esi
call fcn.0049f410
movzx eax, byte [ebx + 8]
lea ecx, [esi + 0x50]
push eax
call fcn.0049f410
lea edi, [esi + 0x74]
mov ecx, edi
call fcn.0049f4a0
push 0x88
call fcn.004bcee7
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
je 0x4a03f4
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov byte [esi + 0x4c], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi], vtable.NCoderMixer2::CCoderMT.0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov byte [esi + 0x68], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
jmp 0x4a03f6
xor esi, esi
mov ecx, dword [edi + 4]
lea eax, [ecx + 1]
mov dword [edi + 4], eax
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x20], eax
mov edi, dword [ebx]
test edi, edi
je 0x4a0416
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4a0423
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x18], edi
mov edi, dword [ebx + 4]
test edi, edi
je 0x4a0433
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4a0440
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [esi + 0x1c], edi
pop edi
mov al, byte [eax + 0x5c]
mov byte [esi + 0x68], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a436c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub dword [esp + 4], 0xc
jmp method.CFilterCoder.virtual_0

Function at 0x4a5540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ec7b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x558384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.ICompressSetFinishMode.0
mov dword [esi + 8], vtable.ICompressGetInStreamProcessedSize2.0
mov dword [esi + 0xc], vtable.ICompressSetInStream2.0
mov dword [esi + 0x10], vtable.ISequentialInStream.0
mov dword [esi + 0x14], vtable.ICompressSetOutStreamSize.0
mov dword [esi + 0x18], vtable.ICompressSetBufSize.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x48], 0x40000
mov dword [esi + 0x24], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x4c], 0x40000
mov dword [esi + 0x28], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x50], 0x40000
mov dword [esi + 0x2c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x54], 0x40000
mov dword [esi + 0x30], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x58], 0x40000
push 0x48fe00
push 0x4a5530
push 4
push 4
lea eax, [esi + 0xa0]
mov dword [ebp - 4], 0
push eax
mov dword [esi], vtable.NCompress::NBcj2::CDecoder.0
mov dword [esi + 4], vtable.NCompress::NBcj2::CDecoder.1.0
mov dword [esi + 8], vtable.NCompress::NBcj2::CDecoder.2.0
mov dword [esi + 0xc], vtable.NCompress::NBcj2::CDecoder.3.0
mov dword [esi + 0x10], vtable.NCompress::NBcj2::CDecoder.4.0
mov dword [esi + 0x14], vtable.NCompress::NBcj2::CDecoder.5.0
mov dword [esi + 0x18], vtable.NCompress::NBcj2::CDecoder.6.0
call fcn.004bd24d
mov word [esi + 0xb0], 0
mov eax, esi
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a90a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ed48
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x558384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.004a9cc0
add esp, 4
cmp eax, 0xffffffff
je 0x4a90f1
test al, 0x10
je 0x4a90f1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004aa3f0
add esp, 4
test al, al
je 0x4a9112
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004aa1a0
add esp, 4
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
push esi
call fcn.004a86a0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.004a8d20
test eax, eax
js 0x4a915c
mov edx, dword [ebp - 0x18]
lea ecx, [edx - 1]
cmp eax, ecx
jne 0x4a915c
cmp edx, 1
jne 0x4a9150
mov bl, dl
jmp 0x4a929e
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x18], ecx
mov word [eax + ecx*2], dx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
call fcn.004a8640
mov esi, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x1c]
jmp 0x4a9180
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4a924c
call ebx
cmp eax, 0xb7
jne 0x4a91e7
lea ecx, [ebp - 0x60]
call fcn.004a93f0
lea ecx, [ebp - 0x38]
call fcn.004a8700
push 0
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
call fcn.004a95b0
mov byte [ebp - 4], 1
push dword [ebp - 0x38]
test al, al
jne 0x4a91ce
call fcn.004b8926
add esp, 4
jmp 0x4a91e7
mov ebx, dword [ebp - 0x40]
shr ebx, 4
call fcn.004b8926
add esp, 4
and bl, 1
jne 0x4a924c
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x4a92bd
lea ecx, [ebp - 0x1c]
call fcn.004a8d20
mov esi, eax
test esi, esi
js 0x4a92bd
je 0x4a92bd
mov edi, dword [ebp - 0x1c]
cmp esi, 1
jne 0x4a9229
movzx eax, word [edi]
cmp eax, 0x5c
je 0x4a92bd
cmp eax, 0x2f
je 0x4a92bd
lea eax, [esi + 1]
cmp dword [ebp - 0x10], eax
jae 0x4a92bd
cmp esi, dword [ebp - 0x18]
jae 0x4a9180
xor eax, eax
mov dword [ebp - 0x18], esi
mov word [edi + esi*2], ax
jmp 0x4a9175
cmp esi, dword [ebp - 0x24]
jge 0x4a9291
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x28]
lea eax, [eax + esi*2]
add eax, 2
push eax
call fcn.004aa0f0
add esp, 4
test eax, eax
jns 0x4a9272
mov esi, dword [ebp - 0x24]
jmp 0x4a9275
inc esi
add esi, eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
call fcn.004a8d60
push 0
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x4a92bd
cmp esi, dword [ebp - 0x24]
jl 0x4a9257
mov bl, 1
push dword [ebp - 0x28]
call fcn.004b8926
add esp, 4
push dword [ebp - 0x1c]
call fcn.004b8926
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
jmp 0x4a9293
Function at 0x4a92d0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004a9cc0
add esp, 4
cmp eax, 0xffffffff
je 0x4a92fc
test al, 0x10
jne 0x4a92fc
test al, 1
je 0x4a92fc
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4a930c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4a930c
mov al, 1
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x4a9320
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, 0xf0000000
je 0x4a9332
and eax, 0x3fff
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret
Function at 0x4a9cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a9cd3
or eax, eax
pop ebp
ret

Function at 0x4aa000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebx], 0
lea esp, [esp]
mov eax, esi
cmp esi, 0x400000
jbe 0x4aa02f
mov eax, 0x400000
push 0
lea edx, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [ebx], ecx
test eax, eax
je 0x4aa067
test ecx, ecx
je 0x4aa05c
add edi, ecx
sub esi, ecx
mov ecx, dword [ebp - 4]
jne 0x4aa020
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4aa8e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x4aa96f
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x4aa96f
push ebx
push edi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov edx, 2
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea ebx, [ebx]
lea ecx, [edx - 2]
mov eax, esi
shr eax, cl
lea ecx, [edx - 1]
and eax, 1
add edi, eax
mov eax, esi
shr eax, cl
mov ecx, edx
and eax, 1
add dword [ebp - 8], eax
mov eax, esi
shr eax, cl
lea ecx, [edx + 1]
and eax, 1
add edx, 4
add dword [ebp - 4], eax
mov eax, esi
shr eax, cl
and eax, 1
lea ecx, [edx - 2]
add ebx, eax
cmp ecx, 0x20
jb 0x4aa920
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add ecx, ebx
add eax, ecx
add eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ab520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x4ab53d
pop edi
xor eax, eax
pop esi
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
add edx, ebx
mov dword [ebp + 0xc], edx
lea ecx, [ecx]
lea eax, [edi + ebx]
cmp eax, edx
jae 0x4ab566
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x4ab566
inc eax
cmp eax, edx
jb 0x4ab557
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x4ab65c
cmp ecx, 2
jbe 0x4ab5b9
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x4ab648
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 0x10]
add ecx, edi
cmp dword [ebp + 0x18], 0
je 0x4ab5e3
add ebx, ecx
jmp 0x4ab5e5
shr esi, cl
test esi, esi
je 0x4ab57f
cmp esi, 4
ja 0x4ab5d8
cmp esi, 3
je 0x4ab5d8
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x4ab57f
or esi, 8
shr esi, 1
inc edi
jmp 0x4ab550
sub ebx, ecx
test esi, esi
je 0x4ab61b
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x4ab616
mov edx, 0x100
shl edx, cl
mov ecx, dword [ebp + 0x10]
dec edx
xor ebx, edx
add ecx, edi
cmp dword [ebp + 0x18], 0
je 0x4ab614
add ebx, ecx
jmp 0x4ab616
sub ebx, ecx
mov edx, dword [ebp + 0xc]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp + 8]
add edi, eax
jmp 0x4ab550
mov ebx, dword [ebp + 8]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x4ab550
shr esi, cl
mov eax, 2
cmp eax, ecx
mov eax, dword [ebp + 0x14]
pop ebx
sbb ecx, ecx
not ecx
and ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4b0ca0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.004e4b20
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x4b0ccb
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b0cda
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b8028
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4b8e5a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4b8ea9
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b8ea9
cmp esi, dword [ebp + 0x10]
je 0x4b8ea4
push 0x529860
push 1
push edi
push edi
call fcn.004b84ed
jmp 0x4b8eb7
xor eax, eax
inc eax
jmp 0x4b8ebc
mov eax, 0x529860
push eax
push eax
push edi
push edi
call fcn.004b853a
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret