joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, esp
push 0x403
push 0x6e0b70
push 0x6e0c91
push eax
call fcn.005080c0
add esp, 0x10
xor ebx, ebx
mov ecx, esi
push ebx
lea eax, [esp + 4]
push eax
call fcn.004fdc20
cmp byte [edi + 0xb], 0
jns 0x4884f1
mov edi, dword [edi]
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x6d5a80]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x48853a
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x4885ac
call fcn.005080f0
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
dec esi
cmp dword [ebp + 0x10], 0
js 0x488578
lea eax, [ebx + 1]
cmp eax, 2
jb 0x488578
mov eax, dword [ebp + 0xc]
xor edi, edi
dec edi
mov dword [esp], edi
push 0
lea ecx, [esp + 4]
push ecx
mov esi, dword [ebp + 0x10]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, esi
cmove edi, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edi
lea eax, [ebx + 1]
cmp eax, 2
jb 0x48858e
call fcn.005080f0
push ebx
call fcn.004f9550
add esp, 4
lea ecx, [esp + 0x10]
call fcn.004fdc90
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x488533

Function at 0x4885b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x43c
push 0x6e0b70
push 0x6e0c9b
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004fdc20
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.00553af0
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x488676
push ebx
call fcn.0056ac44
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.00508430
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.00491d10
mov ecx, dword [ebp + 8]
push ebx
call fcn.00508590
mov ecx, ebx
call fcn.00508510
mov ecx, edi
call fcn.00508510
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.004fdc90
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4886a0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x44c
push 0x6e0b70
push 0x6e0cb0
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004fdc20
cmp byte [edi + 0xb], 0
jns 0x4886fc
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.004fdc90
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x488ad0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.00553af0
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.00488de0
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.00488f80
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x488b3d
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x488c38
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.00553af0
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00488f40
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x488c8f
mov ecx, ebx
call fcn.00488cf0
test al, al
jne 0x488c3c
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x488b9e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x488c34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x488bc1
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00410a30
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00488f80
lea ecx, [ebp - 0x500]
push ebx
call fcn.00508590
mov ecx, ebx
call fcn.00508510
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x488bfd
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x488b4d
lea ecx, [ebp - 0x500]
call fcn.00508510
lea ecx, [ebp - 0x2a4]
call fcn.00488ed0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x488bc1
xor esi, esi
jmp 0x488c07
xor esi, esi
cmp byte [ebp + 8], 0
je 0x488bc1
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.00488ad0
add esp, 4
test eax, eax
jne 0x488bbf
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x488c7b
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x488bc1
jmp 0x488bad
cmp byte [ebp + 8], 0
jne 0x488cc2
lea ecx, [ebp - 0x4f4]
call fcn.00488cf0
test al, al
je 0x488cbc
lea ecx, [ebp - 0x4f4]
call fcn.00488cf0
test al, al
je 0x488b89
jmp 0x488c34
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x488cd3
lea ecx, [ebp - 0x500]
jmp 0x488cd9
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x488b7a
Function at 0x489860
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
call fcn.0050b130
mov ecx, eax
push 0x6e9170
call fcn.0050b610
test al, al
jne 0x489887
cmp byte [0x75ab38], 1
je 0x4898a2
pop ebp
jmp fcn.00484200
call fcn.00484200
mov ecx, 0x20000000
cmp eax, 0x20000000
cmovae eax, ecx
test edx, edx
cmovne eax, ecx
xor edx, edx
jmp 0x4898b4
mov eax, dword [0x75ab30]
mov edx, dword [0x75ab34]
shld edx, eax, 0x14
shl eax, 0x14
pop ebp
ret

Function at 0x48a280
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov dword [esp + 4], edx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x98], eax
xor ebx, ebx
test ecx, ecx
je 0x48a3ee
push ebx
push ebx
push ecx
mov dword [esp + 0x14], ecx
call fcn.00561924
add esp, 0xc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x20]
push 0x51
push 0x6e0d82
push 0x6e0da0
push esi
call fcn.005080c0
add esp, 0x10
mov ecx, edi
push ebx
push esi
call fcn.004fdc20
mov dword [esi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push dword [esp + 8]
call fcn.005618fd
add esp, 4
push eax
call fcn.005623ca
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x48a406
mov eax, dword [esp + 0x44]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x40]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 4]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x18]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0xc]
call dword [0x74e248]
mov eax, dword [esp + 0x10]
push edi
push eax
push ebx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 8]
push edi
push 1
push eax
call fcn.00568d56
add esp, 0x10
test eax, eax
je 0x48a3ae
mov ebx, eax
mov eax, dword [esp + 4]
sub eax, esi
cmp eax, ebx
jb 0x48a410
add ebx, esi
push dword [esp + 8]
call fcn.005686cc
add esp, 4
test eax, eax
je 0x48a418
mov esi, ebx
push dword [esp + 8]
call fcn.005686f8
add esp, 4
test eax, eax
sete bl
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x74e248]
mov eax, dword [esp + 0x94]
lea edx, [esp + 0x10]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x60]
call fcn.004fdc90
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x48a342
xor ebx, ebx
mov esi, dword [esp + 4]
jmp 0x48a3bf
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x94], eax
mov ecx, dword [ebp + 0xc]
call dword [0x74e248]
mov eax, dword [esp + 0x94]
lea esi, [esp + 0x10]
push dword [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov esi, ebx
jmp 0x48a378
Function at 0x4901d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00490350
mov eax, dword [edi]
mov dword [0x7561b4], eax
mov bl, 1
test al, 1
jne 0x49020c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x75abd4]
test eax, eax
je 0x490236
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x75abd4], 0
cmp dword [0x75abd8], 0
jne 0x490236
and byte [0x7561b4], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x490253
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x490248
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x4902be
mov dword [0x75abd4], eax
jmp 0x4901f8
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x49025e
mov eax, dword [edi + 8]
test eax, eax
je 0x4902ff
lea esi, [edi + 4]
mov ecx, dword [0x75abd8]
test ecx, ecx
jne 0x490292
push 0xc
call fcn.0054fbd9
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x75abd8], eax
push esi
call fcn.004e6d10
cmp dword [edi + 0x14], 0
jne 0x4902b2
mov eax, dword [0x75abd8]
cmp byte [eax + 0xb], 0
jns 0x4902ab
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.005cc650
mov ebx, eax
jmp 0x4901f8
lea eax, [ebp - 0x24]
push 0x232
push 0x6e16c0
push 0x6e16d6
push eax
call fcn.005080c0
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push 0x6e16fc
push esi
call fcn.005cede0
add esp, 0x10
mov ecx, esi
call fcn.005cf040
mov eax, dword [edi + 0x18]
jmp 0x49024c
lea ebx, [ebp - 0x24]
push 0x238
push 0x6e16c0
push 0x6e16d6
push ebx
call fcn.005080c0
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push 0x6e171b
push esi
call fcn.005cede0
add esp, 0x10
mov ecx, esi
push 0x6e173b
call fcn.005cc620
mov ecx, esi
call fcn.005cf040
jmp 0x490266
Function at 0x4923d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
xor eax, eax
mov dword [ecx], eax
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4923f0
call fcn.005080f0
cmp dword [esi], ebx
je 0x492419
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x492451
cmp edi, 2
jb 0x492412
mov dword [esi], ebx
mov edi, eax
call fcn.005080f0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
call fcn.005083a0
lea ecx, [esi + 0x10]
call fcn.00516880
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
lea edi, [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 0x19], al
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x49246e
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ebp - 0x10], eax
call fcn.005080f0
push dword [esi]
call fcn.004f9550
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x492402
call fcn.005080f0
push dword [edi]
call fcn.004f9550
add esp, 4
jmp 0x492445

Function at 0x4927a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.00550f70
mov esi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.004ffb60
add esp, 0xc
test esi, esi
je 0x492859
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.00553af0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x492805
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x49282b
cmp eax, 0x7fff
jae 0x492882
push esi
push eax
push edi
call fcn.0048e8b0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x492842
push dword [ebp - 0x1001c]
call fcn.0054fc10
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x49286a
lea eax, [ebp - 0x1001c]
jmp 0x492870
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x49282b
int3
Function at 0x492df0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x75ac60]
test ebx, ebx
jne 0x492e74
push 0x28
call fcn.0054fbd9
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.0054fbd9
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x492e7e
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x75ac60], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x492e7e
mov edi, eax
push eax
call fcn.0056ac44
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00492e80
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4988c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x4989f9
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x74e248]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x74e248]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x74e248]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x498991
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x498985
push 1
call fcn.00520830
add esp, 4
bt eax, 0x19
jae 0x498a2c
not eax
test eax, 0x12000000
lea edi, [ebp - 0x20]
mov ebx, dword [ebp - 0x44]
jne 0x4989fd
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403290
add esp, 0xc
mov eax, 0x401cd0
mov ecx, 0x401140
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edi]
movups xmmword [ebx], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4989e5
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00402f80
jmp 0x4989c3
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.005cfc40
add esp, 0xc
mov eax, 0x5d07d0
mov ecx, 0x5cfb50
jmp 0x498a4b
bt eax, 9
jae 0x498a0e
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00404020
add esp, 0xc
xor eax, eax
mov ecx, 0x4040d0
lea edi, [ebp - 0x20]
mov ebx, dword [ebp - 0x44]
jmp 0x4989d0
Function at 0x4a6c00
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
jns 0x4a6c19
mov ecx, dword [ecx]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], edx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [esi]
cmp ebx, eax
je 0x4a6c5f
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4a6cb9
lea eax, [edi + 1]
cmp eax, 2
jb 0x4a6c56
mov dword [esi], edi
call fcn.005080f0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esi]
lea eax, [ebx + 1]
cmp eax, 2
jae 0x4a6c73
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
mov eax, esi
add eax, 1
mov edx, dword [ebp - 0x14]
mov ecx, edx
adc ecx, 0x80000000
cmp eax, 2
sbb ecx, 0
jae 0x4a6c99
xor eax, eax
test edx, edx
setns al
neg eax
jmp 0x4a6ca7
push 0
push 0x3e8
push edx
push esi
call fcn.0057a860
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
sete al
jmp 0x4a6c69
call fcn.005080f0
push dword [esi]
call fcn.004f9550
add esp, 4
mov dword [esi], 0
jmp 0x4a6c47

Function at 0x4a9800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x4a98d9
cmp dword [esi], 0
jne 0x4a98d9
cmp dword [esi + 0xc], 0
jne 0x4a98d9
xor eax, eax
cmp dword [esi + 4], 0
jne 0x4a98d9
mov ebx, dword [edi]
cmp eax, ebx
je 0x4a9863
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4a98a9
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4a9859
mov dword [esi], ebx
call fcn.005080f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x4a9896
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x4a98c0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4a988c
mov dword [esi + 4], ebx
call fcn.005080f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005080f0
push dword [esi]
call fcn.004f9550
add esp, 4
mov dword [esi], 0
jmp 0x4a984a
call fcn.005080f0
push dword [esi + 4]
call fcn.004f9550
add esp, 4
mov dword [esi + 4], 0
jmp 0x4a987c
mov ecx, esi
call fcn.0063f3a0
mov eax, dword [esi]
jmp 0x4a9834
Function at 0x4ae2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x15bc]
mov ebx, dword [ecx + 0x15c0]
add ebx, eax
mov eax, dword [ecx + 0x15b4]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x4ae2d6
push dword [ebp + 8]
call fcn.004c4260
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x54], 0x343677
mov dword [esp + 0x50], 0x6f777369
lea eax, [esp + 0x50]
push eax
call fcn.00410a30
add esp, 4
cmp ebx, edi
jbe 0x4ae336
push ebx
call fcn.004c4290
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
lea eax, [esp + 0x40]
push eax
call fcn.00410a30
add esp, 4
mov eax, dword [esi + 0x15c4]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
lea eax, [esp + 0x30]
push eax
call fcn.00410a30
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x15b4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
lea eax, [esp + 0x10]
push eax
call fcn.00410a30
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
lea eax, [esp + 0x20]
push eax
call fcn.00410a30
add esp, 4
mov ecx, dword [0x76c304]
test ecx, ecx
je 0x4ae409
call dword [0x74e248]
push esi
call ecx
add esp, 4
push esi
call fcn.004a7ff0
int3
Function at 0x4b5990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x754040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x4b59c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x4b5ad0
push 0
push eax
push 0x4b5920
push 0x769900
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4b5ac8
cmp dword [0x769904], 0
jne 0x4b59ac
push dword [0x769908]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b59ac
mov esi, eax
mov eax, 0x76990c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x769910]
mov ebx, dword [0x769914]
mov eax, dword [0x769918]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x76991c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x769920]
mov dword [ebp - 0x24], eax
mov eax, 0x76990c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x4b5aae
test ebx, ebx
jne 0x4b5a9b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4b5a66
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x4b5a77
test ebx, ebx
jne 0x4b5a88
push esi
call fcn.00495590
add esp, 4
jmp 0x4b59ac
mov edi, dword [esi + 8]
call dword [0x74e248]
push edi
call ecx
add esp, 4
jmp 0x4b5a4a
mov edi, dword [esi + 0xc]
call dword [0x74e248]
push edi
call ecx
add esp, 4
jmp 0x4b5a54
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x74e248]
push edi
call ebx
add esp, 4
jmp 0x4b5a58
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x74e248]
push edi
call ebx
add esp, 4
jmp 0x4b5a43
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x74e248]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x4b5a3f
call fcn.0056410f
int3