joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x211
push 0x6d1c40
push 0x6d1c84
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e8e00
cmp byte [edi + 0xb], 0
jns 0x48b4ac
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004e8e70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48b4e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x21a
push 0x6d1c40
push 0x6d1df5
push esi
call fcn.004f2b50
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.004e8e00
cmp byte [edi + 0xb], 0
jns 0x48b541
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x48b5d7
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x48b59a
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x48b5d3
call fcn.004f2b80
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x48b5b5
call fcn.004f2b80
push esi
call fcn.004e4b30
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x48b593
xor ebx, ebx
jmp 0x48b5b5
Function at 0x48b5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x239
push 0x6d1c40
push 0x6d1c8f
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e8e00
cmp byte [edi + 0xb], 0
jns 0x48b63c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004e8e70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48b670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.00544260
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x48b6f3
push ebx
call fcn.0055b404
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.004f2ed0
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00496330
mov ecx, dword [ebp + 8]
push ebx
call fcn.00495930
mov ecx, ebx
call fcn.004f2fc0
mov ecx, edi
call fcn.004f2fc0
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48b720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.00544260
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x6d1c30]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x48b79d
cmp word [ebp - 0x214], 0
je 0x48b79d
push edi
call fcn.0055b404
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004f2ed0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.004f2e40
push edi
call fcn.0048b670
add esp, 4
mov ecx, esi
test al, al
jne 0x48b7d2
push 3
push 0x6d1ca0
call fcn.004f2ed0
jmp 0x48b7d8
push edi
call fcn.004f2ea0
lea ecx, [ebp - 0x220]
call fcn.004f2fc0
jmp 0x48b787
Function at 0x48bb30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x748b10], 0
jne 0x48bd54
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2bf
push 0x6d1c40
push 0x6d1cea
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e8e00
cmp dword [ebp + 8], 0
je 0x48bd58
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
call fcn.004f2e40
push esi
push 0x65
call fcn.0048d830
add esp, 8
test al, al
je 0x48bc4a
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push 0x6d1cfe
push ebx
call fcn.004961f0
mov ecx, esi
push ebx
call fcn.00495930
mov ecx, ebx
call fcn.004f2fc0
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x40]
push 0x211
push 0x6d1c40
push 0x6d1c84
push edi
call fcn.004f2b50
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.004e8e00
cmp byte [esi + 0xb], 0
jns 0x48bc31
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.004e8e70
cmp esi, 0xffffffff
jne 0x48bcff
lea ecx, [esp + 4]
call fcn.004f2fc0
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ebx, [esp + 4]
mov ecx, ebx
call fcn.004f2e40
push ebx
push 0x67
call fcn.0048d830
add esp, 8
test al, al
je 0x48bcf2
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x211
push 0x6d1c40
push 0x6d1c84
push edi
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.004e8e00
cmp byte [esp + 0xf], 0
jns 0x48bcc3
mov ebx, dword [esp + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.004e8e70
cmp ebx, 0xffffffff
je 0x48bcf2
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.0048b4e0
add esp, 4
test al, al
jne 0x48bd1d
lea ecx, [esp + 4]
call fcn.004f2fc0
xor ebx, ebx
jmp 0x48bd33
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.0048b4e0
add esp, 4
test al, al
je 0x48bc4a
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.004f2fe0
mov ecx, esi
call fcn.004f2fc0
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.004e8e70
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x48bd3c
int3
Function at 0x48c380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, esp
push 0x401
push 0x6d1c40
push 0x6d1d7b
push eax
call fcn.004f2b50
add esp, 0x10
xor ebx, ebx
mov ecx, esi
push ebx
lea eax, [esp + 4]
push eax
call fcn.004e8e00
cmp byte [edi + 0xb], 0
jns 0x48c3e1
mov edi, dword [edi]
sub esp, 0x1c
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x6c5a80]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x48c42a
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x48c49c
call fcn.004f2b80
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
dec esi
cmp dword [ebp + 0x10], 0
js 0x48c468
lea eax, [ebx + 1]
cmp eax, 2
jb 0x48c468
mov eax, dword [ebp + 0xc]
xor edi, edi
dec edi
mov dword [esp], edi
push 0
lea ecx, [esp + 4]
push ecx
mov esi, dword [ebp + 0x10]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, esi
cmove edi, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edi
lea eax, [ebx + 1]
cmp eax, 2
jb 0x48c47e
call fcn.004f2b80
push ebx
call fcn.004e4b30
add esp, 4
lea ecx, [esp + 0x10]
call fcn.004e8e70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x48c423

Function at 0x48c4a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x43a
push 0x6d1c40
push 0x6d1d85
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e8e00
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.00544260
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x48c566
push ebx
call fcn.0055b404
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.004f2ed0
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.00496330
mov ecx, dword [ebp + 8]
push ebx
call fcn.00495930
mov ecx, ebx
call fcn.004f2fc0
mov ecx, edi
call fcn.004f2fc0
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48c590
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x44a
push 0x6d1c40
push 0x6d1d9a
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004e8e00
cmp byte [edi + 0xb], 0
jns 0x48c5ec
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov ecx, esi
call fcn.004e8e70
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48c9e0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4fc
mov ebx, edx
mov edi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.00544260
add esp, 0xc
mov ecx, esi
push ebx
push 3
push 0
push edi
call fcn.0048cca0
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.0048cea0
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x48ca47
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x48cb44
mov dword [ebp - 0x508], ebx
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.00544260
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0048ce60
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x48cb4c
mov ecx, ebx
call fcn.0048cc10
test al, al
jne 0x48cba3
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x48caae
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x48cb48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x48cad1
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00411680
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0048cea0
lea ecx, [ebp - 0x500]
push ebx
call fcn.00495930
mov ecx, ebx
call fcn.004f2fc0
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x48cb0d
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x48ca5d
lea ecx, [ebp - 0x500]
call fcn.004f2fc0
lea ecx, [ebp - 0x2a4]
call fcn.0048cdf0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 0x4fc
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x48cb17
xor esi, esi
jmp 0x48cad1
cmp byte [ebp + 8], 0
jne 0x48cb7c
lea ecx, [ebp - 0x4f4]
call fcn.0048cc10
test al, al
je 0x48cb76
lea ecx, [ebp - 0x4f4]
call fcn.0048cc10
test al, al
je 0x48ca99
jmp 0x48cb48
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x48cb8d
lea ecx, [ebp - 0x500]
jmp 0x48cb93
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x48ca8a
xor esi, esi
cmp byte [ebp + 8], 0
je 0x48cad1
lea ecx, [ebp - 0x500]
mov dword [ebp - 0x504], ecx
mov edx, dword [ebp - 0x508]
push 1
call fcn.0048c9e0
add esp, 4
mov esi, eax
test eax, eax
jne 0x48cad1
cmp byte [ebp - 0x4f5], 0
jns 0x48cbea
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x504], eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x48cad1
jmp 0x48cabd
Function at 0x48d7d0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
call fcn.004f5ac0
mov ecx, eax
push 0x6d9ee0
call fcn.004f5ad0
test al, al
jne 0x48d7f7
cmp byte [0x748b28], 1
je 0x48d812
pop ebp
jmp fcn.004881f0
call fcn.004881f0
mov ecx, 0x20000000
cmp eax, 0x20000000
cmovae eax, ecx
test edx, edx
cmovne eax, ecx
xor edx, edx
jmp 0x48d824
mov eax, dword [0x748b20]
mov edx, dword [0x748b24]
shld edx, eax, 0x14
shl eax, 0x14
pop ebp
ret
Function at 0x48f210
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0xc], edx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0xa8], eax
xor ebx, ebx
test ecx, ecx
je 0x48f38a
push ebx
push ebx
push ecx
mov dword [esp + 0x1c], ecx
call fcn.00552094
add esp, 0xc
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x30]
push 0x50
push 0x6d1f5f
push 0x6d1f7d
push edi
call fcn.004f2b50
add esp, 0x10
mov ecx, esi
push ebx
push edi
call fcn.004e8e00
mov dword [edi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
push dword [esp + 0x10]
call fcn.0055206d
add esp, 4
push eax
call fcn.00552b3a
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x48f3a2
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x50]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 0xc]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x28]
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea ecx, [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
call dword [0x73c768]
mov eax, dword [esp + 0x20]
push edi
push eax
push ebx
mov dword [esp + 0x24], ecx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 0x10]
push edi
push 1
push eax
call fcn.00559524
add esp, 0x10
test eax, eax
je 0x48f348
mov ebx, eax
mov eax, dword [esp + 0xc]
sub eax, esi
cmp eax, ebx
jb 0x48f3ac
add ebx, esi
push dword [esp + 0x10]
call fcn.00558e9a
add esp, 4
test eax, eax
je 0x48f3b4
mov esi, ebx
push dword [esp + 0x10]
call fcn.00558ec6
add esp, 4
test eax, eax
sete bl
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x73c768]
mov eax, dword [esp + 0xa4]
lea edx, [esp + 0x20]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.004e8e70
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x48f2d2
xor ebx, ebx
mov esi, dword [esp + 0xc]
jmp 0x48f359
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x73c768]
mov eax, dword [esp + 0xa4]
lea esi, [esp + 0x20]
push dword [esp + 0x1c]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov esi, ebx
jmp 0x48f312
Function at 0x4948f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00494a70
mov eax, dword [edi]
mov dword [0x7441b4], eax
mov bl, 1
test al, 1
jne 0x49492c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x748bac]
test eax, eax
je 0x494956
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x748bac], 0
cmp dword [0x748bb0], 0
jne 0x494956
and byte [0x7441b4], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x494973
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x494968
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x4949de
mov dword [0x748bac], eax
jmp 0x494918
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x49497e
mov eax, dword [edi + 8]
test eax, eax
je 0x494a1f
lea esi, [edi + 4]
mov ecx, dword [0x748bb0]
test ecx, ecx
jne 0x4949b2
push 0xc
call fcn.00540349
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x748bb0], eax
push esi
call fcn.004d3530
cmp dword [edi + 0x14], 0
jne 0x4949d2
mov eax, dword [0x748bb0]
cmp byte [eax + 0xb], 0
jns 0x4949cb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.005bce50
mov ebx, eax
jmp 0x494918
lea eax, [ebp - 0x24]
push 0x231
push 0x6d2600
push 0x6d2616
push eax
call fcn.004f2b50
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push 0x6d263c
push esi
call fcn.005bf620
add esp, 0x10
mov ecx, esi
call fcn.005bf880
mov eax, dword [edi + 0x18]
jmp 0x49496c
lea ebx, [ebp - 0x24]
push 0x237
push 0x6d2600
push 0x6d2616
push ebx
call fcn.004f2b50
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push 0x6d265b
push esi
call fcn.005bf620
add esp, 0x10
mov ecx, esi
push 0x6d267b
call fcn.005bce20
mov ecx, esi
call fcn.005bf880
jmp 0x494986

Function at 0x495620
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00411680

Function at 0x4969c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
xor eax, eax
mov dword [ecx], eax
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4969e0
call fcn.004f2b80
cmp dword [esi], ebx
je 0x496a0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x496a53
cmp edi, 2
jb 0x496a01
mov dword [esi], ebx
call fcn.004f2b80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
call fcn.004f2e40
lea ecx, [esi + 0x10]
call fcn.00501850
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
lea edi, [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 0x19], al
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x496a42
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004f2b80
push dword [edi]
call fcn.004e4b30
add esp, 4
jmp 0x496a36
call fcn.004f2b80
push dword [esi]
call fcn.004e4b30
add esp, 4
mov dword [esi], 0
jmp 0x4969f5
Function at 0x496dd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.005416e0
mov esi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.004eb0d0
add esp, 0xc
test esi, esi
je 0x496e89
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.00544260
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x496e35
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x496e5b
cmp eax, 0x7fff
jae 0x496eb2
push esi
push eax
push edi
call fcn.00492ed0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x496e72
push dword [ebp - 0x1001c]
call fcn.00540380
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x496e9a
lea eax, [ebp - 0x1001c]
jmp 0x496ea0
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x496e5b
int3

Function at 0x4974c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x748c38]
test ebx, ebx
jne 0x497544
push 0x28
call fcn.00540349
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.00540349
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x49754e
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x748c38], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x497555
mov edi, eax
push eax
call fcn.0055b404
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00497570
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6bd165
jmp 0x49755a
push 0x6be6d6
push 0x6bd0bf
call fcn.0057cbd0
int3