joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x4a0045
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x4a0083
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x4a0083
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4a014e
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x4a00ad
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a00ba
push dword [esi + 0x4c]
push edi
jmp 0x4a00f7
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x4a014e
cmp eax, 1
jle 0x4a0121
cmp eax, 3
jne 0x4a014e
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00502577
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x4a0153
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x4a013e
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.00502f96
add esp, 0x10
cmp ebx, eax
jne 0x4a014e
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x4a006d
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
Function at 0x4a08b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4a0998
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4a0987
jg 0x4a08f0
test edx, edx
je 0x4a0987
nop dword [eax]
call fcn.004702a0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4a0944
jg 0x4a0907
test esi, esi
je 0x4a0944
cmp ebx, eax
jg 0x4a0917
jl 0x4a0911
cmp edi, esi
jae 0x4a0917
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004edc20
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4a096b
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x4a0981
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4a08f0
jl 0x4a0981
test edi, edi
jne 0x4a08f0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4a09ba
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4a09bc
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4a0a3a
jg 0x4a09cf
test esi, esi
je 0x4a0a3a
test eax, eax
jl 0x4a0a14
jg 0x4a09d9
test ebx, ebx
je 0x4a0a14
cmp edi, eax
jg 0x4a09e9
jl 0x4a09e3
cmp esi, ebx
jae 0x4a09e9
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004edc20
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x4a0a17
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4a0a3a
jg 0x4a0a21
test esi, esi
je 0x4a0a3a
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4a0a3a
push eax
push esi
push 1
push edx
call fcn.00502f96
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a0a50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4a0b3b
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4a0b2a
jg 0x4a0a90
test edx, edx
je 0x4a0b2a
nop dword [eax]
call fcn.004702c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4a0ae7
jg 0x4a0aa7
test esi, esi
je 0x4a0ae7
cmp ebx, eax
jg 0x4a0ab7
jl 0x4a0ab1
cmp edi, esi
jae 0x4a0ab7
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.004edc20
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x4a0b0c
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4a0b24
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x4a0a90
jl 0x4a0b24
test edi, edi
jne 0x4a0a90
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4a0b5d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x4a0b5f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4a0c15
jg 0x4a0b7a
test esi, esi
je 0x4a0c15
test eax, eax
jl 0x4a0bc3
jg 0x4a0b84
test ebx, ebx
je 0x4a0bc3
cmp edi, eax
jg 0x4a0b94
jl 0x4a0b8e
cmp esi, ebx
jae 0x4a0b94
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.004edc20
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x4a0bca
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x4a0c15
jg 0x4a0bd4
test esi, esi
je 0x4a0c15
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x4a0c15
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x4a0c00
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.0050358f
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a0f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4a0f70
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4a0fac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4a0fac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4a1093
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4a0fd4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a1007
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00501ed1
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x4a1093
cmp eax, 1
jle 0x4a1066
cmp eax, 3
jne 0x4a1093
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.0049a8c0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4a1083
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00502f96
add esp, 0x10
cmp edi, eax
jne 0x4a1093
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4a0f97
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004eabba
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4a17ef
cmp byte [esi + 0x3e], 0
je 0x4a17ef
mov eax, dword [esi]
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x4a17a5
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4a17b7
sub eax, 1
je 0x4a17bb
sub eax, 2
je 0x4a17ef
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4a17d8
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00502f96
add esp, 0x10
cmp edi, eax
jne 0x4a17a5
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004eabba
mov esp, ebp
pop ebp
ret

Function at 0x4a18d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4a1973
cmp byte [esi + 0x3d], 0
je 0x4a1973
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4a1929
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4a193b
sub eax, 1
je 0x4a193f
sub eax, 2
je 0x4a1973
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4a195c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00502f96
add esp, 0x10
cmp edi, eax
jne 0x4a1929
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004eabba
mov esp, ebp
pop ebp
ret
Function at 0x4a4550
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x4a45c3
cmp ecx, eax
jne 0x4a45bb
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x4a45cb
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x4a45cb
cmp ecx, eax
jne 0x4a45cb
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x14
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.004eb418
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8

Function at 0x4a5e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4a5e83
test al, 0x10
jne 0x4a5e83
mov al, 1
ret
xor al, al
ret
Function at 0x4a6700
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x531d3d
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 4], 1
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x4a68f3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x2b4], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a4], 0
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4a68c8
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x2ac], 0
cmp edi, 0x80
jbe 0x4a67e2
push edi
lea ecx, [ebp - 0x2a0]
call fcn.00453850
mov eax, dword [ebp - 0x2a0]
jmp 0x4a67ee
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x2a0], eax
push eax
push edi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x218]
push dword [ebp - 0x2a4]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4a689f
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x2ac], 0
push eax
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x2a8], 0
push eax
push 0x580190
push dword [ebp - 0x2a0]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4a6896
cmp dword [ebp - 0x2a8], 0
jbe 0x4a688d
mov ecx, dword [ebp - 0x2ac]
cmp dword [ecx], 0xfeef04bd
jne 0x4a6884
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._hu._hu._hu._hu
push esi
call fcn.00453b60
add esp, 0x18
jmp 0x4a68ad
push 8
push 0x586a34
jmp 0x4a68a6
push 8
push 0x586a20
jmp 0x4a68a6
push 8
push 0x586a5c
jmp 0x4a68a6
push 8
push 0x586a48
mov ecx, esi
call fcn.00453760
lea eax, [ebp - 0x29c]
cmp dword [ebp - 0x2a0], eax
je 0x4a68d6
lea ecx, [ebp - 0x2a0]
call fcn.00453600
jmp 0x4a68d6
push 8
push 0x586a80
mov ecx, esi
call fcn.00453760
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0044a700
int3
Function at 0x4a6a00
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x531dc9
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
nop
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
push 2
push dword [edx]
call dword [sym.imp.NETAPI32.dll_NetShareEnum]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x4a6aa1
cmp esi, 0xea
jne 0x4a6bfa
mov ecx, dword [ebp - 0x14]
xor edi, edi
test ecx, ecx
je 0x4a6b30
xor esi, esi
mov eax, dword [ebp - 0x18]
cmp dword [esi + eax + 0x14], 0
jbe 0x4a6b25
push dword [esi + eax]
lea ecx, [ebp - 0x10]
call fcn.00452b60
mov dword [ebp - 4], 1
mov eax, dword [ebx + 4]
mov dword [ebp - 0x28], eax
cmp dword [ebx + 8], eax
je 0x4a6af0
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00453690
mov ecx, dword [ebp - 0x28]
add eax, 0x10
mov dword [ecx], eax
add dword [ebx + 4], 4
jmp 0x4a6afc
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.00473050
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a6b1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
inc edi
add esi, 0x20
cmp edi, ecx
jb 0x4a6ab0
mov esi, dword [ebp - 0x2c]
push dword [ebp - 0x18]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test eax, eax
jne 0x4a6b51
cmp esi, 0xea
jne 0x4a6bfa
mov edx, dword [ebp - 0x30]
jmp 0x4a6a70
call fcn.004d03a0
mov esi, eax
mov ecx, esi
call fcn.004d0140
cmp byte [0x5c221f], 0
jne 0x4a6bb3
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x4a6ba8
sub esp, 8
xorps xmm0, xmm0
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c221f
sub esp, 0xc
push 0x124
push str.C:BuildAgentwork4d643bb3f4c71f96RemoteInstallerInstallerUIutils_collector.cpp
push 0x20
call fcn.004d0210
jmp 0x4a6baa
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x5c4ae8], eax
mov ecx, esi
call fcn.004d0150
mov ecx, dword [0x5c4ae8]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c4ae8]
push str.Cant_free_buffer_memory
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov ecx, dword [0x5c4ae8]
add esp, 8
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c4ae8]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1680
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
xor eax, eax
xor esi, esi
test edi, edi
je 0x4b16a8
nop dword [eax]
lea edx, [eax + 1]
mov al, byte [eax + 0x587090]
xor byte [esi + ecx], al
inc esi
cmp edx, 0xe
sbb eax, eax
and eax, edx
cmp esi, edi
jb 0x4b1690
pop edi
pop esi
ret

Function at 0x4c19f0
Capabilities:
Create directory

Disassembly:
push 0
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4c1a0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4c1a0e
xor al, al
ret
mov al, 1
ret

Function at 0x4c1b10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 8], eax
nop dword [eax + eax]
push 0
push 0x80
push 4
push dword [ebp + 0x14]
push 1
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, 0xffffffff
jne 0x4c1b7e
cmp esi, 0x20
jne 0x4c1b7e
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x4c1b6e
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x3e8
jb 0x4c1b30
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c1b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
movzx eax, dx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4c1c3b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x4c1c3b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c1c3b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4c1c3b
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
push 0x80
push ecx
push 0
push 0x40000000
push dword [ebp + 0xc]
lea ecx, [esp + 0x2c]
call fcn.004880b0
test eax, eax
js 0x4c1c21
push ecx
push ebx
push esi
lea ecx, [esp + 0x1c]
call fcn.0044f450
test eax, eax
js 0x4c1c21
mov bl, 1
jmp 0x4c1c23
xor bl, bl
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c1c32
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret