joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4772f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4773bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x476c84
call fcn.004773dc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x477394
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4773d4
call fcn.004078fc
mov edx, dword [ebp - 8]
mov eax, dword [0x49a628]
call fcn.004242d4
call fcn.00476c94
call sub.user32.dll_GetFocus
mov edx, dword [0x49a628]
cmp eax, dword [edx + 0x20]
jne 0x477377
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x47737e
call sub.user32.dll_WaitMessage
jmp 0x477356
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47739b
mov eax, dword [ebp - 4]
call fcn.00402b58
ret

Function at 0x47b70c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47b714
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47b87f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00453084
mov edx, dword [ebp - 0x10]
mov eax, 0x49b12c
call fcn.00403450
mov edx, 0x47b898
lea eax, [ebp - 0x10]
call fcn.00403494
lea eax, [ebp - 0x10]
mov edx, dword [0x49b12c]
call fcn.0040357c
mov eax, dword [ebp - 0x10]
call fcn.00456ff8
cmp byte [0x49afb4], 0
je 0x47b777
mov eax, dword [0x49b12c]
call fcn.004567f0
lea edx, [ebp - 0x10]
mov eax, dword [0x49b12c]
call fcn.0042c40c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47b8c0
call fcn.004035c0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x47b809
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00450ab8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00406d70
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0042e73c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
mov al, 0x60
call fcn.00450a88
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, 0x406408
call fcn.00408c14
call fcn.0040311c
lea eax, [ebp - 0xc]
mov ecx, 0x47b8d0
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, 0x47b8e8
call fcn.0047b6b4
lea eax, [ebp - 8]
call fcn.00457c20
cmp dword [ebp - 8], 0
je 0x47b857
lea eax, [ebp - 0xc]
mov ecx, 0x47b8fc
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047b6b4
mov eax, dword [ebp - 0xc]
call fcn.00457c60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b886
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403420
ret
Function at 0x47d758
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x49b3c1], 1
call fcn.00454b00
test al, al
jne 0x47d79a
push 5
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov cl, 2
xor edx, edx
mov eax, dword [0x49ad38]
call fcn.0047d664
ret

Function at 0x481958
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x481984
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x48198d
call fcn.00480bb8
mov eax, 0xa
call fcn.0042eae8
call fcn.00480bb8
call fcn.00481924
test al, al
jne 0x481962
pop ebx
ret

Function at 0x481e2c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x49b050], 0
je 0x481ec3
mov eax, dword [0x49b050]
call fcn.00418388
test al, al
je 0x481ec3
mov eax, dword [0x49b050]
cmp byte [eax + 0xc7], 0
je 0x481e73
cmp byte [ebx + 0x1b9], 0
jne 0x481e73
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x481e77
xor eax, eax
jmp 0x481e79
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x49b050]
call fcn.004181f0
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x481ec3
test bl, bl
je 0x481eb1
push 5
mov eax, dword [0x49b050]
call fcn.004181f0
push eax
call sub.user32.dll_ShowWindow
jmp 0x481ec3
push 0
mov eax, dword [0x49b050]
call fcn.004181f0
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x481f6c
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x49b37c], 0
push 0x482044
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x482054
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x481ff8
lea edx, [esp + 4]
push edx
call eax
push 0x482068
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x482002
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x482002
cmp dword [esp], 0
je 0x482002
call fcn.00451d7c
test al, al
je 0x482002
push 0x482078
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x482002
push 0x482094
push 0x4820a4
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x482002
mov byte [0x49b37c], 1
jmp 0x482002
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ax, word [esp + 4]
sub ax, 1
jb 0x48201b
sub ax, 5
je 0x482024
sub ax, 3
je 0x48202d
jmp 0x482036
mov byte [0x498c60], 1
jmp 0x48203d
mov byte [0x498c60], 3
jmp 0x48203d
mov byte [0x498c60], 2
jmp 0x48203d
mov byte [0x498c60], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x4820b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x482124
mov edx, 0x80000002
xor eax, eax
call fcn.0042dd44
test eax, eax
jne 0x48211d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x482150
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x482114
cmp dword [ebp - 0xc], 4
jne 0x482114
cmp dword [ebp - 8], 4
jne 0x482114
mov ax, word [ebp - 0x10]
mov word [0x49b390], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x482298
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x48234a
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x49b38c], eax
cmp byte [0x49b37b], 0
je 0x48234a
mov eax, dword [esp + 4]
cmp eax, 5
jl 0x48233b
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x48234a
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x49b390], ax
mov al, byte [esp + 0x12e]
mov byte [0x49b392], al
mov ax, word [esp + 0x12c]
mov word [0x49b394], ax
jmp 0x48234a
cmp eax, 4
jne 0x48234a
call fcn.004820b4
call fcn.0048215c
add esp, 0x130
ret
Function at 0x48c0d8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x48c279
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
mov ecx, 0x200
xor edx, edx
call fcn.004034e0
push 0
xor eax, eax
mov al, byte [ebp + 8]
mov eax, dword [eax*4 + 0x499090]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0042dd44
test eax, eax
jne 0x48c25e
xor edx, edx
push ebp
push 0x48c253
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [esi + 4]
call fcn.00436330
xor ebx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov dword [ebp - 0x18], eax
cmp byte [ebp + 8], 0
je 0x48c190
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
jmp 0x48c1af
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
sub eax, 1
jb 0x48c1fd
sub eax, 0xe9
je 0x48c1c2
sub eax, 0x19
je 0x48c23c
jmp 0x48c1f6
mov eax, dword [ebp - 0x10]
call fcn.00403574
cmp eax, 0x10000
jl 0x48c1db
call fcn.004031bc
jmp 0x48c25e
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.004034e0
jmp 0x48c15e
call fcn.004031bc
jmp 0x48c25e
lea ecx, [ebx + 1]
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.00436330
lea eax, [ebp - 0x10]
call fcn.00403744
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004034e0
lea ecx, [ebp - 0x24]
mov eax, esi
mov edx, ebx
call fcn.00442d50
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00435280
inc ebx
jmp 0x48c15e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c25a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c280
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403420
ret
Function at 0x494978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x494a1b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x494a34
push ebx
push 0x494a40
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403634
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402934
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4949f9
mov eax, dword [0x49adb8]
call fcn.004948d0
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494a22
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x495228
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4953f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042d940
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00452f1c
test al, al
jne 0x49528f
xor eax, eax
push ebp
push 0x495285
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.0045326c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49528f
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
mov eax, dword [0x49b45c]
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x4952b8
mov eax, dword [0x49adb4]
call fcn.004948d0
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov eax, dword [0x49a014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x495408
push 0x49540c
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push 0x494a80
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x49b488], eax
xor eax, eax
push ebp
push 0x4953cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d418
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x49541c
call fcn.004078fc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d2f8
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040357c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00494978
mov dword [ebp - 0xc], eax
call fcn.00494a44
test al, al
jne 0x4953ac
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x49538c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4953d3
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x49639c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x496601
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x496618
mov eax, dword [0x49a628]
call fcn.004242d4
push 5
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x4965cd
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0047d9a0
lea eax, [ebp - 0x10]
call fcn.0042d890
mov eax, dword [ebp - 0x10]
call fcn.004072b0
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d418
mov edx, dword [ebp - 0x10]
mov eax, 0x49b45c
call fcn.00403450
call fcn.00494c20
lea ecx, [ebp - 0x10]
mov edx, 0x49662c
mov eax, dword [0x49b45c]
call fcn.0042c4c4
mov edx, dword [ebp - 0x10]
mov eax, 0x49b460
call fcn.00403450
lea ecx, [ebp - 0x10]
mov edx, 0x49663c
mov eax, dword [0x49b45c]
call fcn.0042c4c4
mov edx, dword [ebp - 0x10]
mov eax, 0x49b464
call fcn.00403450
push 2
push 0
push 1
mov ecx, dword [0x49b45c]
mov dl, 1
mov eax, 0x44fb30
call fcn.0044fd8c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4964e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.0044fd50
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.0044fd28
cmp dword [ebp - 0xc], 0x67734d49
je 0x4964bf
mov cl, 1
xor edx, edx
mov eax, dword [0x49b464]
call fcn.00450c10
jmp 0x4964ce
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x49b45c]
call fcn.00450c10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4964eb
mov eax, dword [ebp - 4]
call fcn.00402b58
ret
Function at 0x4966e4
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x496822
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
mov edx, ebx
lea eax, [ebp - 0x14c]
call fcn.00403494
lea eax, [ebp - 0x14c]
mov edx, 0x496838
call fcn.0040357c
mov eax, dword [ebp - 0x14c]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x496801
xor eax, eax
push ebp
push 0x4967fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x496848
lea eax, [ebp - 0x11c]
mov ecx, 5
call fcn.00407460
test eax, eax
jne 0x4967cb
test byte [ebp - 0x148], 0x10
jne 0x4967cb
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.0040355c
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004035c0
mov esi, dword [ebp - 0x148]
test esi, 1
je 0x4967c3
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
call fcn.00406f58
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x49675b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496801
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496829
lea eax, [ebp - 0x14c]
call fcn.00403400
lea eax, [ebp - 8]
call fcn.00403400
ret
Function at 0x496850
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x496946
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403400
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c920
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x49695c
call fcn.004078fc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004035c0
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
cmp esi, 0xffffffff
je 0x4968ee
test esi, 0x10
jne 0x49691e
test esi, 1
je 0x4968ee
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x496918
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00403494
jmp 0x49692b
inc edi
cmp edi, 0xa
je 0x49692b
inc ebx
cmp ebx, 0x3e8
jne 0x49688f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49694d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403420
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x401120
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
push 0
mov dword [esp + 0xc], 0
push dword [esi]
call fcn.00409c98
push dword [esi]
lea eax, [esp + 0x1c]
push 2
push 1
push eax
call fcn.0040992e
mov ax, word [esp + 0x28]
add esp, 0x1c
cmp al, 0x4d
jne 0x4011f2
cmp ah, 0x5a
jne 0x4011f2
push 0
push 0x3c
push dword [esi]
call fcn.00409c98
push dword [esi]
lea eax, [esp + 0x14]
push 1
push 4
push eax
call fcn.0040992e
mov eax, dword [esp + 0x20]
push 0
add eax, 0x18
push eax
push dword [esi]
call fcn.00409c98
push dword [esi]
lea eax, [esp + 0x38]
push 1
push 2
push eax
call fcn.0040992e
mov ax, word [esp + 0x44]
add esp, 0x38
cmp al, 0xb
jne 0x4011f2
cmp ah, 1
jne 0x4011b6
mov ecx, 0x98
jmp 0x4011c0
cmp ah, 2
jne 0x4011f2
mov ecx, 0xa8
mov eax, dword [esp + 4]
push 0
add eax, ecx
push eax
push dword [esi]
call fcn.00409c98
push dword [esi]
lea eax, [esp + 0x14]
push 1
push 4
push eax
call fcn.0040992e
mov eax, dword [esp + 0x20]
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
pop esi
pop ecx
ret
or eax, 0xffffffff
pop esi
pop ecx
ret

Function at 0x401220
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi], 0
jne 0x401252
lea eax, [edi + 0x68]
push 0x4211f0
push eax
call fcn.00402640
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x401252
push str.Cannot_open_archive_file_n
call fcn.00401850
add esp, 4
xor eax, eax
pop edi
ret
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push 0
push dword [ebp + 4]
call sub.WS2_32.dll_ntohl
add eax, dword [edi + 4]
push eax
push dword [edi]
call fcn.00409c98
add esp, 0xc
push dword [ebp + 8]
call sub.WS2_32.dll_ntohl
push eax
call fcn.0040960b
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40129a
push str.Could_not_allocate_read_buffer_n
call fcn.00401850
add esp, 4
xor eax, eax
pop ebp
pop ebx
pop edi
ret
push dword [edi]
push 1
push dword [ebp + 8]
call sub.WS2_32.dll_ntohl
push eax
push ebx
call fcn.0040992e
add esp, 0x10
cmp eax, 1
jae 0x4012ce
push str.Could_not_read_from_file_n
call fcn.00401850
push ebx
call fcn.00409606
add esp, 8
xor eax, eax
pop ebp
pop ebx
pop edi
ret
cmp byte [ebp + 0x10], 1
jne 0x401305
push esi
push ebp
push ebx
call fcn.00401030
push ebx
mov esi, eax
call fcn.00409606
add esp, 0xc
mov ebx, esi
test esi, esi
pop esi
jne 0x401305
lea eax, [ebp + 0x12]
push eax
push str.Error_decompressing__s_n
call fcn.00401850
add esp, 8
xor eax, eax
pop ebp
pop ebx
pop edi
ret
mov eax, dword [edi]
test eax, eax
je 0x40131a
push eax
call fcn.0040968c
add esp, 4
mov dword [edi], 0
pop ebp
mov eax, ebx
pop ebx
pop edi
ret