joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484a70
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0xa0
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x9c], eax
push edi
mov edi, dword [esp + 0xa8]
lea eax, [esp + 4]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x484ad4
push esi
lea eax, [esp + 0x74]
push eax
push 0x10
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp esi, 1
pop esi
je 0x484ae0
push 0x10
lea eax, [esp + 0x74]
push eax
call fcn.00484b60
push 0x10
lea eax, [esp + 0x74]
push eax
call fcn.00484b60
lea eax, [esp + 8]
push eax
call fcn.004bcac0
push 0x10
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004bcb10
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004bc9b0
mov eax, dword [esp + 0xac]
cmp eax, 0x20
jb 0x484b2a
mov eax, 0x20
push eax
lea eax, [esp + 0x84]
push eax
push edi
call fcn.00531d40
mov ecx, dword [esp + 0xac]
add esp, 0xc
pop edi
xor ecx, esp
call fcn.00530218
add esp, 0xa0
ret 8

Function at 0x484b60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004bf260
lea ecx, [esp + 0xc]
call fcn.004befa0
mov edi, eax
mov ebp, edx
call fcn.00538625
cdq
add edi, eax
adc ebp, edx
xor ebx, ebx
cmp dword [esp + 0x1c], ebx
jbe 0x484bd0
push esi
mov esi, dword [esp + 0x1c]
mov ecx, ebx
mov eax, edi
and ecx, 7
mov edx, ebp
shl ecx, 3
call fcn.00530470
mov ecx, dword [0x5d3744]
xor al, bl
add al, cl
inc ecx
mov byte [ebx + esi], al
inc ebx
mov dword [0x5d3744], ecx
cmp ebx, dword [esp + 0x20]
jb 0x484ba3
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x484be0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x91c]
add edx, 2
push ebp
mov ebp, dword [ecx + 0x920]
push esi
mov esi, dword [ecx + 0x914]
push edi
mov edi, dword [ecx + 0x918]
mov dword [esp + 0x10], 4
lea esp, [esp]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
xor esi, dword [ecx + eax*4 + 0x414]
mov dword [ecx + 0x914], esi
movzx eax, byte [edx - 5]
xor edi, dword [ecx + eax*4 + 0x414]
mov dword [ecx + 0x918], edi
movzx eax, byte [edx - 4]
xor ebx, dword [ecx + eax*4 + 0x414]
mov dword [ecx + 0x91c], ebx
movzx eax, byte [edx - 3]
xor ebp, dword [ecx + eax*4 + 0x414]
sub dword [esp + 0x10], 1
mov dword [ecx + 0x920], ebp
jne 0x484c10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x484c70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1d4
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1f0]
push ebx
mov ebx, dword [esp + 0x1e0]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1ec]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1f8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
push ebp
mov ebp, dword [esp + 0x1e0]
push esi
push edi
mov edi, dword [esp + 0x1fc]
mov dword [esp + 0x1c], edi
cmp ebx, 0x40
jbe 0x484d1e
lea eax, [esp + 0xf8]
push eax
call fcn.004bcac0
push ebx
push ebp
lea eax, [esp + 0x100]
push eax
call fcn.004bcb10
lea eax, [esp + 0x1a0]
push eax
lea eax, [esp + 0xfc]
push eax
call fcn.004bc9b0
mov edx, dword [esp + 0x10]
lea ebp, [esp + 0x1a0]
mov ebx, 0x20
mov eax, 0x40
test edi, edi
je 0x484d3f
cmp byte [edx], 0
je 0x484d3f
mov esi, edi
mov ecx, 0x1a
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x1c]
jmp 0x484dac
xor edx, edx
test ebx, ebx
je 0x484d6a
mov esi, ebp
lea eax, [esp + 0x160]
sub esi, eax
lea ecx, [esp + 0x160]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor al, 0x36
mov byte [ecx], al
cmp edx, ebx
jb 0x484d50
mov eax, 0x40
cmp ebx, 0x40
jae 0x484d86
sub eax, ebx
lea ecx, [esp + 0x160]
push eax
add ecx, ebx
push 0x36
push ecx
call fcn.00532770
add esp, 0xc
lea eax, [esp + 0x28]
push eax
call fcn.004bcac0
push 0x40
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004bcb10
test edi, edi
je 0x484dbf
mov edx, dword [esp + 0x10]
cmp byte [edx], 0
jne 0x484dbf
mov ecx, 0x1a
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov byte [edx], 1
push dword [esp + 0x1f4]
lea eax, [esp + 0x2c]
push dword [esp + 0x24]
push eax
call fcn.004bcb10
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004bc9b0
mov edi, dword [esp + 0x14]
test edi, edi
je 0x484e0d
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
je 0x484e0d
mov esi, edi
mov ecx, 0x1a
lea edi, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x484e82
xor edx, edx
test ebx, ebx
je 0x484e35
lea eax, [esp + 0x160]
sub ebp, eax
lea esp, [esp]
lea ecx, [esp + 0x160]
add ecx, edx
inc edx
mov al, byte [ecx + ebp]
xor al, 0x5c
mov byte [ecx], al
cmp edx, ebx
jb 0x484e20
cmp ebx, 0x40
jae 0x484e56
mov ecx, 0x40
lea eax, [esp + 0x160]
sub ecx, ebx
add eax, ebx
push ecx
push 0x5c
push eax
call fcn.00532770
add esp, 0xc
lea eax, [esp + 0x90]
push eax
call fcn.004bcac0
push 0x40
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.004bcb10
test edi, edi
je 0x484e98
mov eax, dword [esp + 0x18]
cmp byte [eax], 0
jne 0x484e98
mov ecx, 0x1a
lea esi, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x20
lea eax, [esp + 0x1c4]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.004bcb10
push dword [esp + 0x24]
lea eax, [esp + 0x94]
push eax
call fcn.004bc9b0
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x1d4
ret 0x24
Function at 0x484ee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x19c
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x1a8]
push ebx
mov ebx, dword [esp + 0x1b4]
push ebp
mov ebp, dword [esp + 0x1bc]
push esi
mov esi, dword [esp + 0x1b8]
mov dword [esp + 0x10], eax
mov eax, esi
push edi
mov edi, dword [esp + 0x1b0]
mov dword [esp + 0x18], edi
cmp esi, 0x40
jb 0x484f36
mov eax, 0x40
push eax
push ecx
lea eax, [esp + 0x14c]
push eax
call fcn.00531d40
add esp, 0xc
cmp esi, 0x44
jae 0x48514d
lea eax, [esi + 1]
mov byte [esp + esi + 0x144], 0
cmp eax, 0x44
jae 0x48514d
mov byte [esp + eax + 0x144], 0
lea eax, [esi + 2]
cmp eax, 0x44
jae 0x48514d
push 0
push 0
push 0
mov byte [esp + eax + 0x150], 0
lea eax, [esp + 0x130]
push 0
push eax
lea eax, [esi + 4]
mov byte [esp + esi + 0x15b], 1
push eax
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0x1d0]
push edi
call fcn.00484c70
mov eax, dword [esp + 0x1cc]
lea esi, [esp + 0x124]
dec eax
mov dword [esp + 0xfc], ebp
mov ecx, 8
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x104]
xor ebp, ebp
mov dword [esp + 0xf0], 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xf4], 0x10
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x100], eax
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x14], ebp
jmp 0x485020
mov ebx, dword [esp + ebp + 0xec]
test ebx, ebx
je 0x4850d1
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1b]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x198]
push eax
push 0x20
lea eax, [esp + 0x13c]
push eax
push dword [esp + 0x1d0]
push ebp
call fcn.00484c70
mov ecx, 8
lea esi, [esp + 0x188]
lea edi, [esp + 0x124]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movzx ecx, byte [esp + eax + 0x124]
xor byte [esp + eax + 0x104], cl
movzx ecx, byte [esp + eax + 0x125]
xor byte [esp + eax + 0x105], cl
movzx ecx, byte [esp + eax + 0x126]
xor byte [esp + eax + 0x106], cl
movzx ecx, byte [esp + eax + 0x127]
xor byte [esp + eax + 0x107], cl
add eax, 4
cmp eax, 0x20
jb 0x485080
sub ebx, 1
jne 0x485033
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + ebp + 0xf8]
lea esi, [esp + 0x104]
add ebp, 4
mov ecx, 8
mov dword [esp + 0x14], ebp
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0xc
jb 0x485020
push 0x44
lea eax, [esp + 0x148]
push eax
call fcn.004baf90
push 0x20
lea eax, [esp + 0x108]
push eax
call fcn.004baf90
push 0x20
lea eax, [esp + 0x128]
push eax
call fcn.004baf90
push 0x20
lea eax, [esp + 0x18c]
push eax
call fcn.004baf90
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x19c
ret 0x20
call fcn.0053013d
int3
Function at 0x486030
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
mov edx, dword [esi]
mov eax, dword [edi]
cmp eax, edx
jbe 0x4860a0
mov ebx, 1
cmp edx, ebx
jb 0x486078
mov eax, dword [esp + 0x18]
lea ecx, [esi + 4]
mov ebp, edi
sub ebp, esi
sub eax, esi
mov edi, eax
lea ecx, [ecx]
mov eax, dword [ecx + ebp]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc ebx
mov dword [edi + ecx - 4], eax
mov edx, dword [esi]
cmp ebx, edx
jbe 0x486060
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
mov esi, dword [esp + 0x18]
sub eax, edx
shl eax, 2
push eax
lea eax, [edi + ebx*4]
push eax
lea eax, [esi + ebx*4]
push eax
call fcn.00531d40
mov eax, dword [edi]
add esp, 0xc
mov dword [esi], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
jae 0x4860fc
mov edx, 1
cmp eax, edx
jb 0x4860d4
mov ebp, dword [esp + 0x18]
lea ecx, [esi + 4]
mov ebx, edi
sub ebx, esi
sub ebp, esi
jmp 0x4860c0
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc edx
mov dword [ecx + ebp - 4], eax
mov eax, dword [edi]
cmp edx, eax
jbe 0x4860c0
mov ecx, dword [esi]
mov ebx, dword [esp + 0x18]
sub ecx, eax
shl ecx, 2
lea eax, [esi + edx*4]
push ecx
push eax
lea eax, [ebx + edx*4]
push eax
call fcn.00531d40
mov eax, dword [esi]
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test eax, eax
je 0x486116
mov ebx, edi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + ebx]
cmp ecx, dword [edx]
jne 0x486116
sub edx, 4
sub eax, 1
jne 0x486107
mov ebx, dword [esp + 0x18]
mov dword [ebx], eax
test eax, eax
je 0x486139
sub edi, esi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + edi]
lea edx, [edx - 4]
xor ecx, dword [edx + 4]
mov dword [edx + ebx + 4], ecx
sub eax, 1
jne 0x486127
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x486590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x5c
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
push ebx
mov ebx, dword [esp + 0x68]
push esi
mov esi, dword [esp + 0x68]
mov dword [esp + 0x10], esi
cmp dword [ebx], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
je 0x4866d0
mov ecx, dword [eax]
test ecx, ecx
je 0x4866d0
mov edx, dword [0x5d374c]
mov esi, eax
mov eax, dword [esi + ecx*4]
mov eax, dword [edx + eax*4]
mov dword [esp + ecx*4 + 0x14], eax
sub ecx, 1
jne 0x4865d3
mov esi, dword [esp + 0x10]
push edi
push 0x90
push ecx
push esi
call fcn.00532770
mov edi, dword [ebx]
add esp, 0xc
test edi, edi
je 0x48666a
mov ecx, dword [0x5d374c]
push ebp
mov ebp, dword [0x5d3748]
lea esp, [esp]
mov eax, dword [ebx + edi*4]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0x7fff
je 0x486660
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x486660
lea edx, [eax - 1]
add edx, edi
lea edx, [esi + edx*4]
mov ecx, dword [esp + eax*4 + 0x1c]
cmp ecx, 0x7fff
je 0x486652
add ecx, ebx
cmp ecx, 0x7fff
jb 0x48664c
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
sub edx, 4
sub eax, 1
jne 0x486630
mov ecx, dword [0x5d374c]
mov ebx, dword [esp + 0x14]
sub edi, 1
jne 0x486610
pop ebp
mov eax, dword [esp + 0xc]
mov edx, dword [ebx]
pop edi
mov ecx, dword [eax]
dec ecx
add edx, ecx
mov dword [esi], edx
cmp edx, 0x11
jle 0x48669e
lea ecx, [esi - 0x38]
lea ecx, [ecx + edx*4]
add edx, 0xffffffef
mov eax, dword [ecx + 0x38]
lea ecx, [ecx - 4]
xor dword [ecx - 8], eax
xor dword [ecx + 4], eax
mov dword [ecx + 0x3c], 0
sub edx, 1
jne 0x486686
cmp dword [esi], 0x11
jbe 0x4866d6
mov dword [esi], 0x11
mov eax, 0x11
mov edi, edi
cmp dword [esi + eax*4], 0
jne 0x4866d6
add eax, 0xffffffff
mov dword [esi], eax
jne 0x4866b0
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00530218
add esp, 0x5c
ret 0xc
mov dword [esi], 0
mov ecx, dword [esp + 0x60]
pop esi
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x5c
ret 0xc
Function at 0x486800
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [esp + 0xc]
mov ecx, dword [edi]
test ecx, ecx
je 0x4868f1
mov eax, dword [edi + ecx*4]
push ebx
mov ebx, dword [0x5d3748]
push ebp
mov ebp, dword [0x5d374c]
push esi
mov eax, dword [ebp + eax*4]
cmp eax, 0x7fff
je 0x486843
add eax, eax
cmp eax, 0x7fff
jb 0x48683e
add eax, 0xffff8001
mov esi, dword [ebx + eax*4]
jmp 0x486845
xor esi, esi
mov eax, 8
imul eax, ecx
mov dword [eax + edx - 4], esi
mov ecx, dword [edi]
sub ecx, 1
je 0x486895
lea esi, [edi + ecx*4]
jmp 0x486860
mov dword [edx + ecx*8], 0
mov eax, dword [esi]
mov eax, dword [ebp + eax*4]
cmp eax, 0x7fff
je 0x486887
add eax, eax
cmp eax, 0x7fff
jb 0x486882
add eax, 0xffff8001
mov eax, dword [ebx + eax*4]
jmp 0x486889
xor eax, eax
mov dword [edx + ecx*8 - 4], eax
sub esi, 4
sub ecx, 1
jne 0x486860
mov eax, dword [edi]
lea esi, [eax*2 - 1]
mov dword [edx], esi
cmp esi, 0x11
jle 0x4868c8
lea eax, [edx - 0x38]
lea eax, [eax + esi*4]
add esi, 0xffffffef
mov edi, edi
mov ecx, dword [eax + 0x38]
lea eax, [eax - 4]
xor dword [eax - 8], ecx
xor dword [eax + 4], ecx
mov dword [eax + 0x3c], 0
sub esi, 1
jne 0x4868b0
cmp dword [edx], 0x11
pop esi
pop ebp
pop ebx
jbe 0x4868f7
mov dword [edx], 0x11
mov eax, 0x11
jmp 0x4868e0
cmp dword [edx + eax*4], 0
jne 0x4868f7
add eax, 0xffffffff
mov dword [edx], eax
jne 0x4868e0
pop edi
ret 8
mov dword [edx], 0
pop edi
ret 8
Function at 0x48ef00
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5511a0
mov eax, dword fs:[0]
push eax
mov eax, 0x5044
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3010]
push 0x800
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x48f0ef
cmp eax, 0x800
jae 0x48f0ef
push 0x800
lea eax, [ebp - 0x4010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x48f0ef
cmp eax, 0x800
jae 0x48f0ef
lea eax, [ebp - 0x3010]
push eax
call fcn.004a3770
mov ebx, eax
lea eax, [ebp - 0x4010]
push eax
call fcn.004a3770
mov esi, eax
cmp word [esi], 0
je 0x48f0ef
push esi
push ebx
call fcn.004c1ba0
test eax, eax
je 0x48f0ef
push esi
push edi
call fcn.004a3770
push eax
call fcn.004c1ba0
test eax, eax
jne 0x48f0ef
mov word [ebp - 0x1010], ax
xor esi, esi
test ax, ax
jne 0x48f041
push 0x800
push edi
lea eax, [ebp - 0x1010]
push eax
call fcn.004bdae0
push esi
push str.rtmp_d
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.004a3770
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.00491350
test al, al
je 0x48f026
xor eax, eax
mov word [ebp - 0x1010], ax
jmp 0x48f02d
mov ax, word [ebp - 0x1010]
add esi, 0x7b
cmp esi, 0x2710
jl 0x48efd4
test ax, ax
je 0x48f0ef
push 0x800
push edi
lea eax, [ebp - 0x2010]
push eax
call fcn.004bdae0
push 0x800
push ebx
lea eax, [ebp - 0x2010]
push eax
call fcn.004a3880
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x48f0ef
lea ecx, [ebp - 0x5050]
call fcn.0048f110
mov dword [ebp - 4], 0
xor bl, bl
push edi
call fcn.00491350
test al, al
jne 0x48f0ab
push 0x12
push edi
lea ecx, [ebp - 0x5050]
call fcn.0048f5a0
mov bl, al
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test bl, bl
je 0x48f0d9
lea ecx, [ebp - 0x5050]
call fcn.0048f390
lea ecx, [ebp - 0x5050]
call fcn.0048f6b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5050]
call fcn.0048f160
mov al, 1
jmp 0x48f0f1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530218
mov esp, ebp
pop ebp
ret 4
Function at 0x48f6f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 1
jne 0x48f708
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 8], eax
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
mov ebp, dword [esp + 0x18]
push 0
push eax
push ebx
push ebp
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48f7b4
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x48f760
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x48f743
cmp eax, 3
jne 0x48f760
cmp ebx, 0x4e20
jbe 0x48f760
push 0x4e20
push ebp
mov ecx, esi
call fcn.0048f6f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esi + 0x10], 1
jne 0x48f77b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x48f77b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0x10], 0
jne 0x48f7a9
cmp ebx, 0x8000
jbe 0x48f7a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x48f7a9
push 0x8000
push ebp
mov ecx, esi
call fcn.0048f6f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x48f900
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1010
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
mov ebx, dword [esp + 0x101c]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1020]
mov dword [esp + 0xc], ecx
cmp byte [esi + 0x30], 0
mov dword [esi + 0x1034], 0
jne 0x48f948
test bl, 4
jne 0x48f948
xor al, al
jmp 0x48f94a
mov al, 1
push edi
mov edi, ebx
shr edi, 1
not edi
and edi, 1
inc edi
shl edi, 0x1e
test bl, 1
je 0x48f963
or edi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test al, al
je 0x48f972
or ebx, 2
cmp byte [esi + 0x24], 0
je 0x48f97e
or edi, 0x100
push 0
push 0x8000000
push 3
push 0
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x48f9e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push 0x800
push eax
push dword [esp + 0x18]
call fcn.004a2bb0
test al, al
je 0x48f9f2
push 0
push 0x8000000
push 3
push 0
push ebx
push edi
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x48f9ed
mov dword [esp + 0x14], eax
jmp 0x48f9ed
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp ebp, 0xffffffff
jne 0x48fa03
cmp dword [esp + 0x14], 2
jne 0x48fa03
mov dword [esi + 0x1034], 1
cmp byte [esi + 0x24], 0
pop edi
je 0x48fa42
cmp ebp, 0xffffffff
je 0x48fa42
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0xffffffff
push eax
push 0
push ebp
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov byte [esi + 0x1c], 0
mov bl, 1
mov dword [esi + 0x10], 0
mov byte [esi + 0x15], 0
jmp 0x48fa59
cmp ebp, 0xffffffff
mov byte [esi + 0x1c], 0
mov dword [esi + 0x10], 0
mov byte [esi + 0x15], 0
setne bl
je 0x48fa72
push 0x800
push dword [esp + 0x10]
lea ecx, [esi + 0x32]
mov dword [esi + 8], ebp
push ecx
call fcn.004bdae0
mov byte [esi + 0x25], 0
mov ecx, dword [esp + 0x1018]
mov al, bl
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x1010
ret 8
Function at 0x490400
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x490419
pop ebp
mov al, 1
pop ebx
add esp, 0x1c
ret 8
cmp dword [ebp + 0x10], 1
push esi
push edi
lea edi, [ebp + 8]
mov dword [esp + 0x18], edi
jne 0x490434
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi], eax
jmp 0x490440
mov dword [esp + 0x18], edi
jmp 0x490440
cmp dword [ebp + 0x10], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0
je 0x49049f
xor esi, esi
test ebx, ebx
je 0x4904c5
lea esp, [esp]
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x490470
mov eax, 0x4000
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x3c]
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
mov byte [esp + 0x13], cl
jne 0x4904bd
add esi, 0x4000
cmp esi, ebx
jb 0x490460
jmp 0x4904bd
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push dword [esp + 0x3c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
mov byte [esp + 0x13], cl
test cl, cl
jne 0x4905cb
cmp byte [ebp + 0x1e], 0
je 0x4905cb
cmp dword [ebp + 0x10], 0
jne 0x4905cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x55770c]
mov ecx, ebp
call esi
mov dword [esp + 0x20], eax
lea eax, [ebp + 0x32]
push eax
mov dword [esp + 0x28], edx
call fcn.004914a0
push edi
mov dword [esp + 0x20], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x49055d
ja 0x49051f
cmp dword [esp + 0x1c], ebx
jbe 0x49055d
mov esi, dword [esp + 0x20]
mov edx, esi
mov edi, dword [esp + 0x24]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x49055d
jl 0x49053a
cmp edx, 0xffffffff
ja 0x49055d
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x28], ecx
js 0x49055d
jg 0x49054d
cmp eax, 0xffffffff
jbe 0x49055d
lea esi, [ebp + 0x32]
mov ecx, 0x5d381c
push esi
call fcn.00488890
jmp 0x490560
lea esi, [ebp + 0x32]
push 0
push esi
mov ecx, 0x5d381c
call fcn.00487910
test al, al
je 0x4905be
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp eax, ebx
jae 0x490440
test eax, eax
je 0x490440
mov edi, dword [ebp]
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x55770c]
mov ecx, ebp
call esi
sub eax, dword [esp + 0x14]
mov esi, dword [edi + 0x10]
mov ecx, esi
push 0
sbb edx, 0
push edx
push eax
call dword [0x55770c]
mov ecx, ebp
call esi
mov edi, dword [esp + 0x18]
jmp 0x490440
push esi
push 0
mov ecx, 0x5d381c
call fcn.004887c0
mov al, byte [esp + 0x13]
pop edi
pop esi
mov byte [ebp + 0xc], 1
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x490d30
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x490d87
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004a2bb0
test al, al
je 0x490d87
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x490d89
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x1004
ret 4

Function at 0x490db0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x490e07
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004a2bb0
test al, al
je 0x490e07
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x490e09
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x1004
ret 4