joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492400
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7038
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x30]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0
call fcn.00405530
mov dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
push 0x513888
lea ecx, [ebp - 0x58]
mov dword [edi + 0xb4], 0
call fcn.00405670
mov byte [ebp - 4], 2
lea eax, [edi + 0x40]
push ecx
mov ecx, dword [ebp - 0x3c]
push eax
lea eax, [edi + 0x58]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push dword [ebp + 0x10]
push eax
push dword [ebx + 4]
call fcn.004b4c00
mov bl, al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00405620
test bl, bl
jne 0x4924c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xb0], eax
jmp 0x49257e
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push ecx
push eax
push 0x13
mov ecx, ebx
mov dword [ebp - 0x14], 0
call fcn.0042dd70
test al, al
jne 0x4924f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xb0], eax
jmp 0x49257e
mov eax, dword [ebp - 0x14]
mov dword [edi + 0xb4], eax
cmp eax, 0xc8
je 0x49256b
cmp eax, 0xce
je 0x49256b
cmp eax, 0x12e
jne 0x49259f
mov ecx, 0x400
mov dword [ebp - 0x34], ecx
test esi, esi
jne 0x492533
push 0x800
call fcn.004bd0c5
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x34]
add ecx, ecx
push ecx
push 0
push esi
call fcn.004bf410
add esp, 8
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
push esi
push 0x21
call fcn.0042dde0
test al, al
je 0x49259f
push esi
call fcn.00402af0
add esp, 4
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004028e0
mov ebx, dword [ebp - 0x38]
jmp 0x49258f
cmp dword [ebp + 0x14], 0
ja 0x492577
cmp dword [ebp + 0x10], 0
jbe 0x4925a3
cmp eax, 0xce
je 0x4925a3
mov ebx, dword [ebp - 0x38]
cmp dword [ebx + 4], 0
je 0x49259f
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 3
jb 0x492463
xor bl, bl
jmp 0x4925af
mov dword [edi + 0xb0], 0
mov bl, 1
mov byte [ebp - 4], 0
test esi, esi
je 0x4925c0
push esi
call fcn.004bd0c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004027f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4930b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaad8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x4930e7
xor al, al
jmp 0x49314a
and esi, 0xffffb1af
push esi
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x493102
mov al, 1
jmp 0x49314a
lea ecx, [ebp - 0x28]
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004938d0
test al, al
je 0x493137
push esi
lea ecx, [ebp - 0x28]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x493137
mov bl, 1
jmp 0x493139
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret

Function at 0x493170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaad8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4931ee
lea ecx, [ebp - 0x28]
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004938d0
test al, al
je 0x4931dd
lea ecx, [ebp - 0x28]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret
Function at 0x493320
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7258
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0xb
mov ecx, esi
call fcn.004027b0
push eax
mov ecx, edi
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x493372
mov al, 1
jmp 0x493460
lea ecx, [ebp - 0x58]
xor bl, bl
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.004938d0
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp - 0x40]
call fcn.00402850
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.004938d0
test al, al
jne 0x4933b8
test bl, bl
je 0x4933d6
push 0xb
lea ecx, [ebp - 0x40]
call fcn.004027b0
push eax
lea ecx, [ebp - 0x58]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x49342a
mov ecx, esi
call fcn.00493170
cmp eax, 0xffffffff
je 0x493441
push esi
lea ecx, [ebp - 0x28]
call fcn.00405530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00493690
test al, al
je 0x493435
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00493210
test al, al
je 0x493435
mov edx, esi
mov ecx, edi
call fcn.00493210
lea ecx, [ebp - 0x28]
test al, al
je 0x49342e
call fcn.00493480
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov bl, 1
jmp 0x493443
mov edx, esi
call fcn.00493210
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004027f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret
Function at 0x493480
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f72a0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004027b0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4934c6
mov al, 1
jmp 0x4935bb
mov ecx, esi
call fcn.004027b0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402800
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00493170
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
cmp ebx, 0xffffffff
jne 0x493505
xor al, al
jmp 0x4935bb
mov ecx, esi
call fcn.004027b0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402800
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004930b0
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
test bl, bl
je 0x4934fe
mov ecx, esi
call fcn.004027b0
push eax
call edi
test eax, eax
jne 0x4934bf
lea ecx, [ebp - 0x28]
call fcn.00402850
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004938d0
test al, al
je 0x49357d
lea ecx, [ebp - 0x28]
call fcn.004027b0
push eax
call edi
test eax, eax
je 0x49357d
mov bl, 1
jmp 0x4935aa
mov ecx, esi
call fcn.004027b0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402800
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.004930b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.004027f0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret

Function at 0x4935e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x534068]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.004bf410
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.004027b0
push eax
mov ecx, edi
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x493675
xor eax, eax
mov word [esp + 0x216], ax
lea eax, [esp + 0xc]
push eax
call fcn.00402af0
add esp, 4
mov ecx, ebx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004028e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004bc969
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bc969
add esp, 0x210
ret
Function at 0x497230
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x534068]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.004bf410
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4972c7
cmp dword [esp + 8], 6
jb 0x4972c7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004bc969
add esp, 0x118
ret

Function at 0x4972e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7850
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x534068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00402800
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00482220
mov ecx, eax
call fcn.004822e0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00402800
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00482220
mov ecx, eax
call fcn.004822e0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004027f0
test ebx, ebx
je 0x4973f5
test esi, esi
je 0x4973f5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c060
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f513f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x534068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.004020b0
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.00405530
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.00405530
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00405530
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00405530
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00405530
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00405530
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49dc00
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x534068]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x49dc65
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49dc40
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49dc65
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004bc969
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004bc969
add esp, 8
ret 4
Function at 0x49de00
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8698
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x49de49
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x49df9b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x49df66
test eax, eax
je 0x49df66
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x49df69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x49deeb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49dedf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49deeb
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x49def9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00405530
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x49df66
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x49dea4
jmp 0x49df69
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x49df92
test edx, edx
je 0x49df8e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x49de60
mov al, 1
jmp 0x49df9d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x49df9b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49f470
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8a08
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x534068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.00405520
test al, al
jne 0x49f4ca
cmp byte [ebp + 8], al
jne 0x49f4d1
mov eax, dword [ebx]
test eax, eax
je 0x49f631
cmp byte [eax + 0xa5], 0
je 0x49f631
xor al, al
jmp 0x49f647
mov ecx, esi
call fcn.00405520
test al, al
jne 0x49f631
push esi
call fcn.0046fab0
add esp, 4
test al, al
je 0x49f4f9
push esi
push edi
call fcn.0049f0a0
jmp 0x49f62d
push 0xb
mov ecx, esi
call fcn.004027b0
push eax
mov ecx, edi
call fcn.004027b0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x49f51e
mov al, 1
jmp 0x49f62d
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.004938d0
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.00402850
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.004938d0
test al, al
jne 0x49f56b
cmp byte [ebp - 0x60], al
je 0x49f5a7
push 0xb
lea ecx, [ebp - 0x40]
call fcn.004027b0
push eax
lea ecx, [ebp - 0x58]
call fcn.004027b0
push eax
call ebx
test eax, eax
je 0x49f5a7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004027f0
mov al, 1
jmp 0x49f62d
mov ecx, esi
call fcn.00493170
cmp eax, 0xffffffff
je 0x49f610
push esi
lea ecx, [ebp - 0x28]
call fcn.00405530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00493690
test al, al
je 0x49f604
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00493210
test al, al
je 0x49f604
mov edx, esi
mov ecx, edi
call fcn.00493210
lea ecx, [ebp - 0x28]
test al, al
je 0x49f5fd
call fcn.00493480
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
jmp 0x49f585
mov edx, esi
call fcn.00493210
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004027f0
xor al, al
test al, al
jne 0x49f645
push edi
call fcn.0046fab0
add esp, 4
test al, al
je 0x49f645
mov ecx, edi
call fcn.00493480
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc969
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b2ef0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4b2efb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004b2f10
Function at 0x4d6c54
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d6ad3

Function at 0x4db6ae
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004db36e

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x2d5d75e7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0xb481217
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4a5e01
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5c5f94]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a5e4c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a62c3
test al, al
jne 0x4a5e46
sub edx, 2
cmp edx, edi
jne 0x4a5e2c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a5e6e
lea eax, [edi + 2]
cmp edx, eax
je 0x4a5e6e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a59fa
add esp, 0x10
jmp 0x4a5f68
push esi
lea ecx, [ebp - 0x255]
call fcn.004a62c3
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a5eb1
push dword [ebp - 0x25c]
jmp 0x4a5e5e
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a5eee
cmp word [ebp - 0x226], 0
je 0x4a5f0f
cmp word [ebp - 0x226], ax
jne 0x4a5eee
cmp word [ebp - 0x224], 0
je 0x4a5f0f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a59fa
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a5f5b
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a5ec8
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a5f43
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a5f68
push 0x4a53e2
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00406055
add esp, 0x10
jmp 0x4a5f38
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040351c
leave
ret