joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442be0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
xor esi, esi
mov dword [ebp - 0xc], edi
cmp dword [edi + 0x6c], edx
jbe 0x442db7
mov ebx, dword [edi + 0xc]
mov edi, edi
mov al, byte [ebx + edx]
movzx ecx, al
movzx ecx, byte [ecx + 0x5bf900]
test ecx, ecx
jne 0x442c50
cmp al, 0x41
jb 0x442c19
cmp al, 0x5a
jbe 0x442c56
cmp al, 0x61
jb 0x442c21
cmp al, 0x7a
jbe 0x442c56
cmp al, 0x30
jb 0x442c29
cmp al, 0x39
jbe 0x442c56
cmp al, 0x3d
je 0x442c56
cmp al, 0x3f
je 0x442c56
cmp al, 0x26
je 0x442c56
cmp al, 0x2f
je 0x442c56
cmp al, 0x2d
je 0x442c56
cmp al, 0x5f
je 0x442c56
cmp al, 0x25
je 0x442c56
cmp al, 0x2e
je 0x442c56
cmp al, 0x7e
je 0x442c56
inc esi
jmp 0x442c56
lea esi, [esi + ecx + 1]
add edx, ecx
inc edx
cmp edx, dword [edi + 0x6c]
jb 0x442c00
test esi, esi
je 0x442db7
lea eax, [esi + esi + 4]
mov dword [ebp - 0x10], eax
add eax, dword [edi + 0x6c]
push eax
call fcn.004176a0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x442c86
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
xor esi, esi
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], edx
jbe 0x442d6c
mov eax, dword [edi + 0xc]
mov al, byte [edx + eax]
movzx ecx, al
movzx ecx, byte [ecx + 0x5bf900]
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x442d10
cmp al, 0x41
jb 0x442cb5
cmp al, 0x5a
jbe 0x442d06
cmp al, 0x61
jb 0x442cbd
cmp al, 0x7a
jbe 0x442d06
cmp al, 0x30
jb 0x442cc5
cmp al, 0x39
jbe 0x442d06
cmp al, 0x3d
je 0x442d06
cmp al, 0x3f
je 0x442d06
cmp al, 0x26
je 0x442d06
cmp al, 0x2f
je 0x442d06
cmp al, 0x2d
je 0x442d06
cmp al, 0x5f
je 0x442d06
cmp al, 0x25
je 0x442d06
cmp al, 0x2e
je 0x442d06
cmp al, 0x7e
je 0x442d06
lea edx, [esi + ebx + 1]
movzx eax, al
push edx
push eax
mov byte [esi + ebx], 0x25
call fcn.00416db0
add esp, 8
add esi, 3
inc dword [ebp - 4]
jmp 0x442d60
mov byte [esi + ebx], al
inc esi
inc edx
mov dword [ebp - 4], edx
jmp 0x442d60
lea eax, [ecx + 1]
xor edi, edi
test eax, eax
je 0x442d53
lea esp, [esp]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea edx, [edi + ecx]
mov ecx, dword [eax + 0xc]
mov al, byte [edx + ecx]
lea edx, [esi + ebx + 1]
movzx eax, al
push edx
push eax
mov byte [esi + ebx], 0x25
call fcn.00416db0
mov eax, dword [ebp - 8]
inc edi
inc eax
add esp, 8
add esi, 3
cmp edi, eax
jb 0x442d20
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
lea eax, [edx + ecx + 1]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [edi + 0x6c]
jb 0x442c96
mov byte [esi + ebx], 0
cmp byte [edi + 9], 0
mov dword [edi + 0x6c], esi
je 0x442d90
test esi, esi
je 0x442d90
mov eax, dword [edi + 0xc]
test eax, eax
je 0x442d90
push esi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov eax, dword [edi + 0x64]
test eax, eax
je 0x442da8
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], eax
mov ecx, dword [edi + 0x6c]
add ecx, dword [ebp - 0x10]
mov dword [edi + 0x64], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x68], ecx
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x449f57
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x449f57
xor edx, edx
mov dword [ebp - 0x68], edx
xor eax, eax
xor ecx, ecx
mov edx, 0x23
mov dword [ebp - 0x6c], 0x250024
mov dword [ebp - 0x64], 0x270026
mov dword [ebp - 0x60], 0x290028
mov dword [ebp - 0x5c], 0x10000
mov dword [ebp - 0x58], 0x30002
mov dword [ebp - 0x54], 0x50004
mov dword [ebp - 0x50], 0x70006
mov dword [ebp - 0x4c], 0x90008
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0x2a0000
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0xa0000
mov dword [ebp - 0x38], 0xc000b
mov dword [ebp - 0x34], 0xe000d
mov dword [ebp - 0x30], 0x10000f
mov dword [ebp - 0x2c], 0x120011
mov dword [ebp - 0x28], 0x140013
mov dword [ebp - 0x24], 0x160015
mov dword [ebp - 0x20], 0x180017
mov dword [ebp - 0x1c], 0x1a0019
mov dword [ebp - 0x18], 0x1c001b
mov dword [ebp - 0x14], 0x1e001d
mov dword [ebp - 0x10], 0x20001f
mov dword [ebp - 0xc], 0x220021
mov word [ebp - 8], dx
cmp edi, 2
jb 0x449f57
movzx eax, byte [esi]
cmp edi, 3
jb 0x449efd
cmp eax, 0x28
jb 0x449e99
cmp eax, 0x5a
jbe 0x449e9e
mov eax, 0x28
add eax, 0xffffffd8
movzx ecx, ax
movzx eax, word [ebp + ecx*2 - 0x6c]
movzx ecx, byte [esi + 1]
cmp ecx, 0x28
jb 0x449eb7
cmp ecx, 0x5a
jbe 0x449ebc
mov ecx, 0x28
add ecx, 0xffffffd8
movzx ecx, cx
movzx edx, word [ebp + ecx*2 - 0x6c]
movzx ecx, byte [esi + 2]
cmp ecx, 0x28
jb 0x449ed5
cmp ecx, 0x5a
jbe 0x449eda
mov ecx, 0x28
imul eax, eax, 0x2b
add eax, edx
imul eax, eax, 0x2b
add ecx, 0xffffffd8
movzx ecx, cx
add ax, word [ebp + ecx*2 - 0x6c]
mov ecx, ebx
movzx edx, ax
push edx
add esi, 3
call fcn.004158f0
jmp 0x449f46
cmp eax, 0x28
jb 0x449f07
cmp eax, 0x5a
jbe 0x449f0c
mov eax, 0x28
add eax, 0xffffffd8
movzx ecx, ax
movzx eax, word [ebp + ecx*2 - 0x6c]
movzx ecx, byte [esi + 1]
cmp ecx, 0x28
jb 0x449f25
cmp ecx, 0x5a
jbe 0x449f2a
mov ecx, 0x28
mov dl, 0x2b
imul dl
add ecx, 0xffffffd8
movzx ecx, cx
add al, byte [ebp + ecx*2 - 0x6c]
mov ecx, ebx
movzx eax, al
push eax
add esi, 2
call fcn.00411a20
cmp edi, 3
jbe 0x449f57
sub edi, 3
cmp edi, 2
jae 0x449e87
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0059af98
mov esp, ebp
pop ebp
ret
Function at 0x44af50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0xc
test ecx, ecx
jne 0x44af65
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ecx], 0
test eax, eax
je 0x44b0ff
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x44b0ff
lea edx, [eax + eax*4]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [edx + 4]
push esi
push eax
mov dword [ecx], eax
call fcn.004176a0
mov esi, eax
add esp, 4
test esi, esi
jne 0x44afab
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xaaaaaaab
mul dword [ebp + 0xc]
push edi
xor edi, edi
xor ecx, ecx
shr edx, 1
mov dword [ebp - 0xc], edx
je 0x44b04a
mov dword [ebp - 4], edx
jmp 0x44afd0
movzx eax, byte [edi + ebx]
movzx edx, byte [edi + ebx + 1]
movzx ebx, byte [edi + ebx + 2]
mov dword [ebp - 8], ebx
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x5bfef0]
mov byte [ecx + esi], bl
mov ebx, edx
sar ebx, 4
and eax, 3
and ebx, 0xf
shl eax, 4
or ebx, eax
movzx eax, byte [ebx + 0x5bfef0]
mov byte [ecx + esi + 1], al
mov eax, dword [ebp - 8]
and edx, 0xf
mov ebx, eax
sar ebx, 6
add edx, edx
and ebx, 3
add edx, edx
or ebx, edx
mov dl, byte [ebx + 0x5bfef0]
mov ebx, dword [ebp + 8]
mov byte [ecx + esi + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x5bfef0]
mov byte [ecx + esi + 3], al
add edi, 3
add ecx, 4
dec dword [ebp - 4]
jne 0x44afd0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
lea edx, [edx + edx*2]
sub eax, edx
dec eax
je 0x44b0bc
dec eax
jne 0x44b0eb
movzx eax, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x5bfef0]
mov byte [ecx + esi], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
mov al, byte [edx + 0x5bfef0]
mov byte [ecx + esi + 1], al
and edi, 0xf
movzx edx, byte [edi*4 + 0x5bfef0]
mov byte [ecx + esi + 2], dl
mov edx, dword [ebp + 0x10]
mov byte [ecx + esi + 3], 0x3d
add ecx, 4
pop edi
mov byte [ecx + esi], 0
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, byte [edi + ebx]
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x5bfef0]
and eax, 3
mov byte [ecx + esi], dl
shl eax, 4
mov al, byte [eax + 0x5bfef0]
mov byte [ecx + esi + 1], al
mov word [ecx + esi + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0x10]
pop edi
mov byte [ecx + esi], 0
mov eax, esi
pop esi
mov dword [edx], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x468430
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2dc1
mov eax, dword fs:[0]
push eax
mov eax, 0x1354
call fcn.0059b430
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x112c]
call fcn.0040c500
push edi
lea ecx, [ebp - 0x112c]
mov dword [ebp - 4], 0
call fcn.0040ffb0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x112c]
call fcn.00410220
lea ecx, [ebp - 0x112c]
call fcn.0040e5d0
cmp eax, 0x104
jle 0x468599
lea ecx, [ebp - 0x1244]
call fcn.0040c500
lea ecx, [ebp - 0x1244]
mov byte [ebp - 4], 1
call fcn.0040c7b0
lea eax, [ebp - 0x1360]
push eax
lea ecx, [ebp - 0x1014]
push ecx
push 0x800
lea ecx, [ebp - 0x112c]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x1244]
test eax, eax
je 0x468504
lea edx, [ebp - 0x1014]
push edx
call fcn.0040f9b0
mov bl, 1
jmp 0x468512
lea eax, [ebp - 0x112c]
push eax
call fcn.0040cb80
xor bl, bl
lea ecx, [ebp - 0x135c]
call fcn.0040c500
mov byte [ebp - 4], 2
test bl, bl
je 0x468535
push 0x5f59d4
lea ecx, [ebp - 0x135c]
call fcn.0040f360
lea ecx, [ebp - 0x1244]
call fcn.0040d9a0
push eax
lea ecx, [ebp - 0x135c]
call fcn.0040f360
lea ecx, [ebp - 0x135c]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x468576
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x468574
mov esi, 1
test esi, esi
lea ecx, [ebp - 0x135c]
setne bl
mov byte [ebp - 4], 1
call fcn.0040c590
lea ecx, [ebp - 0x1244]
mov byte [ebp - 4], 0
call fcn.0040c590
jmp 0x4685e7
lea ecx, [ebp - 0x112c]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test ebx, ebx
jne 0x4685e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x4685d8
push edi
mov ecx, esi
call fcn.0044eb70
lea ecx, [ebp - 0x112c]
push ecx
push str.failedToDeleteFilepath
mov ecx, esi
call fcn.0044e4d0
cmp edi, 2
jne 0x4685e2
mov ebx, 1
test ebx, ebx
setne bl
lea ecx, [ebp - 0x112c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret
Function at 0x468ea0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2e76
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, edi
mov dword [ebp - 0x244], eax
mov dword [esi], 0xffffffff
call fcn.0040dfd0
test al, al
je 0x468f10
test ebx, ebx
je 0x468f09
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
push str.GetAttributes:_filename_is_empty
mov ecx, ebx
call edx
xor al, al
jmp 0x468fd8
lea ecx, [ebp - 0x128]
call fcn.0040c500
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.0040ffb0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.00410220
lea ecx, [ebp - 0x128]
call fcn.0040e5d0
test eax, eax
jle 0x468f97
lea ecx, [ebp - 0x240]
call fcn.0040c500
push ebx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x128]
push ecx
mov byte [ebp - 4], 1
call fcn.004682e0
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x240]
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.0040c590
jmp 0x468fab
lea ecx, [ebp - 0x128]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x468fc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x244]
mov dword [edx], eax
cmp dword [esi], 0xffffffff
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret
Function at 0x469000
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2eb6
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x128]
call fcn.0040c500
xor ebx, ebx
push edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], ebx
call fcn.0040ffb0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.00410220
lea ecx, [ebp - 0x128]
call fcn.0040e5d0
test eax, eax
jle 0x4690b9
lea ecx, [ebp - 0x240]
call fcn.0040c500
push ebx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x128]
push ecx
mov byte [ebp - 4], 1
call fcn.004682e0
add esp, 0xc
push ebx
lea ecx, [ebp - 0x240]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x240]
mov edi, eax
mov byte [ebp - 4], bl
call fcn.0040c590
jmp 0x4690ce
push ebx
lea ecx, [ebp - 0x128]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
cmp edi, ebx
jne 0x46911b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4690f5
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov al, 1
jmp 0x469132
cmp esi, ebx
je 0x469119
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push 1
push str.createDirWin32
mov ecx, esi
call eax
mov ecx, esi
call fcn.0044ea80
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
cmp edi, ebx
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret
Function at 0x469150
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2ef6
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x128]
call fcn.0040c500
xor ebx, ebx
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], ebx
call fcn.0040ffb0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.00410220
push ebx
lea eax, [ebp - 0x128]
push 1
push eax
call fcn.00468620
add esp, 0xc
lea ecx, [ebp - 0x128]
call fcn.0040dfd0
test al, al
jne 0x46921a
lea ecx, [ebp - 0x240]
call fcn.0040c500
push ebx
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x128]
push edx
mov byte [ebp - 4], 1
call fcn.004682e0
mov eax, dword [ebp + 0xc]
add esp, 0xc
push eax
lea ecx, [ebp - 0x240]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x240]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.0040c590
jmp 0x469232
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x128]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp esi, ebx
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret

Function at 0x469430
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2f6b
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x128]
call fcn.0040c500
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.0040c960
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x128]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [ebp - 0x128]
setne bl
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret

Function at 0x4694d0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2fab
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x128]
call fcn.0040c500
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.0040c960
lea ecx, [ebp - 0x128]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x128]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret
Function at 0x469560
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a300c
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x474], eax
call fcn.0040c500
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], 0
call fcn.0040c500
push esi
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 1
call fcn.0040ffb0
push edi
lea ecx, [ebp - 0x240]
call fcn.0040ffb0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.00410220
push 0x5c
push 0x2f
lea ecx, [ebp - 0x240]
call fcn.00410220
lea ecx, [ebp - 0x128]
call fcn.0040dfd0
test al, al
je 0x46963a
lea ecx, [ebp - 0x240]
call fcn.0040dfd0
test al, al
je 0x46963a
lea ecx, [ebp - 0x240]
call fcn.0040e920
push eax
lea ecx, [ebp - 0x128]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jmp 0x4696c6
lea ecx, [ebp - 0x358]
call fcn.0040c500
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 2
call fcn.0040c500
push 0
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x128]
push edx
mov byte [ebp - 4], 3
call fcn.004682e0
push 0
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x240]
push ecx
call fcn.004682e0
add esp, 0x18
lea ecx, [ebp - 0x470]
call fcn.0040e920
push eax
lea ecx, [ebp - 0x358]
call fcn.0040e920
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [ebp - 0x470]
setne bl
mov byte [ebp - 4], 2
call fcn.0040c590
lea ecx, [ebp - 0x358]
mov byte [ebp - 4], 1
call fcn.0040c590
test bl, bl
jne 0x4696d9
mov ecx, dword [ebp - 0x474]
test ecx, ecx
je 0x4696d9
call fcn.0044ea80
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.0040c590
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret

Function at 0x46a260
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00469560
Function at 0x46e630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a33c3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x676664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0046f950
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.00440f60
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [esi], vtable.AsyncProgressEvent.1.0
mov dword [esi + 0x10], vtable.AsyncProgressEvent.0
call fcn.0046a960
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x50], bl
mov dword [esi + 0x54], ebx
mov byte [esi + 0x48], 1
mov byte [esi + 0xc], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x470de8
mov edx, dword [ebp + 0xc]
xor cl, cl
xor eax, eax
test edx, edx
je 0x470de6
push ebx
push esi
mov esi, dword [ebp + 8]
jmp 0x470dd0
movzx ebx, byte [eax + esi]
movzx ecx, cl
xor ebx, ecx
mov cl, byte [ebx + 0x672198]
inc eax
cmp eax, edx
jb 0x470dd0
pop esi
pop ebx
mov byte [edi], cl
pop edi
pop ebp
ret
Function at 0x471a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 8], 0xffffffff
mov dword [ebp - 4], ecx
jne 0x471a7e
cmp dword [ecx + 4], 0
jne 0x471a7e
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x471a76
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Failed_to_write_because_file_is_not_open.
call edx
xor al, al
mov esp, ebp
pop ebp
ret 0x14
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x471a97
mov dword [edi], 0
mov dword [edi + 4], 0
mov edx, dword [ebp + 0xc]
mov eax, edx
or eax, dword [ebp + 0x10]
push esi
je 0x471b61
cmp dword [ebp + 0x10], 0
jl 0x471abd
jg 0x471ab6
cmp edx, 0x989680
jbe 0x471abd
mov esi, 0x989680
jmp 0x471abf
mov esi, edx
mov eax, dword [ecx + 8]
cmp eax, 0xffffffff
je 0x471b18
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push ebx
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x471ae6
cmp dword [ebp + 8], esi
je 0x471b35
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x471b0d
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push 1
push str.WriteFileError
mov ecx, esi
call eax
mov ecx, esi
call fcn.0044ea80
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ecx + 4]
test eax, eax
je 0x471b3b
push eax
push 1
push esi
push ebx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x471b6c
mov dword [ebp + 8], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add ebx, esi
sub edx, esi
mov eax, 0
sbb dword [ebp + 0x10], eax
mov dword [ebp + 0xc], edx
cmp edi, eax
je 0x471b56
mov esi, dword [ebp + 8]
add dword [edi], esi
adc dword [edi + 4], eax
mov eax, edx
or eax, dword [ebp + 0x10]
jne 0x471aa6
pop esi
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x471b7f
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.fwrite_failed.
call eax
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14