joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493060
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaa78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x493097
xor al, al
jmp 0x4930fa
and esi, 0xffffb1af
push esi
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4930b2
mov al, 1
jmp 0x4930fa
lea ecx, [ebp - 0x28]
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.00493880
test al, al
je 0x4930e7
push esi
lea ecx, [ebp - 0x28]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4930e7
mov bl, 1
jmp 0x4930e9
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret

Function at 0x493120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaa78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49319e
lea ecx, [ebp - 0x28]
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.00493880
test al, al
je 0x49318d
lea ecx, [ebp - 0x28]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret
Function at 0x4932d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f71f8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0xb
mov ecx, esi
call fcn.004027b0
push eax
mov ecx, edi
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x493322
mov al, 1
jmp 0x493410
lea ecx, [ebp - 0x58]
xor bl, bl
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.00493880
test al, al
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
lea ecx, [ebp - 0x40]
call fcn.00402850
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00493880
test al, al
jne 0x493368
test bl, bl
je 0x493386
push 0xb
lea ecx, [ebp - 0x40]
call fcn.004027b0
push eax
lea ecx, [ebp - 0x58]
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4933da
mov ecx, esi
call fcn.00493120
cmp eax, 0xffffffff
je 0x4933f1
push esi
lea ecx, [ebp - 0x28]
call fcn.00405530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00493640
test al, al
je 0x4933e5
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004931c0
test al, al
je 0x4933e5
mov edx, esi
mov ecx, edi
call fcn.004931c0
lea ecx, [ebp - 0x28]
test al, al
je 0x4933de
call fcn.00493430
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov bl, 1
jmp 0x4933f3
mov edx, esi
call fcn.004931c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004027f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret
Function at 0x493430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7240
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004027b0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x493476
mov al, 1
jmp 0x49356b
mov ecx, esi
call fcn.004027b0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402800
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00493120
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
cmp ebx, 0xffffffff
jne 0x4934b5
xor al, al
jmp 0x49356b
mov ecx, esi
call fcn.004027b0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402800
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.00493060
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
test bl, bl
je 0x4934ae
mov ecx, esi
call fcn.004027b0
push eax
call edi
test eax, eax
jne 0x49346f
lea ecx, [ebp - 0x28]
call fcn.00402850
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00493880
test al, al
je 0x49352d
lea ecx, [ebp - 0x28]
call fcn.004027b0
push eax
call edi
test eax, eax
je 0x49352d
mov bl, 1
jmp 0x49355a
mov ecx, esi
call fcn.004027b0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402800
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.00493060
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.004027f0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret

Function at 0x493590
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x533068]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.004bf3c0
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.004027b0
push eax
mov ecx, edi
call fcn.004027b0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x493625
xor eax, eax
mov word [esp + 0x216], ax
lea eax, [esp + 0xc]
push eax
call fcn.00402af0
add esp, 4
mov ecx, ebx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004028e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004bc909
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bc909
add esp, 0x210
ret
Function at 0x4971e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x533068]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.004bf3c0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x497277
cmp dword [esp + 8], 6
jb 0x497277
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004bc909
add esp, 0x118
ret

Function at 0x497290
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f77f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x533068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00402800
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004821d0
mov ecx, eax
call fcn.00482290
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004027f0
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00402800
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.004821d0
mov ecx, eax
call fcn.00482290
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004027f0
test ebx, ebx
je 0x4973a5
test esi, esi
je 0x4973a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c010
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f50df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x533068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.004020b0
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.00405530
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.00405530
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00405530
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00405530
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00405530
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00405530
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49dbb0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x533068]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x49dc15
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49dbf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49dc15
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004bc909
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004bc909
add esp, 8
ret 4
Function at 0x49ddb0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8638
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x49ddf9
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x49df4b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x49df16
test eax, eax
je 0x49df16
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x49df19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x49de9b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49de8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49de9b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x49dea9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00405530
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x49df16
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x49de54
jmp 0x49df19
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x49df42
test edx, edx
je 0x49df3e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x49de10
mov al, 1
jmp 0x49df4d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x49df4b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49f420
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f89a8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x533068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.00405520
test al, al
jne 0x49f47a
cmp byte [ebp + 8], al
jne 0x49f481
mov eax, dword [ebx]
test eax, eax
je 0x49f5e1
cmp byte [eax + 0xa5], 0
je 0x49f5e1
xor al, al
jmp 0x49f5f7
mov ecx, esi
call fcn.00405520
test al, al
jne 0x49f5e1
push esi
call fcn.0046fa70
add esp, 4
test al, al
je 0x49f4a9
push esi
push edi
call fcn.0049f050
jmp 0x49f5dd
push 0xb
mov ecx, esi
call fcn.004027b0
push eax
mov ecx, edi
call fcn.004027b0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x49f4ce
mov al, 1
jmp 0x49f5dd
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.00402850
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.00493880
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.00402850
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00493880
test al, al
jne 0x49f51b
cmp byte [ebp - 0x60], al
je 0x49f557
push 0xb
lea ecx, [ebp - 0x40]
call fcn.004027b0
push eax
lea ecx, [ebp - 0x58]
call fcn.004027b0
push eax
call ebx
test eax, eax
je 0x49f557
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004027f0
mov al, 1
jmp 0x49f5dd
mov ecx, esi
call fcn.00493120
cmp eax, 0xffffffff
je 0x49f5c0
push esi
lea ecx, [ebp - 0x28]
call fcn.00405530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00493640
test al, al
je 0x49f5b4
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004931c0
test al, al
je 0x49f5b4
mov edx, esi
mov ecx, edi
call fcn.004931c0
lea ecx, [ebp - 0x28]
test al, al
je 0x49f5ad
call fcn.00493430
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
jmp 0x49f535
mov edx, esi
call fcn.004931c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004027f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004027f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.004027f0
xor al, al
test al, al
jne 0x49f5f5
push edi
call fcn.0046fa70
add esp, 4
test al, al
je 0x49f5f5
mov ecx, edi
call fcn.00493430
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bc909
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b2e90
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4b2e9b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004b2eb0
Function at 0x4d6bf4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d6a73

Function at 0x4db64e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004db30e
Function at 0x40ef8f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409cf4
and dword [ebp - 4], 0
cmp dword [0x418b2c], 0
mov ebx, eax
jne 0x40f040
push 0x413b98
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f0f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x413b8c
push edi
call esi
test eax, eax
je 0x40f0f1
push eax
call fcn.00409c82
mov dword [esp], 0x413b7c
push edi
mov dword [0x418b2c], eax
call esi
push eax
call fcn.00409c82
mov dword [esp], 0x413b68
push edi
mov dword [0x418b30], eax
call esi
push eax
call fcn.00409c82
mov dword [esp], 0x413b4c
push edi
mov dword [0x418b34], eax
call esi
push eax
call fcn.00409c82
pop ecx
mov dword [0x418b3c], eax
test eax, eax
je 0x40f040
push 0x413b34
push edi
call esi
push eax
call fcn.00409c82
pop ecx
mov dword [0x418b38], eax
mov eax, dword [0x418b38]
cmp eax, ebx
je 0x40f098
cmp dword [0x418b3c], ebx
je 0x40f098
push eax
call fcn.00409cfd
push dword [0x418b3c]
mov esi, eax
call fcn.00409cfd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f098
test edi, edi
je 0x40f098
call esi
test eax, eax
je 0x40f08f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f08f
test byte [ebp - 0xc], 1
jne 0x40f098
or dword [ebp + 0x10], 0x200000
jmp 0x40f0d1
mov eax, dword [0x418b30]
cmp eax, ebx
je 0x40f0d1
push eax
call fcn.00409cfd
pop ecx
test eax, eax
je 0x40f0d1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f0d1
mov eax, dword [0x418b34]
cmp eax, ebx
je 0x40f0d1
push eax
call fcn.00409cfd
pop ecx
test eax, eax
je 0x40f0d1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418b2c]
call fcn.00409cfd
pop ecx
test eax, eax
je 0x40f0f1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f0f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0xde7780
Capabilities:
Encode data using xor

Disassembly:
jmp 0xde778a
pushal
call 0xde7790
pop ebp
sub ebp, 0x10
sub ebp, 0x9e7780
jmp 0xde77a6
mov eax, 0x9e7780
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c4
mov edx, 0x320209eb
xor byte [eax], dl
inc eax
dec ecx
jne 0xde77bd
jmp 0xde77d0
pushal
pushal
invalid
Function at 0x44f000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x53adbc], eax
push 2
mov eax, dword [0x53adbc]
push eax
call fcn.00492e10
add esp, 8
mov dword [0x53ac80], 0
mov ecx, dword [ebp + 8]
mov dword [0x53ac94], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x53ac98], edx
mov eax, dword [ebp + 0x10]
mov dword [0x53ac9c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x53ac88], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x53ac8c], eax
call fcn.0046c390
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44f0a1
call fcn.0046a680
push eax
push 0x522f08
call fcn.004b9f9b
add esp, 8
call fcn.0046a6a0
push eax
call fcn.004b9f10
add esp, 4
test eax, eax
je 0x44f0a1
call fcn.0046a6a0
push eax
push 0x522f08
call fcn.004b9f9b
add esp, 8
mov eax, dword [0x53ac10]
mov esp, ebp
pop ebp
ret
Function at 0x455650
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x520f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004523c0
add esp, 4
movzx edx, al
test edx, edx
je 0x4556e1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.004bb190
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4556df
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x4556df
jmp 0x4556e1
jmp 0x455663
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ba663
mov esp, ebp
pop ebp
ret
Function at 0x46b9c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x46ba2c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x46ba73
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004bf4b8
add esp, 8
test eax, eax
jne 0x46ba71
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x46ba75
jmp 0x46ba23
xor eax, eax
mov esp, ebp
pop ebp
ret