joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4838c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x483999
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x483937
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00483480
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x483909
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x483a40
call 0x483949
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x4839e9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004835b0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4839a6
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x483a40
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004835b0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x483a3e
jmp 0x483a40
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x488370
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x48861c
test edx, edx
je 0x48861c
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x488530
cmp ecx, 0xc0
je 0x488450
cmp ecx, 0x80
jne 0x488624
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.00488436
aeskeygenassist xmm1, xmm0, 2
call fcn.00488430
aeskeygenassist xmm1, xmm0, 4
call fcn.00488430
aeskeygenassist xmm1, xmm0, 8
call fcn.00488430
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00488430
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00488430
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00488430
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00488430
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00488430
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00488430
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.004884d0
aeskeygenassist xmm1, xmm2, 2
call fcn.00488510
aeskeygenassist xmm1, xmm2, 4
call fcn.004884c0
aeskeygenassist xmm1, xmm2, 8
call fcn.00488510
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004884c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00488510
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004884c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00488510
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.004885e6
aeskeygenassist xmm1, xmm0, 1
call fcn.00488600
aeskeygenassist xmm1, xmm2, 2
call fcn.004885e0
aeskeygenassist xmm1, xmm0, 2
call fcn.00488600
aeskeygenassist xmm1, xmm2, 4
call fcn.004885e0
aeskeygenassist xmm1, xmm0, 4
call fcn.00488600
aeskeygenassist xmm1, xmm2, 8
call fcn.004885e0
aeskeygenassist xmm1, xmm0, 8
call fcn.00488600
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004885e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00488600
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004885e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00488600
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004885e0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x488650
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00488370
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x4886b1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x488682
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x488c60
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x488c80
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x493a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x493aef
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x493a85
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004930c0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x493a4f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x493ba6
call 0x493a97
pop edx
lea ecx, [edx + 0x129]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x493b47
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00493570
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x493afc
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x493ba6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00493570
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x493ba4
jmp 0x493ba6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x494440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x49451f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x4944b5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00493c00
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x49447f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4945d6
call 0x4944c7
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x494577
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00494020
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x49452c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x4945d6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00494020
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4945d4
jmp 0x4945d6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x49b530
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515398
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x56b0f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 0xc]
xor eax, eax
push eax
push 0x561700
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00498dc0
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0
call fcn.004ba11b
cmp dword [esi + 0x14], 8
jb 0x49b5ac
mov eax, dword [esi]
jmp 0x49b5ae
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49b6d6
cmp dword [esi + 0x14], 8
jb 0x49b5c5
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 1
push connect
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49b604
push 0x561700
mov ecx, edi
call fcn.004989c0
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x49b6f6
inc ecx
push ecx
jmp 0x49b6eb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc8], eax
inc eax
push eax
mov dword [ebp - 0xcc], eax
call fcn.004adda0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x49b642
push 0x561700
mov ecx, edi
call fcn.004989c0
lea ecx, [ebp - 0x28]
call fcn.00498900
jmp 0x49b6f6
push dword [ebp - 0xcc]
push 0
push ebx
call fcn.004c42d0
add esp, 0xc
lea eax, [ebp - 0xd4]
push 0
push eax
push dword [ebp - 0xc8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xc4]
push ebx
call fcn.004bab0d
push ebx
call fcn.004add5a
add esp, 4
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xc4]
push eax
call fcn.004ba35b
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.004b87cd
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00498a90
cmp dword [ebp - 0x30], 0
jbe 0x49b6ce
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00498ec0
lea ecx, [ebp - 0x40]
call fcn.00498900
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00499bf0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x49b6f6
inc eax
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00499470
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004add49
mov esp, ebp
pop ebp
ret 8
Function at 0x49b720
Capabilities:
Check if file exists
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5153c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x56b0f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49b77f
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004c42d0
push 0x98967f
push 0x64
call fcn.004b7c81
add esp, 0x14
cmp dword [esi + 0x14], 8
jb 0x49b7a9
mov esi, dword [esi]
push eax
push esi
lea eax, [ebp - 0x218]
push str._s__d
push eax
call fcn.00499d90
add esp, 0x10
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
cmovae eax, dword [ebp + 0xc]
push 0
push 0
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x49b7fc
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49b7fc
mov bl, 1
jmp 0x49b7fe
xor bl, bl
mov ecx, dword [ebp + 0x20]
cmp ecx, 8
jb 0x49b813
inc ecx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00499470
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004add49
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x49d6e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515528
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x56b0f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
cmp dword [ebx + 0x38], 0
je 0x49d89f
cmp byte [ebx + 0x3d], 0
je 0x49d89f
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x49d73c
xor al, al
jmp 0x49d8a1
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0049d180
lea eax, [ebx + 0x40]
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
nop dword [eax]
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
cmp edx, 0x10
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
mov ecx, dword [ecx + 0x38]
cmovae edi, ebx
cmovae esi, ebx
add eax, edi
push eax
push esi
mov edx, dword [ecx]
push dword [ebp - 0x30]
call dword [edx + 0x20]
sub eax, 0
je 0x49d7ab
sub eax, 1
jne 0x49d874
mov edi, dword [ebp - 0x2c]
jmp 0x49d7b2
mov edi, dword [ebp - 0x2c]
mov byte [edi + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x34]
cmovae eax, ebx
sub esi, eax
je 0x49d7ee
push dword [edi + 0x4c]
cmp edx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ebx
push 1
push eax
call fcn.004cb742
add esp, 0x10
cmp esi, eax
jne 0x49d879
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp byte [edi + 0x3d], 0
je 0x49d891
test esi, esi
jne 0x49d770
mov ecx, dword [ebp - 0x18]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x49d887
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x49d887
cmp edx, esi
jae 0x49d85c
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004999b0
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
test esi, esi
je 0x49d770
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edx, 0x10
xorps xmm0, xmm0
cmovae ecx, ebx
movq qword [ecx + eax], xmm0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x28]
mov byte [eax + esi], 0
jmp 0x49d767
test esi, esi
jne 0x49d831
cmp edx, 0x10
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
cmovae eax, ebx
mov byte [eax], 0
jmp 0x49d767
sub eax, 2
je 0x49d891
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.00498a90
mov al, bl
jmp 0x49d8a1
push str.string_too_long
call fcn.004acad2
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.00498a90
mov al, bl
jmp 0x49d8a1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004add49
mov esp, ebp
pop ebp
ret
Function at 0x49df30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515236
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56b0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004add5f
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004acd84
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49f4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 4], ecx
test edi, edi
jle 0x49f5da
lea eax, [ecx + 0x80]
mov dword [ebp - 0x10], eax
lea edx, [ebx + 2]
mov eax, dword [ebp + 8]
push esi
mov dword [ebp + 0xc], edx
lea esi, [eax + 2]
sub eax, ebx
lea ecx, [eax - 2]
lea eax, [edi - 1]
mov dword [ebp - 0xc], ecx
shr eax, 3
inc eax
mov dword [ebp - 8], eax
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
mov edx, ecx
mov ecx, dword [ebp - 0x10]
call fcn.0049eb90
mov ecx, dword [ebp - 4]
lea esi, [esi + 8]
mov edx, dword [ebp + 0xc]
add esp, 4
movzx eax, byte [ecx + 0x100]
mov ecx, dword [ebp - 0xc]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [ebp - 8], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [ebp - 0xc]
jne 0x49f510
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret