joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4643e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], 0
push ebx
push esi
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ecx + 0x18]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x46447b
mov esi, dword [eax + 0x18]
test esi, esi
je 0x46447b
mov eax, dword [eax + 0x20]
lea edi, [eax + esi*4]
add edi, ebx
mov eax, dword [edi - 4]
lea edi, [edi - 4]
add eax, ebx
dec esi
mov edx, 0x811c9dc5
mov cl, byte [eax]
inc eax
test cl, cl
je 0x464471
nop dword [eax]
movsx ecx, cl
lea eax, [eax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [eax - 1]
test cl, cl
jne 0x464450
cmp edx, 0x4cfe97c1
je 0x46453f
test esi, esi
jne 0x464434
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp eax, edx
je 0x46448c
cmp dword [ecx + 0x18], 0
jne 0x464412
mov dword [ebp - 0x14], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov dword [ebp - 0xc], ecx
nop dword [eax + eax]
mov ebx, dword [ecx + 0x18]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x46450e
mov esi, dword [eax + 0x18]
test esi, esi
je 0x46450e
mov eax, dword [eax + 0x20]
lea edi, [eax + esi*4]
add edi, ebx
mov ecx, dword [edi - 4]
lea edi, [edi - 4]
add ecx, ebx
dec esi
mov edx, 0x811c9dc5
mov al, byte [ecx]
inc ecx
test al, al
je 0x464504
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x4644e7
cmp edx, 0x6dd8a845
je 0x46455f
test esi, esi
jne 0x4644d2
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp eax, edx
je 0x46451f
cmp dword [ecx + 0x18], 0
jne 0x4644b0
xor eax, eax
call eax
lea ecx, [ebp - 8]
push ecx
push eax
call dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + ebx]
add edx, ebx
mov dword [ebp - 0x14], edx
jmp 0x464493
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x464521
Function at 0x467200
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x467220
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
pop ebp
ret 4

Function at 0x4673a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x4673fd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4673c0
mov eax, dword [esi]
jmp 0x4674db
cmp eax, 0x4e0
jb 0x4674db
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x467416
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x467461
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48ba90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628528
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp + 8]
add eax, 0x2bc8
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
push 4
push eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], edx
call fcn.0046d7b0
mov ecx, edi
call fcn.004a0bb0
mov eax, dword [ebp - 0x14c]
lea ecx, [ebp - 0x14]
push 0
push 0
mov dword [ebp - 0x14], 0
push dword [eax + 0xb88]
push dword [eax + 0xb84]
push esi
call fcn.00518a30
mov esi, dword [ebp - 0x14c]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00480560
mov byte [esi + 0x18d4], 1
call sub.KERNEL32.dll_GetTickCount
push 0x12c
mov dword [ebp - 0x14c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x148]
movlpd qword [ebp - 0x1c], xmm0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00519210
push eax
lea ecx, [ebp - 0x148]
call fcn.004d8ea0
push dword [ebp - 0x150]
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x11c], 0
push eax
push edi
lea eax, [esi + 0x1280]
mov ecx, ebx
push eax
push 0
push dword [ebp + 0x10]
call fcn.0046be50
mov ecx, dword [ebp - 0x154]
push eax
push esi
lea eax, [esi + 0x1778]
push eax
lea eax, [esi + 0x2a40]
push eax
call fcn.0046be50
push eax
push esi
call fcn.004df380
mov bl, al
add esp, 0x34
mov eax, dword [ebp - 0x11c]
mov dword [esi + 0xc30], eax
mov al, byte [ebp - 0x129]
mov byte [esi + 0x10ab], al
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x150]
cmp eax, ecx
jb 0x48bc09
sub eax, ecx
mov ecx, edi
push eax
push str.totalElapsedMs
call fcn.004b2d90
push edi
test bl, bl
je 0x48bc48
lea ecx, [ebp - 0x14]
call fcn.00518fc0
push dword [esi + 0x155c]
lea ecx, [esi + 0x908]
push dword [esi + 0x1558]
push str.ContentLength
call fcn.004b2d20
xor ecx, ecx
movzx eax, bl
cmp dword [esi + 0x1554], 0x190
cmovl ecx, eax
mov bl, cl
jmp 0x48bc53
lea ecx, [esi + 0x2a40]
call fcn.00517450
lea ecx, [ebp - 0x148]
call fcn.004d8f80
lea ecx, [ebp - 0x14]
call fcn.00518a80
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4962d0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor edx, edx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], ebx
mov esi, dword [edi + 0x6c]
test esi, esi
je 0x496352
mov edi, dword [edi + 0xc]
nop
mov al, byte [edi + edx]
movzx ecx, al
movzx ecx, byte [ecx + 0x6461b0]
test ecx, ecx
jne 0x496342
cmp al, 0x41
jb 0x496309
cmp al, 0x5a
jbe 0x496347
cmp al, 0x61
jb 0x496313
cmp al, 0x7a
jbe 0x496347
jmp 0x49633b
cmp al, 0x30
jb 0x49631b
cmp al, 0x39
jbe 0x496347
cmp al, 0x3d
je 0x496347
cmp al, 0x3f
je 0x496347
cmp al, 0x26
je 0x496347
cmp al, 0x2f
je 0x496347
cmp al, 0x2d
je 0x496347
cmp al, 0x5f
je 0x496347
cmp al, 0x25
je 0x496347
cmp al, 0x2e
je 0x496347
cmp al, 0x7e
je 0x496347
inc ebx
jmp 0x496347
inc ebx
add ebx, ecx
add edx, ecx
inc edx
cmp edx, esi
jb 0x4962f0
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x4964b7
lea eax, [esi + 4]
lea eax, [eax + ebx*2]
push eax
call fcn.00477830
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x49637b
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
xor esi, esi
cmp dword [edi + 0x6c], ebx
jbe 0x496464
nop dword [eax + eax]
mov eax, dword [edi + 0xc]
mov cl, byte [ebx + eax]
movzx eax, cl
movzx eax, byte [eax + 0x6461b0]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x49641e
cmp cl, 0x41
jb 0x4963b1
cmp cl, 0x5a
jbe 0x4963bb
cmp cl, 0x61
jb 0x4963ca
cmp cl, 0x7a
ja 0x4963fc
mov eax, dword [edi + 0xc]
mov al, byte [ebx + eax]
mov byte [esi + edx], al
inc esi
jmp 0x49645a
cmp cl, 0x30
jb 0x4963d4
cmp cl, 0x39
jbe 0x4963bb
cmp cl, 0x3d
je 0x4963bb
cmp cl, 0x3f
je 0x4963bb
cmp cl, 0x26
je 0x4963bb
cmp cl, 0x2f
je 0x4963bb
cmp cl, 0x2d
je 0x4963bb
cmp cl, 0x5f
je 0x4963bb
cmp cl, 0x25
je 0x4963bb
cmp cl, 0x2e
je 0x4963bb
cmp cl, 0x7e
je 0x4963bb
mov byte [esi + edx], 0x25
inc esi
lea eax, [esi + edx]
push eax
movzx eax, cl
push eax
call fcn.00478110
mov edx, dword [ebp - 4]
add esp, 8
add esi, 2
jmp 0x49645a
xor edi, edi
add eax, 1
je 0x496454
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
add eax, edi
mov cl, byte [eax + ebx]
mov byte [esi + edx], 0x25
inc esi
lea eax, [esi + edx]
push eax
movzx eax, cl
push eax
call fcn.00478110
mov eax, dword [ebp - 0x10]
inc edi
mov edx, dword [ebp - 4]
inc eax
add esp, 8
add esi, 2
cmp edi, eax
jb 0x496425
add ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
inc ebx
cmp ebx, dword [edi + 0x6c]
jb 0x496390
mov byte [esi + edx], 0
cmp byte [edi + 9], 0
mov dword [edi + 0x6c], esi
je 0x496488
test esi, esi
je 0x496488
mov eax, dword [edi + 0xc]
test eax, eax
je 0x496488
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [edi + 0x64]
test eax, eax
je 0x49649f
push eax
call fcn.00622535
add esp, 4
mov dword [edi + 0x68], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x64], eax
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x6c]
lea eax, [eax + ecx*2]
add eax, 4
mov dword [edi + 0x68], eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebx + 8]
cmp edi, dword [ecx + 8]
jne 0x4a28da
test edi, edi
jne 0x4a28ca
cmp byte [esi + 0x11], 0
mov dword [esi + 8], edi
je 0x4a298b
mov dword [esi + 0x14], edi
mov al, 1
mov dword [esi + 0xc], edi
pop edi
mov byte [esi + 0x11], 0
pop esi
pop ebx
pop ebp
ret 8
cmp byte [esi + 0x10], 0xdb
je 0x4a28e3
push 0
call fcn.00401ab0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
cmp dword [esi + 0xc], edi
jae 0x4a294b
push edi
call fcn.00477830
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x4a28da
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4a2925
cmp dword [esi + 0x14], 0
je 0x4a2925
cmp ecx, edi
jbe 0x4a2916
push 0
call fcn.00401ab0
mov eax, dword [ebp + 8]
add esp, 4
push dword [esi + 8]
push dword [esi + 0x14]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp byte [esi + 0x11], 0
jne 0x4a293b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a293b
push eax
call fcn.00622535
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], edi
mov byte [esi + 0x11], 0
mov eax, dword [ebx + 8]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
cmp eax, edx
jbe 0x4a295b
mov dword [esi + 8], edx
cmp dword [esi + 0x14], 0
je 0x4a28da
xor edi, edi
cmp dword [ebx + 8], edi
jbe 0x4a298b
nop dword [eax]
mov eax, dword [ebx + 0x14]
mov ecx, dword [ecx + 0x14]
mov dl, byte [eax + edi]
xor dl, byte [ecx + edi]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp + 0xc]
mov byte [edi + eax], dl
inc edi
cmp edi, dword [ebx + 8]
jb 0x4a2970
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 8
Function at 0x4a5920
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629cfb
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, eax
mov edi, dword [ebp + 0x14]
mov dword [ebx], 0
mov dword [ebp - 0x244], eax
mov dword [esi], 0xffffffff
call fcn.0046c3b0
test al, al
je 0x4a598e
test edi, edi
je 0x4a5987
mov eax, dword [edi]
mov ecx, edi
push str.GetAttributes:_filename_is_empty
call dword [eax + 0x14]
xor al, al
jmp 0x4a5a76
push 0x118
lea eax, [ebp - 0x128]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x128]
call fcn.00468d60
push dword [ebp - 0x244]
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.00469a00
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.0046c710
lea ecx, [ebp - 0x128]
call fcn.0046b630
test eax, eax
jle 0x4a5a42
push 0x118
lea eax, [ebp - 0x240]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.00468d60
push edi
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.004a5fb0
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x240]
mov dword [esi], eax
call fcn.00468df0
jmp 0x4a5a56
lea ecx, [ebp - 0x128]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4a5a66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
cmp dword [esi], 0xffffffff
lea ecx, [ebp - 0x128]
setne bl
call fcn.00468df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret
Function at 0x4a69a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629e4b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
mov edi, dword [ebp + 0xc]
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x128]
call fcn.00468d60
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.00469a00
push 0x5c
push 0x2f
lea ecx, [ebp - 0x128]
call fcn.0046c710
lea ecx, [ebp - 0x128]
call fcn.0046b630
test eax, eax
jle 0x4a6a8a
push 0x118
lea eax, [ebp - 0x240]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.00468d60
push 0
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.004a5fb0
add esp, 0xc
lea ecx, [ebp - 0x240]
push 0
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.00468df0
jmp 0x4a6aa0
push 0
lea ecx, [ebp - 0x128]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x4a6ad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a6ab5
mov bl, 1
jmp 0x4a6ada
test edi, edi
je 0x4a6ad5
mov eax, dword [edi]
mov ecx, edi
push 1
push str.createDirWin32
call dword [eax + 0x24]
mov ecx, edi
call fcn.004b3640
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
test esi, esi
setne bl
lea ecx, [ebp - 0x128]
call fcn.00468df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret
Function at 0x4a6bc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629ea6
mov eax, dword fs:[0]
push eax
mov eax, 0x1354
call fcn.00622a10
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x112c]
mov edi, dword [ebp + 0xc]
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x112c]
call fcn.00468d60
push esi
lea ecx, [ebp - 0x112c]
mov dword [ebp - 4], 0
call fcn.00469a00
push 0x5c
push 0x2f
lea ecx, [ebp - 0x112c]
call fcn.0046c710
lea ecx, [ebp - 0x112c]
call fcn.0046b630
cmp eax, 0x104
jle 0x4a6d5f
push 0x118
lea eax, [ebp - 0x1244]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1244]
call fcn.00468d60
lea ecx, [ebp - 0x1244]
mov byte [ebp - 4], 1
call fcn.0046d800
lea eax, [ebp - 0x1360]
push eax
lea eax, [ebp - 0x1014]
push eax
push 0x800
lea ecx, [ebp - 0x112c]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x1244]
test eax, eax
je 0x4a6cc0
lea eax, [ebp - 0x1014]
push eax
call fcn.0046cf90
mov bl, 1
jmp 0x4a6cce
lea eax, [ebp - 0x112c]
push eax
call fcn.0046a070
xor bl, bl
push 0x118
lea eax, [ebp - 0x135c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x135c]
call fcn.00468d60
mov byte [ebp - 4], 2
test bl, bl
je 0x4a6d07
push 0x646850
lea ecx, [ebp - 0x135c]
call fcn.004698d0
lea ecx, [ebp - 0x1244]
call fcn.0046be50
push eax
lea ecx, [ebp - 0x135c]
call fcn.004698d0
lea ecx, [ebp - 0x135c]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x4a6d47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, 1
cmove esi, ecx
lea ecx, [ebp - 0x135c]
call fcn.00468df0
lea ecx, [ebp - 0x1244]
call fcn.00468df0
jmp 0x4a6da9
lea ecx, [ebp - 0x112c]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x4a6dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x4a6d9e
push ebx
mov ecx, edi
call fcn.004b3aa0
lea eax, [ebp - 0x112c]
mov ecx, edi
push eax
push str.failedToDeleteFilepath
call fcn.004b3300
cmp ebx, 2
mov eax, 1
cmove esi, eax
test esi, esi
lea ecx, [ebp - 0x112c]
setne bl
call fcn.00468df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret

Function at 0x4a7700
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a74f0
Function at 0x4a7cb0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62a080
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x128]
call fcn.00468d60
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.0046cdd0
lea ecx, [ebp - 0x128]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x128]
mov esi, eax
call fcn.00468df0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret

Function at 0x4a7d50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6268d0
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x128]
call fcn.00468d60
push esi
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.0046cdd0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x128]
call fcn.0046c230
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [ebp - 0x128]
setne bl
call fcn.00468df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret
Function at 0x4ab760
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
test ebx, ebx
je 0x4ab8ff
mov esi, dword [ebp + 0xc]
mov dword [ebx], 0
test esi, esi
je 0x4ab8ff
cmp dword [ebp + 8], 0
je 0x4ab8ff
lea ecx, [esi + esi*4]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
add edx, 4
push edx
mov dword [ebx], edx
call fcn.00477830
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4ab8ff
mov eax, 0xaaaaaaab
xor ecx, ecx
mul esi
push edi
xor edi, edi
mov eax, edx
shr eax, 1
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
je 0x4ab849
mov dword [ebp - 8], eax
nop dword [eax]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
movzx edx, byte [eax + edi]
movzx esi, byte [eax + edi + 1]
movzx edi, byte [eax + edi + 2]
add eax, 3
mov dword [ebp - 4], eax
mov eax, edx
shr eax, 2
and edx, 3
shl edx, 4
movzx eax, byte [eax + 0x6478d8]
mov byte [ecx + ebx], al
mov eax, esi
shr eax, 4
and esi, 0xf
or edx, eax
shl esi, 2
movzx eax, byte [edx + 0x6478d8]
mov byte [ecx + ebx + 1], al
mov eax, edi
shr eax, 6
and edi, 0x3f
or eax, esi
movzx eax, byte [eax + 0x6478d8]
mov byte [ecx + ebx + 2], al
movzx eax, byte [edi + 0x6478d8]
mov byte [ecx + ebx + 3], al
add ecx, 4
sub dword [ebp - 8], 1
jne 0x4ab7d0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*2]
sub esi, eax
sub esi, 1
je 0x4ab8ba
sub esi, 1
jne 0x4ab8eb
mov eax, dword [ebp + 8]
movzx edx, byte [edi + eax]
movzx esi, byte [edi + eax + 1]
mov eax, edx
shr eax, 2
and edx, 3
shl edx, 4
pop edi
movzx eax, byte [eax + 0x6478d8]
mov byte [ecx + ebx], al
mov eax, esi
shr eax, 4
and esi, 0xf
or edx, eax
movzx eax, byte [edx + 0x6478d8]
mov byte [ecx + ebx + 1], al
movzx eax, byte [esi*4 + 0x6478d8]
mov byte [ecx + ebx + 2], al
mov eax, dword [ebp + 0x10]
mov byte [ecx + ebx + 3], 0x3d
add ecx, 4
pop esi
mov byte [ecx + ebx], 0
mov dword [eax], ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
movzx edx, byte [edi + eax]
mov eax, edx
and edx, 3
shr eax, 2
shl edx, 4
movzx eax, byte [eax + 0x6478d8]
mov byte [ecx + ebx], al
movzx eax, byte [edx + 0x6478d8]
mov byte [ecx + ebx + 1], al
mov word [ecx + ebx + 2], 0x3d3d
add ecx, 4
mov eax, dword [ebp + 0x10]
pop edi
mov byte [ecx + ebx], 0
pop esi
mov dword [eax], ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc