joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442fe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x818
push ebx
mov ebx, dword [esp + 0x824]
push ebp
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
mov ecx, dword [esp + 0x82c]
mov dword [esp + 0x1c], edi
mov al, byte [ecx]
test al, al
je 0x443021
movsx eax, al
add edx, eax
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x443014
push edx
call fcn.00443c70
movsx ebp, di
add esp, 4
mov dword [esp + 0x10], esi
test ebp, ebp
jle 0x4430e4
movsx eax, word [esp + 0x838]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x24], eax
jmp 0x443050
mov eax, dword [esp + 0x24]
movsx ecx, word [esp + 0x10]
cmp ecx, eax
mov dword [esp + 0x20], ecx
jge 0x4430e4
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x14], ecx
mov word [esp + 0x18], cx
cmp esi, ebp
jge 0x4430ae
movsx edx, byte [esi + ebx]
push edx
call fcn.00498bc0
add esp, 4
test eax, eax
jne 0x44309a
cmp esi, ebp
jge 0x4430a6
movsx eax, byte [esi + ebx + 1]
inc esi
push eax
call fcn.00498bc0
add esp, 4
test eax, eax
je 0x443083
cmp esi, ebp
jge 0x4430a6
mov cl, byte [esi + ebx]
inc esi
mov byte [esp + edi + 0x14], cl
inc edi
cmp edi, 5
jl 0x44306e
cmp esi, ebp
jg 0x4431e1
lea edx, [esp + 0x14]
push edx
call fcn.00498b80
mov ecx, dword [esp + 0x24]
xor edx, edx
add ecx, ecx
mov dl, ah
add esp, 4
mov byte [esp + ecx + 0x28], al
mov byte [esp + ecx + 0x29], dl
mov ecx, dword [esp + 0x10]
inc ecx
cmp esi, ebp
mov dword [esp + 0x10], ecx
jl 0x44304c
cmp esi, ebp
jg 0x4431e1
mov eax, dword [esp + 0x10]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
lea esi, [eax + eax]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], esi
cmp ecx, 5
jae 0x44310f
dec esi
mov dword [esp + 0x10], esi
movsx edi, si
push ebp
mov byte [esp + edi + 0x2c], 0
call fcn.004985f0
add esp, 4
cmp word [esp + 0x1c], 0
mov ebx, eax
jle 0x443143
mov esi, ebx
push 0x100
call fcn.00443c80
add esp, 4
mov byte [esi], al
inc esi
dec ebp
jne 0x44312c
mov esi, dword [esp + 0x10]
test si, si
jle 0x443163
mov ecx, ebx
lea edx, [esp + 0x28]
lea eax, [esp + 0x28]
sub ecx, edx
mov esi, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x443156
mov esi, dword [esp + 0x10]
push ebx
call fcn.00498600
mov edi, dword [esp + 0x83c]
add esp, 4
lea eax, [esp + 0x428]
lea ecx, [esp + 0x28]
push 0
push edi
push eax
push esi
push ecx
call fcn.00443640
add esp, 0x14
test eax, eax
jle 0x4431e1
movsx ecx, di
lea edx, [eax - 1]
cmp edx, ecx
jg 0x4431e1
mov byte [esp + eax + 0x428], 0
lea edi, [esp + 0x429]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x834]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
movsx eax, byte [esp + 0x428]
mov ecx, edx
and ecx, 3
sub eax, 0x41
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x818
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x818
ret
Function at 0x44a450
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x6d0]
test eax, eax
jne 0x44a4c4
mov eax, dword [esi + 0x6cc]
mov dword [esi + 0x6d0], 1
push eax
mov dword [esi + 0x6d4], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x6c8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 4]
push edx
push 4
push esi
push 0x44a4d0
push 0
push 0
call fcn.00498d80
mov ecx, dword [esp + 0x24]
add esp, 0x18
mov dword [esi + 0x6c4], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x6c4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ecx
ret 4

Function at 0x44c260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x6e0]
cmp eax, 1
jne 0x44c2be
mov eax, dword [esi + 0x6e4]
test eax, eax
jne 0x44c283
push 3
call fcn.0044bb20
pop edi
pop esi
ret
mov eax, dword [esi + 0x6ec]
test eax, eax
je 0x44c294
mov ecx, esi
call fcn.0044b9d0
mov eax, dword [esi + 0x6e4]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov dword [esi + 0x6ec], eax
jne 0x44c3bf
push 3
mov ecx, esi
call fcn.0044bb20
pop edi
pop esi
ret
cmp eax, 3
jne 0x44c2e3
push 0
mov ecx, esi
mov dword [esi + 0x6fc], 0
mov dword [esi + 0x704], 0
call fcn.0044bb20
pop edi
pop esi
ret
cmp eax, 4
jne 0x44c389
mov ecx, dword [esi + 0x6f4]
mov edx, dword [esi + 0x6f0]
push 0xa
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x44c314
push 3
mov ecx, esi
call fcn.0044bb20
pop edi
pop esi
ret
mov eax, dword [esi + 0x6f0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esi + 0x6f8], eax
jne 0x44c338
push 3
mov ecx, esi
call fcn.0044bb20
pop edi
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esi + 0x6e8], eax
jne 0x44c355
push 3
mov ecx, esi
call fcn.0044bb20
pop edi
pop esi
ret
mov ecx, dword [esi + 0x6f0]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
mov ecx, esi
mov dword [esi + 0x700], eax
mov dword [esi + 0x6fc], 0
mov dword [esi + 0x704], 0
call fcn.0044bb20
pop edi
pop esi
ret
cmp eax, 2
jne 0x44c3cb
mov edx, dword [esi + 0x6fc]
mov eax, dword [esi + 0x6ec]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
jne 0x44c3b5
push 6
mov ecx, esi
call fcn.0044bb20
pop edi
pop esi
ret
mov dword [esi + 0x704], 0
push 0
mov ecx, esi
call fcn.0044bb20
pop edi
pop esi
ret
push 1
mov ecx, esi
call fcn.0044bb20
pop edi
pop esi
ret
Function at 0x44f2c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
cmp eax, 0x32
push edi
mov dword [esp + 0x10], 0x9ac6cdd7
jl 0x44f3f9
mov eax, dword [esp + 0x38]
mov ecx, 4
lea edi, [esp + 0x10]
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x44f3f9
mov dword [esp + 0x3c], edx
mov ecx, eax
mov dx, word [esp + 0x3c]
mov esi, 0xa
xor dx, word [ecx]
add ecx, 2
dec esi
jne 0x44f305
cmp dx, word [eax + 0x14]
jne 0x44f3f9
mov cx, word [eax + 0xc]
mov dx, word [eax + 0xe]
mov di, word [eax + 6]
mov bx, word [eax + 8]
mov bp, word [eax + 0xa]
push 0
mov word [esp + 0x18], cx
mov word [esp + 0x40], dx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [esp + 0x40], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
movsx ecx, di
movsx edx, bp
mov ebp, dword [sym.imp.KERNEL32.dll_MulDiv]
and esi, 0xffff
sub edx, ecx
push esi
inc edx
push eax
push edx
call ebp
movsx edx, word [esp + 0x14]
mov edi, dword [esp + 0x2c]
push esi
movsx ecx, bx
mov dword [edi], eax
mov eax, dword [esp + 0x14]
sub edx, ecx
push eax
inc edx
push edx
call ebp
mov esi, dword [esp + 0x30]
mov dword [esi], eax
mov ecx, dword [edi]
cmp ecx, 0x7d0
jg 0x44f3b6
cmp eax, 0x7d0
jle 0x44f3e2
cmp ecx, eax
mov ebx, ecx
jg 0x44f3be
mov ebx, eax
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 4
cdq
idiv ebx
mov dword [edi], eax
mov eax, dword [esi]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 4
cdq
idiv ebx
mov dword [esi], eax
mov eax, dword [esp + 0x34]
mov dword [eax], 0x18
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x44f8e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0xa
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x44f901
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x44f914
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x44f926
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
push edx
push eax
push ebx
push 0
push 0
push 0
push 0
call fcn.0044f410
add esp, 0x28
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x456db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a8eee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4aab3c
xor edi, edi
push 0x80
mov dword [esp + 0x1c], edi
mov dword [esi + 0xc], 0x4aac24
call fcn.004985f0
add esp, 4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0x1f
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 0x40
mov ebx, 1
push 0x80
mov byte [esp + 0x1c], bl
mov dword [esi + 0x28], 0x4aac20
call fcn.004985f0
add esp, 4
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x1f
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0x40
push 0x80
mov byte [esp + 0x1c], 2
mov dword [esi + 0x44], 0x4aa684
call fcn.004985f0
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], 0x1f
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], 0x40
mov dword [esi], 0x4aac1c
mov dword [esi + 0x1c], ebx
add esp, 4
mov dword [esi + 0x38], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x60], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret

Function at 0x456dc7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a8eee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4aab3c
xor edi, edi
push 0x80
mov dword [esp + 0x1c], edi
mov dword [esi + 0xc], 0x4aac24
call fcn.004985f0
add esp, 4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0x1f
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 0x40
mov ebx, 1
push 0x80
mov byte [esp + 0x1c], bl
mov dword [esi + 0x28], 0x4aac20
call fcn.004985f0
add esp, 4
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x1f
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0x40
push 0x80
mov byte [esp + 0x1c], 2
mov dword [esi + 0x44], 0x4aa684
call fcn.004985f0
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], 0x1f
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], 0x40
mov dword [esi], 0x4aac1c
mov dword [esi + 0x1c], ebx
add esp, 4
mov dword [esi + 0x38], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x60], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret
Function at 0x46e7d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x46e800
push esi
call fcn.00476fa0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x46e7f9
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x46e883
mov eax, dword [esi + 0x18c]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x46e86f
mov eax, dword [esi + 8]
test eax, eax
je 0x46e824
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x18c]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46e86b
cmp eax, 2
je 0x46e86f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46e817
cmp eax, 3
je 0x46e84a
cmp eax, 1
jne 0x46e817
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46e817
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46e817
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0046e8b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x46e8a3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x11
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0046e8b0
add esp, 4
pop esi
ret

Function at 0x474920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x47492b
xor eax, eax
ret
mov eax, dword [esp + 4]
push edi
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
push ebx
not eax
jb 0x474a2d
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4c4c00]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4c4c00]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4c4c00]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4c4c00]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4c4c00]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4c4c00]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4c4c00]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4c4c00]
xor eax, edx
inc ecx
dec edi
jne 0x474946
test esi, esi
je 0x474a4f
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4c4c00]
xor eax, edx
inc ecx
dec esi
jne 0x474a31
pop ebx
pop esi
not eax
pop edi
ret
Function at 0x498c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x498c73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00499a60
add esp, 4
or eax, 0xffffffff
ret
test al, 1
je 0x498c98
test byte [esp + 8], 2
je 0x498c98
call fcn.00499ae0
mov dword [eax], 0xd
call fcn.00499af0
mov dword [eax], 5
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x498d80
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x74
push 1
xor edi, edi
call fcn.0049ad40
mov esi, eax
add esp, 8
test esi, esi
je 0x498de0
push esi
call fcn.0049bd80
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x14]
push eax
push esi
push 0x498e00
push ecx
push edx
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x498df8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.0049abf0
add esp, 4
test edi, edi
je 0x498df6
push edi
call fcn.00499a60
add esp, 4
xor eax, eax
pop edi
pop esi
ret
Function at 0x499850
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9588
push 0x49d498
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4cd9c0], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4cd9bc], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4cd9b8], ecx
shr eax, 0x10
mov dword [0x4cd9b4], eax
call fcn.0049f9a0
test eax, eax
jne 0x4998ba
push 0x1c
call fcn.00499a30
add esp, 4
call fcn.0049bd20
test eax, eax
jne 0x4998cd
push 0x10
call fcn.00499a30
add esp, 4
mov dword [ebp - 4], 0
call fcn.0049b580
call fcn.0049f990
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4cf0ac], eax
call fcn.0049f330
mov dword [0x4cd9a4], eax
test eax, eax
je 0x499900
mov eax, dword [0x4cf0ac]
test eax, eax
jne 0x49990a
push 0xffffffffffffffff
call fcn.0049a2f0
add esp, 4
call fcn.0049f080
call fcn.0049ef90
call fcn.0049a2c0
mov esi, dword [0x4cf0ac]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x4999e9
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x499951
test al, al
je 0x499951
and eax, 0xff
push eax
call fcn.0049ef30
add esp, 4
test eax, eax
je 0x49992b
inc esi
mov dword [ebp - 0x64], esi
jmp 0x49992b
cmp byte [esi], 0x22
jne 0x49995a
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x49996a
cmp al, 0x20
ja 0x49996a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x49995a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x49998b
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x499990
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0049a2f0
jmp 0x4999ce
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x49995a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4999e9

Function at 0x499a30
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4cd9ac], 1
jne 0x499a3e
call fcn.0049f9e0
mov eax, dword [esp + 4]
push eax
call fcn.0049fa20
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x499b00
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x499b19
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x499b1b
xor eax, eax
test eax, eax
je 0x499b2c
push eax
call fcn.00499a60
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x49a330
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.0049a3f0
mov eax, dword [0x4cd9f0]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x49a354
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x4cd9ec], 1
mov byte [0x4cd9e8], bl
jne 0x49a3ae
mov ecx, dword [0x4cf0a8]
test ecx, ecx
je 0x49a39c
mov esi, dword [0x4cf0a4]
sub esi, 4
cmp esi, ecx
jb 0x49a39c
mov eax, dword [esi]
test eax, eax
je 0x49a395
call eax
mov ecx, dword [0x4cf0a8]
sub esi, 4
cmp esi, ecx
jae 0x49a387
push 0x4be02c
push 0x4be024
call fcn.0049a410
add esp, 8
push 0x4be038
push 0x4be030
call fcn.0049a410
add esp, 8
test ebx, ebx
je 0x49a3cd
call fcn.0049a400
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x4cd9f0], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x49afc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x42c]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x49afec
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x430]
mov eax, ecx
sar eax, 5
lea edi, [eax*4 + 0x4cdf80]
mov eax, ecx
and eax, 0x1f
mov dword [esp + 0x24], edi
mov edx, dword [edi]
lea esi, [eax + eax*8]
shl esi, 2
mov dword [esp + 0x14], esi
test byte [esi + edx + 4], 0x20
je 0x49b027
push 2
push ebp
push ecx
call fcn.0049b500
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x49b189
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x49b0d1
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x49b082
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x49b06f
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x49b052
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49b17a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x49b0cd
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x49b04e
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x49b169
mov eax, dword [esp + 0x18]
test eax, eax
je 0x49b125
cmp eax, 5
jne 0x49b10e
call fcn.00499ae0
mov dword [eax], 9
call fcn.00499af0
mov dword [eax], 5
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.00499a60
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x49b145
cmp byte [ebp], 0x1a
jne 0x49b145
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
call fcn.00499ae0
mov dword [eax], 0x1c
call fcn.00499af0
mov dword [eax], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x49b0cd
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49b1ba
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x49b0d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x49b0d1