joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b060
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49b1aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0049a518
xor eax, eax
push ebp
push 0x49b18d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x49b0c5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x49b0c5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x49b177
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x49b0d8
call fcn.004047a8
jmp 0x49b194
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49b177
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x49b177
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403fc0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x49b177
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d9f0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x49b1c4
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x52d758]
mov dl, 1
mov eax, dword [0x499818]
call fcn.0040e32c
call fcn.004046fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b194
mov eax, dword [ebp - 4]
call fcn.0049a524
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b1b1
lea eax, [ebp - 0x28]
call fcn.00404dc8
ret
Function at 0x4ad7e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405248
xor eax, eax
push ebp
push 0x4ad992
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ebx, ebx
je 0x4ad971
mov eax, ebx
xor ecx, ecx
mov edx, 0x21
call fcn.004036e4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405258
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ad971
mov eax, dword [ebp - 0x14]
call fcn.00402f48
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ad96a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ad954
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4ad9a4
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ad954
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebx + 0x19], ax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
mov word [ebx + 0x1b], ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebx + 0x1d], ax
mov eax, dword [ebp - 0x10]
movzx esi, word [eax + 0xc]
mov word [ebx + 0x1f], si
lea eax, [ebp - 0x118]
push eax
movzx eax, word [ebx + 0x19]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0
movzx eax, word [ebx + 0x1b]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x12c], 0
movzx eax, word [ebx + 0x1d]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x124], 0
movzx eax, si
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x138]
mov ecx, 3
mov eax, 0x4ad9b0
call fcn.0040b39c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov ecx, 0xff
call fcn.00405064
lea edx, [ebp - 0x114]
mov eax, ebx
mov cl, 0x18
call fcn.004035d4
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad971
mov eax, dword [ebp - 0xc]
call fcn.00402f7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad999
lea eax, [ebp - 0x118]
call fcn.00404dc8
lea eax, [ebp - 4]
call fcn.00404dc8
ret

Function at 0x4c13a4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004036e4
ret
Function at 0x4c581c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405248
mov eax, dword [ebp - 8]
call fcn.00405248
xor eax, eax
push ebp
push 0x4c59b5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c5960
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0x52d4c4]
call fcn.00491438
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, 0x4c59c4
call fcn.00406da0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, 0x4c59d4
call fcn.00406da0
mov eax, dword [ebp - 4]
call fcn.00405258
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 4]
call fcn.0040a72c
mov eax, dword [ebp - 0x12c]
call fcn.00405258
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x20]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0x4c59ec
push dword [ebp - 8]
push 0x4c59f8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040515c
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00405038
lea eax, [ebp - 0x130]
mov edx, dword [ebp - 0xc]
call fcn.00405094
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x1c]
call fcn.00405700
push 0
mov eax, dword [ebp - 0x1c]
call fcn.00405710
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c596a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c59bc
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.00404dec
lea eax, [ebp - 0x1c]
call fcn.004055a8
lea eax, [ebp - 0x18]
call fcn.00406d5c
lea eax, [ebp - 0x14]
call fcn.00406d5c
lea eax, [ebp - 0x10]
call fcn.00406d5c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404dec
ret
Function at 0x4c5a98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov byte [ebp - 0x12], 0
xor eax, eax
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jl 0x4c5b76
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 0
cmp eax, dword [ebp + 8]
jge 0x4c5b76
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
mov byte [ebp - 0x13], 0xaa
movzx ecx, byte [ebp - 0x10]
add byte [ebp - 0x13], cl
xor dl, byte [ebp - 0x13]
lea ecx, [ebx + 2]
movzx esi, dl
shr esi, cl
mov ecx, esi
or cl, byte [ebp - 0x12]
and cl, 0x3f
mov byte [ebp - 0x11], cl
lea ecx, [ebx + 2]
push ecx
mov ecx, 8
pop esi
sub ecx, esi
movzx edx, dl
shl edx, cl
shr edx, 2
and dl, 0x3f
mov byte [ebp - 0x12], dl
add ebx, 2
cmp ebx, 6
jge 0x4c5b2e
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
jmp 0x4c5b6a
mov edx, dword [ebp + 8]
dec edx
cmp eax, edx
jge 0x4c5b56
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
movzx edx, byte [ebp - 0x12]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax + 1], dl
add eax, 2
jmp 0x4c5b64
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
xor ebx, ebx
mov byte [ebp - 0x12], 0
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4c5ac8
test ebx, ebx
jle 0x4c5b88
movzx edx, byte [ebp - 0x12]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
mov edx, dword [ebp - 8]
mov byte [edx + eax], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c5b98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, 2
xor eax, eax
xor edi, edi
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jl 0x4c5c54
inc edx
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
sub ecx, 0x3c
js 0x4c5be8
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
sub cl, 0x3c
mov byte [ebp - 0xd], cl
jmp 0x4c5bec
xor edi, edi
jmp 0x4c5c54
cmp edi, dword [ebp + 8]
jge 0x4c5c54
lea ecx, [eax + 6]
cmp ecx, 8
jl 0x4c5c30
mov ecx, 6
sub ecx, esi
movzx eax, byte [ebp - 0xd]
and al, 0x3f
movzx eax, al
shr eax, cl
or al, byte [ebp - 0xe]
mov cl, 0xaa
mov ebx, edi
add cl, bl
xor al, cl
mov ecx, dword [ebp - 8]
mov byte [ecx + edi], al
inc edi
xor eax, eax
cmp esi, 6
jge 0x4c5c29
add esi, 2
jmp 0x4c5c30
mov esi, 2
jmp 0x4c5c4a
mov ecx, esi
movzx ebx, byte [ebp - 0xd]
shl bl, cl
and bl, byte [esi + 0x5103ce]
mov byte [ebp - 0xe], bl
mov ecx, 8
sub ecx, esi
add eax, ecx
inc edx
dec dword [ebp - 0x14]
jne 0x4c5bcd
mov eax, dword [ebp - 8]
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cdf5c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x51043c
test edx, edx
jne 0x4cdf6f
xor eax, eax
jmp 0x4ce084
mov dword [esp], 1
cmp byte [esp], 0
je 0x4cdf8c
push ecx
push edx
push eax
call fcn.004ce088
add esp, 0xc
jmp 0x4ce084
push ecx
push edx
push eax
call fcn.004ce348
add esp, 0xc
jmp 0x4ce084
pop edx
pop esi
pop ebx
ret
Function at 0x4cfbf4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x4cfc2f
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x4cfcb0
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.004cd2b4
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x4cfc7d
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4cfc7f
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cfc66
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x4cfca5
mov cx, word [ebp - 4]
sub cx, si
jmp 0x4cfca7
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4cfc8e
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x4cfd12
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.004cf8c0
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4cfcfd
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4cfd12
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4cfc03
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4e6e90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4e6eb4
cmp eax, 0
jbe 0x4e6fbd
jmp 0x4e6eba
jle 0x4e6fbd
mov eax, dword [ebp + 8]
add eax, 0xffffff04
xor ecx, ecx
mov edx, 0xf8
call fcn.004036e4
mov eax, dword [ebp + 8]
lea edx, [eax - 0x13c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x4e6fbd
mov eax, dword [ebp + 8]
cmp word [eax - 0x13c], 0x5a4d
jne 0x4e6fbd
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x100]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x100]
jne 0x4e6fbd
mov eax, dword [ebp + 8]
lea edx, [eax - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x4e6fbd
mov eax, dword [ebp + 8]
cmp dword [eax - 0xfc], 0x4550
jne 0x4e6fbd
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x4e6fbd
mov eax, dword [ebp + 8]
cmp word [eax - 0xf8], 0x14c
jne 0x4e6fbd
mov eax, dword [ebp + 8]
movzx ecx, word [eax - 0xe8]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx - 0xe8]
cmp eax, edx
jne 0x4e6fbd
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4e760c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xf6]
test ax, ax
jbe 0x4e76ec
mov edx, dword [ebp + 8]
movzx eax, ax
dec eax
test eax, eax
jl 0x4e76ea
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x4e7682
test eax, 0x40000000
je 0x4e766e
test eax, 0x80000000
je 0x4e7669
or edx, 0x40
jmp 0x4e76a9
or edx, 0x20
jmp 0x4e76a9
test eax, 0x80000000
je 0x4e767d
or edx, 0x80
jmp 0x4e76a9
or edx, 0x10
jmp 0x4e76a9
test eax, 0x40000000
je 0x4e769a
test eax, 0x80000000
je 0x4e7695
or edx, 4
jmp 0x4e76a9
or edx, 2
jmp 0x4e76a9
test eax, 0x80000000
je 0x4e76a6
or edx, 8
jmp 0x4e76a9
or edx, 1
test eax, 0x4000000
je 0x4e76b6
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xfffffebc
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8]
push eax
call sub.kernel32.dll_VirtualProtect
inc ebx
dec dword [ebp - 4]
jne 0x4e763c
mov dl, 1
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4fd7e4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405248
xor eax, eax
push ebp
push 0x4fd85f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a72c
mov eax, dword [ebp - 8]
call fcn.00405258
push eax
call sub.IMAGEHLP.DLL_MakeSureDirectoryPathExists
push 0
mov eax, dword [ebp - 4]
call fcn.00405258
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00405258
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd866
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404dec
ret
Function at 0x5074fc
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x52d110]
mov eax, dword [eax]
call fcn.00405258
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0x3c0], esi
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov dword [ebx + 0x3c4], edi
test edi, edi
je 0x507551
mov eax, ebx
call fcn.00459b50
mov edx, dword [ebx + 0x3c4]
mov dword [edx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x44a59b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x44a5aa
pop dword [ebp - 0x10]
mov eax, 0x5f12a221
sub eax, 0x5ecdfc77
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x7ccd098c
sub dword [ebp - 0x20], 0x2e7ac441
mov dword [ebp - 0x1c], 0x9ec4da02
add dword [ebp - 0x1c], 0x936e7243
mov dword [ebp - 0x18], 0xd4c0fc68
add dword [ebp - 0x18], 0x778b47c6
mov dword [ebp - 0x14], 0x65075e9c
sub dword [ebp - 0x14], 0x65075e9c
lea eax, [ebp - 0x20]
push eax
mov eax, 0xbc0ddadd
sub eax, 0xbbc82a79
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xd557bd7d
sub dword [ebp - 0x20], 0x60e55427
mov dword [ebp - 0x1c], 0x127adca6
sub dword [ebp - 0x1c], 0xd10e7b31
mov dword [ebp - 0x18], 0xbe15c681
sub dword [ebp - 0x18], 0x5aa65a15
mov dword [ebp - 0x14], 0x2c80ef43
sub dword [ebp - 0x14], 0x2c80ef43
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5aba9b57
sub eax, 0x5a74ead7
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x50af1
push 0
call eax
mov ecx, 0x424c3a63
add ecx, 0xbdb41b2d
mov esi, eax
mov edi, 0x4469e9ee
sub edi, 0x442289ee
add edi, dword [ebp - 0x10]
mov ebx, 0xad3048df
add ebx, 0xdf7cfee1
mov edx, dword [edi]
xor dword [ebp - 0xc], edi
sub edx, ebx
mov dword [ebp - 4], 0x927b572
mov dword [esi], edx
sub dword [ebp - 8], 0x4d548caa
add esi, 4
add edi, 0x21af68df
sub edi, 0x21af68db
loop 0x44a6cc
add eax, 0x14913
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3907588d
add ecx, 0xc738a773
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4791e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
or ebp, 0xffffffff
jmp 0x479202
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x479209
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4791f8
mov eax, 1
add ebx, ebx
jne 0x47921b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47922c
jne 0x47924b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47924b
dec eax
add ebx, ebx
jne 0x479238
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x479210
add ebx, ebx
jne 0x479247
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47929d
xor ecx, ecx
sub eax, 3
jb 0x479263
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4792d2
sar eax, 1
mov ebp, eax
jmp 0x47926e
add ebx, ebx
jne 0x47926e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47923c
inc ecx
add ebx, ebx
jne 0x47927c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47923c
add ebx, ebx
jne 0x479289
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47927e
jne 0x47929a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47927e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4792bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4792ae
jmp 0x4791fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4792bc
add edi, ecx
jmp 0x4791fe
pop esi
mov edi, esi
mov ecx, 0x8e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4792da
cmp byte [edi], 6
jne 0x4792da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4792df
lea edi, [esi + 0x77000]
mov eax, dword [edi]
or eax, eax
je 0x479357
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x790c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x79104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47930c
mov ecx, edi
jns 0x47933b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x79108]
or eax, eax
je 0x479351
mov dword [ebx], eax
add ebx, 4
jmp 0x479329
call dword [esi + 0x79118]
mov ebp, dword [esi + 0x7910c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47938b
sub esp, 0xffffff80
jmp 0x4013bc
Function at 0x100053f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [0x1017109c], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x1016ab20], ecx
call fcn.10005200
mov edx, dword [ebp + 0xc]
mov dword [0x10171098], edx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10005100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
push 0xea60
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x10005469
push 1
call fcn.10004a50
add esp, 4
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10005d00
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011ee98
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101694f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push str..
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.10002c00
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10018bcd
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c], 0
push 0
lea ecx, [ebp - 0x30]
call fcn.10004490
push eax
lea ecx, [ebp - 0x28]
call fcn.10018c74
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10005e04
lea ecx, [ebp - 0x28]
call fcn.100189b5
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x28]
call fcn.10018b8f
test eax, eax
je 0x10005d91
jmp 0x10005d6e
lea ecx, [ebp - 0x28]
call fcn.10006a70
test eax, eax
je 0x10005dcb
mov edx, dword [ebp + 0xc]
push edx
push ecx
mov eax, esp
mov dword [ebp - 0x34], esp
push eax
lea ecx, [ebp - 0x28]
call fcn.10018eb7
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.10005d00
add esp, 8
jmp 0x10005dff
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x28]
call fcn.10018eb7
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
call fcn.10004490
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.10004630
jmp 0x10005d6e
lea ecx, [ebp - 0x28]
call fcn.100188cf
cmp dword [ebp + 0xc], 0
je 0x10005e21
lea ecx, [ebp + 8]
call fcn.10004490
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x3c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10018bff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10004630
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10004630
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret