joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca450
Capabilities:
Create directory
Delete directory

Disassembly:
sub esp, 0x6ec
push esi
push 0x104
push 0x637bf8
call fcn.00423a00
push 0x104
push 0x637d00
call fcn.00423a00
push 0x104
push 0x637e08
call fcn.00423a00
lea eax, [esp + 0x20]
push 0x3e7
push eax
mov dword [0x637f0c], 0
mov dword [0x637f10], 0
mov dword [0x637f14], 0
call fcn.00423a00
lea ecx, [esp + 0x28]
push ecx
push 0
call fcn.00438db0
add esp, 0x28
test eax, eax
lea edx, [esp + 8]
je 0x4ca501
push edx
call fcn.00426aa0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0xc]
push eax
push 0x637bf8
call esi
lea ecx, [esp + 0x14]
push ecx
push str._smirc.ini
push 0x637d00
call esi
add esp, 0x18
mov eax, 1
pop esi
add esp, 0x6ec
ret
push 0x3e7
push edx
call fcn.00423a00
mov ecx, dword [0x645320]
add esp, 8
push 0x104
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4ca61d
lea edx, [esp + 0x4f0]
push edx
lea eax, [esp + 0x5f4]
push eax
lea ecx, [esp + 0x3f8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.005cc984
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x404]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x5e6a64
push 0x637bf8
call esi
push 0x637bf8
call fcn.00426aa0
push 0x637bf8
push str._smirc.ini
push 0x637d00
call esi
lea eax, [esp + 0x3c]
push 0x3e7
push eax
call fcn.00423a00
lea ecx, [esp + 0x44]
push 5
push ecx
call fcn.004c9370
add esp, 0x44
test eax, eax
je 0x4ca5cf
xor eax, eax
mov cl, byte [esp + eax + 8]
mov byte [eax + 0x637e08], cl
inc eax
test cl, cl
jne 0x4ca5b3
push 0x637e08
call fcn.00426aa0
add esp, 4
call fcn.00424380
push eax
push 0x637bf8
lea edx, [esp + 0x10]
push 0x5e6a64
push edx
call esi
add esp, 0x10
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov esi, 1
je 0x4ca614
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x4ca614
mov dword [0x637f14], esi
call fcn.00581190
test eax, eax
jne 0x4ca627
xor eax, eax
pop esi
add esp, 0x6ec
ret
mov eax, dword [0x637f14]
test eax, eax
je 0x4ca642
push esi
push 0x637d00
call fcn.00425b60
add esp, 8
test eax, eax
jne 0x4ca64e
mov dword [0x637f0c], esi
mov dword [0x637f10], esi
mov eax, esi
pop esi
add esp, 0x6ec
ret
Function at 0x4ca660
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
mov al, byte [0x637e08]
sub esp, 0x618
test al, al
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x4ca6f1
mov eax, dword [0x637f0c]
test eax, eax
jne 0x4ca688
mov eax, dword [0x637f10]
test eax, eax
je 0x4ca6f1
push 0x637e08
lea eax, [esp + 0x30]
push 0x3e7
push eax
call fcn.00423900
lea ecx, [esp + 0x38]
push ecx
call fcn.00426e70
add esp, 0x10
test eax, eax
je 0x4ca6f1
lea edx, [esp + 0x2c]
push edx
call fcn.00426aa0
mov eax, dword [0x637f0c]
add esp, 4
test eax, eax
je 0x4ca6d4
xor eax, eax
mov cl, byte [esp + eax + 0x2c]
mov byte [eax + 0x637bf8], cl
inc eax
test cl, cl
jne 0x4ca6c5
mov eax, dword [0x637f10]
test eax, eax
je 0x4ca6f1
lea eax, [esp + 0x2c]
push eax
push str._smirc.ini
push 0x637d00
call esi
add esp, 0xc
push 1
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x5e7eec
push 0x637bf8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00426b70
mov eax, dword [esp + 0x1c]
add esp, 0x18
test eax, eax
jne 0x4ca819
mov eax, dword [esp + 8]
test eax, eax
jne 0x4ca819
mov eax, dword [str.defaults]
mov ecx, dword [0x5ec578]
mov dl, byte [0x5ec57c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x34], ecx
mov byte [esp + 0x38], dl
call fcn.00422000
lea ecx, [esp + 0x30]
push ecx
call fcn.00426aa0
lea edx, [esp + 0x34]
push 2
push edx
call fcn.00425b60
add esp, 0x10
test eax, eax
je 0x4ca830
push edi
xor eax, eax
mov ecx, 7
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x51c]
push 0x104
push eax
call fcn.00423a00
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x528]
push str._s.
push edx
call esi
lea ecx, [esp + 0x42c]
lea eax, [esp + 0x530]
push 0x104
push ecx
mov dword [esp + 0x34], eax
call fcn.00423a00
add esp, 0x1c
xor eax, eax
pop edi
lea ebx, [ebx]
mov cl, byte [eax + 0x637bf8]
mov byte [esp + eax + 0x414], cl
inc eax
test cl, cl
jne 0x4ca7e0
lea eax, [esp + 0xc]
lea edx, [esp + 0x414]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 2
mov word [esp + 0x20], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
jmp 0x4ca830
lea ecx, [esp + 4]
push ecx
call fcn.004e33a0
lea edx, [esp + 0xc]
push edx
call fcn.004e33a0
add esp, 8
mov al, byte [0x637d00]
test al, al
pop esi
je 0x4ca868
push 0x637d00
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4ca868
test al, 0x50
jne 0x4ca868
test ah, 0x11
jne 0x4ca868
mov ecx, eax
and ecx, 0xfffffff8
cmp ecx, eax
je 0x4ca868
push ecx
push 0x637d00
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
add esp, 0x618
ret
Function at 0x4ce2d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x440
push esi
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x38]
push eax
xor esi, esi
push str.main
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.00521800
mov eax, dword [0x644578]
add esp, 0x24
cmp eax, esi
mov edi, 3
je 0x4ce338
mov ecx, dword [0x645324]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4ce338
mov dword [esp + 8], edi
jmp 0x4ce36a
mov edx, dword [0x645324]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4ce353
mov dword [esp + 8], 1
jmp 0x4ce36a
mov eax, dword [0x645324]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
neg eax
sbb eax, eax
and eax, 2
mov dword [esp + 8], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x4ce414
mov dword [esp + 8], edi
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov ecx, dword [0x645324]
lea eax, [esp + 0x34]
push eax
push ecx
mov dword [esp + 0x3c], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
mov ecx, dword [esp + 0x5c]
mov edi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x10]
push edi
sub ecx, esi
push ecx
sub eax, edx
push esi
push eax
push edx
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x7c]
push str._d__d__d__d__d__d__d
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x30], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x637d00
lea eax, [esp + 0x88]
push eax
push str.main
push str.windows
call fcn.004c9500
add esp, 0x34
pop edi
pop esi
add esp, 0x440
ret
cmp dword [esp + 8], esi
jne 0x4ce37e
mov edx, dword [0x645324]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
jmp 0x4ce3b5
Function at 0x4e0f20
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x612328]
sub esp, 0x7d4
test eax, eax
je 0x4e0fcf
lea eax, [esp + 0x3ec]
push 0x3e7
push eax
call fcn.00423a00
lea ecx, [esp + 0xc]
push 0x3e7
push ecx
call fcn.00423a00
mov eax, dword [esp + 0x7e8]
lea edx, [esp + 0x3fc]
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4e0f67
lea edx, [esp + 0x3ec]
push edx
call fcn.005e3ca4
mov eax, dword [esp + 0x7e0]
push eax
lea ecx, [esp + 0xc]
push 0x3e7
push ecx
call fcn.00423900
lea edx, [esp + 0x14]
push str.fnord
push edx
call fcn.0041e620
push 0x637d00
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40c]
push ecx
push str.user
call fcn.004c9500
add esp, 0x28
mov eax, 1
add esp, 0x7d4
ret
lea edx, [esp]
push edx
push 0x5ed150
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4e0ff1
xor eax, eax
add esp, 0x7d4
ret
mov edx, dword [esp + 0x7dc]
mov eax, edx
push esi
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e1000
mov ecx, dword [esp + 4]
sub eax, esi
inc eax
push eax
mov eax, dword [esp + 0x7e0]
push edx
push 1
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0x7d4
ret

Function at 0x4e1040
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3f0
push esi
mov esi, dword [esp + 0x3fc]
push edi
xor eax, eax
mov ecx, 0xf9
mov edi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x612328]
test eax, eax
je 0x4e10fb
lea eax, [esp + 0x10]
push 0x3e7
push eax
call fcn.00423a00
mov edx, dword [esp + 0x404]
push 0x637d00
push 0x3e7
lea ecx, [esp + 0x20]
push ecx
push 0x5e6c98
push edx
push str.user
call fcn.004c9870
mov al, byte [esp + 0x30]
add esp, 0x20
test al, al
jne 0x4e10b5
pop edi
xor eax, eax
pop esi
add esp, 0x3f0
ret
lea eax, [esp + 0x10]
push str.fnord
push eax
call fcn.0041e6f0
mov al, byte [esp + 0x18]
add esp, 8
test al, al
je 0x4e10aa
mov edx, esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c5], 0
lea eax, [esp + 0x10]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4e10e3
pop edi
mov eax, 1
pop esi
add esp, 0x3f0
ret
lea edx, [esp + 8]
push edx
push 0x5ed150
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4e10aa
mov ecx, dword [esp + 0x3fc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x1c], 0x3b5
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
add esp, 0x3f0
ret
Function at 0x4e1160
Capabilities:
Delete registry key

Disassembly:
push ecx
mov eax, dword [0x612328]
test eax, eax
je 0x4e118a
mov eax, dword [esp + 8]
push 0x637d00
push 0
push eax
push str.user
call fcn.004c9500
add esp, 0x10
mov eax, 1
pop ecx
ret
lea ecx, [esp]
push ecx
push 0x5ed150
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4e11a7
xor eax, eax
pop ecx
ret
mov edx, dword [esp + 8]
mov eax, dword [esp]
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret
Function at 0x4e4630
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi], 0
jne 0x4e463e
xor eax, eax
pop edi
ret
push esi
push 0x5b
push edi
call fcn.005cbf10
mov esi, eax
add esp, 8
test esi, esi
je 0x4e4741
inc esi
push 0x5d
push esi
call fcn.005cbf10
add esp, 8
test eax, eax
je 0x4e4741
mov byte [eax], 0
cmp byte [esi], 0
je 0x4e4741
push 0x2e
push esi
call fcn.005cbf10
add esp, 8
test eax, eax
je 0x4e4741
push esi
call fcn.005cbe51
add esp, 4
test eax, eax
jle 0x4e46e0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
push esi
jns 0x4e46a8
push str.__.server__m__s
jmp 0x4e46ad
push str.__.server__s
push 0x63b6f0
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x1c]
add esp, 0xc
push eax
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push 0x63b6f0
push eax
call fcn.00447670
add esp, 0x1c
pop esi
mov eax, 1
pop edi
ret
cmp byte [edi], 9
mov eax, edi
jne 0x4e46f0
mov cl, byte [eax + 1]
inc eax
cmp cl, 9
je 0x4e46e7
cmp byte [eax], 0x2a
jne 0x4e4741
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
push esi
jns 0x4e4709
push str.__.server__m__s
jmp 0x4e470e
push str.__.server__s
push 0x63b6f0
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
add esp, 0xc
push eax
push 0
push 0
push 0
push 0
push 0x63b6f0
push ecx
call fcn.00447670
add esp, 0x1c
pop esi
mov eax, 1
pop edi
ret
cmp byte [edi], 9
mov esi, edi
jne 0x4e4750
mov al, byte [esi + 1]
inc esi
cmp al, 9
je 0x4e4748
cmp byte [esi], 0x2a
jne 0x4e4780
mov edx, dword [0x61369c]
push edx
push 0
push 0xe11
call fcn.00421db0
add esp, 8
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push ecx
call fcn.005275f0
add esp, 0xc
pop esi
xor eax, eax
pop edi
ret
push 0x20
push esi
call fcn.005cbf10
add esp, 8
test eax, eax
je 0x4e477b
push 0x10
mov byte [eax], 0
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
push esi
jns 0x4e47a6
push str.__.server__m__s
jmp 0x4e47ab
push str.__.server__s
push 0x63b6f0
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
add esp, 0xc
push eax
push 0
push 0
push 0
push 0
push 0x63b6f0
push edx
call fcn.00447670
add esp, 0x1c
pop esi
mov eax, 1
pop edi
ret
Function at 0x4e6050
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [esp + 0x110]
push ebx
call fcn.00582ac0
add esp, 4
test eax, eax
je 0x4e60c9
mov eax, dword [ebx + 0x6b4]
cmp eax, 0xffffffff
je 0x4e607d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6b4], 0xffffffff
mov eax, dword [0x63aafc]
test eax, eax
je 0x4e609f
lea eax, [ebx + 0x4a0]
push eax
call fcn.004e5e10
add esp, 4
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea ecx, [ebx + 0x4a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebx + 0x6b4], eax
jne 0x4e60d3
xor eax, eax
pop ebx
add esp, 0x108
ret
push esi
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x118]
test eax, eax
je 0x4e6242
mov al, byte [0x5e6c96]
mov dx, word [0x5e6c94]
mov byte [esp + 0xe], al
lea eax, [esp + 0xc]
mov word [esp + 0xc], dx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e6110
sub eax, edx
push 0
mov esi, eax
call fcn.005cce76
push eax
call fcn.0055a8d0
add esp, 8
push eax
push 0
push 0xe75
call fcn.00421db0
add esp, 8
push eax
lea ecx, [esp + esi + 0x14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str._s__s_r_n
push ecx
call esi
lea eax, [esp + 0x1c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e6158
mov ecx, dword [ebx + 0x6b4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, edx
push 0
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
push 0
push 0xe7d
call fcn.00421db0
push eax
lea edx, [esp + 0x1c]
push 0x5e773c
push edx
call esi
mov eax, dword [ebx + 0x71c]
add esp, 0x14
cmp eax, 2
jne 0x4e61ce
mov eax, dword [ebx + 0x720]
cmp eax, 3
je 0x4e61b5
cmp eax, 4
jne 0x4e61ce
lea esi, [ebx + 8]
push 0x20
push esi
call fcn.005cbf10
add esp, 8
test eax, eax
jne 0x4e61cb
mov eax, esi
jmp 0x4e61d1
inc eax
jmp 0x4e61d1
lea eax, [ebx + 8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e61d3
push edi
lea edi, [esp + 0x14]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e61e2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e6200
mov ax, word [0x5e6c94]
mov cl, byte [0x5e6c96]
mov word [edi], ax
lea eax, [esp + 0x14]
mov byte [edi + 2], cl
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e6222
mov ecx, dword [ebx + 0x6b4]
sub eax, edx
push 0
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
pop ebp
mov eax, dword [0x63aaf0]
mov esi, 1
cmp eax, esi
jne 0x4e6267
mov edx, dword [ebx + 0x6b4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6b4], 0xffffffff
mov dword [ebx + 0x6a8], esi
mov eax, esi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x4e6280
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x110
push esi
mov esi, dword [esp + 0x118]
push esi
call fcn.00582ac0
add esp, 4
test eax, eax
je 0x4e63c3
cmp dword [esi + 0x6b4], 0xffffffff
mov dword [esi + 0x6a8], 0
jne 0x4e62ed
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [esi + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x6b4], eax
je 0x4e63c3
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov edi, dword [esp + 0x120]
test edi, edi
je 0x4e6357
push 0
call fcn.005cce76
push eax
call fcn.0055a8d0
add esp, 8
push eax
push 0
push 0xe76
call fcn.00421db0
add esp, 8
push eax
lea ecx, [esp + 0x1c]
push str._s__s_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e6334
mov ecx, dword [esi + 0x6b4]
sub eax, edx
push 0
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x6b4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
mov dword [esi + 0x6b4], 0xffffffff
je 0x4e63c2
lea eax, [esp + 8]
push eax
push esi
push 3
lea edi, [esi + 0x4a0]
push 1
push edi
mov dword [esp + 0x1c], 0
call fcn.004e3b80
add esp, 0x14
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4e63b5
mov eax, dword [esp + 8]
test eax, eax
jne 0x4e63b5
push edi
call fcn.00426470
add esp, 4
pop edi
pop esi
add esp, 0x110
ret
lea ecx, [esp + 0xc]
push ecx
call fcn.004e33a0
add esp, 4
pop edi
pop esi
add esp, 0x110
ret
Function at 0x4e7bd0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x528
push esi
mov esi, dword [esp + 0x530]
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x14b
push 0x6d
push esi
call edi
mov eax, dword [0x63dcd0]
test eax, eax
mov byte [esp + 0x148], 0
je 0x4e7c25
lea ecx, [esp + 0x148]
push ecx
push 0x198
push eax
call fcn.00424fb0
mov al, byte [esp + 0x154]
add esp, 0xc
test al, al
jne 0x4e7c42
xor eax, eax
jmp 0x4e7c30
mov cl, byte [eax + 0x63ab10]
mov byte [esp + eax + 0x148], cl
inc eax
test cl, cl
jne 0x4e7c30
push ebp
lea edx, [esp + 0x14c]
push edx
push str._s.
push 0x63dcd8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.Main_folder
push 0
push 0x143
push 0x6d
push esi
call edi
lea eax, [esp + 0xc]
push eax
push 0x63dcd8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4e7cfb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
test byte [esp + 0x10], 0x10
je 0x4e7ce7
cmp byte [esp + 0x3c], 0x2e
je 0x4e7ce7
xor eax, eax
mov cl, byte [esp + eax + 0x3c]
mov byte [eax + 0x63dcd8], cl
inc eax
test cl, cl
jne 0x4e7ca0
push 0x63dcd8
push 0
push 0x158
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
jne 0x4e7ce0
push 0x63dcd8
push 0
push 0x143
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
je 0x4e7cf3
cmp eax, 0xfffffffe
je 0x4e7cf3
lea ecx, [esp + 0x10]
push ecx
jmp 0x4e7cec
lea edx, [esp + 0x10]
push edx
push ebp
call ebx
test eax, eax
jne 0x4e7c90
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push 0
push 0
push 0x146
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
pop ebp
jne 0x4e7d11
xor eax, eax
mov ecx, dword [0x63ac18]
test ecx, ecx
jl 0x4e7d1f
cmp ecx, eax
jle 0x4e7d27
xor ecx, ecx
mov dword [0x63ac18], ecx
push 0
push ecx
push 0x14e
push 0x6d
push esi
call edi
pop edi
pop esi
add esp, 0x528
ret
Function at 0x4e8090
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x63ac30]
test eax, eax
push ebx
push esi
push edi
je 0x4e815e
push 0
push 0xe89
call fcn.00421db0
mov esi, dword [esp + 0x18]
add esp, 8
push eax
push 0
push 0xc
push 0x68
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x6d
push esi
call edi
push eax
call ebx
push 0
push 0x65
push esi
call edi
push eax
call ebx
push 0
push 0x66
push esi
call edi
push eax
call ebx
push 0
push 0x6e
push esi
call edi
push eax
call ebx
push 0
push 0x67
push esi
call edi
push eax
call ebx
push 0
push 0x6f
push esi
call edi
push eax
call ebx
push 0
push 1
push esi
call edi
push eax
call ebx
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
ret
push ebp
push 0
push 0xe88
call fcn.00421db0
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
add esp, 8
push eax
push 0
push 0xc
push 0x68
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 5
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x6d
push esi
call edi
push eax
call ebx
push 1
push 0x65
push esi
call edi
push eax
call ebx
push 1
push 0x66
push esi
call edi
push eax
call ebx
push 1
push 0x6e
push esi
call edi
push eax
call ebx
push 1
push 0x67
push esi
call edi
push eax
call ebx
push 1
push 0x6f
push esi
call edi
push eax
call ebx
push 1
push 1
push esi
call edi
push eax
call ebx
push 0
push 0
push 0x190
push 0x67
push esi
call ebp
cmp eax, 0xffffffff
pop ebp
je 0x4e82a6
test eax, eax
jne 0x4e821f
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
jmp 0x4e8283
cmp eax, 1
jne 0x4e826d
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 1
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0x14], 2
jne 0x4e82a6
push 0
push 0x6a
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
ret
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 1
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0x14], 2
jne 0x4e82a6
push 0
call fcn.00421c80
add esp, 4
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
ret
Function at 0x4ead20
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x4eaed0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x58
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
xor eax, eax
mov dword [0x63ad50], eax
mov dword [0x63ad54], eax
mov dword [0x63ad58], eax
push ecx
mov dword [0x63ad5c], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
push edx
lea eax, [esp + 8]
push eax
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.004ead50
lea ecx, [esp + 0xc]
push 0x63ad50
push ecx
call fcn.004eae20
mov eax, 0x63ad50
add esp, 0x6c
ret