joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4999f9
Capabilities:
Create pipe

Disassembly:
push 0x24
mov eax, 0x4d8b65
call fcn.004b814b
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp byte [esi + 0x1c], bl
je 0x499a19
mov al, 1
call fcn.004b81ce
ret 4
push 0xffffffffffffffff
push ebx
mov byte [esi + 0x1d], cl
push eax
lea ecx, [esi + 0x20]
call fcn.00403ffa
lea edi, [ebp - 0x2c]
mov ecx, esi
call fcn.00499e5a
mov dword [ebp - 4], ebx
cmp byte [esi + 0x1d], bl
je 0x499a6b
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x499a46
lea ecx, [ebp - 0x28]
push ebx
push 0x1388
mov eax, 0x400
push eax
push eax
push 0xff
push 6
push 3
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp byte [esi + 0x1d], bl
jne 0x499aab
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x499a77
lea eax, [ebp - 0x28]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
jne 0x499aab
mov byte [ebp - 0x2d], bl
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004035da
mov al, byte [ebp - 0x2d]
jmp 0x499a11
mov byte [esi + 0x1c], 1
mov byte [ebp - 0x2d], 1
jmp 0x499a94
Function at 0x499c2d
Capabilities:
Connect pipe
Read file on windows
Read pipe

Disassembly:
push 0x3c
mov eax, 0x4d5d66
call fcn.004b814b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], ebx
cmp byte [ebp + 0x14], bl
jne 0x499c7d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x499c6a
xor edi, edi
inc edi
mov esi, edi
jmp 0x499c80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub esi, 0x217
neg esi
sbb esi, esi
inc esi
xor edi, edi
inc edi
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.00403660
mov dword [ebp - 4], edi
cmp esi, ebx
jne 0x499cb1
cmp byte [ebp + 0x14], bl
jne 0x499cb1
mov ecx, dword [ebp - 0x30]
call fcn.00409e84
mov dword [ebp - 0x34], edi
mov byte [ebp - 4], bl
push ebx
push edi
jmp 0x499d63
mov dword [ebp - 0x44], edi
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ebx
add edi, 0x40
push ebx
lea eax, [ebp - 0x48]
push eax
push 0x400
push ebx
mov ecx, edi
call fcn.00408a54
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jne 0x499ced
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x499d38
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x38], eax
shr eax, 1
push eax
mov ecx, edi
call fcn.00408a54
xor ecx, ecx
mov word [eax], cx
cmp dword [edi + 0x18], 8
jb 0x499d0d
mov esi, dword [edi + 4]
jmp 0x499d10
lea esi, [edi + 4]
push esi
call fcn.004b3310
pop ecx
push eax
mov eax, esi
lea esi, [ebp - 0x2c]
call fcn.00408d63
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0x44], ebx
ja 0x499cbd
cmp dword [ebp - 0x3c], ebx
je 0x499d50
cmp dword [ebp - 0x38], ebx
je 0x499d50
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.00409e5e
jmp 0x499d58
mov ecx, dword [ebp - 0x30]
call fcn.00409e84
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], bl
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.004035da
mov eax, dword [ebp - 0x30]
call fcn.004b81ce
ret 0x10

Function at 0x499d76
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x4d408c
call fcn.004b80e2
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
xor edi, edi
cmp dword [ebp + 0x10], 0xffffffff
mov dword [ebp - 0x10], edi
jne 0x499d9c
mov ecx, ebx
call fcn.00409e84
jmp 0x499dda
mov ecx, dword [eax + 0x14]
add ecx, ecx
cmp dword [eax + 0x18], 8
jb 0x499dac
mov eax, dword [eax + 4]
jmp 0x499daf
add eax, 4
push edi
lea edx, [ebp + 0x14]
push edx
push ecx
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
jne 0x499dcc
mov ecx, ebx
call fcn.00409e84
jmp 0x499dda
push 1
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.00499c2d
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 1
mov eax, ebx
call fcn.004b81ba
ret 0x10
Function at 0x499dee
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [eax + 0x14]
add ecx, ecx
cmp dword [eax + 0x18], 8
jb 0x499dff
mov eax, dword [eax + 4]
jmp 0x499e02
add eax, 4
push 0
lea edx, [esp + 4]
push edx
push ecx
push eax
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop ecx
ret

Function at 0x49c6e1
Capabilities:
Check if file exists

Disassembly:
push 0x58
mov eax, 0x4dbd25
call fcn.004b814b
mov eax, dword [ebp + 8]
lea esi, [eax + 4]
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0045a5d0
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x49c761
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x49c711
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49c77e
lea edi, [ebp - 0x64]
lea ecx, [ebp - 0x2c]
call fcn.0045ba70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
call fcn.0045a560
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403ffa
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
call fcn.0040367e
mov byte [ebp - 4], bl
mov eax, edi
push eax
call fcn.0042220e
cmp dword [ebp - 0x18], ebx
jne 0x49c705
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.0040367e
cmp dword [esi + 0x18], 8
jb 0x49c78f
mov esi, dword [esi + 4]
jmp 0x49c792
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.0040367e
mov al, 1
jmp 0x49c79f
add esi, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
neg eax
sbb eax, eax
neg eax
call fcn.004b81ce
ret 4
Function at 0x49f0a4
Capabilities:
Parse credit card information

Disassembly:
push 0x68
mov eax, 0x4d8501
call fcn.004b814b
mov esi, ecx
push 0x4f196c
lea ecx, [ebp - 0x6c]
call fcn.00404357
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x2c]
push edx
call dword [eax]
mov byte [ebp - 4], 2
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x6c]
call fcn.004035da
cmp dword [ebp - 0x18], 3
jb 0x49f1a7
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d8bc
mov ecx, eax
call fcn.0040d7ce
cmp word [eax], 0x3c
jne 0x49f1a7
push ebx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00419fd4
mov ecx, eax
call fcn.0041ac01
mov ecx, eax
call fcn.0040d7ce
cmp word [eax], 0x3e
jne 0x49f1a7
mov eax, dword [ebp - 0x18]
add eax, 0xfffffffe
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040d824
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403ffa
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x6c]
call fcn.004035da
push str.PIDKEY
lea ecx, [ebp - 0x6c]
call fcn.00404357
mov byte [ebp - 4], 4
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x48]
push edx
call dword [eax]
mov byte [ebp - 4], 6
push edi
push ebx
lea ecx, [ebp - 0x6c]
call fcn.004035da
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x18]
je 0x49f1bd
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.004035da
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004035da
xor al, al
call fcn.004b81ce
ret
mov dword [ebp - 0x4c], edi
cmp eax, edi
jbe 0x49f243
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
call fcn.00408a54
movzx eax, word [eax]
cmp eax, 0x3d
jg 0x49f200
je 0x49f238
sub eax, 0x23
je 0x49f1e5
dec eax
dec eax
je 0x49f1e5
dec eax
jmp 0x49f212
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.00408a54
movzx eax, word [eax]
push eax
call fcn.004b3cb2
pop ecx
test eax, eax
je 0x49f199
jmp 0x49f238
cmp eax, 0x3f
jl 0x49f214
cmp eax, 0x40
jle 0x49f238
cmp eax, 0x5e
je 0x49f238
cmp eax, 0x60
je 0x49f238
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.00408a54
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00408a54
mov cx, word [esi]
cmp cx, word [eax]
jne 0x49f199
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x34]
jb 0x49f1c4
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.004035da
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004035da
mov al, bl
jmp 0x49f1b7
Function at 0x4a371a
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x4d83b0
call fcn.004b814b
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x104
lea eax, [ebp - 0x21c]
mov esi, ecx
push eax
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x240]
call fcn.00404357
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x240]
call fcn.0045a5d0
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], bl
push ebx
push edi
lea ecx, [ebp - 0x240]
call fcn.004035da
push str.msiexec.exe
lea ecx, [ebp - 0x240]
call fcn.00404357
mov dword [ebp - 4], 2
lea eax, [ebp - 0x240]
push eax
call fcn.0041a500
mov byte [ebp - 4], bl
push ebx
push edi
lea ecx, [ebp - 0x240]
call fcn.004035da
mov eax, esi
call fcn.004b81ce
ret
Function at 0x4a45f9
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x90
mov eax, 0x4d82de
call fcn.004b814b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], ecx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x80], eax
call fcn.00404357
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0045a5d0
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.004035da
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x9c]
call fcn.0045a8b0
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x4a4661
mov eax, dword [eax + 4]
jmp 0x4a4664
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.004035da
cmp ebx, 3
jne 0x4a468d
test dword [ebp + 0xc], 0x20000
jne 0x4a46db
cmp ebx, 2
jne 0x4a469b
test dword [ebp + 0xc], 0x10000
jne 0x4a46db
cmp ebx, 4
jne 0x4a46a9
test dword [ebp + 0xc], 0x40000
jne 0x4a46db
cmp ebx, 5
jne 0x4a46b7
test dword [ebp + 0xc], 0x80000
jne 0x4a46db
cmp ebx, 6
jne 0x4a46c5
test dword [ebp + 0xc], 0x100000
jne 0x4a46db
cmp ebx, 2
jne 0x4a4787
test dword [ebp + 0xc], 0x200000
je 0x4a4787
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x9c]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
call fcn.0045a8b0
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x4a4705
mov eax, dword [eax + 4]
jmp 0x4a4708
add eax, 4
push edi
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.004035da
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9c]
call fcn.00404357
mov byte [ebp - 4], 5
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x9c]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0049885b
mov byte [ebp - 4], 7
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.004035da
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x68]
push eax
call fcn.004a590f
mov byte [ebp - 4], 2
lea eax, [ebp - 0x68]
push eax
call fcn.0042220e
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.0040367e
call fcn.004b81ce
ret 0xc
Function at 0x4a8c00
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x4dbafa
call fcn.004b814b
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x21c], cx
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x270]
call fcn.00404357
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x270]
call fcn.0045a5d0
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x270]
call fcn.004035da
push str.msi.dll
lea ecx, [ebp - 0x270]
call fcn.00404357
mov byte [ebp - 4], 3
lea eax, [ebp - 0x270]
push eax
lea esi, [ebp - 0x238]
call fcn.0041a500
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x270]
call fcn.004035da
lea eax, [ebp - 0x254]
push eax
call fcn.00492089
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x248]
sar eax, 1
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x234]
jae 0x4a8cdd
lea eax, [ebp - 0x234]
push edi
push edi
lea ecx, [ebp - 0x23c]
push ecx
push edi
push eax
call sub.msi.dll_MsiMessageBoxW
mov eax, dword [ebp - 0x23c]
inc eax
lea ecx, [ebp - 0x254]
call fcn.0045bda0
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x248]
sar eax, 1
jne 0x4a8d14
call fcn.004b3673
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x4a8d29
lea eax, [ebp - 0x234]
push edi
push edi
lea ecx, [ebp - 0x23c]
push ecx
push dword [ebp - 0x248]
push eax
call sub.msi.dll_MsiMessageBoxW
xor ebx, ebx
cmp edi, dword [ebp - 0x23c]
jae 0x4a8d6e
lea esi, [ebp - 0x254]
call fcn.0045bca0
cmp word [eax], 0x2e
je 0x4a8d68
call fcn.0045bca0
imul ebx, ebx, 0xa
movzx eax, word [eax]
lea ebx, [ebx + eax - 0x30]
inc edi
cmp edi, 3
jb 0x4a8d40
imul ebx, ebx, 0xa
mov byte [ebp - 4], 2
lea eax, [ebp - 0x254]
push eax
call fcn.0045cbd0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x238]
push eax
call fcn.0040367e
mov eax, ebx
call fcn.004b81ce
ret
Function at 0x4ab678
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d8177
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0xec]
mov dword [esp + 0x1c], eax
inc dword [eax]
mov byte [esp + 0x20], 0
and dword [esp + 0x38], 0
lea edi, [ecx + 0xf0]
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x24]
call fcn.00490303
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x24]
call fcn.00490303
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4ab6f9
cmp esi, dword [esp + 0x24]
je 0x4ab6fe
call fcn.004b3673
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esp + 0x28]
je 0x4ab749
test esi, esi
jne 0x4ab741
call fcn.004b3673
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4ab71d
call fcn.004b3673
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
call dword [eax]
test esi, esi
jne 0x4ab745
call fcn.004b3673
cmp ebx, dword [esi + 0x10]
jb 0x4ab738
call fcn.004b3673
add ebx, 0x4c
mov dword [esp + 0x18], ebx
jmp 0x4ab6df
mov eax, dword [esi]
jmp 0x4ab713
mov esi, dword [esi]
jmp 0x4ab72e
mov eax, edi
call fcn.004ab965
or dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x1c]
dec dword [eax]
mov byte [esp + 0x20], 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ad7a7
Capabilities:
Delete directory

Disassembly:
push 8
mov eax, 0x4d6b71
call fcn.004b80e2
lea eax, [ebp - 0x10]
push eax
call fcn.004029ba
and dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x4ad808
lea ecx, [eax - 1]
mov eax, esi
call fcn.00459f00
cmp ax, 0x5c
jne 0x4ad808
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
lea ecx, [eax - 1]
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0043aef2
mov byte [ebp - 4], 1
lea edi, [ebp - 0x10]
call fcn.0044607b
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00402964
jmp 0x4ad812
mov eax, esi
lea edi, [ebp - 0x10]
call fcn.0044607b
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov ecx, dword [esi]
cmp eax, dword [ecx - 0xc]
jge 0x4ad865
push 0x5c
call fcn.004460e6
lea ecx, [ebp - 0x14]
push ecx
push esi
mov ecx, eax
call fcn.0043aef2
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x4ad859
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004ad7a7
pop ecx
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402964
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402964
call fcn.004b81ba
ret
Function at 0x4ad877
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x4d805d
call fcn.004b80e2
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x4ad90c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x10]
push eax
call fcn.004029ba
and dword [ebp - 4], 0
push 0x5c
call fcn.004460e6
cmp eax, 0xffffffff
je 0x4ad8d2
lea ecx, [ebp - 0x14]
push ecx
push esi
mov ecx, eax
call fcn.0043aef2
mov byte [ebp - 4], 1
lea edi, [ebp - 0x10]
call fcn.0044607b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402964
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4ad900
lea eax, [ebp - 0x14]
push eax
call fcn.004029ba
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004ad7a7
pop ecx
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402964
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402964
call fcn.004b81ba
ret

Function at 0x4adc89
Capabilities:
Check if file exists

Disassembly:
push 0x90
mov eax, 0x4ddc90
call fcn.004b814b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], ecx
push eax
mov ecx, esi
mov dword [ebp - 0x60], esi
mov edi, edx
mov dword [ebp - 0x5c], ebx
call fcn.00409e5e
push dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 4], ebx
push esi
inc ebx
push edi
mov dword [ebp - 0x5c], ebx
call fcn.004ada3b
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x4adce4
mov eax, dword [esi + 4]
jmp 0x4adce7
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4addbc
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.0045a5d0
lea edi, [ebp - 0x7c]
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.0045ba70
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0045a560
mov eax, edi
push eax
mov byte [ebp - 4], 4
call fcn.0042220e
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x48]
call fcn.0045b8d0
mov edi, eax
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.0045b8d0
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0040ec20
xor edi, edi
push edi
push ebx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0x49], al
mov byte [ebp - 4], 5
call fcn.004035da
push edi
push ebx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 4
call fcn.004035da
cmp byte [ebp - 0x49], 0
je 0x4adda3
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4add8a
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4adda3
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00403ffa
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], bl
call fcn.0040367e
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 0
call fcn.0040367e
mov eax, esi
call fcn.004b81ce
ret
Function at 0x4ae3fc
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004b3b00
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4ae455
cmp dword [ebp - 0x7c], 5
jae 0x4ae451
cmp dword [ebp - 0x7c], 4
jne 0x4ae455
cmp dword [ebp - 0x78], 0x5a
jb 0x4ae455
xor eax, eax
jmp 0x4ae458
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.004b196e
add ebp, 0x98
leave
ret

Function at 0x4ae6f0
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4af4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x527014], 0
push esi
jne 0x4af433
call fcn.004af359
test eax, eax
je 0x4af476
mov eax, dword [0x527014]
cmp eax, 1
jne 0x4af454
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4af476
pop esi
ret
push eax
call dword [0x52701c]
test eax, eax
jne 0x4af4be
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4af47a
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x527014]
call dword [0x52701c]
mov edi, eax
test edi, edi
je 0x4af49f
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4af4bb
mov edi, esi
add esi, 0xff0
push edi
push dword [0x527014]
call dword [0x527018]
add edi, 0x10
cmp edi, esi
jb 0x4af4a7
mov eax, edi
pop edi
pop esi
ret
jmp 0x4af420
Function at 0x4b127e
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x4d0568
call fcn.004b814b
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x4b1390
cmp byte [esi + 0x42], bl
je 0x4b1390
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4b12ba
xor al, al
jmp 0x4b1392
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.004445c9
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x4b132a
dec eax
je 0x4b132e
dec eax
dec eax
je 0x4b138c
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404ef5
mov al, bl
jmp 0x4b1392
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x4b136e
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004445ef
mov ecx, eax
call fcn.00444aea
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004ba952
add esp, 0x10
cmp edi, eax
jne 0x4b1318
cmp byte [esi + 0x42], 0
je 0x4b138c
test edi, edi
jne 0x4b12c8
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00444644
jmp 0x4b12c8
mov bl, 1
jmp 0x4b131a
mov al, 1
call fcn.004b81ce
ret