joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d050
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x48d161
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi + 0x36c], 0
jne 0x48d07f
mov edx, 0x1000
mov eax, edi
call fcn.0048a87c
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x344], esi
inc esi
jne 0x48d0a3
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, edi
call fcn.0048e6e8
mov dl, 1
mov eax, edi
call fcn.0048a844
mov byte [edi + 0x348], 1
mov byte [edi + 0x371], 1
push 0x48d170
call sub.wsock32.dll_inet_addr
mov dword [edi + 0x2c0], eax
mov word [edi + 0x2bc], 2
mov ax, word [edi + 0xf8]
push eax
call sub.wsock32.dll_htons
mov word [edi + 0x2be], ax
mov byte [edi + 0x128], 0
push 0x10
lea eax, [edi + 0x2bc]
push eax
mov eax, dword [edi + 0x344]
push eax
call sub.wsock32.dll_bind
test bl, bl
je 0x48d123
push 8
push 0x466
mov eax, dword [edi + 0x34c]
push eax
mov eax, dword [edi + 0x344]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x48d13d
push 8
push 0x465
mov eax, dword [edi + 0x34c]
push eax
mov eax, dword [edi + 0x344]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 1
mov eax, dword [edi + 0x344]
push eax
call sub.wsock32.dll_listen
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d168
lea eax, [ebp - 4]
call fcn.00403ba8
ret

Function at 0x48d754
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x344]
cmp eax, 0xffffffff
jne 0x48d778
or esi, 0xffffffff
jmp 0x48d849
or esi, 0xffffffff
cmp byte [ebx + 0x2f3], 0
je 0x48d837
cmp dword [ebx + 0x2f4], 0
je 0x48d849
xor edi, edi
mov eax, dword [ebx + 0x2f4]
test eax, eax
je 0x48d849
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
mov eax, dword [0x553620]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
test esi, esi
jg 0x48d82e
cmp edi, 0xc8
jg 0x48d82e
push esi
mov eax, dword [ebx + 0x2f4]
push eax
mov eax, dword [0x5537e4]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x48d82e
je 0x48d807
sub eax, 4
je 0x48d7ed
dec eax
je 0x48d7fa
jmp 0x48d814
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0048e504
jmp 0x48d82e
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0048e504
jmp 0x48d82e
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0048e504
jmp 0x48d82e
inc edi
cmp byte [ebx + 0x318], 0
je 0x48d82e
mov dx, 2
mov eax, ebx
call fcn.0048ece8
jmp 0x48d797
test esi, esi
jne 0x48d849
or esi, 0xffffffff
jmp 0x48d849
push 0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
call sub.wsock32.dll_recv
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48d854
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x344]
cmp eax, 0xffffffff
jne 0x48d878
or esi, 0xffffffff
jmp 0x48d90a
cmp byte [ebx + 0x2f3], 0
je 0x48d8f8
xor edi, edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x2f4]
push eax
mov eax, dword [0x553378]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
test esi, esi
jg 0x48d90a
cmp edi, 0x14
jg 0x48d90a
push esi
mov eax, dword [ebx + 0x2f4]
push eax
mov eax, dword [0x5537e4]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x48d90a
je 0x48d8e8
sub eax, 4
je 0x48d8ce
dec eax
je 0x48d8db
jmp 0x48d8f5
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0048e504
jmp 0x48d90a
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0048e504
jmp 0x48d90a
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0048e504
jmp 0x48d90a
inc edi
jmp 0x48d883
push 0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
call sub.wsock32.dll_send
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48e504
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, eax
xor eax, eax
push ebp
push 0x48e6c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x344], 0xffffffff
je 0x48e6ac
test bl, bl
jne 0x48e553
cmp byte [esi + 0x370], 0
je 0x48e546
mov byte [esi + 0xed], 1
jmp 0x48e54d
mov byte [esi + 0xed], 2
mov byte [esi + 0xee], dl
test dl, dl
je 0x48e567
cmp byte [esi + 0x370], 0
je 0x48e567
mov byte [esi + 0x2fc], 1
mov byte [esi + 0x371], 0
mov byte [esi + 0x370], 0
mov byte [esi + 0x2f3], 0
xor eax, eax
mov dword [esi + 0x2f8], eax
mov eax, dword [esi + 0x2f4]
test eax, eax
je 0x48e62e
push eax
mov eax, dword [0x5531d0]
mov eax, dword [eax]
call eax
pop ecx
mov eax, dword [esi + 0x2f4]
push eax
mov eax, dword [0x5531d0]
mov eax, dword [eax]
call eax
pop ecx
test eax, eax
jne 0x48e5c3
mov eax, dword [esi + 0x2f4]
push eax
mov eax, dword [0x5531d0]
mov eax, dword [eax]
call eax
pop ecx
mov eax, dword [esi + 0x2f4]
push eax
mov eax, dword [0x553804]
mov eax, dword [eax]
call eax
pop ecx
xor eax, eax
mov dword [esi + 0x2f4], eax
mov eax, dword [esi + 0x2f8]
push eax
mov eax, dword [0x55314c]
mov eax, dword [eax]
call eax
pop ecx
xor eax, eax
mov dword [esi + 0x2f8], eax
push 0x3f
push 0x465
mov eax, dword [esi + 0x34c]
push eax
mov eax, dword [esi + 0x344]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, esi
call fcn.0048fcec
test eax, eax
jle 0x48e62e
push esi
push 0
push 0x468
mov eax, dword [esi + 0x34c]
push eax
call sub.user32.dll_SendMessageA
cmp byte [esi + 0x318], 1
jne 0x48e65f
mov word [ebp - 4], 0
mov word [ebp - 2], 0x64
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
mov eax, dword [esi + 0x344]
push eax
call sub.wsock32.dll_setsockopt
cmp dword [esi + 0x344], 0xffffffff
je 0x48e6ac
cmp byte [esi + 0x348], 0
je 0x48e6ac
mov eax, esi
call fcn.0048d3a8
mov eax, esi
call fcn.0048fd2c
test al, al
je 0x48e69e
test bl, bl
jne 0x48e6ac
test byte [esi + 0x20], 8
jne 0x48e6ac
cmp word [esi + 0x5e], 0
je 0x48e6ac
mov edx, esi
mov eax, dword [esi + 0x60]
call dword [esi + 0x5c]
jmp 0x48e6ac
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, esi
call fcn.0048e6e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e6c9
lea eax, [ebp - 8]
call fcn.00403ba8
ret

Function at 0x48ed18
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x5536c4]
mov edx, dword [edx]
call fcn.00403c40
cmp dword [ebx + 0x344], 0xffffffff
je 0x48ed8c
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x344]
push eax
call sub.wsock32.dll_getsockname
push esi
mov bx, word [ebp - 0x12]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
shr bx, 8
movzx eax, bx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x48ed9c
call fcn.00409f14
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48fbe4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48fc8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2d0]
mov edx, dword [0x5536c4]
mov edx, dword [edx]
call fcn.00403f34
jne 0x48fc48
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x344]
push eax
call sub.wsock32.dll_getsockname
push dword [ebp - 0x10]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.004099cc
jmp 0x48fc55
mov eax, esi
mov edx, dword [ebx + 0x2d0]
call fcn.00403c40
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esi]
mov ecx, 0x48fca4
mov edx, 0x48fcb0
call fcn.0045333c
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.00403c40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fc93
lea eax, [ebp - 0x18]
call fcn.00403ba8
ret

Function at 0x48fd68
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.00402bd8
push 0x48fde4
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.wsock32.dll_bind
test eax, eax
sete bl
xor bl, 1
test bl, bl
jne 0x48fdd3
push 1
push esi
call sub.wsock32.dll_listen
test eax, eax
sete bl
xor bl, 1
push esi
call sub.wsock32.dll_closesocket
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x490418
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402bd8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
pop ebp
ret

Function at 0x490fa4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00402bd8
pop ebp
ret
Function at 0x4ab0a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4ab108
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov ebx, 0x555e54
lea eax, [ebp - 4]
mov edx, esi
add dl, 0x40
call fcn.00403d4c
lea eax, [ebp - 4]
mov edx, 0x4ab11c
call fcn.00403e2c
mov eax, dword [ebp - 4]
call fcn.00403fe8
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebx], eax
inc esi
add ebx, 4
cmp esi, 0x1a
jne 0x4ab0bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab10f
lea eax, [ebp - 4]
call fcn.00403ba8
ret

Function at 0x4acbac
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], ebx
mov ebx, ecx
test ebx, ebx
js 0x4acbd3
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4acbcc
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fd8
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x4010c4]
call fcn.00404650
xor eax, eax
push ebp
push 0x4acd61
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x4acd29
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x4acd88
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403ee4
mov eax, dword [ebp - 0x158]
call fcn.00403fe8
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4acd1d
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x4acd02
test al, 2
jne 0x4acd02
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x4acd88
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403dd4
push dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403ee4
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x10]
call fcn.00466280
call fcn.00463a1c
test al, al
je 0x4accc0
or edi, 0xffffffff
jmp 0x4acccf
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00466484
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.004661e0
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403dd4
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x38]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4acc55
push ebx
call sub.kernel32.dll_FindClose
add esi, 4
dec dword [ebp - 0x14]
jne 0x4acc18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acd68
lea eax, [ebp - 0x15c]
mov edx, 2
call fcn.00403bcc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x4010c4]
call fcn.00404538
lea eax, [ebp - 4]
call fcn.00403ba8
ret
Function at 0x4adeb4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4adfb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x14]
mov edx, dword [0x5536c4]
mov edx, dword [edx]
call fcn.00403f34
je 0x4adefa
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00403c40
jmp 0x4adf9b
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.004adfc4
mov edx, dword [ebp - 0x164]
lea eax, [ebx + 0x14]
call fcn.00403bfc
cmp dword [ebx + 0x14], 0
jne 0x4adf6c
lea eax, [ebp - 0x160]
xor ecx, ecx
mov edx, 0x160
call fcn.00402bd8
push 0x208
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.004ade50
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4adf6c
lea eax, [ebp - 0x154]
call fcn.00409790
mov ecx, eax
lea edx, [ebp - 0x154]
lea eax, [ebx + 0x14]
call fcn.00403c8c
mov eax, ebx
call fcn.004addd4
test al, al
je 0x4adf91
mov eax, dword [ebx + 0x14]
call fcn.00403e24
mov edx, eax
sub edx, 3
lea eax, [ebx + 0x14]
mov ecx, 4
call fcn.00404068
mov eax, esi
mov edx, dword [ebx + 0x14]
call fcn.00403c40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adfbb
lea eax, [ebp - 0x164]
call fcn.00403ba8
ret
Function at 0x4b22b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b2363
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x358], 0
jne 0x4b2302
push 0x465
mov eax, dword [ebp - 4]
call fcn.00447190
mov ecx, eax
mov dl, 1
mov eax, dword [0x4ae950]
call fcn.004ae9bc
mov edx, dword [ebp - 4]
mov dword [edx + 0x358], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004aee88
lea eax, [ebp - 8]
mov edx, 0x4b2378
call fcn.00403c40
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x4b234d
test bl, 1
je 0x4b2346
lea eax, [ebp - 8]
call fcn.00403ff4
lea edx, [esi + 0x41]
mov byte [eax], dl
push ebp
mov eax, dword [ebp - 8]
call fcn.004b2248
pop ecx
shr ebx, 1
inc esi
test ebx, ebx
jne 0x4b232a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b236a
lea eax, [ebp - 8]
call fcn.00403ba8
ret

Function at 0x4b2e84
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403fd8
xor eax, eax
push ebp
push 0x4b2f96
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b2f69
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403fe8
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b2f46
test byte [ebp - 0x14c], 0x10
jne 0x4b2f29
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403dd4
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408980
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4b2eec
push ebx
call sub.kernel32.dll_FindClose
mov byte [ebp - 5], 1
jmp 0x4b2f52
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2f70
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4b9fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov al, byte [ebx + 4]
sub al, 1
jb 0x4b9fb1
je 0x4b9fb7
jmp 0x4b9fdd
mov eax, dword [ebx + 0xc]
pop ebx
pop ebp
ret
cmp dword [ebx + 0xc], 0
jne 0x4b9fd7
lea eax, [ebx + 0xc]
push eax
xor eax, eax
mov al, byte [ebx + 0x10]
push eax
mov eax, dword [0x5535d4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 0xc]
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4c1394
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4c139d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c15a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
mov eax, dword [ebx + 0x350]
mov edx, esi
call fcn.00403f34
jne 0x4c13df
cmp byte [ebx + 0x378], 0
je 0x4c1586
mov byte [ebp - 2], 1
lea eax, [ebx + 0x350]
mov edx, esi
call fcn.00403bfc
mov byte [ebx + 0x378], 0
mov eax, ebx
call fcn.004c0b34
test eax, eax
jne 0x4c141d
mov eax, esi
call fcn.004091c4
test al, al
je 0x4c1586
mov eax, esi
call fcn.004092d0
jmp 0x4c1586
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, esi
call fcn.00403fe8
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4c1586
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp byte [ebp - 1], 0
je 0x4c1465
mov eax, ebx
call fcn.004bfc8c
mov eax, ebx
call fcn.004c0b34
mov edi, eax
dec edi
test edi, edi
jl 0x4c157d
inc edi
xor esi, esi
cmp byte [ebp - 1], 0
je 0x4c14a0
cmp byte [ebp - 1], 0
je 0x4c1575
mov edx, esi
mov eax, dword [ebx + 0x37c]
call fcn.00410c64
cmp byte [eax], 0
je 0x4c1575
mov edx, esi
mov eax, ebx
call fcn.004c0d20
and eax, 0xff
lea edx, [ebp - 0x14]
call fcn.00408e3c
push dword [ebp - 0x14]
push 0x4c15c4
mov edx, esi
mov eax, ebx
call fcn.004c0d00
and eax, 0xff
lea edx, [ebp - 0x18]
call fcn.00408e3c
push dword [ebp - 0x18]
push 0x4c15c4
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, ebx
call fcn.004c0ed0
push dword [ebp - 0x1c]
push 0x4c15c4
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.004c0f94
push dword [ebp - 0x20]
push 0x4c15c4
lea ecx, [ebp - 0x24]
mov edx, esi
mov eax, ebx
call fcn.004c0c7c
push dword [ebp - 0x24]
push 0x4c15c4
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, ebx
call fcn.004c0ca4
push dword [ebp - 0x28]
push 0x4c15c4
mov edx, esi
mov eax, ebx
call fcn.004c0ccc
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00408e6c
push dword [ebp - 0x2c]
push 0x4c15d0
lea eax, [ebp - 8]
mov edx, 0xe
call fcn.00403ee4
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00403e24
push eax
lea eax, [ebp - 8]
call fcn.00403ff4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
inc esi
dec edi
jne 0x4c147a
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c15b0
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00403bcc
lea eax, [ebp - 8]
call fcn.00403ba8
ret
Function at 0x4c665c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edi, esi
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lodsb al, byte [esi]
xor al, bl
rol ebx, 1
add ebx, 0x139a1fc4
stosb byte es:[edi], al
loop 0x4c666b
popal
pop ebp
ret 0xc

Function at 0x4c6680
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4c6709
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x4c6720
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x4c66d2
push 0x4c6720
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
je 0x4c66d2
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
add eax, 0x87654321
adc edx, 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jne 0x4c66f3
cmp dword [ebp - 0x18], 0xffffffff
jbe 0x4c66fc
jmp 0x4c66f5
jle 0x4c66fc
mov ebx, dword [ebp - 0x18]
inc ebx
dec ebx
jmp 0x4c66ff
mov ebx, dword [ebp - 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c6715
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4deb98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004475b8
test al, al
je 0x4dec5e
mov eax, dword [ebp - 4]
call fcn.004deb28
test eax, eax
jle 0x4dec5e
xor edx, edx
push ebp
push 0x4dec57
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x30], 1
mov eax, dword [eax + 0x40]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x4dec1e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov edx, ebx
call fcn.004dc7f8
call fcn.004de588
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov edx, ebx
call fcn.004dc7f8
call fcn.00402f44
dec ebx
cmp ebx, 0xffffffff
jne 0x4debee
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov bx, 0xffff
call fcn.00403120
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dec5e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 0
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4eb330
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4eb444
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x5536c4]
mov edx, dword [edx]
call fcn.00403c40
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
add eax, dword [edx - 4]
mov edx, dword [ebp + 8]
mov dword [edx - 0xc], eax
mov eax, dword [ebp + 8]
inc dword [eax - 4]
mov eax, dword [ebp + 8]
mov edi, dword [eax - 4]
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 0xc]
sub ebx, edi
jl 0x4eb3b0
inc ebx
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dl, byte [edx + edi]
call fcn.00403d4c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00403e2c
inc edi
dec ebx
jne 0x4eb390
mov eax, dword [ebp - 4]
mov edx, dword [0x5536c4]
mov edx, dword [edx]
call fcn.00403c40
mov eax, dword [ebp - 8]
call fcn.00403e24
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.00403e24
mov ebx, eax
test ebx, ebx
jle 0x4eb41b
mov edi, 1
imul eax, esi, 0x8088405
mov esi, eax
inc esi
mov eax, esi
shr eax, 0x18
mov edx, dword [ebp - 8]
movzx edx, byte [edx + edi - 1]
xor eax, edx
mov edx, dword [ebp + 8]
mov dword [edx - 0x10], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x10]
call fcn.00403d4c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00403e2c
mov eax, dword [ebp - 4]
inc edi
dec ebx
jne 0x4eb3dd
mov eax, dword [ebp - 8]
call fcn.00403e24
mov edx, dword [ebp + 8]
add dword [edx - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb44b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403bcc
ret