joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487039
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x18], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret

Function at 0x4893be
Capabilities:
Write file on windows

Disassembly:
push dword [ecx]
lea eax, [esp + 8]
push 1
push 1
push eax
call fcn.005a3f38
add esp, 0x10
ret 4

Function at 0x489433
Capabilities:
Write file on windows

Disassembly:
push dword [ecx]
lea eax, [esp + 8]
push 8
push 1
push eax
call fcn.005a3f38
add esp, 0x10
ret 8

Function at 0x48bf6d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 0xc], eax
jle 0x48bf9a
mov ecx, dword [ebp + 8]
movzx edx, byte [ebp + 0x10]
movzx ecx, byte [eax + ecx]
xor ecx, edx
mov edx, dword [ebp + 0x10]
shr edx, 8
xor edx, dword [ecx*4 + 0x661e08]
inc eax
cmp eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], edx
jl 0x48bf77
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x48ed38
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48ed8e
call edi
cmp eax, 0x3f0
je 0x48ed77
xor eax, eax
jmp 0x48edf0
lea eax, [ebp - 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48ed73
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x48edad
call edi
cmp eax, 0x7a
jne 0x48edbf
push dword [ebp - 0x18]
call fcn.00564e4a
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
cmp edi, ebx
jne 0x48edca
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48eded
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push edi
push 2
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
test eax, eax
jne 0x48edfe
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00564e3f
pop ecx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0059ca15
leave
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x48ee4b
push dword [ebp - 0x14]
call fcn.00564e3f
pop ecx
mov eax, ebx
jmp 0x48edef
mov esi, dword [ebp - 0x14]
xor edi, edi
add esi, 4
mov eax, dword [ebp - 0x14]
cmp edi, dword [eax]
jae 0x48ee70
push dword [esi]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc edi
add esi, 8
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x48ee53
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ebx, dword [ebp - 0x20]
jmp 0x48ee3e
Function at 0x48efe4
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
push edi
lea eax, [ebp - 0x10]
push eax
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push edi
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x48f021
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x48f021
xor eax, eax
jmp 0x48f075
push ebx
push dword [ebp - 8]
call fcn.00564e4a
mov ebx, eax
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.00564e4a
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
cmp ebx, edi
je 0x48f064
cmp eax, edi
je 0x48f05b
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push edi
call esi
test eax, eax
jne 0x48f064
push ebx
call fcn.00564e3f
xor ebx, ebx
pop ecx
cmp dword [ebp - 0xc], edi
je 0x48f072
push dword [ebp - 0xc]
call fcn.00564e3f
pop ecx
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x493583
Capabilities:
Set registry value

Disassembly:
cmp dword [0x6622bc], 2
jne 0x493596
mov ecx, 0x671bc0
jmp fcn.0047bec2
add ecx, 4
jmp fcn.004abcdf

Function at 0x49359e
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x5e1b4c
call fcn.0059ca57
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ecx + 0x418], esi
call fcn.0047bbd8
mov edi, eax
cmp edi, esi
je 0x47bcfd
push edi
call fcn.0059bf90
pop ecx
cmp eax, 8
jne 0x47bcfd
push esi
push 4
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp + 8], esi
call fcn.00428225
add esp, 0x10
push edi
call fcn.00564e3f
mov eax, dword [ebp + 8]
pop ecx
jmp 0x47bd0a
mov eax, dword [ebp + 0xc]
jmp 0x47bd0a
call fcn.0059cafc
ret 8
cmp dword [0x6622bc], 2
jne 0x4935b1
mov ecx, 0x671bc0
jmp 0x47bcac
add ecx, 4
jmp fcn.004ab779

Function at 0x4935b9
Capabilities:
Set registry value

Disassembly:
cmp dword [0x6622bc], 2
jne 0x4935cc
mov ecx, 0x671bc0
jmp fcn.0047befa
add ecx, 4
jmp fcn.004abe67

Function at 0x4935d4
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x5e1b82
call fcn.0059ca57
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ecx + 0x418], esi
call fcn.0047bbd8
mov edi, eax
cmp edi, esi
je 0x47bdc9
push edi
call fcn.0059bf90
pop ecx
cmp eax, 8
jne 0x47bdc9
push esi
push 4
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp + 8], esi
call fcn.00428225
add esp, 0x10
push edi
call fcn.00564e3f
mov eax, dword [ebp + 8]
pop ecx
jmp 0x47bdd6
mov eax, dword [ebp + 0xc]
jmp 0x47bdd6
call fcn.0059cafc
ret 8
cmp dword [0x6622bc], 2
jne 0x4935e7
mov ecx, 0x671bc0
jmp 0x47bd78
add ecx, 4
jmp fcn.004ab912

Function at 0x4935ef
Capabilities:
Set registry value

Disassembly:
push 0x3c
mov eax, 0x5e1c1d
call fcn.0059cac3
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x31
lea eax, [ebp - 0x47]
push ebx
push eax
mov edi, ecx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x48], bl
call fcn.0059cb30
add esp, 0xc
cmp esi, ebx
jne 0x47c008
mov dword [edi + 0x418], 1
xor eax, eax
call fcn.0059cb1f
ret 8
push ebx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0xc]
push 4
push eax
call fcn.004281b6
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push esi
mov ecx, edi
call fcn.0047bec2
jmp 0x47c000
cmp dword [0x6622bc], 2
jne 0x493602
mov ecx, 0x671bc0
jmp 0x47bfc8
add ecx, 4
jmp fcn.004abb7c
Function at 0x493686
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x5e1c9d
call fcn.0059ca57
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x47c327
cmp dword [ebp + 0x10], ebx
jl 0x47c327
cmp dword [ebp + 0xc], ebx
je 0x47c31b
cmp dword [ebp + 0x10], ebx
je 0x47c31b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00428a78
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x47c2fd
mov dword [edi + 0x418], 2
jmp 0x47c331
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.0047bec2
push esi
mov edi, eax
call fcn.00564e3f
pop ecx
mov eax, edi
jmp 0x47c333
push dword [ebp + 8]
mov ecx, edi
call fcn.0047c096
jmp 0x47c333
mov dword [edi + 0x418], 1
xor eax, eax
call fcn.0059cafc
ret 0xc
push ebp
mov ebp, esp
cmp dword [0x6622bc], 2
jne 0x49369d
mov ecx, 0x671bc0
pop ebp
jmp 0x47c2b7
add ecx, 4
pop ebp
jmp fcn.004abf67

Function at 0x4936a6
Capabilities:
Delete registry value

Disassembly:
cmp dword [0x6622bc], 2
jne 0x4936b9
mov ecx, 0x671bc0
jmp fcn.0047c096
add ecx, 4
jmp fcn.004ab045

Function at 0x4937c7
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [0x6622bc], 2
jne 0x4937da
mov ecx, 0x671bc0
jmp fcn.0047bd12
jmp fcn.0049359e

Function at 0x4937df
Capabilities:
Set registry value

Disassembly:
push 0x3c
mov eax, 0x5e1bf8
call fcn.0059cac3
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x31
lea eax, [ebp - 0x47]
push ebx
push eax
mov edi, ecx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x48], bl
call fcn.0059cb30
add esp, 0xc
cmp esi, ebx
jne 0x47bfa1
mov dword [edi + 0x418], 1
xor eax, eax
call fcn.0059cb1f
ret 8
push ebx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0xc]
push 4
push eax
call fcn.004281b6
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push esi
mov ecx, edi
call fcn.0047bec2
jmp 0x47bf99
cmp dword [0x6622bc], 2
jne 0x4937f2
mov ecx, 0x671bc0
jmp 0x47bf61
jmp fcn.004935b9
Function at 0x494e90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 4
mov eax, 0x5e3a36
call fcn.0059ca24
mov esi, ecx
lea ecx, [ebp]
call fcn.00427139
xor edi, edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x1c4]
push eax
mov ecx, 0x66e868
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.00477dd1
test eax, eax
je 0x494fcd
push dword [ebp - 0x10]
call fcn.0059bf90
inc eax
pop ecx
inc eax
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x494f4a
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x494f41
push dword [ebp - 0x10]
call fcn.0059bf90
inc eax
push eax
push dword [ebp - 0x10]
push edi
call fcn.0059d730
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
jne 0x494f33
xor eax, eax
jmp 0x494f36
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x494f83
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor edi, edi
cmp esi, edi
jne 0x494f52
xor esi, esi
jmp 0x494f55
mov esi, dword [esi + 0x20]
push 0xd4
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x16
push esi
call fcn.00428d53
add esp, 0xc
cmp dword [ebp - 0x10], edi
je 0x494fcd
push dword [ebp - 0x10]
call fcn.00564e3f
pop ecx
mov dword [ebp - 0x10], edi
jmp 0x494fcd
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 0x10], 0
je 0x494fab
push dword [ebp - 0x10]
call fcn.00564e3f
and dword [ebp - 0x10], 0
pop ecx
test esi, esi
je 0x494fb2
mov esi, dword [esi + 0x20]
push 0xd5
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x13
push esi
call fcn.00428d53
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x43c
leave
ret
Function at 0x495d93
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 8
mov eax, 0x5e3cff
call fcn.0059ca24
mov esi, ecx
lea ecx, [ebp]
call fcn.00427139
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 0x444], ebx
mov dword [ebp - 4], ebx
jge 0x495dde
mov ecx, esi
call fcn.00494ffc
mov dword [ebp + 0x444], eax
inc edi
push 2
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0x1e4]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0x444]
lea ecx, [esi + 0x1c4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0057ad5c
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], ebx
jne 0x495e24
push 0x631718
lea ecx, [ebp - 0x10]
call fcn.00401ec0
jmp 0x495e6c
cmp edi, ebx
je 0x495e6c
push ebx
push 0x3d
lea ecx, [ebp - 0x10]
call fcn.00452528
test eax, eax
je 0x495e6c
push ebx
push 0x3d
lea ecx, [ebp - 0x10]
call fcn.00452528
inc eax
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d280
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00402340
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00402490
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, 2
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x495ebf
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x495eb8
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx - 0xc]
inc ecx
push ecx
push edx
push eax
call fcn.0059d730
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x495ed6
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [esi + 0x20]
push 0xd4
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x16
jmp 0x495f00
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [esi + 0x20]
push 0xd5
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x13
push esi
call fcn.00428d53
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00402490
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x43c
leave
ret 4
Function at 0x497644
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 8
mov eax, 0x5e3e7f
call fcn.0059ca24
mov esi, dword [ebp + 0x41c]
mov dword [ebp - 0x14], ecx
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x10]
call fcn.00402440
xor ebx, ebx
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.00493dd6
push ebx
push str.WorkMode
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0049359e
cmp eax, 1
je 0x4976bc
cmp eax, 3
je 0x4976bc
push esi
lea eax, [ebp - 0x10]
push str.mailto:_s
push eax
call fcn.00401b30
add esp, 0xc
jmp 0x49772a
push 7
mov edi, 0x5f57f8
push edi
push esi
call fcn.0059d08f
add esp, 0xc
test eax, eax
je 0x497721
push 8
push str.https:__
push esi
call fcn.0059d08f
add esp, 0xc
test eax, eax
je 0x497721
push 6
push 0x5f57e4
push esi
call fcn.0059d08f
add esp, 0xc
test eax, eax
je 0x497721
push 7
push str.file:__
push esi
call fcn.0059d08f
add esp, 0xc
test eax, eax
je 0x497721
push edi
lea ecx, [ebp - 0x10]
call fcn.00401ec0
push esi
lea ecx, [ebp - 0x10]
call fcn.0040d820
jmp 0x49772a
push esi
lea ecx, [ebp - 0x10]
call fcn.00401ec0
mov edi, dword [ebp - 0x14]
cmp edi, ebx
jne 0x497735
xor eax, eax
jmp 0x497738
mov eax, dword [edi + 0x20]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4977a0
push 0x288
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
lea ecx, [ebp - 0x10]
call fcn.00401ec0
push 0x5f5834
lea ecx, [ebp - 0x10]
call fcn.0040d820
push esi
call fcn.0042848c
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d820
cmp edi, ebx
jne 0x49778f
xor eax, eax
jmp 0x497792
mov eax, dword [edi + 0x20]
push dword [ebp - 0x10]
push 0x16
push eax
call fcn.00428d53
add esp, 0xc
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.00493516
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402490
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x414
leave
ret 4

Function at 0x498e70
Capabilities:
Create directory

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x498e91
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x498e91
xor eax, eax
jmp 0x498e94
xor eax, eax
inc eax
ret 4

Function at 0x4992e9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0049919f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov edi, ecx
mov ecx, esi
call fcn.004991f0
mov eax, edi
pop edi
pop esi
ret

Function at 0x49933b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0049919f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x49932d
test al, 0x10
je 0x49932d
xor edi, edi
inc edi
jmp 0x49932f
xor edi, edi
mov ecx, esi
call fcn.004991f0
mov eax, edi
pop edi
pop esi
ret
jmp 0x49930f
Function at 0x499913
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
call fcn.0049933b
test eax, eax
jne 0x499958
mov ecx, esi
call fcn.004992e9
test eax, eax
je 0x499958
push edi
mov eax, 0x80
push eax
push 3
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x499958
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x49995d
Capabilities:
Get session user name
Query environment variable

Disassembly:
push ebp
sub esp, 0x50c
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x50c], eax
push 8
mov eax, 0x5e41a2
call fcn.0059ca24
mov edi, ecx
push edi
push 0x28
mov byte [edi], 0
call fcn.00499062
test eax, eax
je 0x4999b8
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x50c]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x510
leave
ret
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, 0x400
push esi
push edi
push str._USERPROFILE_
call ebx
cmp byte [edi], 0
je 0x4999e2
push str._USERPROFILE_
push edi
call fcn.0059fbe0
pop ecx
pop ecx
test eax, eax
jne 0x499992
lea ecx, [ebp]
call fcn.004aafa5
and dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp]
call fcn.004aafcd
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
lea ecx, [ebp]
call fcn.004ab3d4
test eax, eax
je 0x499a9d
push 0
push str.ProfilesDirectory
lea ecx, [ebp]
call fcn.004ab5bd
mov dword [ebp - 0x14], eax
test eax, eax
je 0x499a9d
push esi
push edi
push eax
call ebx
push dword [ebp - 0x14]
call fcn.00564e3f
push esi
push 0x602a2c
push esi
push edi
call fcn.0059dbd3
push 0xff
lea eax, [ebp + 0x40d]
push 0
push eax
mov byte [ebp + 0x40c], 0
call fcn.0059cb30
add esp, 0x20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x40c]
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push esi
lea eax, [ebp + 0x40c]
push eax
push esi
push edi
call fcn.0059dbd3
xor esi, esi
add esp, 0x10
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.004ac1a5
mov eax, esi
jmp 0x499995
xor esi, esi
jmp 0x499a8a

Function at 0x499d6e
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
push edi
mov edi, ecx
push edi
call fcn.004992b9
pop ecx
test eax, eax
je 0x499db1
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
test eax, eax
je 0x499d8f
xor eax, eax
inc eax
jmp 0x499db3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x499db1
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x499db1
push edi
call esi
test eax, eax
jne 0x499d8a
xor eax, eax
pop edi
pop esi
ret
Function at 0x499dd8
Capabilities:
Delete directory
Set file attributes

Disassembly:
push esi
push edi
mov edi, ecx
push edi
call fcn.004992b9
pop ecx
test eax, eax
je 0x499e1b
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
call esi
test eax, eax
je 0x499df9
xor eax, eax
inc eax
jmp 0x499e1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x499e1b
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x499e1b
push edi
call esi
test eax, eax
jne 0x499df4
xor eax, eax
pop edi
pop esi
ret

Function at 0x49a0df
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x49a0f4
pop esi
ret
mov ecx, esi
call fcn.0049a09c
test eax, eax
je 0x49a114
cmp eax, 1
je 0x49a114
cmp eax, 2
je 0x49a114
mov ecx, esi
call fcn.004992e9
test eax, eax
jne 0x49a120
push 0x607da0
mov ecx, esi
call fcn.00498be1
xor eax, eax
inc eax
pop esi
ret

Function at 0x49a237
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x578
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x578], eax
push 8
mov eax, 0x5e430c
call fcn.0059ca24
mov eax, dword [ebp + 0x588]
mov edi, dword [ebp + 0x584]
mov esi, ecx
lea ecx, [ebp]
mov dword [ebp - 0x14], eax
call fcn.00427139
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea ebx, [esi + 0x400]
push 0
mov ecx, ebx
mov dword [ebp - 0x10], 1
call fcn.005757d6
and dword [esi + 0x414], 0
cmp byte [edi], 0
jne 0x49a2a1
mov edi, 0x5f7710
push edi
push esi
lea ecx, [ebp]
call fcn.00499340
lea eax, [ebp + 0x438]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x49a322
cmp dword [ebp - 0x10], 0
je 0x49a31b
lea eax, [ebp + 0x464]
push eax
call fcn.00498cfc
pop ecx
test eax, eax
jne 0x49a308
lea eax, [ebp + 0x464]
push eax
push esi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.0049933b
test eax, eax
je 0x49a308
mov eax, dword [ebx + 8]
lea ecx, [ebp + 0x464]
push ecx
push eax
mov ecx, ebx
call fcn.00575c79
lea eax, [ebp + 0x438]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x10], eax
jmp 0x49a2c3
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x49a331
mov ecx, dword [esi + 0x408]
mov dword [eax], ecx
mov ecx, esi
call fcn.0049980d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
mov esi, eax
call fcn.0042719c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x578]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x57c
leave
ret 8
Function at 0x49a36d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x578
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x578], eax
push 8
mov eax, 0x5e433c
call fcn.0059ca24
mov eax, dword [ebp + 0x588]
mov edi, dword [ebp + 0x584]
mov esi, ecx
lea ecx, [ebp]
mov dword [ebp - 0x14], eax
call fcn.00427139
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea ebx, [esi + 0x418]
push 0
mov ecx, ebx
mov dword [ebp - 0x10], 1
call fcn.005757d6
and dword [esi + 0x42c], 0
cmp byte [edi], 0
jne 0x49a3d7
mov edi, 0x5f7710
push edi
push esi
lea ecx, [ebp]
call fcn.00499340
lea eax, [ebp + 0x438]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x49a458
cmp dword [ebp - 0x10], 0
je 0x49a451
lea eax, [ebp + 0x464]
push eax
call fcn.00498cfc
pop ecx
test eax, eax
jne 0x49a43e
lea eax, [ebp + 0x464]
push eax
push esi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.0049933b
test eax, eax
jne 0x49a43e
mov eax, dword [ebx + 8]
lea ecx, [ebp + 0x464]
push ecx
push eax
mov ecx, ebx
call fcn.00575c79
lea eax, [ebp + 0x438]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x10], eax
jmp 0x49a3f9
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x49a467
mov ecx, dword [esi + 0x420]
mov dword [eax], ecx
mov ecx, esi
call fcn.0049984c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
mov esi, eax
call fcn.0042719c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x578]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x57c
leave
ret 8