joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10039224]
xor eax, esp
mov dword [esp + 0x208], eax
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
jge 0x1000131f
test eax, eax
jle 0x1000130f
cmp word [esp + eax*2 - 2], 0x5c
lea eax, [esp + eax*2 - 2]
jne 0x1000130f
mov word [eax], 0
push 2
lea ecx, [esp + 4]
push ecx
push ebx
call fcn.10001120
add esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor esi, esi
mov eax, str._n_b__
mov edi, edi
mov edx, dword [eax]
push 0
push edx
lea eax, [esp + 0x10]
push eax
push 0
call edi
cmp word [esp + 8], 0
je 0x10001356
push 2
lea ecx, [esp + 0xc]
push ecx
push ebx
call fcn.10001120
add esp, 0xc
add esi, 1
cmp dword [esi*4 + str._n_b__], 0
lea eax, [esi*4 + str._n_b__]
mov word [esp + 8], 0
jne 0x10001330
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.100291c0
add esp, 0x20c
ret

Function at 0x100014b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x434
mov eax, dword [0x10039224]
xor eax, esp
mov dword [esp + 0x430], eax
push esi
mov esi, dword [esp + 0x43c]
push 0x30
lea eax, [esp + 8]
push 0
push eax
call sub.MOZCRT19.dll_memset
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.MOZCRT19.dll__stat64i32]
add esp, 0x14
test eax, eax
jl 0x10001592
push edi
lea edx, [esp + 8]
push 0x30
push edx
call fcn.1000c2e0
push 0x1002a4f8
push esi
call dword [sym.imp.MOZCRT19.dll_fopen]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10001577
push ebx
mov ebx, dword [sym.imp.MOZCRT19.dll_fread]
push edi
push 0x400
lea eax, [esp + 0x44]
push 1
push eax
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000156c
lea ecx, [esp + 0x3c]
push esi
push ecx
call fcn.1000c2e0
mov eax, dword [0x10039248]
add eax, esi
add esp, 8
cmp eax, dword [section..data]
mov dword [0x10039248], eax
ja 0x1000156c
push edi
push 0x400
lea edx, [esp + 0x44]
push 1
push edx
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10001532
push edi
call dword [sym.imp.MOZCRT19.dll_fclose]
add esp, 4
pop ebx
lea eax, [esp + 0x38]
push 0x14
push eax
call fcn.10001020
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.1000c2e0
add esp, 0x10
pop edi
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.100291c0
add esp, 0x434
ret
Function at 0x10001740
Capabilities:
Get disk information
Get disk size
Get hostname
Get memory capacity

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x10039224]
xor eax, esp
mov dword [esp + 0x1c4], eax
lea eax, [esp + 0x44]
push 0x14
push eax
call fcn.10001020
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.1000c2e0
add esp, 0x10
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esp + 0x24]
push 0x20
push eax
call fcn.1000c2e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea ecx, [esp]
push 4
push ecx
mov dword [esp + 8], eax
call fcn.1000c2e0
add esp, 8
lea edx, [esp]
push edx
lea eax, [esp + 0x48]
push eax
mov dword [esp + 8], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x100017d4
mov ecx, dword [esp]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.1000c2e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 4
push eax
call fcn.1000c2e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp]
push 4
push ecx
mov dword [esp + 8], eax
call fcn.1000c2e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp]
push 4
push edx
mov dword [esp + 8], eax
call fcn.1000c2e0
add esp, 8
push pe_nt_image_headers32
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push 0x80
lea ecx, [esp + 0x15c]
push ecx
push 0
mov byte [esp + 0x164], 0
mov byte [esp + 0x64], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 0x144]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10001862
sub eax, edx
push eax
lea edx, [esp + 0x148]
push edx
call fcn.1000c2e0
lea eax, [esp + 0x28]
push 4
push eax
call fcn.1000c2e0
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.1000c2e0
lea edx, [esp + 0x34]
push 4
push edx
call fcn.1000c2e0
lea eax, [esp + 0x64]
add esp, 0x20
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100018b0
sub eax, edx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.1000c2e0
add esp, 8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x1000191c
lea edx, [esp + 4]
push 4
push edx
call fcn.1000c2e0
lea eax, [esp + 0x10]
push 4
push eax
call fcn.1000c2e0
lea ecx, [esp + 0x1c]
push 4
push ecx
call fcn.1000c2e0
lea edx, [esp + 0x2c]
push 4
push edx
call fcn.1000c2e0
add esp, 0x20
cmp dword [0x10039240], 0
jne 0x1000192a
call fcn.100016c0
lea eax, [esp + 0x44]
push 0x14
push eax
call fcn.10001020
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.1000c2e0
mov ecx, dword [esp + 0x1d4]
add esp, 0x10
xor ecx, esp
call fcn.100291c0
add esp, 0x1c8
ret
Function at 0x10001960
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebp, ebp
push str.advapi32.dll
mov dword [0x10039240], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, ebp
jne 0x10001991
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
call fcn.100015b0
pop ebp
pop ebx
add esp, 8
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SystemFunction036
push ebx
call esi
cmp eax, ebp
je 0x100019e9
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push ebp
push esi
call eax
test al, al
je 0x100019ce
push ebx
mov dword [0x10039240], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
mov eax, ebp
mov ecx, esi
call fcn.100015b0
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
push edi
push str.CryptAcquireContextA
push ebx
call esi
push str.CryptReleaseContext
push ebx
mov edi, eax
call esi
push str.CryptGenRandom
push ebx
mov dword [esp + 0x1c], eax
call esi
test edi, edi
mov esi, eax
je 0x10001a62
cmp dword [esp + 0x14], ebp
je 0x10001a62
test esi, esi
je 0x10001a62
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
mov edi, dword [esp + 0x20]
je 0x10001a5e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push ecx
push edi
push edx
call esi
test eax, eax
je 0x10001a4f
mov ebp, edi
mov dword [0x10039240], 1
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [esp + 0x1c]
test ebp, ebp
jne 0x10001a71
mov eax, edi
jmp 0x10001a66
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
call fcn.100015b0
mov ebp, eax
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret

Function at 0x10002c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
invalid
invalid
invalid

Function at 0x10006b50
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x130
mov eax, dword [0x10039224]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
mov ebx, dword [esp + 0x138]
push ebp
mov ebp, dword [esp + 0x140]
push esi
push edi
push 0x128
lea eax, [esp + 0x18]
push 0
push eax
call sub.MOZCRT19.dll_memset
mov ecx, 8
mov esi, 0x1002a908
lea edi, [esp + 0x120]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x158]
push ecx
lea edx, [esp + 0x24]
push ebp
push edx
call fcn.10006990
push 0x20
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ebx
push ecx
call fcn.10006a50
mov ecx, dword [esp + 0x164]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100291c0
add esp, 0x130
ret
Function at 0x100291c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10039224]
jne 0x100291ca
repz ret
jmp fcn.100296a0
Function at 0x401fa0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x416a74]
push esi
mov esi, ecx
test eax, eax
je 0x401fcd
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x416a74], 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x416a74], eax
mov eax, 2
mov word [ebp - 0x14], ax
mov eax, dword [0x416a68]
mov dword [ebp - 0x10], eax
movzx eax, word [0x416a6c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x416a74]
call dword [sym.imp.WS2_32.dll_connect]
push 0x23
push 0x8001
push esi
push dword [0x416a74]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00403002
mov esp, ebp
pop ebp
ret

Function at 0x402040
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, bx
movzx esi, ax
push edi
add esi, 0x10
mov dword [ebp - 8], edx
push esi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
call fcn.00405834
mov edi, eax
add esp, 4
test edi, edi
je 0x402187
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0xffffffffffffffff
mov word [edi + 2], ax
call dword [sym.imp.WS2_32.dll_ntohl]
push 0
mov dword [edi + 4], eax
mov word [edi + 8], 1
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [edi + 0xa], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0xc], ax
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push ebx
push dword [ebp - 8]
mov word [edi + 0xe], ax
lea eax, [edi + 0x10]
push eax
call fcn.00404860
lea edx, [esi + 0xa]
mov ecx, 8
mov eax, edx
and eax, 7
sub ecx, eax
test eax, eax
cmove ecx, eax
lea eax, [ecx + edx]
mov dword [ebp + 8], eax
add eax, 0x12
push eax
call fcn.00405834
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x402187
lea eax, [ebp + 8]
mov edx, esi
push eax
lea ecx, [ebx + 0x12]
push ecx
push ecx
mov ecx, edi
call fcn.00401140
mov esi, dword [ebp + 8]
push edi
add esi, 0x12
call fcn.00405819
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_htonl]
push 0x74
mov dword [ebx], eax
call dword [sym.imp.WS2_32.dll_ntohs]
push 0
mov word [ebx + 4], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push 0
mov word [ebx + 6], ax
call edi
push 0
mov dword [ebx + 8], eax
call edi
mov dword [ebx + 0xc], eax
mov edi, ebx
mov word [ebx + 0x10], 1
test esi, esi
jle 0x40217e
push 0
push esi
push edi
push dword [0x416a74]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x40217e
sub esi, eax
add edi, eax
test esi, esi
jg 0x402162
push ebx
call fcn.00405819
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402370
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040def0
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
mov dword [ebp - 0x100c], ecx
sub eax, 1
jne 0x402576
push ebx
push esi
push eax
lea ebx, [ebp - 0x1004]
push 0x1000
mov eax, ebx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x402574
mov ecx, dword [0x416a5c]
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
push edi
test ecx, ecx
je 0x402506
cmp dword [0x416a64], 4
jae 0x402425
mov ebx, dword [0x416a64]
lea eax, [ebp - 0x1004]
mov edi, 4
sub edi, ebx
cmp esi, edi
cmovl edi, esi
push edi
push eax
lea eax, [ebx + ecx]
push eax
call fcn.00404860
add ebx, edi
add esp, 0xc
mov dword [0x416a64], ebx
cmp ebx, 4
jb 0x402573
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
lea ebx, [ebp - 0x1004]
mov ecx, dword [0x416a5c]
add ebx, edi
sub esi, edi
push dword [ecx]
call eax
mov edx, dword [0x416a64]
mov ecx, eax
sub eax, edx
mov dword [ebp - 0x1010], ecx
mov dword [ebp - 0x1008], eax
cmp ecx, dword [0x416a60]
jle 0x40247a
push ecx
push dword [0x416a5c]
mov dword [0x416a60], ecx
call fcn.0040580e
mov edi, eax
add esp, 8
test edi, edi
je 0x402573
mov eax, dword [ebp - 0x1008]
mov edx, dword [0x416a64]
mov dword [0x416a5c], edi
jmp 0x402480
mov edi, dword [0x416a5c]
test eax, eax
js 0x4024e0
cmp esi, eax
cmovl eax, esi
push eax
mov dword [ebp - 0x1008], eax
lea eax, [edx + edi]
push ebx
push eax
call fcn.00404860
mov ecx, dword [0x416a64]
add esp, 0xc
add ecx, dword [ebp - 0x1008]
mov eax, dword [ebp - 0x1010]
mov dword [0x416a64], ecx
cmp ecx, eax
jl 0x402573
mov ecx, dword [ebp - 0x100c]
mov edx, edi
push eax
call fcn.00402190
add ebx, dword [ebp - 0x1008]
add esp, 4
sub esi, dword [ebp - 0x1008]
mov edi, dword [0x416a5c]
push edi
call fcn.00405819
add esp, 4
mov dword [0x416a5c], 0
mov dword [0x416a64], 0
test esi, esi
jle 0x402573
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
cmp esi, 4
jae 0x402512
mov edi, 4
jmp 0x402518
push dword [ebx]
call eax
mov edi, eax
push edi
cmp edi, esi
jg 0x40254b
mov ecx, dword [ebp - 0x100c]
mov edx, ebx
call fcn.00402190
mov eax, dword [sym.imp.WS2_32.dll_ntohl]
sub esi, edi
add esp, 4
add ebx, edi
test esi, esi
jg 0x402506
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403002
mov esp, ebp
pop ebp
ret
mov dword [0x416a60], edi
call fcn.00405834
add esp, 4
test eax, eax
je 0x402573
push esi
push ebx
push eax
mov dword [0x416a5c], eax
call fcn.00404860
add esp, 0xc
mov dword [0x416a64], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403002
mov esp, ebp
pop ebp
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x48af30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
push edi
jmp 0x48af4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48af51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48af40
mov eax, 1
add ebx, ebx
jne 0x48af63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48af58
jne 0x48af74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48af58
xor ecx, ecx
sub eax, 3
jb 0x48af88
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48affa
mov ebp, eax
add ebx, ebx
jne 0x48af93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x48afa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x48afc4
inc ecx
add ebx, ebx
jne 0x48afb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48afa5
jne 0x48afc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48afa5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48afe4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48afd5
jmp 0x48af46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48afe4
add edi, ecx
jmp 0x48af46
pop esi
mov edi, esi
mov ecx, 0x5fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48b002
cmp byte [edi], 9
jne 0x48b002
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48b007
lea edi, [esi + 0x88000]
mov eax, dword [edi]
or eax, eax
je 0x48b076
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8b3f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8b43c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48b034
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8b444]
or eax, eax
je 0x48b070
mov dword [ebx], eax
add ebx, 4
jmp 0x48b051
call dword [esi + 0x8b440]
mov ebp, dword [esi + 0x8b448]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48b0aa
sub esp, 0xffffff80
jmp 0x402da0
Function at 0x401229
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, 0x104
push esi
call fcn.00402d80
pop ecx
push esi
push eax
pop edi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.00402d80
push edi
mov dword [ebp - 8], eax
call fcn.00401d50
mov ebx, eax
push ebx
call fcn.00402d80
mov esi, eax
add esp, 0xc
sub eax, eax
test ebx, ebx
mov dword [ebp - 4], esi
jle 0x40128b
push edi
pop ecx
sub esi, edi
mov dl, byte [ecx]
cmp dl, 0x2e
je 0x401284
inc eax
mov byte [esi + ecx], dl
inc ecx
cmp eax, ebx
jl 0x401272
jmp 0x40128b
mov ecx, dword [ebp - 4]
mov byte [ecx + eax], 0
push dword [ebp - 4]
push str._s.cab
push dword [ebp - 8]
call fcn.00401cb9
add esp, 0xc
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WinExec]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
leave
ret

Function at 0x4012b4
Capabilities:
Copy file
Delete file
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x12c
mov eax, dword [0x4110fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x4348f4]
push ecx
pop ebx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push ebx
mov dword [ebp - 0x118], eax
call edi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
call ebx
lea ecx, [ebp - 0x12c]
push ecx
push esi
lea ecx, [ebp - 0x124]
push ecx
push eax
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push dword [0x4348f4]
lea eax, [ebp - 0x110]
push eax
mov dword [0x4348f8], eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4013d6
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x114]
call fcn.00401000
push dword [ebp - 0x114]
call fcn.00401b21
add esp, 0xc
push esi
push esi
push 3
push esi
push esi
push 0x100
push dword [0x4348f4]
call ebx
push eax
pop ebx
lea eax, [ebp - 0x12c]
push eax
push esi
lea eax, [ebp - 0x124]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x118]
push dword [0x4348f4]
call edi
push 2
push dword [ebp - 0x114]
call edi
sub eax, eax
inc eax
jmp 0x4013d8
sub eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401caa
leave
ret
Function at 0x4013e7
Capabilities:
Copy file
Enumerate files on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x4110fc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov esi, str..exe
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x11c]
sub ebx, ebx
push str._s_s
push eax
mov dword [ebp - 0x264], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x27c], ebx
call fcn.00401cb9
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x278], eax
jne 0x401465
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
sub eax, eax
jmp 0x4015e4
mov esi, 0x104
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push ebx
mov edi, eax
push 0x6d
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x280]
push eax
push 1
lea eax, [ebp - 0x25d]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x25d], 0x30
je 0x40159c
push esi
call fcn.00402d80
pop ecx
push esi
mov dword [ebp - 0x268], eax
call fcn.00402d80
push eax
pop edi
pop ecx
lea eax, [ebp - 0x230]
push eax
call fcn.00401d50
pop ecx
push eax
pop ebx
push ebx
call fcn.00402d80
pop ecx
sub ecx, ecx
test ebx, ebx
mov dword [ebp - 0x274], eax
jle 0x401530
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x230]
sub dword [ebp - 0x26c], eax
mov al, byte [ebp + ecx - 0x230]
cmp al, 0x2e
je 0x401526
mov edx, dword [ebp - 0x26c]
add edx, ecx
inc ecx
cmp ecx, ebx
mov byte [ebp + edx - 0x230], al
jl 0x401505
jmp 0x401530
mov eax, dword [ebp - 0x274]
mov byte [eax + ecx], 0
push dword [ebp - 0x274]
push dword [ebp - 0x270]
push str._s_s.cab
push esi
push dword [ebp - 0x268]
call fcn.00401d34
add esp, 0x14
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x270]
push str._s_s
push esi
push edi
call fcn.00401d34
add esp, 0x14
push 1
push dword [ebp - 0x268]
mov dword [0x4348f4], edi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40159a
mov ecx, dword [ebp - 0x268]
call fcn.004012b4
test eax, eax
je 0x40159a
inc dword [ebp - 0x264]
sub ebx, ebx
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
or eax, eax
je 0x4015bc
cmp dword [ebp - 0x264], 2
jne 0x4015d2
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x27c], 1
cmp dword [ebp - 0x27c], ebx
je 0x40146a
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401caa
leave
ret