joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a0a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4e0f30]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4e0f30]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4e0f30]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e0f30]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4e0ab4]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x49a0d3
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x49c19c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004075b8
ret

Function at 0x49cd38
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004075b8
ret
Function at 0x49dff8
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x49e096
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4e13d0]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4e13d0]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4e13d0]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4e13d0]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x49e017
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x49e0ac
dec edx
je 0x49e0e1
jmp 0x49e132
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4e13d0]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4e13d0]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x49e132
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4e13d0]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4e13d0]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4e13d0]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49e194
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x49e1b3
add edx, 3
sar edx, 2
test edx, edx
jle 0x49e2c0
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x49e1e9
je 0x49e229
sub ecx, 0x2b
je 0x49e21f
sub ecx, 4
je 0x49e224
dec ecx
sub ecx, 0xa
jb 0x49e212
jmp 0x49e22c
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x49e1fb
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x49e205
jmp 0x49e22c
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x49e22c
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x49e22c
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x49e22c
mov byte [eax], 0x3e
jmp 0x49e22c
mov byte [eax], 0x3f
jmp 0x49e22c
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x49e1cb
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x49e27d
cmp byte [esp + 7], 0xff
jne 0x49e27d
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x49e2b5
cmp dl, 0xff
je 0x49e2b5
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x49e1c2
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4a26ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4a270c
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4a26fa
pop edi
pop esi
pop ebx
ret
Function at 0x4a5368
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4a5371
mov eax, dword [ebp - 4]
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2164], ecx
mov dword [ebp - 0x2160], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040472c
mov eax, dword [ebp - 8]
call fcn.0040472c
xor eax, eax
push ebp
push 0x4a556d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.004092e4
test al, al
je 0x4a5542
mov eax, dword [ebp - 4]
call fcn.00409318
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x215c]
mov eax, dword [ebp - 4]
call fcn.004a46e0
mov byte [ebp - 0x19], al
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.0040932c
xor ecx, ecx
push ebp
push 0x4a5538
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x4a5500
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x12
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x418c44]
call fcn.0041d6cc
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2160]
mov eax, dword [ebp - 0x10]
call fcn.004a4564
mov eax, dword [ebp - 0x2160]
mov edx, 0x4a5588
call fcn.00404688
jne 0x4a5458
call fcn.00403ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5542
mov dword [ebp - 0x18], 0x1fff
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4a5474
cmp eax, 0x1fff
ja 0x4a5480
jmp 0x4a5476
jg 0x4a5480
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x18], eax
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0041d1d4
lea edx, [ebp - 0x2019]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x18]
test edx, edx
jl 0x4a54b2
inc edx
lea eax, [ebp - 0x2019]
xor byte [eax], 0x24
inc eax
dec edx
jne 0x4a54ab
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0041d1d4
lea edx, [ebp - 0x2019]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea eax, [ebp - 0x2164]
push eax
lea ecx, [ebp - 0x10]
mov eax, 0x4a5588
mov edx, dword [ebp - 8]
call fcn.004a45dc
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5507
mov eax, dword [ebp - 0x10]
call fcn.00403468
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5574
lea eax, [ebp - 0x2164]
mov edx, 2
call fcn.004042a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a0
ret
Function at 0x4a5594
Capabilities:
Clear file content
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4a559d
mov eax, dword [ebp - 4]
add esp, 0xfffffda0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040472c
mov eax, dword [ebp - 8]
call fcn.0040472c
xor eax, eax
push ebp
push 0x4a579e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.004092e4
test al, al
je 0x4a5783
mov eax, dword [ebp - 4]
call fcn.00409318
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x2264]
mov eax, dword [ebp - 4]
call fcn.004a46e0
mov byte [ebp - 0x1d], al
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.0040932c
xor ecx, ecx
push ebp
push 0x4a5779
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x4a5741
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x12
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x418c44]
call fcn.0041d6cc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x1fff
mov dword [ebp - 0x1c], 0x106
lea eax, [ebp - 0x2123]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
call fcn.00402e08
mov ecx, 0x4a57b8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004a4450
test al, al
jne 0x4a5688
call fcn.00403ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5783
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 0x1c]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4a56ac
cmp eax, 0x1fff
ja 0x4a56bb
jmp 0x4a56ae
jg 0x4a56bb
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0041d1d4
lea edx, [ebp - 0x201d]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
test edx, edx
jl 0x4a56ed
inc edx
lea eax, [ebp - 0x201d]
xor byte [eax], 0x24
inc eax
dec edx
jne 0x4a56e6
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0041d1d4
lea edx, [ebp - 0x201d]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov edx, dword [ebp - 0x1c]
neg edx
mov cx, 2
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SetEndOfFile
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5748
mov eax, dword [ebp - 0x10]
call fcn.00403468
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a57a5
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a0
ret
Function at 0x4a6a70
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff04
mov esi, edx
mov ebx, eax
push 0
push 0x4a6b70
push 0
push ebx
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6b78
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6b88
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6b98
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6ba4
push 0
push eax
call sub.user32.dll_FindWindowExA
mov edx, esp
push edx
push 0xfa
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov eax, esi
mov edx, esp
mov ecx, 0xfb
call fcn.004044ec
call fcn.004a6a64
test al, al
je 0x4a6b66
push 0
push 0x4a6bac
push 0
push ebx
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6b78
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6bb4
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6bc8
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6bdc
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x4a6bf0
push 0
push eax
call sub.user32.dll_FindWindowExA
mov edx, esp
push edx
push 0xfa
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov eax, esi
mov edx, esp
mov ecx, 0xfb
call fcn.004044ec
add esp, 0xfc
pop esi
pop ebx
ret

Function at 0x4a6c00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040472c
mov eax, dword [ebp - 8]
call fcn.0040472c
xor eax, eax
push ebp
push 0x4a6d07
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x4a6d20
mov edx, dword [ebp - 4]
call fcn.00404588
mov eax, dword [ebp - 0x14c]
call fcn.0040473c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004042d0
cmp esi, 0xffffffff
je 0x4a6cd6
jmp 0x4a6cd2
cmp byte [ebp - 0x11c], 0x2e
je 0x4a6cbf
test byte [ebp - 0x148], 0x10
je 0x4a6cbf
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004044ec
cmp dword [ebp - 0x150], 0
je 0x4a6cd6
mov eax, edi
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004044ec
jmp 0x4a6cd6
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4a6c80
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6d0e
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.004042a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a0
ret
Function at 0x4a85f8
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040472c
mov ebx, 0x4e3dec
xor eax, eax
push ebp
push 0x4a86f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4a870c
call fcn.004042d0
jmp 0x4a8666
lea eax, [ebp - 8]
mov edx, dword [ebx]
movzx edx, byte [edx]
dec edx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00402cec
mov edx, 0x4a8710
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.00402cbc
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004044e0
mov eax, dword [ebx]
call fcn.004092f4
test al, al
jne 0x4a8633
mov eax, esi
mov edx, dword [ebx]
call fcn.004042d0
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4a86a4
mov eax, dword [esi]
call fcn.0040473c
push eax
push 0x4a8714
mov eax, dword [ebp - 4]
call fcn.0040473c
push eax
call sub.mpr.dll_WNetAddConnectionA
test eax, eax
sete bl
jmp 0x4a86d4
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4a8720
call fcn.00404588
mov eax, dword [ebp - 0x10]
call fcn.0040473c
push eax
mov eax, dword [ebx]
call fcn.0040473c
push eax
push 1
call sub.kernel32.dll_DefineDosDeviceA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a86f9
lea eax, [ebp - 0x10]
call fcn.0040427c
lea eax, [ebp - 4]
call fcn.0040427c
ret

Function at 0x4a884c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040472c
mov eax, dword [ebp - 8]
call fcn.0040472c
xor eax, eax
push ebp
push 0x4a88c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004092e4
test al, al
je 0x4a888b
mov eax, dword [ebp - 8]
call fcn.00409448
push 0
mov eax, dword [ebp - 8]
call fcn.0040473c
push eax
mov eax, dword [ebp - 4]
call fcn.0040473c
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a88cc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a0
ret
Function at 0x4a88d4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040472c
xor eax, eax
push ebp
push 0x4a8a3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409620
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 4]
call fcn.00409538
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 4]
call fcn.00404314
mov bl, 1
mov byte [ebp - 5], 0
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
mov ecx, 0x4a8a58
mov edx, dword [ebp - 4]
call fcn.00404588
mov eax, dword [ebp - 0x158]
call fcn.0040473c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4a89e8
jmp 0x4a89e4
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004044ec
mov eax, dword [ebp - 0xc]
call fcn.0040453c
cmp eax, 7
jle 0x4a89d1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00404880
test eax, eax
jne 0x4a89b1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00404880
test eax, eax
je 0x4a89d1
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x20]
mov ecx, 0xe
call fcn.004044ec
cmp dword [ebp - 0x15c], 0
setne byte [ebp - 5]
jmp 0x4a89e8
lea eax, [ebp - 0x150]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4a8973
push esi
call sub.kernel32.dll_FindClose_1
cmp byte [ebp - 5], 0
jne 0x4a8a0c
call fcn.004a6954
push 0
push 0x4a8a5c
push 0x4a8a64
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8a46
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.004042a0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004042a0
lea eax, [ebp - 4]
call fcn.0040427c
ret

Function at 0x4a97e4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffa8
mov esi, edx
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x44
call fcn.00402e08
mov dword [esp + 4], 0x44
mov dword [esp + 0x30], 1
mov word [esp + 0x34], si
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push ebx
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4a983b
xor eax, eax
mov dword [esp], eax
jmp 0x4a9852
push 0xffffffffffffffff
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_WaitForSingleObject
push esp
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esp]
add esp, 0x58
pop esi
pop ebx
ret
Function at 0x4a9924
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a9a76
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x14c]
mov eax, 0x4a9a8c
call fcn.0040e964
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 8]
mov ecx, 0x4a9aa0
call fcn.00404588
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x4a9ab0
mov edx, dword [ebp - 8]
call fcn.00404588
mov eax, dword [ebp - 0x150]
call fcn.0040473c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4a9a45
jmp 0x4a9a3d
cmp byte [ebp - 0x11c], 0x2e
je 0x4a9a2a
test byte [ebp - 0x148], 0x10
jne 0x4a9a2a
lea eax, [ebp - 4]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004044ec
lea edx, [ebp - 0x154]
mov eax, 0x4a9abc
call fcn.004088c8
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00404880
test eax, eax
jne 0x4a9a2a
push dword [ebp - 8]
push 0x4a9acc
push dword [ebp - 4]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.004045fc
mov eax, dword [ebp - 0x158]
call fcn.00409448
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4a99bd
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9a7d
lea eax, [ebp - 0x158]
mov edx, 4
call fcn.004042a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a0
ret

Function at 0x4a9ad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040472c
xor eax, eax
push ebp
push 0x4a9b6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404314
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402e08
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.0040473c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
mov edi, ebx
lea esi, [ebp - 0x44]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9b76
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a0
ret
Function at 0x4a9b80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x204], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040472c
lea edi, [ebp - 0x103]
xor eax, eax
push ebp
push 0x4a9d8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040453c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4a9c03
lea eax, [ebp - 4]
mov edx, 0x4a9da4
call fcn.00404544
push 0
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x4a9d60
push 0xfa
push edi
push esi
call sub.user32.dll_GetClassNameA
push 0xfa
lea eax, [ebp - 0x1fe]
push eax
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x204]
mov edx, edi
mov ecx, 0xfb
call fcn.004044ec
mov eax, dword [ebp - 0x204]
mov edx, 0x4a9db0
call fcn.00404688
je 0x4a9c7f
lea eax, [ebp - 0x208]
mov edx, edi
mov ecx, 0xfb
call fcn.004044ec
mov eax, dword [ebp - 0x208]
mov edx, 0x4a9dc8
call fcn.00404688
jne 0x4a9d4e
lea edx, [ebp - 8]
mov eax, esi
call fcn.004a6a70
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 8]
call fcn.004088c8
mov eax, dword [ebp - 0x20c]
push eax
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004088c8
mov eax, dword [ebp - 0x210]
pop edx
call fcn.00404880
test eax, eax
jne 0x4a9d24
lea eax, [ebp - 0x218]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040479c
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004088c8
mov eax, dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x1fe]
mov ecx, 0xfb
call fcn.004044ec
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.004088c8
mov edx, dword [ebp - 0x21c]
pop eax
call fcn.00404880
test eax, eax
je 0x4a9d4e
mov eax, dword [ebp - 4]
call fcn.0040453c
cmp eax, 3
jg 0x4a9d42
mov eax, dword [ebp - 8]
call fcn.0040453c
cmp eax, 3
jg 0x4a9d42
test bl, bl
je 0x4a9d4e
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x4a9c15
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9d92
lea eax, [ebp - 0x220]
mov edx, 8
call fcn.004042a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a0
ret