joyce8/EMBER2024-capa huggingface dataset:
Function at 0x528ba8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x528bd9
mov ecx, dword [0x562e28]
mov dl, 1
mov eax, dword [0x527aac]
call fcn.0040f0dc
call fcn.00404cfc
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x528c06
mov ecx, dword [0x562d54]
mov dl, 1
mov eax, dword [0x527aac]
call fcn.0040f0dc
call fcn.00404cfc
xor eax, eax
push ebp
push 0x528c82
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00404580
cmp byte [ebp + 8], 0
je 0x528c5e
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00528b10
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.005289f0
jmp 0x528c78
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.005284e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x528c9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x528e80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.005287a0
xor eax, eax
push ebp
push 0x528ff3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x528fdd
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x528ecc
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x528ed6
call fcn.00404da8
jmp 0x528ffa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004204fc
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x528fd2
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x528f85
call sub.wsock32.dll_WSAGetLastError_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x528f72
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404580
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00528e38
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x529008]
cmp dl, byte [eax + 0x28]
je 0x528fd9
call fcn.0040eff4
jmp 0x528fd9
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0042051c
jmp 0x528fd9
cmp edi, ebx
jge 0x528fa1
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0042051c
jmp 0x528ed6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004204fc
cmp edx, dword [esp + 4]
jne 0x528fc1
cmp eax, dword [esp]
pop edx
pop eax
jne 0x528ed6
push ebp
call fcn.00528e38
pop ecx
jmp 0x528fd9
push ebp
call fcn.00528e38
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x528ffa
mov eax, dword [ebp - 4]
call fcn.005287ac
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52900c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52912e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005287a0
xor eax, eax
push ebp
push 0x529111
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x52905c
call fcn.00404da8
jmp 0x529118
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x5290fb
call sub.wsock32.dll_WSAGetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x5290fb
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404580
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x5290fb
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040e7dc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x529148
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x562ff4]
mov dl, 1
mov eax, dword [0x527aac]
call fcn.0040f118
call fcn.00404cfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529118
mov eax, dword [ebp - 4]
call fcn.005287ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529135
lea eax, [ebp - 0x28]
call fcn.004053c8
ret
Function at 0x529194
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5292de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005287a0
xor eax, eax
push ebp
push 0x5292c1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x5291f9
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x5291f9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x5292ab
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x52920c
call fcn.00404da8
jmp 0x5292c8
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x5292ab
call sub.wsock32.dll_WSAGetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x5292ab
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404580
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x5292ab
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040e7dc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x5292f8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x562ff4]
mov dl, 1
mov eax, dword [0x527aac]
call fcn.0040f118
call fcn.00404cfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5292c8
mov eax, dword [ebp - 4]
call fcn.005287ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5292e5
lea eax, [ebp - 0x28]
call fcn.004053c8
ret
Function at 0x52a1ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x52a210
cmp eax, 0
jbe 0x52a319
jmp 0x52a216
jle 0x52a319
mov eax, dword [ebp + 8]
add eax, 0xffffff04
xor ecx, ecx
mov edx, 0xf8
call fcn.00403b48
mov eax, dword [ebp + 8]
lea edx, [eax - 0x13c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x52a319
mov eax, dword [ebp + 8]
cmp word [eax - 0x13c], 0x5a4d
jne 0x52a319
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x100]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x100]
jne 0x52a319
mov eax, dword [ebp + 8]
lea edx, [eax - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x52a319
mov eax, dword [ebp + 8]
cmp dword [eax - 0xfc], 0x4550
jne 0x52a319
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x52a319
mov eax, dword [ebp + 8]
cmp word [eax - 0xf8], 0x14c
jne 0x52a319
mov eax, dword [ebp + 8]
movzx ecx, word [eax - 0xe8]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx - 0xe8]
cmp eax, edx
jne 0x52a319
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x52a968
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xf6]
test ax, ax
jbe 0x52aa48
mov edx, dword [ebp + 8]
movzx eax, ax
dec eax
test eax, eax
jl 0x52aa46
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x52a9de
test eax, 0x40000000
je 0x52a9ca
test eax, 0x80000000
je 0x52a9c5
or edx, 0x40
jmp 0x52aa05
or edx, 0x20
jmp 0x52aa05
test eax, 0x80000000
je 0x52a9d9
or edx, 0x80
jmp 0x52aa05
or edx, 0x10
jmp 0x52aa05
test eax, 0x40000000
je 0x52a9f6
test eax, 0x80000000
je 0x52a9f1
or edx, 4
jmp 0x52aa05
or edx, 2
jmp 0x52aa05
test eax, 0x80000000
je 0x52aa02
or edx, 8
jmp 0x52aa05
or edx, 1
test eax, 0x4000000
je 0x52aa12
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xfffffebc
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8]
push eax
call sub.kernel32.dll_VirtualProtect
inc ebx
dec dword [ebp - 4]
jne 0x52a998
mov dl, 1
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x52d554
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b48
ret

Function at 0x52ef90
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x52f00b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b2fc
mov eax, dword [ebp - 8]
call fcn.00405858
push eax
call sub.IMAGEHLP.DLL_MakeSureDirectoryPathExists
push 0
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00405858
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f012
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x5312bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov byte [ebp - 0x12], 0
xor eax, eax
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jl 0x53139a
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 0
cmp eax, dword [ebp + 8]
jge 0x53139a
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
mov byte [ebp - 0x13], 0xae
movzx ecx, byte [ebp - 0x10]
add byte [ebp - 0x13], cl
xor dl, byte [ebp - 0x13]
lea ecx, [ebx + 2]
movzx esi, dl
shr esi, cl
mov ecx, esi
or cl, byte [ebp - 0x12]
and cl, 0x3f
mov byte [ebp - 0x11], cl
lea ecx, [ebx + 2]
push ecx
mov ecx, 8
pop esi
sub ecx, esi
movzx edx, dl
shl edx, cl
shr edx, 2
and dl, 0x3f
mov byte [ebp - 0x12], dl
add ebx, 2
cmp ebx, 6
jge 0x531352
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
jmp 0x53138e
mov edx, dword [ebp + 8]
dec edx
cmp eax, edx
jge 0x53137a
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
movzx edx, byte [ebp - 0x12]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax + 1], dl
add eax, 2
jmp 0x531388
movzx edx, byte [ebp - 0x11]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
xor ebx, ebx
mov byte [ebp - 0x12], 0
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x5312ec
test ebx, ebx
jle 0x5313ac
movzx edx, byte [ebp - 0x12]
add dl, 0x3c
mov ecx, dword [ebp - 8]
mov byte [ecx + eax], dl
inc eax
mov edx, dword [ebp - 8]
mov byte [edx + eax], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5313bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, 2
xor eax, eax
xor edi, edi
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jl 0x531478
inc edx
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
sub ecx, 0x3c
js 0x53140c
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx]
sub cl, 0x3c
mov byte [ebp - 0xd], cl
jmp 0x531410
xor edi, edi
jmp 0x531478
cmp edi, dword [ebp + 8]
jge 0x531478
lea ecx, [eax + 6]
cmp ecx, 8
jl 0x531454
mov ecx, 6
sub ecx, esi
movzx eax, byte [ebp - 0xd]
and al, 0x3f
movzx eax, al
shr eax, cl
or al, byte [ebp - 0xe]
mov cl, 0xae
mov ebx, edi
add cl, bl
xor al, cl
mov ecx, dword [ebp - 8]
mov byte [ecx + edi], al
inc edi
xor eax, eax
cmp esi, 6
jge 0x53144d
add esi, 2
jmp 0x531454
mov esi, 2
jmp 0x53146e
mov ecx, esi
movzx ebx, byte [ebp - 0xd]
shl bl, cl
and bl, byte [esi + 0x56289a]
mov byte [ebp - 0xe], bl
mov ecx, 8
sub ecx, esi
add eax, ecx
inc edx
dec dword [ebp - 0x14]
jne 0x5313f1
mov eax, dword [ebp - 8]
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5368a4
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x563050]
mov eax, dword [eax]
call fcn.00405858
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0x3d8], esi
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov dword [ebx + 0x3dc], edi
test edi, edi
je 0x5368f9
mov eax, ebx
call fcn.00463004
mov edx, dword [ebx + 0x3dc]
mov dword [edx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x536db0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x536efa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
call fcn.0040b5d8
mov edx, dword [ebp - 0x2c]
mov eax, edi
mov ecx, 0x536f10
call fcn.004056e0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 8]
call fcn.004053c8
xor ebx, ebx
mov esi, 0x41
lea eax, [ebp - 0x30]
mov edx, esi
call fcn.004055b0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
mov ecx, 0x536f1c
call fcn.004056e0
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x536eb4
lea eax, [ebp - 0x34]
mov ecx, 0x536f28
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x34]
call fcn.0040aecc
test al, al
jne 0x536ea3
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
mov eax, dword [0x562c60]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x24]
jne 0x536e87
cmp eax, dword [ebp - 0x28]
jbe 0x536e9f
jmp 0x536e89
jle 0x536e9f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040541c
mov bl, 1
jmp 0x536eb4
cmp dword [ebp - 8], 0
jne 0x536eb4
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
inc esi
cmp esi, 0x5b
jne 0x536e0e
test bl, bl
jne 0x536ed2
cmp dword [ebp - 8], 0
je 0x536ed2
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040541c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536f01
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004053ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x405477
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422490], 0x44
push eax
xor eax, eax
push 0x422490
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054b2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405558
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040580e
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x40558c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423f08], eax
jmp 0x405725
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x4055aa
test eax, eax
je 0x4056d0
test byte [ebp + 0xc], 2
je 0x4056d0
mov esi, 0x421490
push edi
push esi
call fcn.00405c42
test ebx, ebx
je 0x4055c7
push str..
push esi
call fcn.00405c65
jmp 0x4055cd
push edi
call fcn.00405772
cmp byte [edi], 0
jne 0x4055db
cmp byte [0x421490], 0x5c
jne 0x4055e6
push 0x409010
push edi
call fcn.00405c65
push edi
call fcn.00405c58
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4056c6
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405756
cmp byte [eax], 0
je 0x40562c
cmp byte [ebp - 0x18], 0
je 0x40562c
lea esi, [ebp - 0x18]
mov al, byte [esi]
cmp al, 0x2e
jne 0x405647
cmp byte [esi + 1], 0
je 0x4056a5
cmp al, al
jne 0x405647
cmp byte [esi + 1], al
jne 0x405647
cmp byte [esi + 2], 0
je 0x4056a5
push esi
push ebx
call fcn.00405c42
test byte [ebp - 0x148], 0x10
je 0x40566c
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4056a5
push dword [ebp + 0xc]
push edi
call fcn.00405558
jmp 0x4056a5
push edi
call fcn.004058f8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40569d
test byte [ebp + 0xc], 4
je 0x405695
push edi
push 0xfffffffffffffff1
call fcn.00404fab
push 0
push edi
call fcn.0040598f
jmp 0x4056a5
inc dword [0x423f08]
jmp 0x4056a5
push edi
push 0xfffffffffffffff2
call fcn.00404fab
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40560a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x4056d0
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x405725
cmp dword [ebp - 8], esi
jne 0x4056e5
inc dword [0x423f08]
jmp 0x405725
push edi
call fcn.00405f67
test eax, eax
je 0x405725
push edi
call fcn.0040572b
push edi
call fcn.004058f8
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40571d
test byte [ebp + 0xc], 4
je 0x4056dd
push edi
push 0xfffffffffffffff1
call fcn.00404fab
push esi
push edi
call fcn.0040598f
jmp 0x405725
push edi
push 0xffffffffffffffe5
call fcn.00404fab
pop edi
pop esi
leave
ret 8
Function at 0x10002670
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x10195040]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x5c
mov byte [ebp - 0xf], 0x43
mov byte [ebp - 0xe], 0x56
mov byte [ebp - 0xd], 0x46
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x54
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x54
mov byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.1011e200
add esp, 8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
je 0x10002782
push 0
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
push eax
call fcn.10002bca
add esp, 4
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x128], 0
push 0
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x118], 0
je 0x10002782
mov eax, dword [ebp - 0x118]
push eax
call fcn.10001b10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011e2e8
mov esp, ebp
pop ebp
ret

Function at 0x10009c91
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x10009cd6
call fcn.100071fb
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10009cd6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10009cf2
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.10016be1
mov ebx, eax
test edi, edi
je 0x10009cf0
test esi, esi
je 0x10009cf0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10019731
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.100071fb
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10019768
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.10019789
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8