joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401fe1
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x416840
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
test edi, edi
mov ebx, ecx
jle 0x41688f
mov ebp, dword [esp + 0x14]
mov edx, dword [ebx + 0x18]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebp]
push ecx
push edx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x416889
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x41688b
mov ecx, ebx
call fcn.00401e5b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
add esi, eax
cmp esi, edi
jl 0x416854
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8

Function at 0x4024e6
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket

Disassembly:
jmp 0x416b70
sub esp, 0x18
mov eax, dword [0x4f1d14]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
push 6
push 1
mov esi, ecx
push 2
mov byte [esi + 0x20], 0
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
jne 0x416bbb
mov edi, dword [esi]
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov eax, dword [edi + 4]
mov ecx, esi
call eax
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0045006d
add esp, 0x18
ret
movzx ecx, word [esi + 0x14]
push ecx
mov word [esp + 0x10], 2
call sub.WSOCK32.dll_htons
mov edx, dword [esi + 0x10]
push edx
mov word [esp + 0x12], ax
call sub.WSOCK32.dll_htonl
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0x14], 1
call sub.WSOCK32.dll_ioctlsocket
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x18]
push 0x10
push 0x401
push edx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x416c3b
mov edi, dword [esi]
call sub.WSOCK32.dll_WSAGetLastError
mov edx, dword [edi + 4]
push eax
mov ecx, esi
call edx
mov ecx, esi
call fcn.00401e5b
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0045006d
add esp, 0x18
ret
mov ecx, dword [esi + 0x18]
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x416c5c
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x416c12
mov eax, dword [esi + 0xc]
push 0
push 0x2710
push 0
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.0045006d
add esp, 0x18
ret
Function at 0x4146f0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48944b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4f1d14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x41482a
cmp dword [ebp + 8], 0
je 0x41482a
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
je 0x41482a
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_inet_addr
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x414778
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x414778
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebp - 0x10], eax
push 0x230
call fcn.0045097a
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x4147b6
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00401cf3
mov dword [ebp - 0x2c], eax
jmp 0x4147bd
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
je 0x4147eb
mov ecx, dword [ebp - 0x14]
call fcn.00401dac
movzx edx, al
test edx, edx
je 0x4147eb
mov al, 1
jmp 0x41482c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
je 0x414823
mov ecx, dword [ebp - 0x24]
call fcn.00401dbb
mov edx, 1
and edx, 1
je 0x41481b
mov eax, dword [ebp - 0x24]
push eax
call fcn.00450591
add esp, 4
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
jmp 0x41482a
mov dword [ebp - 0x30], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x416b70
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
jmp 0x416b70
sub esp, 0x18
mov eax, dword [0x4f1d14]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
push 6
push 1
mov esi, ecx
push 2
mov byte [esi + 0x20], 0
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
jne 0x416bbb
mov edi, dword [esi]
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov eax, dword [edi + 4]
mov ecx, esi
call eax
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0045006d
add esp, 0x18
ret
movzx ecx, word [esi + 0x14]
push ecx
mov word [esp + 0x10], 2
call sub.WSOCK32.dll_htons
mov edx, dword [esi + 0x10]
push edx
mov word [esp + 0x12], ax
call sub.WSOCK32.dll_htonl
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0x14], 1
call sub.WSOCK32.dll_ioctlsocket
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x18]
push 0x10
push 0x401
push edx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x416c3b
mov edi, dword [esi]
call sub.WSOCK32.dll_WSAGetLastError
mov edx, dword [edi + 4]
push eax
mov ecx, esi
call edx
mov ecx, esi
call fcn.00401e5b
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0045006d
add esp, 0x18
ret
mov ecx, dword [esi + 0x18]
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x416c5c
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x416c12
mov eax, dword [esi + 0xc]
push 0
push 0x2710
push 0
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.0045006d
add esp, 0x18
ret

Function at 0x416da0
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x416da0
sub esp, 0x1bc
mov eax, dword [0x4f1d14]
xor eax, esp
mov dword [esp + 0x1b8], eax
mov eax, dword [esp + 0x1c0]
mov dword [0x4f8340], eax
mov eax, dword [0x4f833c]
add eax, 1
cmp eax, 1
mov dword [0x4f833c], eax
jne 0x416e4d
lea eax, [esp + 0x28]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x416e2f
mov ecx, dword [0x4f8340]
lea edx, [esp]
push edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x401d20
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], str.CasinoNetClass
call dword [0x4f79e0]
test ax, ax
jne 0x416e4d
call sub.WSOCK32.dll_WSACleanup
sub dword [0x4f833c], 1
xor al, al
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.0045006d
add esp, 0x1bc
ret
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
mov al, 1
call fcn.0045006d
add esp, 0x1bc
ret
Function at 0x4198b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x4198ce
cmp dword [ebp + 0xc], 0
jl 0x4198ce
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0xffffffff
jne 0x4198d3
or eax, 0xffffffff
jmp 0x419924
cmp dword [ebp + 0xc], 0
jne 0x4198dd
xor eax, eax
jmp 0x419924
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
and edx, 4
je 0x4198fb
push 2
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x419921
mov eax, dword [ebp - 4]
jmp 0x419924
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
Function at 0x445b50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x4f8820
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x445bc9
cmp dword [ebp - 4], 0x104
jge 0x445bc9
push 0x4f8820
push 0
push str.unicows
push 0x4f8820
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
je 0x445bc9
mov eax, 0x4f8820
add eax, 0xffffffff
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 1]
mov byte [ebp - 9], dl
add dword [ebp - 8], 1
cmp byte [ebp - 9], 0
jne 0x445b9f
mov edi, dword [ebp - 8]
mov eax, dword [str..dll]
mov dword [edi], eax
mov cl, byte [0x498cf4]
mov byte [edi + 4], cl
mov al, 1
jmp 0x445bcb
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x446a80
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c4c9
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x4f1d14]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x20]
call fcn.00401a87
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401005
push 0x498da4
lea ecx, [ebp - 0x290]
call fcn.00401da7
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0040245a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x290]
call fcn.00401a3c
lea ecx, [ebp - 0x20]
call fcn.0040136b
mov dword [ebp - 0x2bc], eax
lea edx, [ebp - 0x27c]
push edx
mov eax, dword [ebp - 0x2bc]
push eax
call dword [0x4f4c2c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x446c40
mov ecx, dword [ebp - 0x27c]
and ecx, 0x10
je 0x446bb0
push 0x492178
lea edx, [ebp - 0x250]
push edx
call dword [0x4f6388]
test eax, eax
je 0x446bae
push 0x492170
lea eax, [ebp - 0x250]
push eax
call dword [0x4f6388]
test eax, eax
je 0x446bae
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401005
lea edx, [ebp - 0x250]
push edx
lea ecx, [ebp - 0x2a4]
call fcn.00401055
mov byte [ebp - 4], 2
push 1
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040245a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a4]
call fcn.00401a3c
lea ecx, [ebp - 0x20]
push ecx
call fcn.004017b7
add esp, 4
jmp 0x446c24
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
call fcn.00401005
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.00401055
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0x2b8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0040245a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.00401a3c
lea ecx, [ebp - 0x20]
call fcn.0040136b
mov dword [ebp - 0x2c0], eax
mov edx, dword [ebp - 0x2c0]
push edx
call dword [0x4f4b28]
test eax, eax
jne 0x446c24
push 4
push 0
lea ecx, [ebp - 0x20]
call fcn.0040136b
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [0x4f4d30]
test eax, eax
jne 0x446c3b
jmp 0x446c40
jmp 0x446b1f
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [ebp + 8]
call fcn.0040136b
push eax
call dword [0x4f5e74]
test eax, eax
jne 0x446c70
push 4
push 0
mov ecx, dword [ebp + 8]
call fcn.0040136b
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0040192e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0045006d
mov esp, ebp
pop ebp
ret
Function at 0x4481d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4f1d14]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 1
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 6
jae 0x448248
xor eax, eax
jmp 0x448364
cmp dword [ebp + 8], 0
jne 0x448258
mov eax, 0x57
jmp 0x448364
lea eax, [ebp - 0x48]
push eax
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 4
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x448287
jmp 0x448331
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4482b2
jmp 0x448331
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x3c], 0x1f01ff
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x3c]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x448316
jmp 0x448331
push 0
mov ecx, dword [ebp - 0x44]
push ecx
push 0
push 0
push 4
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x1c], 0
je 0x448341
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x48], 0
je 0x448351
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 0x44], 0
je 0x448361
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045006d
mov esp, ebp
pop ebp
ret
Function at 0x44ca64
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x4f1d14]
mov dword [ebp - 4], eax
mov eax, dword [0x4e4c68]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x44ca93
call eax
cmp eax, ebx
mov dword [ebp - 0x528], eax
jne 0x44cc20
push dword [0x4f0c30]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x528], eax
je 0x44cc20
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jne 0x44cacb
mov byte [ebp - 0x41c], bl
push esi
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
jne 0x44cae3
mov byte [ebp - 0x524], bl
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x528]
call edi
test eax, eax
jne 0x44cb04
mov byte [ebp - 0x10c], bl
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call edi
test eax, eax
pop edi
jne 0x44cb21
mov byte [ebp - 0x214], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0044c9c7
lea eax, [ebp - 0x52c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44cb44
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x314]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x44cb58
sub eax, esi
add eax, ecx
mov byte [ebp + eax - 0x213], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0044c9c7
lea eax, [ebp - 0x52c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x44cb8d
sub eax, ecx
lea ecx, [ebp - 0x314]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x44cb9f
sub ecx, esi
add ecx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x524]
push eax
mov byte [ebp + ecx - 0x10b], bl
call fcn.0044c8f8
test eax, eax
pop esi
jne 0x44cbe0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.0044c8f8
test eax, eax
jne 0x44cc0e
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0044c8f8
test eax, eax
jne 0x44cc20
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0044c8f8
test eax, eax
je 0x44cc20
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [ebp - 0x528], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x528]
pop ebx
call fcn.0045006d
leave
ret
Function at 0x44eda0
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
mov ecx, 0x412
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov esi, 0x4f0cc8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x44edc6
mov ecx, 0x48
mov edi, dword [esp + 0x20]
push ebp
mov eax, edi
mov ebp, ebx
lea esi, [ecx + edi]
mov dword [esp + 0x1c], 0x12
xor ecx, ecx
mov cl, byte [eax]
inc eax
cmp eax, esi
jb 0x44ede5
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x44edf5
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x44ee05
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x44ee15
mov eax, edi
mov edx, dword [ebp]
add ebp, 4
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp - 4], edx
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x44edda
xor eax, eax
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 9
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.0044ee90
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x44ee3d
lea esi, [ebx + 0x48]
mov edi, 0x200
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.0044ee90
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x44ee66
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x45006d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f1d14]
jne 0x450077
repz ret
jmp fcn.00455d48

Function at 0x4546bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4546e9
call fcn.0045331c
mov dword [eax], esi
call fcn.00453309
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0045b53e
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4546c5
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x454718
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.0045332f
pop ecx
call fcn.00453309
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x45473f
test al, 1
je 0x45473f
test byte [esp + 0xc], 2
je 0x45473f
call fcn.0045331c
mov dword [eax], 5
call fcn.00453309
mov dword [eax], 0xd
jmp 0x45470f
xor eax, eax
pop esi
ret
Function at 0x10028180
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100281a4
push 1
push 0x4d2f
push 0x133a
call fcn.10028218
add esp, 0xc
jmp 0x10028214
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002820a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100281ee
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10028208
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10017a5d
and dword [eax], 0
jmp 0x100281e3
jmp 0x10028214
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esp, ebp
pop ebp
ret
Function at 0x1002b8c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002b91c
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.1002cd4c
add esp, 0x20
jmp 0x1002b992
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002b947
push 0x3d7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1002b992
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002b975
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1002b992
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.10017a5d
mov dword [eax], 0x2d5e
jmp 0x1002b96a
mov esp, ebp
pop ebp
ret
Function at 0x10031ba1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10031bcd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
call fcn.10031c0b
add esp, 0xc
jmp 0x10031c07
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10031bf8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10031bf6
push 0x3d7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10031c07
push 0
push 0x16bc
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esp, ebp
pop ebp
ret
Function at 0x100371ea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10037265
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10037224
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10037263
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10017a5d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 1
jmp 0x10037298
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
push dword [ebp - 0x34]
push 0x7d4b
push dword [ebp - 0x38]
call fcn.1002b6b6
add esp, 0x18
mov esp, ebp
pop ebp
ret