joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4bec1b99
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3bdb7ff0
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x409400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xb2006108
mov ebp, 0x2433
push ebx
push ds
pop ebp
adc byte [ecx], ch
push edi
xor esp, ebx
mov byte [0x3f845], al
rol dword [eax], 1
test bl, 0xe4
mov dword [ebp - 4], edi
je 0x409403
invalid
Function at 0x42b93c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x503ea0
cmp dword [edi], 0
jne 0x42b9b8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x503e9c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4fcecc
mov ecx, 2
call fcn.004031d0
mov edx, 0x42b914
lea eax, [esi + 5]
call fcn.0042b934
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042b934
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42b98d
mov dword [0x503e9c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42f5e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42f5e6
ret
Function at 0x479408
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4795b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x479596
mov dl, 1
mov eax, dword [0x421184]
call fcn.00425c14
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.00406448
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x479585
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00468fc0
test al, al
je 0x479578
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4795c4
lea eax, [ebp - 0x394]
call fcn.0040e304
push eax
push 0x80000002
call fcn.004093d0
test eax, eax
jne 0x479578
xor eax, eax
push ebp
push 0x479571
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x479634
mov eax, dword [ebp - 0xc]
push eax
call fcn.004093e0
test eax, eax
jne 0x47955a
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406630
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x47955a
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479578
mov eax, dword [ebp - 0xc]
push eax
call fcn.00409398
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x47947b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.00425a00
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4795bc
lea eax, [ebp - 0x3a0]
call fcn.00406438
ret

Function at 0x479ff4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x504178]
cmp byte [eax + 0xa9], 0
jne 0x47a066
cmp dword [0x504190], 0
jne 0x47a026
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4fdd94]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x504190], eax
cmp dword [0x50418c], 0
jne 0x47a041
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x50418c], eax
cmp dword [0x504194], 0
jne 0x47a066
push esp
push 0
push 0
mov eax, dword [0x4fdd90]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x504194], eax
pop edx
ret
Function at 0x47a27c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x47a293
add esp, 0xfffffff0
call fcn.004044d0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042a860
mov eax, dword [0x4fe938]
cmp byte [eax], 0
jne 0x47a2c0
push 0
call fcn.0040a418
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4fec8c]
cmp word [eax + 2], 0
jne 0x47a2da
mov eax, dword [0x4fec8c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047c238
mov eax, dword [0x4feda8]
cmp word [eax + 2], 0
jne 0x47a2f4
mov eax, dword [0x4feda8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047c448
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x42eb98]
call fcn.00430618
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x47c8cc
mov dl, 1
mov eax, dword [0x420d0c]
call fcn.00404068
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x420d0c]
call fcn.00404068
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x42f3f0]
call fcn.00436820
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x47a4d0
mov eax, dword [0x4feb08]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00436c24
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x47cb7c
mov dl, 1
mov eax, dword [0x420d0c]
call fcn.00404068
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4feb08]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040e13c
test eax, eax
je 0x47a402
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040decc
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040e124
test eax, eax
je 0x47a41a
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406630
push ebx
push 0x47bc08
call fcn.00470948
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x4fe938]
cmp byte [eax], 0
jne 0x47a46b
mov eax, ebx
call fcn.0047a644
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.0047cda4
mov eax, ebx
call fcn.0047d968
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47a4c8
call fcn.00404528
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f938
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x4fef70]
cmp dword [eax], 2
je 0x47f955
mov byte [ebp - 1], 1
jmp 0x47fb23
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x4fddd4
call fcn.00409358
test eax, eax
je 0x47fb23
xor eax, eax
push ebp
push 0x47fb1c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x47f9b7
push 0x47fb30
push 0x47fb5c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409600
mov ebx, eax
test ebx, ebx
je 0x47f9de
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x47fb05
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x47fb05
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call fcn.00409390
test eax, eax
jne 0x47fa2f
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x47fa10
call fcn.00404b68
jmp 0x47fb23
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call fcn.00409388
test eax, eax
jne 0x47fa2f
call fcn.00404b68
jmp 0x47fb23
xor eax, eax
push ebp
push 0x47fafe
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call fcn.00409370
test eax, eax
jne 0x47fa72
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x47fa72
call fcn.00404b68
call fcn.00404b68
jmp 0x47fb23
mov eax, dword [ebp - 0x14]
call fcn.00403018
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call fcn.00409370
test eax, eax
jne 0x47faa4
call fcn.00404b68
call fcn.00404b68
jmp 0x47fb23
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x47fadf
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00409360
test eax, eax
je 0x47fadb
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x47fadb
mov byte [ebp - 1], 1
jmp 0x47fadf
inc ebx
dec esi
jne 0x47fab1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fb05
mov eax, dword [ebp - 0x18]
call fcn.00403034
mov eax, dword [ebp - 0x10]
push eax
call fcn.004093f0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fb23
mov eax, dword [ebp - 8]
push eax
call fcn.00409368
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4881e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x488394
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.00486e34
pop ecx
test al, al
jne 0x48822b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.004884c8
xor ebx, ebx
jmp 0x488394
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x488249
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.004884c8
xor ebx, ebx
jmp 0x488394
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.0049ded8
test eax, eax
jne 0x488280
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.004884c8
xor ebx, ebx
jmp 0x488394
test byte [edi + 4], 1
je 0x48838d
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.00486e34
pop ecx
test al, al
jne 0x4882b4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.004884c8
xor ebx, ebx
jmp 0x488394
mov edx, dword [0x4844bc]
mov eax, 0xc
call fcn.0040765c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48835f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00405d30
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00405ac4
mov edx, dword [ebp - 4]
call fcn.00486e34
pop ecx
test al, al
jne 0x488322
mov edx, dword [0x4844bc]
mov eax, dword [ebp - 8]
call fcn.00407670
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.004884c8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x488394
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00481b90
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.00481fa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48838d
dec esi
jne 0x488202
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2ba4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4a2bf0
cmp dword [ebp - 0x104], 2
jne 0x4a2bf0
cmp dword [ebp - 0x110], 5
ja 0x4a2bee
cmp dword [ebp - 0x110], 5
jne 0x4a2bf0
cmp dword [ebp - 0x10c], 1
jb 0x4a2bf0
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a8bf0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x504414
mov eax, esi
mov edx, 8
test al, 1
je 0x4a8c0c
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a8c0e
shr eax, 1
dec edx
jne 0x4a8bff
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a8bf8
pop esi
ret

Function at 0x4a8c24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x504410], 0
jne 0x4a8c47
call fcn.004a8bf0
push 1
push 0x504410
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4a8c72
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x504414]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4a8c4d
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4a97dc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x4aa4c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004064d4
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x4aa56a
mov eax, ebx
call fcn.00403018
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4aa563
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4aa54d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4aa58c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4aa54d
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa581
mov eax, dword [ebp - 0x10]
call fcn.00403034
ret
mov eax, dword [0x4fef70]
cmp dword [eax], 1
je 0x4aa581
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004aa2ec
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aa80c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa748
test al, al
jne 0x4aa830
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aa896
xor eax, eax
push ebp
push 0x4aa886
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa88d
lea eax, [ebp - 0xc]
call fcn.004aa784
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4aa92c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa748
test al, al
jne 0x4aa94d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aa999
xor eax, eax
push ebp
push 0x4aa989
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa990
lea eax, [ebp - 0xc]
call fcn.004aa784
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aab04
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa748
test al, al
jne 0x4aab27
mov dword [ebp - 4], 0xffffffff
jmp 0x4aab73
xor eax, eax
push ebp
push 0x4aab63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aab6a
lea eax, [ebp - 0xc]
call fcn.004aa784
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aaca8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa748
test al, al
jne 0x4aaccc
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aad20
xor eax, eax
push ebp
push 0x4aad10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004064d4
push eax
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aad17
lea eax, [ebp - 0xc]
call fcn.004aa784
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aad2c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x4aad4f
test esi, 4
je 0x4aad4f
xor edi, edi
jmp 0x4aad58
mov eax, edi
call fcn.004064d4
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004aa748
test al, al
jne 0x4aad6d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4aadbc
xor eax, eax
push ebp
push 0x4aadac
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aadb3
lea eax, [ebp - 0x10]
call fcn.004aa784
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4aae38
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa748
test al, al
jne 0x4aae59
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aaea5
xor eax, eax
push ebp
push 0x4aae95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_RemoveDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aae9c
lea eax, [ebp - 0xc]
call fcn.004aa784
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aaeb0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004aa748
test al, al
jne 0x4aaed4
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aaf21
xor eax, eax
push ebp
push 0x4aaf11
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aaf18
lea eax, [ebp - 0xc]
call fcn.004aa784
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ad670
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4ad69e
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00406630
jmp 0x4ad6a7
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x24
pop ebx
ret

Function at 0x4ad6f8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x4fef70]
cmp dword [eax], 2
jne 0x4ad760
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call fcn.00409388
test eax, eax
jne 0x4ad71b
xor eax, eax
jmp 0x4ad76f
lea eax, [esp + 8]
push eax
push 0x4ad774
push 0
call fcn.00409380
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call fcn.004ad6f0
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4ad760
xor eax, eax
jmp 0x4ad76f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4ad79c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4ad7f6
inc esi
xor edi, edi
cmp edi, 1
jne 0x4ad7c2
mov eax, dword [ebp + 0xc]
push eax
call fcn.004136e8
jmp 0x4ad7d0
cmp edi, 1
jle 0x4ad7d0
mov eax, dword [ebp + 8]
push eax
call fcn.004136e8
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004aa92c
test eax, eax
jne 0x4ad7f6
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4ad7f6
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4ad7f6
inc edi
dec esi
jne 0x4ad7b2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8