joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6241
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push ecx
mov ecx, esp
mov dword [ebp - 0x454], esp
mov eax, dword [ebp + 8]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x458], eax
call fcn.004ae8a4
add esp, 4
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
jne 0x4e6280
xor eax, eax
jmp 0x4e6415
mov ecx, dword [ebp + 8]
push ecx
push str._s.
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4e62b2
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x104
jae 0x4e62ce
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x218], 0
jmp 0x4e62a5
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x34c], eax
movsx ecx, byte [ebp - 0x218]
test ecx, ecx
jne 0x4e62f8
jmp 0x4e63e5
push 0x5a02dc
lea edx, [ebp - 0x218]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4e6328
push 0x5a02e0
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4e632d
jmp 0x4e63c9
mov ecx, dword [ebp - 0x244]
and ecx, 0x10
cmp ecx, 0x10
jne 0x4e636c
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x5a02e4
lea ecx, [ebp - 0x348]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x348]
push edx
call fcn.004e6241
add esp, 4
jmp 0x4e63c9
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x5a02ec
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x450]
push eax
call fcn.00401fca
add esp, 4
lea ecx, [ebp - 0x450]
push ecx
call fcn.00402131
add esp, 4
push 0
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x34c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4e62e8
mov eax, dword [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
je 0x4e6413
mov eax, 1
jmp 0x4e6415
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4e6419
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
push 0x104
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll__chdir]
add esp, 4
test eax, eax
je 0x4e644d
jmp 0x4e6632
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x4e6480
mov ecx, dword [ebp - 4]
and ecx, 4
test ecx, ecx
jne 0x4e6480
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov dword [0x5b84b8], 0
jmp 0x4e649b
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0x104
jge 0x4e64b7
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x118], 0
jmp 0x4e648c
lea eax, [ebp - 0x144]
push eax
push 0x5a02f4
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x144]
and ecx, 0x10
test ecx, ecx
jne 0x4e651b
mov edx, dword [ebp - 0x144]
and edx, 4
test edx, edx
jne 0x4e651b
mov eax, dword [ebp - 0x144]
and eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x4e651b
movsx ecx, byte [ebp - 0x118]
test ecx, ecx
jne 0x4e6504
jmp 0x4e6533
mov edx, dword [ebp - 0x144]
sub edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4e64cf
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov dword [0x5b84b8], 0
jmp 0x4e655b
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0x104
jge 0x4e6577
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x118], 0
jmp 0x4e654c
lea eax, [ebp - 0x144]
push eax
push 0x5a02f8
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x144]
and ecx, 0x10
cmp ecx, 0x10
jne 0x4e65f9
movsx edx, byte [ebp - 0x118]
cmp edx, 0x2e
je 0x4e65f9
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a02fc
lea edx, [ebp - 0x248]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x248]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.004e6419
add esp, 8
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4e658f
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x350]
push ecx
call dword [sym.imp.MSVCRT.dll__chdir]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4f391f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x5b7db4
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a7e34
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b7eb4
lea edx, [ebp - 0x100]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.ServicePackFilesi386SVCHOST.EXE
lea eax, [ebp - 0x100]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x204], esp
lea edx, [ebp - 0x200]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x208], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4f39c0
push 0
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov esp, ebp
pop ebp
ret
Function at 0x4f5e0b
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513561
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
push 0x5a819c
push 0x5a81a4
push 0x80000002
lea eax, [ebp - 0x14]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::MakeUpper
push 0x5a81dc
lea eax, [ebp - 0x10]
push eax
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4f5f1f
mov ecx, dword [ebp - 0x10]
push ecx
push str.Detectado__Shell__Sospechoso:___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
cmp dword [0x5b851c], 0
jne 0x4f5f1f
push 0x5a8210
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 4
push str.EliStartPage_v50.12
push 0x5b6504
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4f5f1f
push 0x5a8238
push 0x54
push 0x5a8248
push 0x5a8250
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.Restaurado_SHELL_por_el_Original._n
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4f65a6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1554
call fcn.005106b0
push 0x5b7cb4
push str._ssmtmp1
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b7cb4
push str._ssmtmp2
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b7cb4
push str._ssmtmp4
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, 0x5b7664
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x154c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x154c]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x1554], eax
mov edx, dword [ebp - 0x1554]
mov dword [0x5b84b8], edx
jmp 0x4f664b
mov eax, dword [0x5b84b8]
sub eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0
jle 0x4f666b
mov ecx, dword [0x5b84b8]
movsx edx, byte [ebp + ecx - 0x154c]
cmp edx, 0x5c
jne 0x4f6669
jmp 0x4f666b
jmp 0x4f663e
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov dword [ebp - 0x1550], 0
jmp 0x4f66a2
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [ebp - 0x1550]
add edx, 1
mov dword [ebp - 0x1550], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x1554]
jge 0x4f66cb
mov ecx, dword [ebp - 0x1550]
mov edx, dword [0x5b84b8]
mov al, byte [ebp + edx - 0x154c]
mov byte [ebp + ecx - 0x154c], al
jmp 0x4f6684
mov ecx, dword [ebp - 0x1550]
mov byte [ebp + ecx - 0x154c], 0
lea edx, [ebp - 0x154c]
push edx
lea eax, [ebp - 0x104]
push eax
push 0x5a87a0
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x44c]
push ecx
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4f67d7
mov edx, dword [0x5b7668]
push edx
lea eax, [ebp - 0x104]
push eax
push 0x5a87a8
lea ecx, [ebp - 0x144c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
lea edx, [ebp - 0x144c]
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
push str.Restaurados_Links_del_Men
mov ecx, 0x5b5b78
call fcn.0050f680
mov eax, dword [0x5b7654]
push eax
lea ecx, [ebp - 0x208]
push ecx
push str.xcopy__h__e__y___s.____sMicrosoftInternet_ExplorerQuick_Launch_
lea edx, [ebp - 0x144c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
lea eax, [ebp - 0x144c]
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
push str.Restaurados_Links_de_Inicio_Rapido_n
mov ecx, 0x5b5b78
call fcn.0050f680
mov ecx, dword [0x5b7630]
push ecx
lea edx, [ebp - 0x30c]
push edx
push str.xcopy__h__e__y___s.____s_
lea eax, [ebp - 0x144c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
lea ecx, [ebp - 0x144c]
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
push str.Restaurados_Links_del_Escritorio_de__All_Users__n
mov ecx, 0x5b5b78
call fcn.0050f680
mov esp, ebp
pop ebp
ret
Function at 0x50c6fa
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 8], 0
push 0x5b366c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x50c730
jmp 0x50c95f
mov ecx, dword [ebp - 0x20c]
push ecx
push 0x200
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
mov eax, dword [ebp - 0x20c]
push eax
push 0x200
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
push str._Top_2_n
lea edx, [ebp - 0x208]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c787
mov dword [ebp - 8], 1
mov dword [0x5b84b8], 0
jmp 0x50c7a0
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x200
jge 0x50c7bc
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x208], 0
jmp 0x50c793
mov edx, dword [ebp - 0x20c]
push edx
push 0x200
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
push str._Bottom
lea ecx, [ebp - 0x208]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c812
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
jmp 0x50c95f
push str._Bottom_n
lea ecx, [ebp - 0x208]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50c82c
jmp 0x50c84b
mov edx, dword [ebp - 0x20c]
mov eax, dword [edx + 0xc]
and eax, 0x10
test eax, eax
je 0x50c83e
jmp 0x50c84b
mov ecx, 1
test ecx, ecx
jne 0x50c787
cmp dword [ebp - 8], 0
je 0x50c86d
mov edx, dword [ebp - 0x20c]
push edx
push 0x200
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
push 0x5b3694
push 0x5b3698
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x50c89e
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x50c95f
mov dword [0x5b84b8], 0
jmp 0x50c8b9
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0x200
jge 0x50c8d4
mov eax, dword [0x5b84b8]
mov byte [ebp + eax - 0x208], 0
jmp 0x50c8aa
mov ecx, dword [ebp - 0x20c]
push ecx
push 0x200
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov edx, dword [ebp - 0x20c]
mov eax, dword [edx + 0xc]
and eax, 0x10
test eax, eax
je 0x50c916
jmp 0x50c923
mov ecx, 1
test ecx, ecx
jne 0x50c89e
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov edx, dword [ebp + 8]
push edx
push str.file.tmp
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x50e088
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5137de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e8
push edi
mov dword [ebp - 0x1f4], ecx
call fcn.00401310
test eax, eax
jne 0x50e0bf
call fcn.00401487
test eax, eax
je 0x50e0d5
push 0
push 0
push str.Archivo_modificado__posiblemente_por_un_VIRUS._n____________________Contacte_con_SATINFO
call sub.MFC42.DLL_AfxMessageBox
push 0
call dword [sym.imp.MSVCRT.dll_exit]
call fcn.004017c7
test eax, eax
je 0x50e0e6
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 0x5b3c08
push 0x5b7fb4
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b7fb4
mov ecx, dword [ebp - 0x1f4]
add ecx, 0x180
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0x83
mov ecx, dword [ebp - 0x1f4]
add ecx, 0x340
call fcn.0050fc90
call fcn.0050fd60
push eax
mov ecx, dword [ebp - 0x1f4]
call sub.MFC42.DLL_CWnd::SetWindowTextA
push str.EliStartPage_v50.12__c_2023__S.G.H.___Satinfo_S.L._n_www.satinfo.es_
mov ecx, dword [ebp - 0x1f4]
add ecx, 0x300
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 1
push 0x403
mov ecx, dword [ebp - 0x1f4]
call sub.MFC42.DLL_CWnd::CheckDlgButton
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SystemCurrentControlSetControlComputerNameComputerName
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x50e20b
push 0
push 0
push 0x5b3c48
mov ecx, dword [ebp - 0x1f4]
call sub.MFC42.DLL_CWnd::MessageBoxA
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x50e203
mov dword [ebp - 0x150], 0x3c
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x14c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x144], str.runas
lea edx, [ebp - 0x114]
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x134], 1
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
call fcn.00401a4d
test eax, eax
je 0x50e235
call fcn.00401bae
test eax, eax
je 0x50e233
push 0
push 0
push str.ERROR:_nEsta_Aplicaci
call sub.MFC42.DLL_AfxMessageBox
push 0
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x50e288
push 0
lea ecx, [ebp - 0x1f0]
call fcn.0050fe70
mov dword [ebp - 4], 0
push 0
push 0x94
lea ecx, [ebp - 0x1f0]
call fcn.0050f6b0
push str.EliStartPage_v50.12__c_2023__S.G.H.___Satinfo_S.L._n_www.satinfo.es_
lea ecx, [ebp - 0x190]
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f0]
call fcn.0050fd70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040a7e3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040a7e3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040a7e3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040a7e3
mov dword [0x41203c], eax
call fcn.0040a7e3
test eax, eax
jge 0x402550
push 8
call fcn.0040a7e3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040a7e3
pop ecx
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040a7e3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040a7e3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040a7e3
jmp 0x402495

Function at 0x40a7e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40a7f2
pop dword [ebp - 0x14]
mov eax, 0xf357c09a
sub eax, 0xf31718a8
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3581f
push 0
mov eax, 0xd561e7fd
add eax, 0x2adef8db
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3932
mov edi, eax
mov ebx, 0xab737894
sub ebx, 0xab323cd0
add ebx, dword [ebp - 0x14]
mov edx, 0x414a64e3
sub edx, 0x344b4198
add dword [ebp - 8], ebx
mov esi, dword [ebx]
mov dword [ebp - 4], 0xe166f319
add esi, edx
xor dword [ebp - 4], eax
mov dword [edi], esi
xor dword [ebp - 0x10], ebx
add edi, 4
add ebx, 0x539c307f
add ebx, 0xac63cf85
loop 0x40a84b
add eax, 0xd79b
mov ebx, eax
add eax, 0x1e637721
add eax, 0xe19c88e4
mov ecx, 0x51e1b5cb
add ecx, 0xae5e4a35
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
test ebx, ebx
push edi
mov edi, 0x811c9dc5
jle 0x40123c
mov al, byte [esi + ebp]
movzx ecx, al
xor ecx, edi
imul ecx, ecx, 0x1000193
mov edi, ecx
movsx edx, al
push edi
push edx
push esi
push str.__d___d__d_n
call fcn.004014a0
add esi, 1
add esp, 0x10
cmp esi, ebx
jl 0x401212
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x401670
Capabilities:
Move file

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push 0x400
call fcn.00409d82
mov esi, eax
push 0x400
push esi
call fcn.0040c36f
push esi
push str._Extractor__Working_dir_is__s_n
call fcn.004014a0
push esi
call fcn.00409ca5
push edi
push ebp
call fcn.0040a3c1
add esp, 0x20
test eax, eax
mov dword [esp + 0x10], 0
je 0x4017a2
lea esp, [esp]
cmp dword [esp + 0x10], 0xa
jge 0x4017c7
call fcn.00409f59
mov eax, dword [eax]
push eax
push edi
push ebp
push str._Rename__Could_not_rename__s_to__s___d__n
call fcn.004014a0
add esp, 0x10
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.004014a0
add esp, 4
push 3
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4017b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x400
mov esi, eax
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call ebx
push str.MoveFileEx
mov dword [esp + 0x18], eax
call ebx
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax + 0x28]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0xc]
push ecx
push esi
push str.MoveFileEx
push str._HttpDownloader___s_failed_with_error__d:__s_n
mov ebx, eax
call fcn.004014a0
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x10
push edx
call esi
push ebx
call esi
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [esp + 0x10], 1
push edi
push ebp
call fcn.0040a3c1
add esp, 8
test eax, eax
jne 0x4016c0
push edi
push ebp
push str._Rename__File__s_renamed_to__s_n
call fcn.004014a0
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.004014a0
add esp, 4
jmp 0x4017a2
test eax, eax
je 0x4017a2
call fcn.00409f59
mov eax, dword [eax]
push eax
push edi
push ebp
push str._Rename___FAIL__Could_not_rename__s_to__s___d__n
call fcn.004014a0
push str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.004014a0
mov eax, edi
call fcn.00401820
push edi
push ebp
call fcn.00401ca0
add esp, 0x1c
test eax, eax
je 0x4017b1
pop esi
pop ebp
pop ebx
add esp, 0xc
mov dword [esp + 4], str._Rename__Copy_failed_too__Severe_filesystem_issues._n
jmp fcn.004014a0
Function at 0x401930
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov edi, eax
push edi
push str.Fixing__s_n
call fcn.004014a0
push 0x41df1c
push edi
call fcn.0040aec6
mov esi, eax
add esp, 0x10
test esi, esi
mov byte [esp + 8], 0x50
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0
mov byte [esp + 0xb], 0
jne 0x40197d
push edi
push str.Could_not_open_file__s_n
call fcn.004014a0
add esp, 8
push 1
call fcn.0040a825
push ebp
push edi
push str.Opened__s_n
call fcn.004014a0
add esp, 8
xor ebp, ebp
push ebx
xor edi, edi
push esi
call fcn.0040aca1
push esi
mov ebx, eax
add ebp, 1
call fcn.0040a46a
add esp, 8
test eax, eax
jne 0x401a56
cmp bl, byte [esp + edi + 0x10]
jne 0x40198f
add edi, 1
cmp edi, 4
jne 0x401991
push str.Found_marker_OK_n
mov dword [0x431b88], ebp
call fcn.004014a0
mov eax, dword [0x431b88]
push 0
add eax, 0x59
push eax
push esi
call fcn.0040c721
push str.Skipped_to_relevant_spot_n
call fcn.004014a0
push esi
call fcn.0040aca1
push eax
push str.Was__02X_n
call fcn.004014a0
mov ecx, dword [0x431b88]
push 0
add ecx, 0x59
push ecx
push esi
call fcn.0040c721
push esi
push 2
call fcn.0040a282
mov edx, dword [0x431b88]
push 0
add edx, 0x59
push edx
push esi
call fcn.0040c721
add esp, 0x40
push esi
call fcn.0040aca1
push eax
push str.Now__02X_n
call fcn.004014a0
push esi
call fcn.0040ac45
push esi
call fcn.0040ca6f
push str.Fixed_OK_n
call fcn.004014a0
add esp, 0x18
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
push str.SS_edit___PE_sig
push str.Could_not_find_marker:__s_n
call fcn.004014a0
add esp, 8
push 1
call fcn.0040a825
int3

Function at 0x401c20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push edi
mov esi, eax
push 0x41dfe8
push esi
call fcn.0040aec6
mov edi, eax
add esp, 8
test edi, edi
jne 0x401c50
push esi
push str.Unable_to_open_destination_file_for_copy__s_n
call fcn.004014a0
add esp, 8
pop edi
pop esi
ret
push ebx
push 0xc350
push 1
push 0x425820
call fcn.0040b2dd
mov esi, eax
add esp, 0x10
test esi, esi
jbe 0x401c7c
push edi
push esi
push 1
push 0x425820
call fcn.0040c00c
add esp, 0x10
cmp esi, 0xc350
je 0x401c50
push ebx
call fcn.0040ca6f
push edi
call fcn.0040ca6f
add esp, 8
pop edi
pop esi
ret