joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4a0e39
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004a266c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409c34
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a1700
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409b18
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a1774
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0e40
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004049c4
ret
Function at 0x4a0e48
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4a0f51
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004a266c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4a0f17
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409c34
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a1700
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409b18
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a1774
jmp 0x4a0f29
xor edx, edx
mov eax, ebx
call fcn.004a1700
xor edx, edx
mov eax, ebx
call fcn.004a1774
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0f58
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004049c4
ret

Function at 0x4a28c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4a2926
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004a29a4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4a290e
lea eax, [ebp - 4]
call fcn.004a29a4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4a2910
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a292d
lea eax, [ebp - 4]
call fcn.004049a0
ret

Function at 0x4a2934
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4a2998
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004a29a4
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.00409ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a299f
lea eax, [ebp - 4]
call fcn.004049a0
ret
Function at 0x4a7dcc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004a8000
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004a8000
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4a7e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4a7e65
inc esi
mov eax, edi
call fcn.004a7e24
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004a7dcc
inc ebx
dec esi
jne 0x4a7e4f
pop edi
pop esi
pop ebx
ret

Function at 0x4a7ef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4a7f69
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004a7e6c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004a7e24
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004a7dcc
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4a7f34
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7f70
lea eax, [ebp - 4]
call fcn.004049a0
ret
Function at 0x4a8bdc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a8dc0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4a8d7c
mov eax, dword [ebp - 4]
call fcn.004aa568
cmp ebx, eax
jge 0x4a8d7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0049f444
mov edx, dword [0x4a07e0]
call fcn.00403d7c
mov esi, eax
mov eax, esi
call fcn.004a1694
test al, al
je 0x4a8d72
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4a8d66
xor eax, eax
push ebp
push 0x4a8d5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004a91d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041bce8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404fec
mov eax, dword [ebp - 8]
call fcn.00404eb8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a8f58
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8daa
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4a8d5e
mov eax, dword [ebp - 4]
call fcn.004a9254
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00409ff0
jmp 0x4a8daa
mov eax, dword [ebp - 8]
call fcn.004049a0
jmp 0x4a8daa
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409560
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41699c]
call fcn.0040cfdc
call fcn.00404358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8dc7
lea eax, [ebp - 0x54]
call fcn.004049a0
ret
Function at 0x4b02b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b02b8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b04aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b04c0
mov eax, esi
call fcn.004ae13c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004049f4
lea ecx, [ebp - 0x10]
mov edx, 0x4b04d4
mov eax, esi
call fcn.004ae13c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004049f4
lea ecx, [ebp - 0x14]
mov edx, 0x4b04ec
mov eax, esi
call fcn.004ae13c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004049f4
lea ecx, [ebp - 0x18]
mov edx, 0x4b0508
mov eax, esi
call fcn.004ae13c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004049f4
lea ecx, [ebp - 0x1c]
mov edx, 0x4b0524
mov eax, esi
call fcn.004ae13c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004049f4
lea ecx, [ebp - 0x24]
mov edx, 0x4b053c
mov eax, esi
call fcn.004ae13c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408ea4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409284
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b0554
mov eax, esi
call fcn.004ae13c
mov eax, dword [ebp - 0x28]
call fcn.00492584
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b0564
mov eax, esi
call fcn.004ae13c
mov eax, dword [ebp - 0x2c]
call fcn.00492584
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b057c
mov eax, esi
call fcn.004ae13c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409284
inc eax
je 0x4b044d
lea ecx, [ebp - 0x34]
mov edx, 0x4b057c
mov eax, esi
call fcn.004ae13c
mov eax, dword [ebp - 0x34]
call fcn.00409248
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040adec
fstp qword [ebp - 0x3c]
wait
call fcn.0040b150
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b0468
lea ecx, [ebp - 0x40]
mov edx, 0x4b057c
mov eax, esi
call fcn.004ae13c
mov eax, dword [ebp - 0x40]
call fcn.00492584
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b058c
mov eax, esi
call fcn.004ae13c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004049f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b04b1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004049c4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004049c4
ret
Function at 0x4b723c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4b7296
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004b722c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004911f0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00490df0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b729d
lea eax, [ebp - 4]
call fcn.004049a0
ret

Function at 0x4ba698
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4ba6a1
mov eax, dword [ebp - 4]
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4ba7af
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x4cbcd0]
mov byte [eax], 0
or ebx, 0xffffffff
xor ecx, ecx
push ebp
push 0x4ba78f
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x158]
call fcn.00403018
mov edx, 1
lea eax, [ebp - 0x158]
call fcn.0040347c
call fcn.00402958
call fcn.00402aec
test eax, eax
jne 0x4ba770
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10149]
mov ecx, 0xfff1
lea eax, [ebp - 0x158]
call fcn.00403174
call fcn.00402958
mov dx, word [ebp - 0xc]
test dx, dx
jbe 0x4ba76a
lea eax, [ebp - 0x10149]
xor ecx, ecx
mov cl, byte [eax]
mov esi, ebx
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x4ca6e4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc eax
dec dx
jne 0x4ba748
cmp dword [ebp - 0xc], 0
jne 0x4ba71a
lea eax, [ebp - 0x158]
call fcn.00403194
call fcn.00402958
not ebx
mov dword [ebp - 8], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ba799
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba7b6
lea eax, [ebp - 4]
call fcn.004049a0
ret
Function at 0x4ba7f8
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4ba896
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4caae4]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4caae4]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4caae4]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4caae4]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4ba817
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4ba8ac
dec edx
je 0x4ba8e1
jmp 0x4ba932
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4caae4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4caae4]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4ba932
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4caae4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4caae4]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4caae4]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ba994
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4ba9b3
add edx, 3
sar edx, 2
test edx, edx
jle 0x4baac0
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4ba9e9
je 0x4baa29
sub ecx, 0x2b
je 0x4baa1f
sub ecx, 4
je 0x4baa24
dec ecx
sub ecx, 0xa
jb 0x4baa12
jmp 0x4baa2c
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4ba9fb
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4baa05
jmp 0x4baa2c
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4baa2c
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4baa2c
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4baa2c
mov byte [eax], 0x3e
jmp 0x4baa2c
mov byte [eax], 0x3f
jmp 0x4baa2c
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4ba9cb
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x4baa7d
cmp byte [esp + 7], 0xff
jne 0x4baa7d
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4baab5
cmp dl, 0xff
je 0x4baab5
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4ba9c2
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x4c0ce0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e50
mov eax, dword [ebp - 8]
call fcn.00404e50
mov eax, dword [ebp - 0xc]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4c0dd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x4c0dac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e60
push eax
mov ecx, dword [0x4cc668]
mov dl, 1
mov eax, dword [0x417640]
call fcn.0041c718
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4c0d9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004096f8
test al, al
je 0x4c0d76
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404e60
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0041c3e4
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0da2
mov eax, dword [ebp - 0x14]
call fcn.00403bcc
ret
Function at 0x4c1070
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0xc], ecx
mov esi, eax
lea edi, [ebp - 0x40]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov ebx, edx
lea eax, [ebp - 0x40]
mov edx, dword [0x4bfb64]
call fcn.00405594
xor eax, eax
push ebp
push 0x4c1272
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c1237
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x48]
xor eax, eax
call fcn.00402c64
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00409b18
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0xc]
mov ecx, 0x4c128c
call fcn.00404cac
mov eax, dword [ebp - 0xc]
call fcn.004096f8
test al, al
je 0x4c110c
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404e60
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4c111e
mov ecx, dword [ebp - 0xc]
mov edx, 0x4c12a0
mov eax, 0x4c12b4
call fcn.004c0ce0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4330a0]
call fcn.00433150
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c1226
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4c117f
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x4c12c4
mov edx, 0x4c12dc
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.004091f8
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, 0x4c12ec
mov edx, 0x4c12dc
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
jmp 0x4c11ba
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x4c12c4
mov edx, 0x4c12dc
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.004091f8
mov eax, dword [ebp - 0x50]
push eax
mov ecx, 0x4c12ec
mov edx, 0x4c12dc
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x40]
push eax
mov ecx, 0x4c1300
mov edx, 0x4c12dc
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x38]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x54]
call fcn.004091f8
mov eax, dword [ebp - 0x54]
push eax
mov ecx, 0x4c1314
mov edx, 0x4c12dc
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0x4c1324
mov ecx, 0x4c1330
mov edx, 0x4c12dc
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c122d
mov eax, dword [ebp - 8]
call fcn.00403bcc
ret
Function at 0x4c13c0
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 8], ecx
mov esi, eax
lea edi, [ebp - 0x3c]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, edx
lea eax, [ebp - 0x3c]
mov edx, dword [0x4bfb64]
call fcn.00405594
xor eax, eax
push ebp
push 0x4c1515
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x4c14d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x4cb668]
mov ebx, dword [ebx + 0x24]
test ebx, ebx
jle 0x4c143e
mov eax, dword [0x4cb668]
call fcn.004c1340
cmp ebx, eax
jle 0x4c14cd
push 0x104
lea eax, [ebp - 0x141]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x148]
lea eax, [ebp - 0x141]
call fcn.00409ff0
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 8]
mov ecx, 0x4c1530
call fcn.00404cac
mov eax, dword [ebp - 8]
call fcn.00404e60
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x150]
xor eax, eax
call fcn.00402c64
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00409b18
mov eax, dword [ebp - 0x14c]
call fcn.00409dd0
call fcn.004c0de4
mov edx, esi
lea eax, [ebp - 0x3c]
call fcn.004c1070
test al, al
je 0x4c14cd
push 5
push 0x4c1544
call sub.kernel32.dll_WinExec
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c14e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c151c
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.004049c4
lea eax, [ebp - 0x3c]
mov edx, dword [0x4bfb64]
call fcn.00405450
lea eax, [ebp - 8]
call fcn.004049a0
ret

Function at 0x4c1d68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, edx
lea edx, [ebp - 4]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.00409ff0
pop ebx
mov esp, ebp
pop ebp
ret