joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b41d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4b41f1
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4b41ea
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4b4205
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b3b9c
test bl, bl
jne 0x4b42d8
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4dde08
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b423c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b4250
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b40b0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4b4282
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4b4231
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b42a5
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4b42b6
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b42ca
jmp 0x4b4393
cmp bl, 1
jne 0x4b4393
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4dde62
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b42f8
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b430c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b40b0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4b433e
sub ebx, 6
inc dword [ebp - 8]
jne 0x4b42ed
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4b4365
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4b4376
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4b438a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b3c20
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4b786c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b789a
mov eax, ebx
call fcn.004b8320
cmp dword [ebx + 0x40], 0
je 0x4b7893
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b790b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b78fd
cmp dword [ebx + 8], 0
je 0x4b78bc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b78ce
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b78fd
cmp dword [ebx + 8], 0
je 0x4b78af
cmp eax, 3
je 0x4b78e1
dec eax
jne 0x4b78af
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b78af
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b78af
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b7929
cmp dword [ebx + 0x14], 0xcc
je 0x4b7929
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b7934
pop ebx
ret

Function at 0x4cbc4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405320
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4cbc65
test al, 0x10
jne 0x4cbc69
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4cc078
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405644
xor eax, eax
push ebp
push 0x4cc1be
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.0040544c
jne 0x4cc0cf
mov ecx, 0x4cc1d8
mov dl, 1
mov eax, dword [0x408630]
call fcn.0040d910
mov edx, eax
mov dword [edx + 0xc], 3
mov eax, edx
call fcn.00404470
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cbbe0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004051e8
mov eax, dword [ebp - 4]
call fcn.004cbc4c
test al, al
jne 0x4cc18e
mov eax, dword [ebp - 4]
call fcn.00405330
cmp eax, 3
jl 0x4cc18e
mov eax, dword [ebp - 4]
call fcn.004cbc4c
test al, al
jne 0x4cc18e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404d04
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040a2d4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405310
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040544c
je 0x4cc18e
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004cbb64
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.004cc078
test al, al
je 0x4cc16d
push 0
mov eax, dword [ebp - 4]
call fcn.00405320
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4cc171
xor ebx, ebx
jmp 0x4cc173
mov bl, 1
test bl, bl
je 0x4cc18e
test si, si
jbe 0x4cc18e
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.00405320
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc1c5
lea eax, [ebp - 0x18]
call fcn.00405188
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404aa0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051a0
ret

Function at 0x4ce634
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4ce646
add esp, 0xfffffff0
call fcn.00404008
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.00405644
xor eax, eax
push ebp
push 0x4ce6f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403ca0
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.004051c4
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov al, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x4cab14]
call fcn.0040614c
add esp, 4
mov eax, edi
call fcn.004ce488
test al, al
jne 0x4ce6db
call fcn.0040d8f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce6f8
lea eax, [ebp + 0x1c]
call fcn.00405188
ret
Function at 0x4cec20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x4cec29
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.00405644
xor eax, eax
push ebp
push 0x4cee41
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.004cbebc
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.004cc1f4
mov eax, dword [ebp - 0x14018]
mov edx, 0x4cee5c
call fcn.0040544c
jne 0x4cee18
mov dword [ebx + 0xa8], 0
mov dword [ebx + 0xac], 0
mov byte [ebx + 0xa0], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.00405320
mov ecx, 1
mov edx, BaseThreadInitThunk
call fcn.004cc334
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cee11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004cc3c8
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cc3c8
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x4ced87
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.004cebe8
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4ced83
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
jmp 0x4ced87
inc esi
dec edi
jne 0x4ced4e
cmp byte [ebx + 0xa0], 0
jne 0x4cedfb
push ebp
call fcn.004ceaf8
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x4cedfb
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004cc3c8
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.004cebe8
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4cedfb
mov eax, esi
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cee18
mov eax, dword [ebp - 4]
call fcn.00409e10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cee48
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.004051a0
lea eax, [ebp - 0x14008]
call fcn.00405188
ret
Function at 0x4cf0d8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x50
push 0
push 0
dec ecx
jne 0x4cf0e0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4cf35a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x250], 0x3f
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x254]
mov ecx, 0x4cf36c
mov edx, esi
call fcn.0040539c
mov eax, dword [ebp - 0x254]
call fcn.00405320
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4cf33c
lea eax, [ebp - 0x258]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.004052f4
mov eax, dword [ebp - 0x258]
mov edx, 0x4cf378
call fcn.0040544c
je 0x4cf312
lea eax, [ebp - 0x25c]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.004052f4
mov eax, dword [ebp - 0x25c]
mov edx, 0x4cf380
call fcn.0040544c
je 0x4cf312
mov eax, dword [ebp - 0x250]
and eax, 0x10
cmp eax, 0x10
jne 0x4cf276
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x30]
test byte [eax + 0x98], 4
jne 0x4cf20c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x234]
shl eax, 0x20
add eax, dword [ebp - 0x230]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.004052f4
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
mov edx, esi
call fcn.0040539c
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x250]
lea edx, [ebp - 0x23c]
call fcn.004ceeac
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x30]
test byte [eax + 0x98], 1
je 0x4cf312
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.004052f4
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, esi
call fcn.0040539c
mov edx, dword [ebp - 0x26c]
lea ecx, [ebp - 0x268]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x30]
call fcn.004cc400
mov eax, dword [ebp - 0x268]
mov edx, edi
call fcn.004cf0d8
pop ecx
jmp 0x4cf312
mov eax, edi
mov edx, 0x4cf38c
call fcn.0040544c
je 0x4cf2ba
lea eax, [ebp - 0x278]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.004052f4
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x274]
call fcn.004cbebc
mov eax, dword [ebp - 0x274]
mov edx, edi
call fcn.0040544c
jne 0x4cf312
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x234]
shl eax, 0x20
add eax, dword [ebp - 0x230]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x280]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.004052f4
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x27c]
mov edx, esi
call fcn.0040539c
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x250]
lea edx, [ebp - 0x23c]
call fcn.004ceeac
pop ecx
lea eax, [ebp - 0x250]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x4cf336
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x30]
cmp byte [eax + 0xbd], 0
je 0x4cf13b
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf361
lea eax, [ebp - 0x280]
mov edx, 0xc
call fcn.004051a0
ret
Function at 0x4d22c0
Capabilities:
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d2491
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
mov edx, ebx
call fcn.00404c74
mov eax, dword [ebp - 0x150]
call fcn.00409e80
test al, al
jne 0x4d2322
mov word [ebp - 2], 0
jmp 0x4d246b
lea eax, [ebp - 0x158]
mov edx, esi
call fcn.00404c74
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00409528
cmp dword [ebp - 0x154], 0
jne 0x4d2354
mov word [ebp - 2], 0
jmp 0x4d246b
xor edx, edx
push ebp
push 0x4d244f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040a8f4
push 0x42
lea edx, [ebp - 0x15c]
mov eax, ebx
call fcn.0040a8f4
mov ecx, dword [ebp - 0x15c]
mov dl, 1
mov eax, dword [0x417d88]
call fcn.0041bfc0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d243e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0041bb2c
lea edx, [ebp - 0xae]
mov ecx, 0x9e
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor edi, edi
mov dword [ebp - 0xc], 0x9e
lea ebx, [ebp - 0xae]
lea esi, [ebp - 0x14c]
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi - 1]
xor al, byte [ebx]
mov byte [esi], al
mov eax, dword [ebp - 0x10]
call fcn.00404d3c
push eax
lea eax, [edi + 1]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
inc esi
inc ebx
dec dword [ebp - 0xc]
jne 0x4d23dd
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0041bb2c
lea edx, [ebp - 0x14c]
mov ecx, 0x9e
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov word [ebp - 2], 0xffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2445
lea eax, [ebp - 8]
call fcn.0040f6a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2498
lea eax, [ebp - 0x15c]
mov edx, 4
call fcn.00404aa0
lea eax, [ebp - 0x10]
call fcn.00404a7c
ret

Function at 0x4d27e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x4d280b
push 0xa
call sub.kernel32.dll_Sleep_1
test bl, bl
je 0x4d280b
mov eax, dword [0x4dc3d8]
mov eax, dword [eax]
call fcn.00462920
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cdq
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4d282d
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4d27f4
jmp 0x4d2831
pop edx
pop eax
jg 0x4d27f4
pop edi
pop esi
pop ebx
ret

Function at 0x4d30fc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00404cec
add esp, 0x14
pop ebx
ret
Function at 0x4d312c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404cec
add esp, 0x108
pop ebx
ret

Function at 0x4d4acc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404f2c
lea eax, [ebp - 0x160]
mov edx, dword [0x40849c]
call fcn.00405664
xor eax, eax
push ebp
push 0x4d4ce4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 1
mov eax, dword [ebp - 4]
call fcn.0046f3b0
test al, al
je 0x4d4cad
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.004b36e4
lea eax, [ebp - 0x164]
mov edx, 0x4d4d00
call fcn.00404d44
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x3f
call fcn.0040a0ec
mov esi, eax
xor eax, eax
push ebp
push 0x4d4c90
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4d4c77
mov eax, dword [ebp - 0x154]
mov edx, 0x4d4d0c
call fcn.00404e88
je 0x4d4c62
mov eax, dword [ebp - 0x154]
mov edx, 0x4d4d18
call fcn.00404e88
je 0x4d4c62
push 0x80
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.004b36e4
lea eax, [ebp - 0x168]
mov edx, dword [ebp - 0x154]
call fcn.00404d44
mov eax, dword [ebp - 0x168]
call fcn.00404f3c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0x158]
and eax, 0x10
cmp eax, 0x10
jne 0x4d4c2c
push ebx
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 4]
call fcn.004b36e4
lea eax, [ebp - 0x16c]
mov edx, dword [ebp - 0x154]
call fcn.00404d44
mov edx, dword [ebp - 0x16c]
mov cl, 1
mov eax, edi
call fcn.004d4acc
test al, al
jne 0x4d4c62
mov byte [ebp - 6], 0
jmp 0x4d4c62
test bl, bl
jne 0x4d4c62
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 4]
call fcn.004b36e4
lea eax, [ebp - 0x170]
mov edx, dword [ebp - 0x154]
call fcn.00404d44
mov eax, dword [ebp - 0x170]
call fcn.0040a17c
test al, al
jne 0x4d4c62
mov byte [ebp - 6], 0
lea eax, [ebp - 0x160]
call fcn.0040a13c
mov esi, eax
test esi, esi
je 0x4d4b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4c97
lea eax, [ebp - 0x160]
call fcn.0040a160
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4ceb
lea eax, [ebp - 0x170]
mov edx, 4
call fcn.00404aa0
lea eax, [ebp - 0x160]
mov edx, dword [0x40849c]
call fcn.00405734
lea eax, [ebp - 4]
call fcn.00404a7c
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x1aac1893
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x63e96da3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4031b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x4031e8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x4031cb
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
jne 0x4031ec
xor al, al
jmp 0x40322c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40322a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x44
je 0x403220
cmp dword [ebp - 0xc], 0x20
je 0x403220
cmp dword [ebp - 0xc], 0x45
je 0x403220
cmp dword [ebp - 0xc], 0x24
jne 0x403226
mov al, 1
jmp 0x40322c
xor al, al
jmp 0x40322c
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x403560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x45e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x108]
push eax
push 0
push 0
mov eax, dword [0x45e8d0]
cdq
mov esi, eax
mov edi, edx
add esi, 5
adc edi, 0
mov eax, dword [0x45e8d4]
cdq
add eax, 0x2945
adc edx, 0
push 0
push 0x2945
push edx
push eax
call fcn.0044f900
mov ecx, eax
mov ebx, edx
add ecx, 5
adc ebx, 0
mov eax, dword [0x45e8d4]
cdq
add eax, 5
adc edx, 0
push edx
push eax
push ebx
push ecx
call fcn.0044f900
add esi, eax
adc edi, edx
add esi, 0x2945
adc edi, 0
push edi
push esi
call fcn.00402400
add esp, 8
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x11c], 0x2940
mov dword [ebp - 0x118], 0
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x118]
xor edx, 5
xor eax, 0
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x124], 5
mov dword [ebp - 0x120], 0
mov ecx, dword [0x45e8c0]
xor ecx, 0x2945
mov edx, dword [0x45e8c4]
xor edx, 0
push 0
push 6
push edx
push ecx
call fcn.0044f900
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x13c], 0x2945
mov dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x128]
add eax, dword [ebp - 0x12c]
adc ecx, edx
add eax, 1
adc ecx, 0
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], ecx
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x138]
sub eax, dword [ebp - 0x13c]
sbb ecx, edx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0x14c]
mov esi, dword [ebp - 0x148]
push esi
push edx
push ecx
push eax
call fcn.00450f90
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
mov eax, dword [ebp - 0x114]
cdq
mov ecx, dword [ebp - 0x154]
mov esi, dword [ebp - 0x150]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], esi
mov edx, dword [ebp - 0x15c]
cmp edx, dword [ebp - 0x164]
jne 0x403777
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x160]
jne 0x403777
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp - 0x110]
call fcn.00401810
mov edx, dword [ebp - 0x10c]
or edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x110]
jmp 0x40379c
push 0x458e09
mov ecx, dword [ebp - 0x110]
call fcn.00401810
mov eax, dword [ebp - 0x10c]
or eax, 1
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x110]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439348
mov esp, ebp
pop ebp
ret
Function at 0x4352d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x9c], 0
mov esp, ebp
pop ebp
ret