joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c650e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [eax + 0x10], ebx
je 0x4c661f
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], ebx
je 0x4c661e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4c653d
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
test eax, eax
je 0x4c661e
push 0x6fa5d6
push eax
call fcn.004244ca
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x4c661e
cmp dword [esi + 0x14], 0x10
jb 0x4c6572
mov esi, dword [esi]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, dword [ebp - 4]
test eax, eax
je 0x4c660c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4c660c
mov eax, dword [ebp - 0x10]
push 0x6fa5d6
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 8], ecx
call fcn.004244ca
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4c660c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x4c65d5
mov eax, dword [eax]
push eax
push dword [ebp - 8]
push str.StringFileInfo_08lx_s
push 0x80
push edi
call fcn.0040b430
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4c660a
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
call fcn.0040aa10
mov bl, 1
push esi
call fcn.00423c26
pop ecx
test edi, edi
je 0x4c661e
push edi
call fcn.00423c26
pop ecx
pop esi
pop edi
mov al, bl
pop ebx
leave
ret

Function at 0x4c66a2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6ee06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x118
xor ebx, ebx
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.004e7e00
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004c6657
mov eax, dword [ebp - 0x11c]
add esp, 0xc
cmp eax, 5
jne 0x4c6721
cmp dword [ebp - 0x118], ebx
jbe 0x4c6767
cmp dword [ebp - 0x118], 1
setne bl
inc ebx
jmp 0x4c6767
cmp eax, 6
jne 0x4c674c
cmp byte [ebp - 6], 1
jne 0x4c6747
mov eax, dword [ebp - 0x118]
sub eax, ebx
je 0x4c6743
sub eax, 1
je 0x4c673f
push 7
jmp 0x4c6749
push 5
jmp 0x4c6749
push 3
jmp 0x4c6749
push 4
pop ebx
jmp 0x4c6767
push 0xa
pop ecx
cmp eax, ecx
jne 0x4c6764
cmp dword [ebp - 0x114], 0x55f0
sbb ebx, ebx
add ebx, 9
jmp 0x4c6767
cmova ebx, ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00423c15
leave
ret
Function at 0x4c6a49
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x658a0b
call fcn.00424755
and dword [ebp - 0x20], 0
xor eax, eax
mov ebx, dword [ebp + 8]
and dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
and dword [ebp - 4], eax
push 0x208
mov dword [ebp - 0x20], 1
call fcn.00424273
mov edx, eax
xor eax, eax
pop ecx
mov ecx, 0x82
mov dword [ebp - 0x14], edx
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, 0x20019
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4c6b4f
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4c6b46
cmp dword [ebp - 0x10], 0x104
jbe 0x4c6b17
push dword [ebp - 0x14]
call fcn.00423c26
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00424273
mov edi, eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x14], edi
push eax
push esi
push edi
call fcn.00401460
add esp, 0x14
jmp 0x4c6b1a
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov ecx, ebx
mov esi, eax
push edi
call fcn.00403400
push edi
call fcn.00423c26
mov edi, dword [ebp - 0x1c]
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop eax
cmp esi, eax
jne 0x4c6b71
cmp dword [ebp + 0xc], reloc.OLEAUT32.dll_SysReAllocString
jne 0x4c6b71
cmp edi, 0x20019
jne 0x4c6b71
mov edi, 0x20119
jmp 0x4c6a96
mov eax, ebx
call fcn.0042471e
ret

Function at 0x4c6d0b
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push 0x210
mov eax, 0x658a31
call fcn.00424789
mov esi, dword [ebp + 8]
push 1
push 0
push esi
push 0x66b62c
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
setg bl
jle 0x4c6c87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
jne 0x4c6d03
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004e7e00
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004015c0
push eax
lea ecx, [ebp - 0x21c]
call fcn.004144f0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x21c]
push str.__sInternet_Exploreriexplore.exe_
push eax
call fcn.004c6b79
add esp, 0xc
push 1
push ebx
push esi
mov esi, dword [ebp - 0x21c]
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea ecx, [esi - 0x10]
setg bl
call fcn.00410720
mov eax, ebx
call fcn.00424733
ret
push ebp
mov ebp, esp
push 1
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4c6d2e
pop ebp
jmp 0x4c6c47
pop ebp
ret
Function at 0x4c763b
Capabilities:
Check mutex on windows

Disassembly:
push 0x1c
mov eax, 0x658ba3
call fcn.00424755
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004ca3ac
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ca3c5
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0xc
call fcn.004ca3c1
push dword [ebp + 8]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
lea ecx, [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
call fcn.004ca3bc
call fcn.0042471e
ret 4

Function at 0x4c8728
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x3c
mov eax, 0x658bc6
call fcn.00424789
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x4c874b
xor al, al
jmp 0x4c880b
lea edi, [ecx + 4]
cmp dword [edi + 0x10], 0
ja 0x4c876e
lea eax, [ebp - 0x40]
push eax
call fcn.004bed31
pop ecx
push eax
mov ecx, edi
call fcn.0040fbb0
lea ecx, [ebp - 0x40]
call fcn.00401860
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
push edi
call fcn.0040fe40
xor edi, edi
lea ecx, [ebp - 0x28]
push str.Software_
mov dword [ebp - 4], edi
call fcn.0040fdf0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.0040fdf0
test ebx, ebx
je 0x4c87b6
push 0x6d6ddc
lea ecx, [ebp - 0x28]
call fcn.0040fdf0
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040fdf0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x44]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], edi
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c8801
test esi, esi
je 0x4c87ee
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4c87f8
push edi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.00401860
mov al, 1
call fcn.00424733
ret 0xc
Function at 0x4c8ae7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x6ee06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [esi + 0x14], ebx
ja 0x4c8b3f
lea eax, [ebp - 0x1c]
push eax
call fcn.004bed31
pop ecx
lea ecx, [esi + 4]
push eax
call fcn.0040fbb0
lea ecx, [ebp - 0x1c]
call fcn.00401860
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x4c8b4a
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
push ebx
push eax
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x4c8b6d
xor al, al
jmp 0x4c8c26
lea eax, [ebp - 0x24]
push eax
push 0xf013f
push ebx
push 0x66b6f8
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x4c8b90
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c8b66
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x4c8bc2
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
jmp 0x4c8b66
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4c8c15
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4c8be7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call esi
mov bl, 1
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423c15
leave
ret 0x10
Function at 0x4c9fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x4c9ff4
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x4c9ff3
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x4c9fe3
pop edi
pop esi
pop ebp
ret 8

Function at 0x4ca215
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x658c6d
call fcn.00424755
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 0xf
mov byte [eax], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], ebx
je 0x4ca3a0
mov eax, dword [ebp + 0x10]
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x4ca2e6
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x6ee3d4], 0x10
mov ecx, 0x6ee3c0
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x6ee3c0]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0040c4d0
inc edi
cmp edi, 4
jl 0x4ca2ae
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4ca250
mov dword [ebp + 0x10], edi
test edi, edi
je 0x4ca39d
mov eax, edi
cmp edi, esi
jge 0x4ca31c
cmp eax, esi
jae 0x4ca3a6
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x4ca304
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x4ca388
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x6ee3d4], 0x10
mov ecx, 0x6ee3c0
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x6ee3c0]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0040c4d0
inc ebx
cmp ebx, edi
jl 0x4ca359
mov edi, dword [ebp + 0x10]
push 3
pop esi
cmp edi, esi
jge 0x4ca39d
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.0040c4d0
sub esi, 1
jne 0x4ca38e
mov eax, dword [ebp + 8]
call fcn.0042471e
ret
call fcn.004243f0
int3
Function at 0x4cb5f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
add ecx, 2
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x64]
mov ax, word [edx]
mov word [ebp - 0x6a], ax
add dword [ebp - 0x64], 2
cmp word [ebp - 0x6a], 0
jne 0x4cb608
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0x68]
sar ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x70]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00424273
add esp, 4
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00401460
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004f8c39
add esp, 0xc
mov byte [ebp - 9], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x4cb69f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jg 0x4cb70d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + eax*2]
cmp edx, 0x5c
jne 0x4cb70b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dx, word [ecx + eax*2]
mov word [ebp - 0x18], dx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cb6f4
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4cb6f4
mov byte [ebp - 9], 0
jmp 0x4cb70d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x4cb696
mov eax, dword [ebp - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.00423c26
add esp, 4
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cc350
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x658dbe
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x6ee06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x4cc38a
cmp dword [ebp + 0xc], 0
jne 0x4cc391
xor al, al
jmp 0x4cc52e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4cc3ad
mov eax, dword [ebp + 0xc]
push eax
call fcn.004cb5f0
add esp, 4
jmp 0x4cc3b7
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x6d8e03
lea eax, [ebp - 0x14]
push eax
call fcn.004caed0
add esp, 8
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x14]
call fcn.004cb330
mov ecx, eax
call fcn.004cf7b0
push 0
lea ecx, [ebp - 0x14]
call fcn.004cb330
mov ecx, eax
call fcn.004cf7d0
cmp dword [ebp + 0x10], 0
je 0x4cc40a
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.004cb330
mov ecx, eax
call fcn.004cf730
cmp dword [ebp + 0x14], 0
je 0x4cc423
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
call fcn.004cb330
mov ecx, eax
call fcn.004cf760
push 0
push 0x3a8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x88], esp
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403390
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004c0572
add esp, 0x20
mov dword [ebp - 0xc4], eax
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc8]
push eax
push 0xfde9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa4], esp
mov edx, dword [ebp + 8]
push edx
call fcn.00403390
lea eax, [ebp - 0xbc]
push eax
call fcn.004c0572
add esp, 0x20
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xd0]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x14]
call fcn.004cb330
mov ecx, eax
call fcn.004cf900
mov dword [ebp - 0xd4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xbc]
call fcn.0040aa70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.0040aa70
cmp dword [ebp - 0x44], 0xc8
jne 0x4cc4fb
mov dword [ebp - 0xc4], 1
jmp 0x4cc505
mov dword [ebp - 0xc4], 0
mov al, byte [ebp - 0xc4]
mov byte [ebp - 0xbd], al
lea ecx, [ebp - 0x44]
call fcn.004cb270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004cb230
mov al, byte [ebp - 0xbd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00423c15
mov esp, ebp
pop ebp
ret

Function at 0x4d2eac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x506002
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00505cc5

Function at 0x50600d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00505e46
Function at 0x50b8d4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050b594
Function at 0x51b5b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x51b5f9
mov al, byte [esi]
push eax
call fcn.0052a970
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x51b5d7
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x525b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6f2], 0
je 0x525b93
cmp dword [edi + 0x1b0], 0
je 0x525b5d
push esi
push 1
push edi
call fcn.00517880
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00517880
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x525b93
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x67d290
push 2
push eax
call fcn.004efcce
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004efcce
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x525f10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6ee06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov eax, dword [edx + 0xc]
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [eax + ecx*4 + 0x148]
push ecx
push eax
push edx
mov dword [ebp - 0x108], edx
call fcn.00526390
add esp, 0xc
test eax, eax
je 0x525f6b
pop edi
mov dword [esi], 0x1b
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423c15
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0x14]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x525fe8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x525fb0
xor edi, edi
mov dword [esi], 0x51
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423c15
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.005137e0
push eax
push str.Send_failure:__s
push dword [ebp - 0x108]
call fcn.00525ba0
mov eax, dword [ebp - 0x108]
add esp, 0x18
mov dword [eax + 0x93c], ebx
mov dword [esi], 0x37
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423c15
mov esp, ebp
pop ebp
ret