joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47916e
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
cmp dword [0x7ba838], 0
push esi
jne 0x47927d
push str.Iphlpapi.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x7ba838], eax
test eax, eax
jne 0x479198
xor al, al
jmp 0x47927f
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GetAdaptersInfo
push eax
call esi
mov dword [0x7ba83c], eax
test eax, eax
jne 0x4791c4
push dword [0x7ba838]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
and dword [0x7ba838], 0
jmp 0x479191
push str.GetIfTable
push dword [0x7ba838]
call esi
mov dword [0x7ba840], eax
test eax, eax
je 0x4791af
push str.GetIfEntry
push dword [0x7ba838]
call esi
mov dword [0x7ba844], eax
test eax, eax
je 0x4791af
push str.GetBestInterface
push dword [0x7ba838]
call esi
mov dword [0x7ba848], eax
test eax, eax
je 0x4791af
push str.GetBestInterfaceEx
push dword [0x7ba838]
call esi
push str.GetIpAddrTable
push dword [0x7ba838]
mov dword [0x7ba84c], eax
call esi
mov dword [0x7ba850], eax
test eax, eax
je 0x4791af
push str.GetAdaptersAddresses
push dword [0x7ba838]
call esi
push 0x6dc508
push dword [0x7ba838]
mov dword [0x7ba854], eax
call esi
push str.NotifyIpInterfaceChange
push dword [0x7ba838]
mov dword [0x7ba858], eax
call esi
mov dword [0x7ba85c], eax
test eax, eax
je 0x47927d
lea ecx, [esp + 4]
push ecx
push 0
push 0x791b98
push 0x479164
push 2
call eax
mov al, 1
pop esi
pop ecx
ret
Function at 0x4793ed
Capabilities:
Get process image filename
List tcp connections and listeners

Disassembly:
sub esp, 0x234
push edi
call fcn.0047916e
test al, al
jne 0x47941c
mov eax, dword [esp + 0x23c]
xor edi, edi
xor ecx, ecx
mov dword [eax], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], 7
mov word [eax], cx
jmp 0x479570
push ebx
push esi
push 0x1c
pop esi
push esi
call fcn.004513b4
xor edi, edi
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov ebx, eax
push edi
push 4
push 2
push 1
lea eax, [esp + 0x1c]
push eax
push ebx
call esi
cmp eax, 0x7a
jne 0x47945c
push 1
push ebx
call fcn.004513a7
push dword [esp + 0xc]
call fcn.004513b4
mov ebx, eax
push 0x208
lea eax, [esp + 0x3c]
push edi
push eax
call fcn.006678b0
add esp, 0xc
lea eax, [esp + 0xc]
push edi
push 4
push 2
push 1
push eax
push ebx
call esi
test eax, eax
jne 0x479540
mov dword [esp + 0x10], edi
cmp dword [ebx], edi
jle 0x479540
push ebp
lea ebp, [ebx + 0xc]
movzx eax, word [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esp + 0x24c]
movzx esi, ax
mov eax, dword [ebp + 4]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
call fcn.0046d4f2
movzx eax, word [eax + 0x10]
cmp esi, eax
jne 0x479500
mov ecx, dword [esp + 0x24c]
call fcn.0046d781
cmp eax, dword [esp + 0x18]
jne 0x479500
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x20], eax
je 0x479512
mov eax, dword [esp + 0x14]
add ebp, 0x18
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [ebx]
jl 0x479496
jmp 0x47953f
push dword [esp + 0x24]
push edi
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x47953f
push 0x104
lea eax, [esp + 0x40]
push eax
push esi
call sub.KERNEL32.DLL_K32GetProcessImageFileNameW
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
push 1
push ebx
call fcn.004513a7
mov esi, dword [esp + 0x244]
xor eax, eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [esp + 0x38]
push eax
call fcn.00427ba3
mov eax, esi
pop esi
pop ebx
pop edi
add esp, 0x234
ret 8
Function at 0x47b4e3
Capabilities:
Delete file

Disassembly:
mov eax, 0x6abe6e
call fcn.00664608
sub esp, 0x38
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x68]
cmp dword [eax + 0x14], 8
jb 0x47b4ff
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0046665e
xor edi, edi
lea eax, [esi + 0xcc]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.00427a37
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], edi
je 0x47b542
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
jb 0x47b53b
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [esi + 0x78], edi
je 0x47b559
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
jb 0x47b553
mov eax, dword [ebp - 0x44]
push eax
call fcn.004524e4
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x64], 4
cmp eax, 8
jb 0x47b59b
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x47b592
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004279ae
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.006643a9
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00427afc
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x47b85b
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x7ba6a6], 0
je 0x47b86b
mov eax, 0x80004005
jmp 0x47b8a2
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov ecx, esi
sub ecx, 0
je 0x47b89f
dec ecx
sub ecx, 1
je 0x47b89f
push dword [esp + 0xc]
push esi
push str.RegKey::DeleteKey_fail___d_:__s_n
call fcn.004704f0
add esp, 0xc
mov eax, esi
jmp 0x47b8a1
xor eax, eax
pop esi
ret 8

Function at 0x47b8a5
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x7ba6a6], 0
je 0x47b8b2
xor al, al
jmp 0x47b8e3
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, eax
sub ecx, 0
je 0x47b8e1
dec ecx
sub ecx, 1
je 0x47b8e1
push dword [esp + 8]
push eax
push str.RegKey::DeleteTree_fail___d_:__s_n
call fcn.004704f0
add esp, 0xc
jmp 0x47b8ae
mov al, 1
ret 8

Function at 0x47b8e6
Capabilities:
Delete registry value

Disassembly:
cmp byte [0x7ba6a6], 0
je 0x47b8f3
xor al, al
jmp 0x47b923
push esi
push dword [esp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x47b91f
cmp esi, 2
je 0x47b91d
push esi
push dword [esp + 0xc]
push str.RegKey:_Could_not_delete_value__s:__d_n
call fcn.004704f0
add esp, 0xc
test esi, esi
sete al
pop esi
ret 4
Function at 0x47b926
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x6ac8cd
call fcn.00664608
sub esp, 0x218
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
mov edi, 0x104
mov esi, ecx
push 0x208
mov dword [ebp - 0x14], edi
call fcn.0066490b
pop ecx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0xc]
push dword [esi]
call edi
mov dword [ebp - 0x18], eax
cmp eax, 0xea
jne 0x47b9c9
push ebx
call fcn.0066464a
mov eax, dword [ebp - 0x10]
xor ecx, ecx
inc eax
push 2
pop edx
mov dword [ebp - 0x10], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0066490b
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0xc]
push dword [esi]
call edi
mov dword [ebp - 0x18], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x6ce190
mov ecx, esi
and dword [esi], 0
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00427ba3
lea edi, [esi + 0x18]
mov dword [ebp - 4], 1
and dword [edi], 0
xor eax, eax
and dword [edi + 0x10], 0
mov ecx, edi
push 0x6ce190
mov dword [edi + 0x14], 7
mov word [edi], ax
call fcn.00427ba3
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 1
jne 0x47ba41
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.00427ba3
cmp dword [ebp - 0x10], 0
je 0x47ba41
push ebx
mov ecx, edi
call fcn.00427ba3
push ebx
call fcn.0066464a
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x47bb55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 4], eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0x14]
push eax
push esi
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov eax, dword [ebp + 0x10]
jne 0x47bb86
cmp dword [ebp + 0x14], eax
jne 0x47bb86
inc esi
cmp eax, 1
jne 0x47bb96
xor eax, eax
cmp dword [ebp + 0x14], 2
sete al
or esi, eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x47bba2
mov eax, dword [ebp - 4]
mov dword [ecx], eax
test esi, esi
pop esi
setne al
leave
ret 0x14

Function at 0x47c07f
Capabilities:
Set registry value

Disassembly:
cmp byte [0x7ba6a6], 0
je 0x47c08c
xor al, al
jmp 0x47c0c6
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x47c0c2
push esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push str.RegKey:_Could_not_write_DWORD_valuename__s_value__d__Error__d_n
call fcn.004704f0
add esp, 0x10
test esi, esi
sete al
pop esi
ret 8
Function at 0x47c0c9
Capabilities:
Set registry value

Disassembly:
cmp byte [0x7ba6a6], 0
je 0x47c0d7
or eax, 0xffffffff
jmp 0x47c0f1
push dword [esp + 0x10]
push dword [esp + 0xc]
push dword [esp + 0x14]
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0x10
Function at 0x48247a
Capabilities:
Create directory

Disassembly:
mov eax, 0x6acf97
call fcn.00664608
sub esp, 0x20
push ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.00472c65
xor ebx, ebx
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], ebx
jb 0x4824a2
mov eax, dword [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00427a37
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x7bb3c8
call fcn.0042a2bd
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0047e18b
push 0x7bb02c
call fcn.00483e9f
lea ecx, [ebp - 0x2c]
call fcn.00427afc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4891bc
Capabilities:
Get disk information

Disassembly:
mov eax, 0x6ad4eb
call fcn.00664608
sub esp, 0x17c
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ebx, [esi + 4]
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4891e8
mov byte [eax], 0
push str.UuidCreateSequential
push str.rpcrt4.dll
call fcn.00455fd1
mov ecx, eax
or eax, 0xffffffff
test ecx, ecx
je 0x489219
lea eax, [ebp - 0x20]
push eax
call ecx
test eax, eax
jne 0x489219
mov eax, dword [ebp - 0x16]
mov dword [ebx], eax
mov ax, word [ebp - 0x12]
mov word [ebx + 4], ax
jmp 0x489226
push eax
push str.Cant_create_UUID____d
call fcn.00470476
pop ecx
pop ecx
xor ecx, ecx
lea eax, [ebp + 0xc]
push ecx
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0xa]
push eax
push ecx
push ecx
push 0x6df0c8
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
lea ecx, [ebp - 0x188]
call fcn.0045cbc9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x188]
push 0xe
push esi
call fcn.0045cb67
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.0045cbc9
push 0xa
push esi
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 1
call fcn.0045cb67
push 5
pop esi
cmp ebx, eax
je 0x489291
mov ecx, esi
mov edi, ebx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
push 5
pop esi
lea ecx, [ebp - 0x98]
call fcn.0045cbc9
push 4
push dword [ebp + 8]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.0045cb67
mov ecx, dword [eax]
lea eax, [eax + 4]
add dword [ebx], ecx
lea ebx, [ebx + 4]
sub esi, 1
jne 0x4892b0
lea ecx, [ebp - 0x98]
call fcn.00427b28
lea ecx, [ebp - 0x110]
call fcn.00427b28
lea ecx, [ebp - 0x188]
call fcn.00427b28
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x48f313
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push 0x6c078965
push dword [esp + 0xc]
or dword [esi + 0x1384], 0xffffffff
call fcn.004b0433
mov eax, esi
pop esi
ret 4
Function at 0x48f931
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x6ad915
call fcn.00664608
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push esi
mov dword [edi], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.00427a37
lea ecx, [edi + 0x18]
mov dword [ebp - 4], ebx
lea eax, [esi + 0x18]
mov dword [ecx], ebx
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00427a37
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], ecx
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
lea ecx, [edi + 0x60]
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov al, byte [esi + 0x5c]
mov byte [edi + 0x5c], al
mov al, byte [esi + 0x5d]
mov byte [edi + 0x5d], al
mov al, byte [esi + 0x5e]
mov byte [edi + 0x5e], al
lea eax, [esi + 0x60]
push eax
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00427a37
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x7c]
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], ecx
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
mov al, byte [edi + 0x8c]
xor al, byte [esi + 0x8c]
and al, 1
mov byte [ebp - 4], 2
xor byte [edi + 0x8c], al
mov al, byte [edi + 0x8c]
mov cl, byte [esi + 0x8c]
xor cl, al
and cl, 2
xor cl, al
mov byte [edi + 0x8c], cl
mov al, byte [esi + 0x8c]
xor al, cl
and al, 4
xor al, cl
mov byte [edi + 0x8c], al
mov cl, byte [esi + 0x8c]
xor cl, al
and cl, 8
xor cl, al
mov byte [edi + 0x8c], cl
mov al, byte [esi + 0x8c]
xor al, cl
and al, 0x10
xor al, cl
lea ecx, [edi + 0xa4]
mov byte [edi + 0x8c], al
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
lea eax, [esi + 0xa4]
push eax
mov dword [ecx], ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00410794
lea ecx, [edi + 0xbc]
mov byte [ebp - 4], 3
lea eax, [esi + 0xbc]
mov dword [ecx], ebx
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00410794
mov al, byte [esi + 0xd4]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0xd4], al
mov eax, dword [esi + 0xd8]
mov dword [edi + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [edi + 0xdc], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4ac9a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x14]
movzx eax, word [ebx + 0x13c]
cmp ax, bp
je 0x4aca72
push esi
push edi
mov edi, dword [ebx + 0x248]
mov edx, 0x173
and eax, edx
mov esi, ebp
and esi, edx
movzx ecx, ax
mov dword [esp + 0x10], esi
mov esi, dword [edi]
movzx eax, ax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
cmp esi, edi
je 0x4aca00
mov ecx, dword [esi + 8]
push ebp
mov eax, dword [ecx]
call dword [eax + 0x44]
mov esi, dword [esi]
cmp esi, edi
jne 0x4ac9ed
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
cmp ax, di
je 0x4aca28
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x90]
cmp byte [ebx + 0x154], 3
mov ecx, eax
je 0x4aca28
mov byte [0x7bb0a0], 1
movzx esi, word [ebx + 0x13c]
mov word [ebx + 0x13c], bp
cmp word [esp + 0x14], di
je 0x4aca59
cmp dword [0x7b6104], 8
mov eax, 0x7b60f0
jb 0x4aca50
mov eax, dword [0x7b60f0]
push ecx
push eax
mov ecx, ebx
call fcn.00498dd0
xor esi, ebp
mov eax, 0x80
pop edi
cmp si, ax
pop esi
jne 0x4aca72
push 0
push 0
mov ecx, ebx
call fcn.0049804b
pop ebp
pop ebx
pop ecx
pop ecx
ret 4

Function at 0x4acf49
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
push 0x80
push 5
push dword [ebp + 8]
mov edi, ecx
call fcn.00452e49
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4acf81
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.00452e11
test eax, eax
je 0x4acf89
lea eax, [ebp - 8]
push eax
call fcn.00452ddb
xor al, al
pop edi
pop esi
leave
ret 8
push dword [ebp - 0xc]
mov ecx, edi
push dword [ebp - 0x10]
call fcn.004ac4fa
mov eax, dword [edi + 0x23c]
xor esi, esi
sub eax, dword [edi + 0x238]
sar eax, 3
test eax, eax
je 0x4acfc7
push esi
mov ecx, edi
call fcn.004a9119
mov eax, dword [edi + 0x23c]
inc esi
sub eax, dword [edi + 0x238]
sar eax, 3
cmp esi, eax
jb 0x4acfab
mov ecx, dword [edi + 0x778]
mov eax, dword [edi + 0x77c]
add ecx, 0x3fff
adc eax, 0
shrd ecx, eax, 0xe
lea eax, [ebp - 8]
push eax
mov dword [edi + 0xf0], ecx
call fcn.00452ddb
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0049c93a
cmp dword [eax + 0x14], 8
jb 0x4ad002
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea ecx, [ebp - 0x28]
call fcn.00427afc
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0049c93a
cmp byte [ebp + 0xc], 0
je 0x4ad066
cmp dword [eax + 0x14], 8
jb 0x4ad02a
mov eax, dword [eax]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00427afc
test esi, esi
je 0x4acf81
mov ecx, edi
mov byte [ebp - 1], 1
call fcn.0049b2e7
lea ecx, [ebp - 1]
push dword [eax + 0x20]
push ecx
mov ecx, eax
call fcn.004fb07b
mov al, 1
jmp 0x4acf83
cmp dword [eax + 0x14], 8
jb 0x4ad06e
mov eax, dword [eax]
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
jmp 0x4ad034
Function at 0x4af334
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
mov ebp, SysReAllocString
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4af34c
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4af38d
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, ebp
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebp
pop ebx
ret

Function at 0x4af3fa
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4af403
pop esi
ret

Function at 0x4b0433
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [esp + 0x14]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jb 0x4b0448
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
ret 8

Function at 0x4b11bf
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [0x7ba6a6], 0
je 0x4b1259
push dword [ebp + 8]
lea eax, [ebp - 0x30]
push 0x6e16bc
push eax
call fcn.004577f2
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4b11ee
mov eax, dword [eax]
push eax
call fcn.0067ecd0
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00427afc
push dword [ebp + 8]
lea eax, [ebp - 0x30]
push str.TEMP_s
push eax
call fcn.004577f2
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4b1219
mov eax, dword [eax]
push eax
call fcn.0067ecd0
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00427afc
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x6e16dc
push eax
call fcn.004577f2
add esp, 0xc
lea eax, [ebp - 0x18]
cmp dword [ebp - 4], 8
jb 0x4b1248
mov eax, dword [ebp - 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
lea ecx, [ebp - 0x18]
call fcn.00427afc
leave
ret 4