joyce8/EMBER2024-capa huggingface dataset:
Function at 0x728314
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ebx, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x728330
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00727f64
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x48], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x44], ecx
inc edi
cmp edi, 9
jne 0x728391
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1048]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00727f64
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x7283d7
add ebx, 0x400
dec edi
jne 0x7283d5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x72841c
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff9c
push ebx
push esi
push edi
mov byte [ebp - 0x1051], cl
mov dword [ebp - 0x1050], edx
mov dword [ebp - 0x104c], eax
mov ebx, dword [ebp + 0x14]
lea esi, [ebp - 0x1060]
push esi
mov esi, 0x84d978
lea edi, [ebp - 0x48]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
mov esi, 0x84d9c0
lea edi, [ebp - 0x1048]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop esi
mov edi, ebx
test edi, edi
je 0x728475
mov edi, dword [edi - 4]
push ebp
mov eax, ebx
call fcn.0040ba84
mov edx, edi
call fcn.00728314
pop ecx
mov ebx, dword [ebp - 0x104c]
cmp byte [ebp - 0x1051], 0
je 0x7284a9
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x105c], 1
jmp 0x7284bc
lea eax, [ebp - 4]
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x105c], 0xffffffff
mov edi, dword [ebp - 0x1050]
shr edi, 3
dec edi
test edi, edi
jl 0x7285d1
inc edi
cmp dword [ebp + 0x10], 0
jne 0x7284d9
cmp dword [ebp + 0xc], 0
je 0x728558
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
movzx eax, byte [eax]
inc eax
and al, 0xff
lea edx, [ebp + 0xc]
add edx, dword [esi]
mov byte [edx], al
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x728504
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x7284e1
mov eax, dword [ebp + 0xc]
call fcn.00727f38
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.00727f38
mov dword [ebp - 0x1064], eax
push ebp
mov eax, dword [ebp - 0x105c]
push eax
lea edx, [ebp - 0x1064]
mov eax, esi
mov ecx, dword [ebp - 0x1058]
call fcn.00727f64
pop ecx
mov eax, dword [esi]
call fcn.00727f38
xor dword [ebx], eax
mov eax, dword [ebp - 0x1064]
call fcn.00727f38
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x7285c7
cmp byte [ebp + 8], 0
jne 0x7285ae
mov eax, dword [ebx]
call fcn.00727f38
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.00727f38
mov dword [ebp - 0x1064], eax
push ebp
mov eax, dword [ebp - 0x105c]
push eax
lea edx, [ebp - 0x1064]
mov eax, esi
mov ecx, dword [ebp - 0x1058]
call fcn.00727f64
pop ecx
mov eax, dword [esi]
call fcn.00727f38
mov dword [ebx], eax
mov eax, dword [ebp - 0x1064]
call fcn.00727f38
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x7285c7
push ebp
mov eax, dword [ebp - 0x105c]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1058]
call fcn.00727f64
pop ecx
add ebx, 8
dec edi
jne 0x7284cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x728768
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov dword [esp], edx
mov ebx, eax
cmp dword [esp], 0
jle 0x7288af
mov eax, dword [esp]
add eax, 2
mov edx, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
shl edx, 2
mov eax, esi
xor ecx, ecx
call fcn.0040bb40
mov ecx, dword [esi]
mov eax, dword [esp]
mov edx, 0x55555556
imul edx
mov esi, edx
shr esi, 0x1f
add esi, edx
test esi, esi
jle 0x728815
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x84e9c0]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x84e9c0]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x84e9c0]
mov byte [ecx + 2], dl
and eax, 0x3f
movzx eax, byte [eax + 0x84e9c0]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x7287b5
mov esi, dword [esp]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [edx + edx*2]
sub esi, edx
dec esi
je 0x728836
dec esi
je 0x728867
jmp 0x7288b6
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x84e9c0]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x84e9c0]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x7288b6
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x84e9c0]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x84e9c0]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x84e9c0]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x7288b6
mov eax, esi
call fcn.0040b078
pop edx
pop esi
pop ebx
ret

Function at 0x72acfc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor edx, edx
mov dword [esp], edx
lea edx, [eax + 0x250]
xor ecx, ecx
mov dword [edx], ecx
inc dword [esp]
add edx, 4
cmp dword [esp], 8
jb 0x72ad0c
xor edx, edx
mov dword [esp], edx
jmp 0x72ade9
mov ecx, dword [esp]
mov edx, dword [eax + 0x240]
shl ecx, 6
xor ebx, ebx
movzx esi, byte [edx + ecx]
xor edx, edx
jmp 0x72ad77
lea edi, [edx + ecx]
mov ebp, dword [eax + 0x240]
inc edx
movzx edi, byte [ebp + edi]
xor edi, esi
mov ebp, dword [eax + 0x240]
or ebx, edi
lea edi, [edx + ecx]
inc edx
movzx edi, byte [ebp + edi]
xor edi, esi
mov ebp, dword [eax + 0x240]
or ebx, edi
lea edi, [edx + ecx]
inc edx
movzx edi, byte [ebp + edi]
xor edi, esi
mov ebp, dword [eax + 0x240]
or ebx, edi
lea edi, [edx + ecx]
movzx edi, byte [ebp + edi]
xor edi, esi
or ebx, edi
inc edx
cmp edx, 0x40
jb 0x72ad77
test ebx, ebx
jne 0x72ade6
mov ecx, dword [esp]
and ecx, 0x1f
mov edx, 1
shl edx, cl
mov ecx, dword [esp]
shr ecx, 5
or dword [eax + ecx*4 + 0x250], edx
inc dword [esp]
mov edx, dword [esp]
cmp edx, dword [eax + 0xcc]
jb 0x72ad26
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x76cb60
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x76cb81
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x76cb81
xor eax, eax
ret
mov al, 1
ret

Function at 0x77011c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040becc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x770135
test al, 0x10
jne 0x770139
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x7701d4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x20]
call fcn.0040b148
xor eax, eax
push ebp
push 0x7703e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00408670
mov esi, eax
cmp dword [ebp + 0x20], 0
je 0x77027f
cmp dword [ebp - 0x10], 0
je 0x77027f
mov dl, 1
mov eax, dword [ebp + 0x20]
call fcn.00431b38
test al, al
jne 0x770235
mov eax, dword [ebp + 0x20]
call fcn.0077011c
test al, al
je 0x770258
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.0040becc
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x770279
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.0040becc
push eax
call sub.shell32.dll_SHGetFileInfoW
mov esi, dword [ebp - 0x2cc]
cmp byte [ebp + 0x1c], 0
je 0x7702a6
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x7703f4
call sub.shell32.dll_SHGetFileInfoW
mov ebx, eax
jmp 0x7702c5
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x7703f4
call sub.shell32.dll_SHGetFileInfoW
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.comctl32.dll_ImageList_GetIconSize
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 4], eax
cmp byte [ebp + 0x18], 0
je 0x770304
cmp byte [ebp + 0x14], 0
jne 0x770304
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004f7324
push eax
push esi
push ebx
call sub.comctl32.dll_ImageList_Draw
movzx eax, byte [ebp + 0x18]
and al, byte [ebp + 0x14]
je 0x7703c9
mov dl, 1
mov eax, dword [0x4f15c0]
call fcn.004fcef4
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x7703c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004fd8dc
call fcn.004f7324
push eax
push esi
push ebx
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00407c34
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00407c34
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d4], eax
lea edx, [ebp - 0x2e0]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00770038
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7703c9
mov eax, dword [ebp - 0x1c]
call fcn.00409258
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7703e8
lea eax, [ebp + 0x20]
call fcn.0040b054
pop eax
jmp eax
Function at 0x7727c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xd8
push 0
push 0
dec ecx
jne 0x7727d1
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x548]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x779bb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.0040b054
lea eax, [ebp - 0x18]
call fcn.0040b054
mov eax, dword [ebp + 0x34]
mov eax, dword [eax]
sub dword [ebp - 0x53c], eax
mov eax, dword [ebp + 0x3c]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x3e], 0
mov byte [ebp - 0x3f], 0
mov eax, dword [ebp + 0x18]
mov byte [eax], 0
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
lea esi, [ebp - 0x548]
lea edi, [ebp - 0x558]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 8]
call fcn.0040b054
mov eax, dword [ebp + 0x44]
cmp byte [eax - 0x35], 0
je 0x779a51
cmp byte [ebp + 0x40], 0
jne 0x779a51
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp + 0x44]
mov dword [edx - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x44]
call fcn.004f5cbc
mov eax, dword [ebp + 0x44]
mov eax, dword [eax - 0x44]
push eax
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
add eax, dword [ebp - 0x544]
push eax
mov eax, dword [ebp + 0x44]
mov edx, dword [eax - 0x4c]
mov ecx, dword [ebp - 0x544]
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x7c]
jmp 0x779a51

Function at 0x7807ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040becc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7807c5
test al, 0x10
jne 0x7807c9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x780e70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x780f3d
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x780f1a
push 0
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x780f03
mov edi, dword [ebp - 0xc]
test edi, edi
jbe 0x780f08
lea ebx, [ebp - 0x100c]
movzx eax, byte [ebx]
mov edx, esi
call fcn.00780e54
add esi, eax
inc ebx
dec edi
jne 0x780ef1
jmp 0x780f08
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1000
je 0x780ec5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, esi
call fcn.00780e6c
mov esi, eax
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x780f44
lea eax, [ebp - 4]
call fcn.0040b054
pop eax
jmp eax
Function at 0x794180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040becc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x794199
test al, 0x10
jne 0x79419d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x7945b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
mov eax, esi
call fcn.0040b054
call fcn.0043a938
sub eax, 2
je 0x7945dc
jmp 0x7946b5
call fcn.0043a94c
sub eax, 5
je 0x7945f3
dec eax
je 0x794663
sub eax, 4
je 0x794663
jmp 0x7946b5
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x79465c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push 0
push 0
movsx eax, bl
push eax
push 0
call sub.shell32.dll_SHGetFolderLocation
test eax, eax
jne 0x794643
lea eax, [ebp - 0x422]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x794643
mov eax, esi
lea edx, [ebp - 0x422]
mov ecx, 0x20b
call fcn.0040bf80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7946b5
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
pop eax
jmp eax
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x7946ae
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x794695
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.0040bf2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7946b5
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
pop eax
jmp eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7946e4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0
push 0x1a
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
jne 0x794717
mov ecx, 0x79473c
mov dl, 1
mov eax, dword [0x42888c]
call fcn.004394a8
call fcn.0040a700
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.0040bf80
add esp, 0x208
pop ebx
ret
Function at 0x7953c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x79548d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
lea eax, [ebp - 0x210]
mov edx, dword [ebp - 4]
call fcn.0043260c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x795475
mov eax, ebx
call fcn.00407108
mov edi, eax
push edi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x79549c
push edi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x79546e
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x79546e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [esi + 4], eax
mov eax, edi
call fcn.00407124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x795494
lea eax, [ebp - 4]
call fcn.0040b054
pop eax
jmp eax

Function at 0x795c68
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xfffffe6c
mov esi, eax
or ebx, 0xffffffff
lea eax, [esp + 4]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x795c9f
push 3
push 5
mov ecx, 0x795d0c
mov edx, 0x3d4
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x48]
jmp 0x795cf3
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x795cf3
push 4
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 4
lea eax, [esp + 4]
push eax
push 0x1002
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 4
lea eax, [esp + 4]
push eax
push 8
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
mov eax, ebx
add esp, 0x194
pop esi
pop ebx
ret

Function at 0x795ff0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x796063
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
test ebx, ebx
jbe 0x79604b
lea eax, [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79606a
lea eax, [ebp - 4]
call fcn.0040b054
pop eax
jmp eax
Function at 0x796074
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x796125
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
test esi, esi
jbe 0x79610d
push 0
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x7960f9
mov edx, dword [ebp - 8]
test edx, edx
jbe 0x7960fe
lea eax, [ebp - 0x1008]
movzx ecx, byte [eax]
add ebx, ecx
inc eax
dec edx
jne 0x7960ee
jmp 0x7960fe
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1000
je 0x7960c5
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x79612c
lea eax, [ebp - 4]
call fcn.0040b054
pop eax
jmp eax

Function at 0x7965f8
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b158
xor eax, eax
push ebp
push 0x7966df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ba84
mov esi, eax
push esi
call sub.LZ32.DLL_LZOpenFileA
mov ebx, eax
lea eax, [ebp - 0x191]
push eax
push esi
call sub.LZ32.DLL_GetExpandedNameA
dec eax
jne 0x79668d
mov eax, edi
lea edx, [ebp - 0x191]
mov ecx, 0x105
call fcn.0040bf68
push 0x1000
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x191]
push eax
call sub.LZ32.DLL_LZOpenFileA
mov esi, eax
push esi
push ebx
call sub.LZ32.DLL_LZCopy
push esi
call sub.LZ32.DLL_LZClose
jmp 0x796697
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040bf9c
push ebx
call sub.LZ32.DLL_LZClose
lea eax, [ebp - 0x198]
mov edx, dword [ebp - 4]
call fcn.0040bf9c
mov eax, dword [ebp - 0x198]
call fcn.0040becc
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7966e6
lea eax, [ebp - 0x198]
call fcn.0040b054
lea eax, [ebp - 4]
call fcn.0040b078
pop eax
jmp eax