joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e3b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4b3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
call fcn.0045e1e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x45e43d
push 0x4a1fe0
mov ecx, edi
call fcn.0042d680
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45e53f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x45e53f
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push ecx
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push 0x4a1fe0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov esi, eax
call fcn.0042d680
mov byte [ebp - 4], 1
test esi, esi
je 0x45e4ef
push esi
call fcn.0045f1c8
add esp, 4
mov ebx, eax
push ebx
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45e4e6
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x49a36c
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45e4e6
cmp dword [ebp - 0x20], 0
je 0x45e4e6
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0xfeef04bd
jne 0x45e4e6
movzx esi, word [eax + 0xa]
movzx edx, word [eax + 8]
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
push ecx
push edx
push esi
lea eax, [ebp - 0x18]
push str._d._d._d._d
push eax
call fcn.0042fcb0
add esp, 0x18
push ebx
call fcn.0045f190
add esp, 4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0042ed60
add eax, 0x10
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
or esi, 0xffffffff
mov dword [edi], eax
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45e520
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x45e53f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f17f
mov esp, ebp
pop ebp
ret
Function at 0x45e6b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ab08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr eax, 8
movzx eax, al
movzx ebx, cl
mov dword [ebp - 0x18], eax
cmp ecx, 0x80000000
jae 0x45e70a
mov edi, ecx
shr edi, 0x10
cmp ebx, 6
jb 0x45e71d
cmp eax, 2
jb 0x45e71d
mov ecx, esi
call fcn.0045e9f0
jmp 0x45e788
call fcn.0040f7b0
mov ecx, eax
test ecx, ecx
jne 0x45e732
push 0x80004005
call fcn.0041ffd0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push ebx
push str._d._d___d_
push eax
call fcn.0042fcb0
mov edi, dword [ebp - 0x14]
add esp, 0x14
add edi, 0xfffffff0
mov ecx, edi
call fcn.0042ed60
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45e788
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f17f
mov esp, ebp
pop ebp
ret

Function at 0x478616
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00478495

Function at 0x47a4b6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047a176
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x444147]
shl eax, 2
mov dword [0x44414b], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0043ba70
pop edx
call fcn.0043ae44
call fcn.0043ba74
push 0
call fcn.0043c784
pop ecx
push 0x4440f0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x44414f], eax
push 0
jmp fcn.00441c20

Function at 0x402008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
mov byte [esi], 0
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x1a
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x40207d
push esi
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
test eax, eax
je 0x40207d
cmp byte [esi], 0
je 0x40207d
mov eax, esi
call fcn.00401f08
push str.WinRAR
push esi
call fcn.0043bc48
add esp, 8
xor edx, edx
mov eax, esi
call fcn.00404404
test al, al
jne 0x402078
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00403ef8
test eax, eax
je 0x402078
xor ebx, ebx
jmp 0x40207d
mov ebx, 1
test bl, bl
jne 0x402095
push 0x400
push esi
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov eax, esi
call fcn.00401fd8
push dword [ebp - 8]
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4020a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebx], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareWinRARPaths
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4020f6
mov dword [ebp - 8], 0x400
lea edx, [ebp - 8]
lea ecx, [ebp - 0xc]
push edx
push ebx
push ecx
push 0
push str.AppData
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
cmp byte [ebx], 0
je 0x402108
xor edx, edx
mov eax, ebx
call fcn.00404404
test al, al
jne 0x40210f
mov eax, ebx
call fcn.00402008
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403234
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x403257
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x403268
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x403277
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x403284
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.0040c808
test eax, eax
je 0x4032b1
test esi, esi
je 0x4032b1
cmp word [esi], 0
je 0x4032b1
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x4032c8
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x4032e1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x4032e1
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40334f
mov dword [ebx + 4], edi
test esi, esi
je 0x403316
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.0040bdf4
jmp 0x40331f
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x403336
push dword [ebp - 4]
lea ecx, [ebx + 0x17]
push ecx
call fcn.0043bd24
add esp, 8
jmp 0x403345
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.0040bbd0
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.00403480
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403674
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
test esi, esi
je 0x403830
cmp dword [edi + 0xc], 0
je 0x4036b3
mov eax, dword [edi + 0xc]
dec eax
je 0x40369d
dec eax
je 0x4036a9
jmp 0x4036b3
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x4036b3
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
mov byte [ebp - 5], 0
xor edx, edx
mov dword [ebp - 0xc], edx
cmp dword [edi + 0xc], 0
je 0x40370f
xor ebx, ebx
cmp esi, ebx
jle 0x40372c
push 0
lea eax, [ebp - 0xc]
push eax
mov edx, esi
sub edx, ebx
cmp edx, 0x4000
jge 0x4036e0
mov ecx, esi
sub ecx, ebx
jmp 0x4036e5
mov ecx, 0x4000
push ecx
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 5], dl
test dl, dl
je 0x40372c
add ebx, 0x4000
cmp esi, ebx
jg 0x4036c8
jmp 0x40372c
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
jne 0x40382c
cmp byte [edi + 0x14], 0
je 0x40382c
cmp dword [edi + 0xc], 0
jne 0x40382c
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, edi
call fcn.00403a68
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
lea eax, [edi + 0x17]
call fcn.004042e8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
push ebx
call sub.KERNEL32.DLL_SetLastError
mov eax, esi
cdq
cmp edx, dword [ebp - 0x18]
jne 0x403781
cmp eax, dword [ebp - 0x1c]
jae 0x4037c9
jmp 0x403783
jge 0x4037c9
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4037a3
cmp eax, 0xffffffff
ja 0x4037c9
jmp 0x4037a5
jg 0x4037c9
mov eax, esi
cdq
add eax, dword [ebp - 0x14]
adc edx, dword [ebp - 0x10]
cmp edx, 0
jne 0x4037ba
cmp eax, 0xffffffff
jbe 0x4037c9
jmp 0x4037bc
jle 0x4037c9
lea edx, [edi + 0x17]
mov eax, 0x448c38
call fcn.00433abc
lea edx, [edi + 0x17]
mov eax, 0x448c38
call fcn.00433af0
test al, al
je 0x403816
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
jae 0x4036b3
cmp dword [ebp - 0xc], 0
jbe 0x4036b3
mov eax, edi
call fcn.00403a68
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.004039b0
jmp 0x4036b3
lea ecx, [edi + 0x17]
mov eax, 0x448c38
xor edx, edx
call fcn.00433aa4
jmp 0x40382c
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40392c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x403956
cmp esi, 0x4e20
jle 0x40394c
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4039a6
mov eax, ebx
call fcn.00403cbc
test al, al
je 0x40398d
cmp esi, 0x4e20
jle 0x40398d
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040392c
jmp 0x4039a9
cmp dword [ebx + 0xc], 1
jne 0x4039a1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x4039a1
xor eax, eax
jmp 0x4039a9
or eax, 0xffffffff
jmp 0x4039a9
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x403ef8
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.0040c808
test eax, eax
je 0x403f1e
test ebx, ebx
je 0x403f1e
cmp word [ebx], 0
je 0x403f1e
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x403f26
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x403f39
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00404720
xor eax, eax
jmp 0x403f54
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x403f48
cmp eax, 3
jne 0x403f4f
mov eax, 2
jmp 0x403f54
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x4042a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
lea edx, [ebp - 0x400]
call fcn.00402664
cmp byte [ebp - 0x400], 0
je 0x4042c5
lea eax, [ebp - 0x400]
jmp 0x4042c7
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x4042db
cmp eax, 5
je 0x4042db
xor edx, edx
jmp 0x4042e0
mov edx, 1
mov eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x4042e8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
mov ebx, eax
lea edx, [ebp - 0x430]
mov eax, ebx
call fcn.00402664
cmp dword [0x44421c], 0
jne 0x40432b
push 0x444224
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x40432b
push str.GetDiskFreeSpaceExA
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x44421c], eax
cmp dword [0x44421c], 0
je 0x40439c
lea edx, [ebp - 0x430]
mov ecx, 0x400
mov eax, ebx
call fcn.00401f50
xor eax, eax
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
push edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x18]
push eax
cmp byte [ebp - 0x430], 0
je 0x40436b
lea edx, [ebp - 0x430]
jmp 0x40436d
xor edx, edx
push edx
call dword [0x44421c]
test eax, eax
je 0x40439c
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
ja 0x40439c
mov eax, dword [ebp - 0x14]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x18]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp 0x4043fe
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x24]
push ecx
push eax
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push edx
push ecx
cmp byte [ebp - 0x430], 0
je 0x4043bd
lea eax, [ebp - 0x430]
jmp 0x4043bf
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x4043d2
mov eax, 0x163e00
xor edx, edx
jmp 0x4043fe
mov eax, dword [ebp - 0x1c]
imul dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
call fcn.0043e820
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404404
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040c808
test eax, eax
je 0x40442f
test ebx, ebx
je 0x40442f
cmp word [ebx], 0
je 0x40442f
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x4046f4
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040c808
test eax, eax
je 0x404716
test ebx, ebx
je 0x404716
cmp word [ebx], 0
je 0x404716
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x404720
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0040c808
test eax, eax
je 0x40474d
test ebx, ebx
je 0x40474d
cmp word [ebx], 0
je 0x40474d
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x40475c
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x404a60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0040c808
test eax, eax
je 0x404ac7
test ebx, ebx
je 0x404a8d
cmp word [ebx], 0
jne 0x404a97
test esi, esi
je 0x404ac7
cmp word [esi], 0
je 0x404ac7
lea ecx, [ebp - 0x1004]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00402fe8
push eax
lea ecx, [ebp - 0x804]
mov edx, ebx
mov eax, edi
call fcn.00402fe8
push eax
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne al
and eax, 1
jmp 0x404ad8
push dword [ebp - 4]
push edi
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x404bdc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3b8
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040c808
test eax, eax
je 0x404c99
test ebx, ebx
je 0x404c99
cmp word [ebx], 0
je 0x404c99
xor esi, esi
push str.shell32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x404c27
push str.SHFileOperationW
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
test esi, esi
jne 0x404c32
xor eax, eax
jmp 0x404d01
lea edx, [ebp - 0x804]
mov eax, ebx
call fcn.004047b0
lea eax, [ebp - 0x804]
call fcn.0040bde0
mov word [ebp + eax*2 - 0x802], 0
push 0x1e
push 0
lea edx, [ebp - 0x824]
push edx
call fcn.0043bba4
mov dword [ebp - 0x820], 3
mov word [ebp - 0x814], 0x54
add esp, 0xc
lea ecx, [ebp - 0x804]
mov dword [ebp - 0x81c], ecx
lea eax, [ebp - 0x824]
push eax
call esi
test eax, eax
sete al
and eax, 1
jmp 0x404d01
lea edx, [ebp - 0xc28]
mov eax, esi
call fcn.00404760
lea edx, [ebp - 0xc28]
push edx
call fcn.0043bd54
pop ecx
mov byte [ebp + eax - 0xc27], 0
push 0x1e
push 0
lea ecx, [ebp - 0xc48]
push ecx
call fcn.0043bba4
mov dword [ebp - 0xc44], 3
mov word [ebp - 0xc38], 0x54
add esp, 0xc
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xc40], eax
lea edx, [ebp - 0xc48]
push edx
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4051a8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4051b1
mov eax, dword [ebp - 4]
add esp, 0xfffffb2c
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x14b8]
lea eax, [ebp - 0x4a4]
call fcn.00415608
lea eax, [ebp - 0x478]
call fcn.00415608
lea eax, [ebp - 0x44c]
call fcn.00415608
push 0
lea ecx, [ebp - 0x10b8]
mov edx, ebx
mov eax, esi
call fcn.0040f8cc
test al, al
jne 0x40520e
xor eax, eax
jmp 0x40535f
cmp byte [ebp - 0x10b8], 0
je 0x405220
cmp byte [ebp - 0x420], 0
jne 0x405227
xor eax, eax
jmp 0x40535f
lea eax, [ebp - 0x10b8]
call fcn.004019f4
lea edx, [ebp - 0x420]
call fcn.00401764
test eax, eax
je 0x405257
mov eax, esi
call fcn.004019f4
lea edx, [ebp - 0x420]
call fcn.00401764
test eax, eax
je 0x40525e
xor eax, eax
jmp 0x40535f
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.004019b0
push ebx
push str.rtmp_d
mov eax, edi
call fcn.004019f4
push eax
call fcn.0043d474
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00404404
test al, al
je 0x40529c
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x405260
mov eax, edi
xor edx, edx
call fcn.00404404
test al, al
je 0x4052b0
xor eax, eax
jmp 0x40535f
lea eax, [ebp - 0x18b8]
mov ecx, 0x400
mov edx, esi
call fcn.004019b0
lea eax, [ebp - 0x10b8]
call fcn.004019f4
push eax
lea eax, [ebp - 0x18b8]
call fcn.004019f4
push eax
call fcn.0043bd24
add esp, 8
push edi
lea edx, [ebp - 0x18b8]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x4052f7
xor eax, eax
jmp 0x40535f
lea eax, [ebp - 0x24d8]
call fcn.004031a0
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00404404
test al, al
jne 0x405324
push 1
lea eax, [ebp - 0x24d8]
xor ecx, ecx
mov edx, esi
call fcn.004033b0
mov ebx, eax
lea eax, [ebp - 0x18b8]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40534b
lea eax, [ebp - 0x24d8]
call fcn.00403514
lea eax, [ebp - 0x24d8]
call fcn.004035a4
mov al, 1
push eax
lea eax, [ebp - 0x24d8]
mov edx, 2
call fcn.004031f0
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406f18
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret
Function at 0x40c7a8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x40c7f5
lea edx, [ebp - 0x10]
push edx
push str.SeShutdownPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp - 4]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push 0x80000000
push 0xd
call sub.USER32.DLL_ExitWindowsEx
mov esp, ebp
pop ebp
ret

Function at 0x40c898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x44afbc
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x40c8b8
call fcn.0040c860
mov eax, dword [ebp - 4]
jmp 0x40c8d1
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x40c8d9
test al, 7
jne 0x40c8bd
cmp esi, 8
jb 0x40c962
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x40c8e2
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp esi, dword [ebp - 8]
jbe 0x40c98c
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x40c96c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret