joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0c00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f0c09
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f0d46
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
inc dword [ebx + 0x18]
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.004f0a8c
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x22]
call fcn.0040b124
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.004f08f8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x122]
call fcn.0040b124
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.004f09d4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x222]
call fcn.0040b124
cmp word [esi + 0x42], 0
je 0x4f0c96
push edi
lea eax, [ebp - 1]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x44]
call dword [esi + 0x40]
cmp byte [ebp - 1], 0
jne 0x4f0d07
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00405414
mov eax, dword [ebp - 0x14]
call fcn.0040aa78
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00405414
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x122]
mov ecx, pe_nt_image_headers32
call fcn.00405414
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov edx, 1
call fcn.004efb28
mov eax, dword [ebp - 0x18]
call fcn.00405650
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
mov dword [esi + 0x3a2], eax
xor eax, eax
mov dword [esi + 0x3a6], eax
movzx ebx, byte [ebp - 1]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0d4d
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004051c8
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004051c8
ret
Function at 0x4f4ff0
Capabilities:
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
test dl, dl
jne 0x4f4ffd
or esi, 1
test cl, cl
jne 0x4f5004
or esi, 2
cmp byte [ebp + 8], 0
jne 0x4f500d
or esi, 4
push esi
push 0
push eax
call sub.shell32.dll_SHEmptyRecycleBinA
test eax, 0x80000000
sete al
pop esi
pop ebp
ret 4
Function at 0x50a7d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 8]
xor al, 1
mov byte [ebp - 5], al
test bl, bl
jne 0x50a804
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 4]
cmp eax, 0x1f4
jb 0x50a89a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e], 1
jne 0x50a851
xor ebx, ebx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1f]
sub al, 1
jb 0x50a826
je 0x50a82a
dec al
je 0x50a832
dec al
je 0x50a83a
jmp 0x50a840
xor ebx, ebx
jmp 0x50a840
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xe]
jmp 0x50a840
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x12]
jmp 0x50a840
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x16]
test ebx, ebx
je 0x50a851
mov eax, ebx
call fcn.0050947c
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x4a], 0
je 0x50a88f
xor eax, eax
push ebp
push 0x50a885
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
lea edx, [eax + 0x1e]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x4c]
call dword [ebx + 0x48]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50a88f
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x514680
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x514727
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00405650
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x514711
lea eax, [ebp - 4]
mov edx, edi
call fcn.004058e0
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00405650
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x514711
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x514738
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x514711
cmp dword [ebp - 0xc], 0x34
jne 0x514711
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51472e
lea eax, [ebp - 4]
call fcn.004051a4
ret
Function at 0x5148c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x514a29
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.004039c4
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x542d38], eax
mov eax, dword [ebp - 0xc]
mov dword [0x542d3c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x542d40], eax
mov eax, dword [0x5435d4]
cmp dword [eax], 2
sete byte [0x542cd0]
push 0x514a34
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.00514650
cmp byte [0x542cd0], 0
jne 0x51494c
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00514680
test al, al
je 0x51494c
mov eax, dword [ebp - 0x4c]
mov dword [0x549d6c], eax
jmp 0x514953
xor eax, eax
mov dword [0x549d6c], eax
call fcn.0051475c
and eax, 0x7f
cmp eax, 0xb
ja case.0x514964.0
jmp dword [eax*4 + 0x51496b]
mov byte [0x542cbc], 1
jmp case.0x514964.0
mov byte [0x542cc0], 1
jmp case.0x514964.0
mov byte [0x542cc4], 1
jmp case.0x514964.0
mov byte [0x542cc8], 1
jmp case.0x514964.0
mov byte [0x542ccc], 1
jmp case.0x514964.0
mov byte [0x542cd4], 1
mov byte [0x542cd8], 1
jmp case.0x514964.0
mov byte [0x542cd4], 1
mov byte [0x542cdc], 1
jmp case.0x514964.0
mov byte [0x542cd4], 1
mov byte [0x542ce0], 1
jmp case.0x514964.0
mov byte [0x542ce4], 1
jmp case.0x514964.0
mov byte [0x542ce8], 1
jmp case.0x514964.0
mov byte [0x542cec], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514a30
lea eax, [ebp - 4]
call fcn.004051a4
ret
Function at 0x514b0c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], 0
xor eax, eax
push ebp
push 0x514c67
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
jne 0x514b7c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x514b7c
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x514c2d
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
mov eax, dword [0x543108]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
call fcn.00410018
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x514bd0
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x514bd5
call fcn.00514264
mov eax, dword [ebp - 0x10]
call fcn.00402f50
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
call fcn.00410018
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x514c2d
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + esi*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x514c2d
inc esi
dec ebx
jne 0x514c09
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514c6e
cmp dword [ebp - 0x14], 0
je 0x514c48
mov eax, dword [ebp - 0x14]
call fcn.00402f84
cmp byte [ebp - 0x15], 0
je 0x514c57
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x514c66
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
Function at 0x52fa24
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52fbda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0052fe00
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x456], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x45a], edx
lea ecx, [ebp - 0xc]
mov edx, 0x52fbec
mov eax, 0x52fc08
call fcn.0044bba4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x45e
call fcn.00405a04
mov eax, dword [ebp - 4]
mov byte [eax + 0x462], 0
cmp byte [ebp - 5], 1
jne 0x52fae0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x488], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x48c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x492], 0
mov dword [eax + 0x496], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x49a], 0
mov dword [eax + 0x49e], 0
cmp byte [ebp - 5], 3
jne 0x52fb15
xor eax, eax
push ebp
push 0x52fb0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x4a6
call fcn.00410504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52fb15
call sub.kernel32.dll_GetTickCount_1
sub eax, 0x3e8
mov edx, dword [ebp - 4]
mov dword [edx + 0x47b], eax
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x52c160
mov eax, dword [ebp - 4]
push eax
push 0x52bf04
mov eax, dword [0x543510]
cmp byte [eax], 0
je 0x52fb57
call fcn.0050aac0
test al, al
jne 0x52fb5b
xor eax, eax
jmp 0x52fb5d
mov al, 1
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x46d]
mov dl, 1
mov eax, dword [0x50ab38]
call fcn.0050ac14
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x473], ebx
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0x477], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x473]
call fcn.004257fc
lea ecx, [ebp - 0x10]
mov edx, 0x52fc20
mov eax, 0x52fc3c
call fcn.0044bba4
mov edx, dword [ebp - 0x10]
mov eax, dword [0x54344c]
mov eax, dword [eax]
mov eax, dword [eax + 0x414]
call fcn.004d119c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fbe1
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004059e0
ret
Function at 0x536a80
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x536baa
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x536bc0
call fcn.0040ad48
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
call fcn.0040523c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00438560
test al, al
je 0x536b8f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00438490
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00438560
test al, al
je 0x536b2c
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x536bd0
call fcn.0040ad48
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
call fcn.0040523c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00438490
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00405650
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00405650
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00438560
test al, al
jne 0x536b8f
push 1
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov cl, 1
call fcn.00438424
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00438560
test al, al
jne 0x536b84
push 0x3e8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_WaitForSingleObject
push 1
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov cl, 1
call fcn.00438424
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00438490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536bb1
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051c8
ret
Function at 0x4044f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5387e3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x582904]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x404530
mov eax, dword [esi]
push 0x5415ec
push eax
call fcn.005123e8
mov edi, eax
add esp, 8
test edi, edi
jne 0x404548
xor al, al
jmp 0x4045b2
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp - 0x2c]
call fcn.00512618
push edi
call fcn.005122c1
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00404f90
add esp, 0x1c
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 4], 0
jb 0x404578
mov esi, dword [esi]
push esi
mov ecx, ebx
call fcn.004041a0
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4045b0
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4045a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4045d0
push edx
push ecx
call fcn.0050b532
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret 0xc
call fcn.00511c7b
int3

Function at 0x41e510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movss xmm1, dword [ebp + 8]
divss xmm1, dword [0x5415b8]
push esi
mov esi, ecx
push edi
xor edi, edi
movss xmm0, dword [esi + 8]
addss xmm0, xmm1
movss dword [ebp + 8], xmm1
movss dword [esi + 8], xmm0
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0x10]
sar eax, 2
test eax, eax
je 0x41e5cd
nop word [eax + eax]
mov eax, dword [esi + 0x10]
sub esp, 8
movss xmm0, dword [esi + 8]
mov ecx, dword [eax + edi*4]
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [esi + 0x10]
movss xmm0, dword [esi + 4]
mov ecx, dword [eax + edi*4]
movzx eax, byte [esi + 0xc]
push eax
sub esp, 0x14
mov edx, dword [ecx]
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [esi]
xorps xmm0, xmmword [0x542190]
movss dword [esp + 8], xmm0
movss xmm0, dword [ebp + 8]
movss dword [esp + 4], xmm0
movss xmm0, dword [esi + 8]
movss dword [esp], xmm0
call dword [edx + 0xc]
mov eax, dword [esi + 0x14]
inc edi
sub eax, dword [esi + 0x10]
movss xmm1, dword [ebp + 8]
sar eax, 2
cmp edi, eax
jb 0x41e550
pop edi
pop esi
pop ebp
ret 4

Function at 0x423ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00513df5
add esp, 0x10
pop ebp
ret 8

Function at 0x423d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00512618
add esp, 0x10
pop ebp
ret 8
Function at 0x43a890
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
lea eax, [edi + 4]
mov dword [edi + 0x44], edi
mov dword [edi + 0x48], eax
call fcn.00517590
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
lea edx, [eax - 0x5d4cf43]
lea ecx, [eax + 0x14593bf1]
ror eax, 7
xor edx, ecx
add eax, 0x6768eb15
mov dword [edi + esi*4], edx
inc esi
cmp esi, 0x11
jl 0x43a8b0
mov eax, edi
pop edi
pop esi
ret

Function at 0x44e2a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 1
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44e2c8
xor eax, eax
pop ebx
pop ebp
ret
push esi
push edi
push 0x10
call fcn.0050b502
add esp, 4
mov edi, eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
push ebx
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
mov esi, eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
mov eax, edi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44f620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x582904]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0044f980
add esp, 8
test edi, edi
je 0x44f687
cmp dword [ebp + 0x10], 0
je 0x44f687
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0x5415ec
cmovae eax, dword [ebp - 0x1c]
push eax
call fcn.005123e8
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x44f687
push ebx
push 1
push dword [ebp + 0x10]
push edi
call fcn.00512618
push ebx
call fcn.005122c1
add esp, 0x14
mov bl, 1
jmp 0x44f689
xor bl, bl
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x44f6b9
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44f6af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f6cb
push edx
push ecx
call fcn.0050b532
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.0050b540
mov esp, ebp
pop ebp
ret
call fcn.00511c7b
int3

Function at 0x44f6e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x582904]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0044f980
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0x5425d0
cmovae eax, dword [ebp - 0x1c]
push eax
call fcn.005123e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f767
push 2
push 0
push esi
call fcn.005141f3
push esi
call fcn.0051480e
push 0
push 0
push esi
mov dword [ebx], eax
call fcn.005141f3
push dword [ebx]
call fcn.0051269a
mov edi, eax
add esp, 0x20
test edi, edi
je 0x44f75c
push esi
push 1
push dword [ebx]
push edi
call fcn.00513df5
add esp, 0x10
push esi
call fcn.005122c1
add esp, 4
jmp 0x44f769
xor edi, edi
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x44f799
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44f78f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f7ac
push edx
push ecx
call fcn.0050b532
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050b540
mov esp, ebp
pop ebp
ret
call fcn.00511c7b
int3
Function at 0x44f860
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ac18
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x582904]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
push 0x587ab8
lea eax, [ebp - 0x28]
push str._s_s
push eax
call fcn.00444380
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0
lea eax, [edi + 2]
push eax
call fcn.0050b551
add esp, 0x14
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov esi, eax
mov edx, esi
cmovae ecx, dword [ebp - 0x28]
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x44f8d0
mov word [esi + edi], 0
mov eax, 0x14
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x36], 0
mov dword [ebp - 0x2e], 0
mov dword [ebp - 0x32], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push esi
call fcn.0050b55a
mov edx, dword [ebp - 0x14]
add esp, 4
cmp edx, 0x10
jb 0x44f95c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44f952
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f977
push edx
push ecx
call fcn.0050b532
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
call fcn.00511c7b
int3
Function at 0x44fe80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push 0x400
push 0x588ac0
call fcn.00423880
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00516719
add esp, 0x1c
push 0x588ac0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5435ac
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ebp
ret

Function at 0x450120
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x582904]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5822d4], 0
jne 0x4502ae
push edi
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0050ea20
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x100
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edi, [ebp - 0x104]
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x450180
sub edi, ecx
mov ecx, dword [0x5822d8]
mov dword [ebp - 0x108], ecx
push esi
cmp edi, ecx
ja 0x4501c9
cmp ecx, 0x10
mov dword [0x5822d4], edi
push edi
lea eax, [ebp - 0x104]
mov esi, 0x5822c4
cmovae esi, dword [0x5822c4]
push eax
push esi
call fcn.0050e4a0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x4502ac
cmp edi, 0x7fffffff
ja 0x4502c6
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4501e9
mov esi, 0x7fffffff
jmp 0x450207
mov edx, ecx
mov eax, 0x7fffffff
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x4501ff
mov esi, 0x7fffffff
jmp 0x450207
lea eax, [edx + ecx]
cmp esi, eax
cmovb esi, eax
lea ecx, [esi + 1]
push ebx
cmp ecx, 0x1000
jb 0x45023a
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.0050b502
add esp, 4
test eax, eax
je 0x4502c1
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x45024d
test ecx, ecx
je 0x45024b
push ecx
call fcn.0050b502
add esp, 4
mov ebx, eax
jmp 0x45024d
xor ebx, ebx
push edi
lea eax, [ebp - 0x104]
mov dword [0x5822d4], edi
push eax
push ebx
mov dword [0x5822d8], esi
call fcn.0050df20
mov eax, dword [ebp - 0x108]
add esp, 0xc
mov byte [ebx + edi], 0
cmp eax, 0x10
jb 0x4502a5
lea ecx, [eax + 1]
mov eax, dword [0x5822c4]
cmp ecx, 0x1000
jb 0x45029b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4502c1
mov eax, edx
push ecx
push eax
call fcn.0050b532
add esp, 8
mov dword [0x5822c4], ebx
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
mov eax, 0x5822c4
xor ecx, ebp
call fcn.0050b540
mov esp, ebp
pop ebp
ret
call fcn.00511c7b
call fcn.00403500
int3

Function at 0x4502d0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x45030b
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4502e0
sub ecx, esi
pop esi
je 0x45030b
push 1
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 6
push dword [0x587aa4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret