joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491bdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x491e53
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x491e68
call fcn.00491a44
lea eax, [ebp - 0x3f0]
call fcn.00405240
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004056d0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x491e14
xor eax, eax
push ebp
push 0x491e0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x491ea8
call fcn.00491a44
mov eax, dword [ebp - 0x408]
call fcn.004056d0
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x491cdf
push ebp
mov eax, 0x491ed4
call fcn.00491b34
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x40c]
mov eax, 0x491ee0
call fcn.00491a44
mov eax, dword [ebp - 0x40c]
call fcn.004056d0
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x491d69
push dword [ebp - 0x3f0]
push 0x491f08
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004054b0
push dword [ebp - 0x410]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004055d4
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x414]
mov eax, 0x491f14
call fcn.00491a44
mov eax, dword [ebp - 0x414]
call fcn.004056d0
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x491df3
push dword [ebp - 0x3f0]
push 0x491f08
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004054b0
push dword [ebp - 0x418]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004055d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491e14
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.00405294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491e5a
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.00405264
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.00405264
ret
Function at 0x494918
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056c0
xor eax, eax
push ebp
push 0x494a53
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x494a23
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004056d0
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.00409f54
test al, al
jne 0x494993
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403700
lea eax, [ebp - 0x1d0]
call fcn.0040349c
call fcn.00403094
push dword [0x52af68]
push 0x494a6c
push dword [0x52af6c]
push 0x494a6c
push dword [0x52af70]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004055d4
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.00497b78
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.004059f0
call fcn.00403dbc
call fcn.00403094
lea eax, [ebp - 0x1d0]
call fcn.004037c8
call fcn.00403094
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494a2d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494a5a
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405264
lea eax, [ebp - 4]
call fcn.00405240
ret
Function at 0x495b24
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056c0
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x495c8c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00494d94
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00494db4
mov ebx, eax
jmp 0x495c5e
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054b0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a170
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409404
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409404
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405668
je 0x495c3e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004054b0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409404
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409404
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405668
jne 0x495c53
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00494dd4
mov ebx, eax
test ebx, ebx
jne 0x495b9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495c93
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405264
lea eax, [ebp - 4]
call fcn.00405240
ret
Function at 0x495e77
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x495ed1
mov eax, ebx
add eax, dword [eax + 0x3c]
mov edi, dword [eax + 0x78]
add edi, ebx
xor esi, esi
jmp 0x495ecc
mov eax, dword [edi + 0x20]
lea edx, [ebx + eax]
mov eax, dword [edx + esi*4]
add eax, ebx
push dword [ebp + 0xc]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x495ecb
mov edx, dword [edi + 0x24]
lea ecx, [ebx + edx]
mov ax, word [ecx + esi*2]
movzx edx, ax
mov ecx, dword [edi + 0x1c]
lea eax, [ebx + ecx]
mov eax, dword [eax + edx*4]
add eax, ebx
mov dword [ebp - 4], eax
inc esi
cmp esi, dword [edi + 0x18]
jb 0x495e98
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x496d38
Capabilities:
Log keystrokes via application hook

Disassembly:
xor eax, eax
mov dword [0x52b170], eax
push 0x496d78
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x52b170], eax
mov eax, dword [0x5240f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [0x52b174], eax
push 0
mov eax, dword [0x5277f8]
push eax
push 0x496cf0
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x52b178], eax
ret

Function at 0x496fa0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056c0
xor eax, eax
push ebp
push 0x49707a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x497090
mov edx, dword [ebp - 4]
call fcn.00405558
mov eax, dword [ebp - 8]
call fcn.004056d0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x496fea.0
jmp dword [eax*4 + 0x496ff1]
mov eax, ebx
mov edx, 0x49709c
call fcn.00405294
jmp 0x49705f
mov eax, ebx
mov edx, 0x4970b0
call fcn.00405294
jmp 0x49705f
mov eax, ebx
mov edx, 0x4970c0
call fcn.00405294
jmp 0x49705f
mov eax, ebx
mov edx, 0x4970d4
call fcn.00405294
jmp 0x49705f
mov eax, ebx
mov edx, 0x4970e4
call fcn.00405294
jmp 0x49705f
mov eax, ebx
mov edx, 0x4970f8
call fcn.00405294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497081
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405264
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408948
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add esi, esi
call fcn.00408969
mov ecx, ecx
and esi, esi
xor dword [ebx], edi
mov ecx, 0xc4c83df3
inc ebx
cmp ebx, eax
jne fcn.00408948
and ecx, ecx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x406e52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x406e61
pop dword [ebp - 0x50]
mov eax, 0x22e22acf
sub eax, 0x22a1bc6e
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x38091
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x42f1
mov edx, eax
mov esi, 0xec2cc3fc
add esi, 0x141477c8
add esi, dword [ebp - 0x50]
mov ebx, 0xac6ee4b5
add ebx, 0x3f03b5e9
xor dword [ebp - 0x14], 0x5a22a13e
mov edi, dword [esi]
sub dword [ebp - 0x20], ecx
xor edi, ebx
xor dword [ebp - 0x1c], ebx
mov dword [edx], edi
add dword [ebp - 0x2c], 0x5f4ed7db
add edx, 4
add esi, 0xeb2a682e
add esi, 0x14d597d6
loop 0x406eb5
add eax, 0xfe97
xor ebx, ebx
add ebx, eax
add eax, 0xa4e6b2db
add eax, 0x5b194d2a
mov ecx, 0x5ee0a3df
add ecx, 0xa15f5c21
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x79604c90
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x7eb62b7c
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x43c838
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43c9e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404fd0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43ca00
call fcn.00404c34
mov eax, ebx
call fcn.004214b8
mov edi, eax
dec edi
test edi, edi
jl 0x43c8f0
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042148c
mov edx, dword [0x430864]
call fcn.00403d50
test al, al
je 0x43c8ec
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042148c
lea edx, [ebp - 0x14]
call fcn.00443f60
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404fd0
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ca8
inc esi
dec edi
jne 0x43c89e
mov al, byte [0x43ca04]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43ca10
mov eax, dword [ebp - 0xc]
call fcn.0040e2d4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004049c8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00443f60
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43ca00
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.00443f60
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43ca00
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43ca00
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43ca1c
call fcn.00409f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c9f0
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404954
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404954
lea eax, [ebp - 0x14]
call fcn.00404930
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404954
ret
Function at 0x4c7540
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dd0
mov eax, dword [ebp - 8]
call fcn.00404dd0
xor eax, eax
push ebp
push 0x4c75f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x476dd0]
call fcn.00476e7c
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00476f1c
xor eax, eax
push ebp
push 0x4c75cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x4c7604
mov eax, dword [ebp - 0xc]
call fcn.00476f80
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004770a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c75d6
mov eax, dword [ebp - 0xc]
call fcn.00476eec
mov eax, dword [ebp - 0xc]
call fcn.00403bc4
ret
Function at 0x4f0412
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.kernel32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4f0438
jmp 0x4f054e
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x4f0458
jmp 0x4f054e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f5551
add esp, 4
mov dword [0x5050a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x4f04a5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x4f04c5
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x4f04a2
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4f052d
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f50f4
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
jmp 0x4f04e1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4f0553
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004f4e8d
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004f4f15
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004f578f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 2
jne 0x4f05d6
cmp dword [0x5052d2], 1
jne 0x4f05d6
cmp dword [ebp - 0xc], 0
je 0x4f05d6
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f0412
add esp, 8
jmp 0x4f05e5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x4f07d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0x4f081b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4f0841
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x5050a4], ecx
jne 0x4f083f
cmp dword [ebp - 0xc], 0
je 0x4f083d
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
jmp 0x4f0841
jmp 0x4f0818
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x4f08e4
mov dword [ebp - 0x18], 0
jmp 0x4f086f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4f08e4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x5050a4], ecx
jne 0x4f08e2
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0x5051b2]
cmp dword [eax*4 + 0x50513a], ecx
jb 0x4f08d1
mov eax, dword [ebp - 0x10]
cmp dword [0x5050a0], eax
je 0x4f08bf
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x50511c]
push eax
call fcn.004f5551
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x5050a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f50a8
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0x50513a], eax
jmp 0x4f08e4
jmp 0x4f086c
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4f08f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x4f0943
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4f09a5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x5050a4], ecx
jne 0x4f09a3
mov eax, dword [ebp - 0xc]
cmp dword [0x5050a0], eax
je 0x4f097d
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x50511c]
push eax
call fcn.004f5551
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x5050a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f50f4
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x4f09a1
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0x4f09a5
jmp 0x4f0940
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x4f09d3
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f50a8
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14