joyce8/EMBER2024-capa huggingface dataset:
Function at 0x521eb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe1c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1e0], ebx
mov dword [ebp - 0x1e4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405988
mov eax, dword [ebp - 8]
call fcn.00405988
lea esi, [ebp - 0x1dc]
xor eax, eax
push ebp
push 0x522062
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405528
cmp dword [ebp - 8], 0
je 0x522037
mov eax, dword [ebp - 8]
call fcn.0040adcc
test al, al
je 0x522037
lea edx, [ebp - 0xc]
mov eax, 0x522078
call fcn.005225e8
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004036e8
mov eax, esi
call fcn.00403484
call fcn.00402f38
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00405cb0
call fcn.00403798
call fcn.00402f38
mov eax, esi
call fcn.004037b0
call fcn.00402f38
push 1
lea edx, [ebp - 0x1e0]
mov eax, dword [ebp - 8]
call fcn.0040b13c
mov eax, dword [ebp - 0x1e0]
push eax
push 0x522088
push dword [ebp - 0xc]
push 0x522088
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.00405858
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00521d84
mov eax, dword [ebp - 0xc]
call fcn.0040adcc
test al, al
jne 0x521fbd
mov eax, 0x522094
call fcn.004518b0
jmp 0x522037
mov eax, ebx
call fcn.004054d4
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004036e8
mov eax, esi
call fcn.00403478
call fcn.00402f38
jmp 0x52200d
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00403ba8
mov eax, esi
call fcn.00403c14
call fcn.00402f38
push dword [ebx]
push dword [ebp - 0x10]
push 0x5220c0
push 0x5220cc
mov eax, ebx
mov edx, 4
call fcn.00405858
mov eax, esi
call fcn.00403954
call fcn.00402f38
test al, al
je 0x521fdc
mov eax, esi
call fcn.004037b0
call fcn.00402f38
mov eax, dword [ebp - 0xc]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522069
lea eax, [ebp - 0x1e4]
mov edx, 2
call fcn.004054f8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004054f8
ret
Function at 0x522184
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
xor eax, eax
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52231c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x522330
call fcn.0040556c
lea edx, [ebp - 0x2dc]
mov eax, dword [0x5eaad4]
mov eax, dword [eax]
call fcn.0047fae0
mov eax, dword [ebp - 0x2dc]
lea edx, [ebp - 0x2d8]
call fcn.0040b13c
mov edx, dword [ebp - 0x2d8]
lea eax, [ebp - 8]
mov ecx, 0x522340
call fcn.004057e4
mov eax, dword [ebp - 8]
call fcn.0040adcc
test al, al
je 0x522252
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x2d4]
call fcn.004036e8
lea eax, [ebp - 0x2d4]
call fcn.00403478
call fcn.00402f38
lea edx, [ebp - 4]
lea eax, [ebp - 0x2d4]
call fcn.00403ba8
lea eax, [ebp - 0x2d4]
call fcn.00403c14
call fcn.00402f38
lea eax, [ebp - 0x2d4]
call fcn.004037b0
call fcn.00402f38
jmp 0x5222ae
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
push 0x52234c
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jbe 0x522281
lea eax, [ebp - 4]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.00405744
jmp 0x5222ae
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
push 0x522354
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jbe 0x5222ae
lea eax, [ebp - 4]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.00405744
call fcn.0040330c
mov eax, dword [ebp - 4]
call fcn.005220d0
test al, al
jne 0x5222f1
mov eax, 0x522330
call fcn.005220d0
test al, al
jne 0x5222f1
lea eax, [ebp - 0x2e0]
call fcn.0040b30c
mov eax, dword [ebp - 0x2e0]
call fcn.005220d0
test al, al
jne 0x5222f1
mov eax, 0x522360
call fcn.004518b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522323
lea eax, [ebp - 0x2e0]
mov edx, 3
call fcn.004054f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054f8
ret
Function at 0x5223c8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
xor ecx, ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405988
mov eax, dword [ebp - 8]
call fcn.00405988
lea eax, [ebp - 0x168]
mov edx, dword [0x409104]
call fcn.00405fc8
xor eax, eax
push ebp
push 0x52257f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040adf0
test al, al
je 0x522543
lea eax, [ebp - 0x16c]
mov ecx, 0x522594
mov edx, dword [ebp - 8]
call fcn.004057e4
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
mov edx, 0x10
call fcn.0040af90
test eax, eax
jne 0x52253b
push dword [ebp - 8]
push 0x5225a4
push dword [ebp - 0x154]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00405858
mov eax, dword [ebp - 0x170]
call fcn.0040adf0
test al, al
je 0x5224e0
mov eax, dword [ebp - 0x154]
mov edx, 0x5225b0
call fcn.004058e4
je 0x52251d
mov eax, dword [ebp - 0x154]
mov edx, 0x5225bc
call fcn.004058e4
je 0x52251d
push dword [ebp - 8]
push 0x5225a4
push dword [ebp - 0x154]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00405858
mov edx, dword [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.005223c8
jmp 0x52251d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00405adc
dec eax
jne 0x52251d
push dword [ebp - 8]
push 0x5225a4
push dword [ebp - 0x154]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00405858
mov eax, dword [ebp - 0x178]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040afe0
test eax, eax
je 0x522461
lea eax, [ebp - 0x168]
call fcn.0040b004
mov eax, dword [ebp - 8]
call fcn.0040b334
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522586
lea eax, [ebp - 0x178]
mov edx, 4
call fcn.004054f8
lea eax, [ebp - 0x168]
mov edx, dword [0x409104]
call fcn.00406098
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054f8
ret
Function at 0x52e7d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 5], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x52e8e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov eax, dword [ebx]
mov edi, dword [eax + 8]
lea edx, [ebp - 4]
mov eax, 0x52e8fc
call fcn.005225e8
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
call fcn.004f35b0
mov eax, dword [0x5ea5ac]
mov eax, dword [eax]
call fcn.0047b6a8
push 1
lea edx, [ebp - 0xc]
mov eax, dword [0x5eaea0]
mov eax, dword [eax]
call fcn.0040b13c
mov eax, dword [ebp - 0xc]
push eax
push 0x52e90c
push dword [ebp - 4]
push 0x52e90c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405858
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5eaea0]
mov eax, dword [eax]
pop ecx
call fcn.00521d84
mov byte [ebp - 6], al
mov eax, dword [0x5ea5ac]
mov eax, dword [eax]
call fcn.0047b6b0
mov eax, dword [ebp - 4]
call fcn.0040adcc
test al, al
jne 0x52e886
mov eax, 0x52e918
call fcn.004518b0
mov byte [ebp - 6], 0
jmp 0x52e8bd
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
call fcn.004f34f0
cmp byte [ebp - 5], 0
jne 0x52e8af
mov eax, dword [ebx]
cmp esi, dword [eax + 4]
jne 0x52e8a4
mov eax, dword [ebx]
cmp edi, dword [eax + 8]
je 0x52e8af
mov eax, dword [ebx]
mov ecx, edi
mov edx, esi
call fcn.004f2c78
mov eax, dword [ebp - 4]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e8e7
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004054f8
lea eax, [ebp - 4]
call fcn.004054d4
ret
Function at 0x551830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 0x38]
xor eax, eax
push ebp
push 0x55196e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x15c0], esi
mov ecx, edi
mov edx, esi
mov eax, dword [ebx + 0x5b8]
call fcn.00547df8
movzx edx, byte [edi]
mov eax, dword [ebx + 0x424]
mov ecx, dword [eax]
call dword [ecx + 0xdc]
mov edx, dword [edi + 4]
mov eax, dword [ebx + 0x544]
call fcn.004c7f10
mov edx, dword [edi + 8]
mov eax, dword [ebx + 0x548]
call fcn.004c7f10
mov edx, dword [edi + 0xc]
mov eax, dword [ebx + 0x550]
call fcn.004c7f10
mov edx, dword [edi + 0x10]
mov eax, dword [ebx + 0x54c]
call fcn.004c7f10
mov edx, dword [edi + 0x14]
mov eax, dword [ebx + 0x558]
call fcn.004c7f10
mov edx, dword [edi + 0x18]
mov eax, dword [ebx + 0x55c]
call fcn.004c7f10
mov edx, dword [edi + 0x1c]
mov eax, dword [ebx + 0x564]
call fcn.004c7f10
mov edx, dword [edi + 0x20]
mov eax, dword [ebx + 0x560]
call fcn.004c7f10
mov edx, dword [edi + 0x24]
mov eax, dword [ebx + 0x574]
call fcn.004c7f10
mov edx, dword [edi + 0x28]
mov eax, dword [ebx + 0x570]
call fcn.004c7f10
mov edx, dword [edi + 0x2c]
mov eax, dword [ebx + 0x578]
call fcn.004c7f10
mov edx, dword [edi + 0x30]
mov eax, dword [ebx + 0x57c]
call fcn.004c7f10
mov esi, dword [edi + 0x34]
mov dword [ebx + 0x15c4], esi
test esi, esi
jl 0x551948
lea edx, [ebp - 0x3c]
mov eax, esi
call fcn.005968a0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebx + 0x580]
call fcn.00460b90
jmp 0x551958
mov edx, 0x551984
mov eax, dword [ebx + 0x580]
call fcn.00460b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x551975
lea eax, [ebp - 0x3c]
call fcn.004054d4
ret
Function at 0x554dec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x554ef3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x434], 1
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x430]
call fcn.005570ec
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x368]
call fcn.00460b90
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x368]
call fcn.00460b60
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x554f08
call fcn.004057e4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00460b90
mov eax, dword [ebx + 0x41c]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x36c]
call fcn.0044d224
mov eax, dword [ebx + 0x41c]
movzx edx, byte [eax + 0x10]
mov eax, dword [ebx + 0x398]
mov ecx, dword [eax]
call dword [ecx + 0xdc]
mov eax, dword [ebx + 0x41c]
mov edx, dword [eax + 0x14]
mov eax, dword [ebx + 0x3f4]
call fcn.004c7f10
mov eax, dword [ebx + 0x41c]
mov edx, dword [eax + 0x2c]
mov eax, dword [ebx + 0x400]
call fcn.004c7f10
mov eax, dword [ebx + 0x41c]
mov edx, dword [eax + 0x30]
mov eax, dword [ebx + 0x408]
call fcn.004c7f10
mov byte [ebx + 0x434], 0
mov eax, ebx
call fcn.00554fe4
mov edx, ebx
mov eax, ebx
call fcn.00556a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554efa
lea eax, [ebp - 0xc]
call fcn.004054d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054f8
ret
Function at 0x5a8da4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5a8dac
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5a8f8f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jl 0x5a8f5f
mov eax, dword [ebp - 8]
cmp eax, dword [0x5e9464]
jge 0x5a8f5f
mov eax, dword [0x5e9460]
mov edx, dword [ebp - 8]
cmp dword [eax + edx*4], 0
je 0x5a8f5f
call fcn.005a863c
lea edx, [ebp - 0x14]
mov eax, dword [0x5eaad4]
mov eax, dword [eax]
call fcn.0047fae0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040b13c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x5a8fa8
call fcn.004057e4
mov dl, 1
mov eax, dword [0x41a040]
call fcn.00404560
mov dword [ebp - 0xc], eax
mov eax, dword [0x5e9460]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
lea edx, [ebp - 0xc]
call fcn.004f0dec
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a8e8f
inc ebx
xor esi, esi
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.004057e4
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
inc esi
dec ebx
jne 0x5a8e56
mov eax, dword [ebp - 0xc]
call fcn.00404590
mov eax, dword [0x5e9460]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
cmp dword [eax + 0x20], 0
je 0x5a8edb
mov eax, dword [0x5e9460]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
mov ecx, dword [eax + 0x20]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.004057e4
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
push dword [ebp - 4]
mov eax, dword [0x5e9460]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
push dword [eax + 4]
push 0x5a8fbc
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405858
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
push dword [ebp - 4]
mov eax, dword [0x5e9460]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
push dword [eax + 4]
push 0x5a8fcc
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00405858
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
call fcn.005a7910
call fcn.005a86bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8f96
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004054f8
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004054f8
lea eax, [ebp - 4]
call fcn.004054d4
ret
Function at 0x5c7b38
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x5c7b92
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.005c7b28
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.005c5780
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.005c5298
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7b99
lea eax, [ebp - 4]
call fcn.004054d4
ret
Function at 0x5d0114
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xfffffd00
mov ebx, eax
cmp dword [0x5ea264], 0
jge 0x5d012b
call 0x5cfe94
test bl, bl
jne 0x5d0146
cmp dword [0x5ea270], 0
jne 0x5d0146
mov eax, dword [0x5ea9c0]
cmp byte [eax], 0
jne 0x5d0207
call fcn.00521d70
call fcn.004033d4
test bl, bl
jne 0x5d016b
cmp dword [0x5ea270], 0
jne 0x5d016b
mov edx, dword [0x5ea4b8]
cmp eax, dword [edx]
je 0x5d0207
mov edx, dword [0x5ea4b8]
mov dword [edx], eax
cmp dword [0x5ea264], 0
jle 0x5d0185
cmp dword [0x5ea26c], 0
jne 0x5d0195
test bl, bl
je 0x5d0207
mov eax, 0x5d0218
call fcn.004518b0
jmp 0x5d0207
mov eax, dword [0x5ead44]
cmp byte [eax], 0
je 0x5d01eb
push 1
lea eax, [esp + 0x204]
xor edx, edx
call fcn.0040b420
push eax
lea eax, [esp + 0x108]
xor edx, edx
call fcn.0040b420
push eax
lea eax, [esp + 0xc]
mov edx, dword [0x5ea26c]
call fcn.0040b420
push eax
push 0x5d0244
mov eax, dword [0x5eaad4]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.004688dc
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x5d0207
cmp dword [0x5ea260], 0
jne 0x5d0207
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5cfc88]
call fcn.00476474
mov dword [0x5ea260], eax
add esp, 0x300
pop ebx
ret
Function at 0x5d489c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405988
xor eax, eax
push ebp
push 0x5d49b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040b170
cmp dword [ebx], 0
jne 0x5d48e8
mov eax, ebx
mov edx, 0x5d49cc
call fcn.00405528
lea eax, [ebp - 0xc]
call fcn.005225d4
push dword [ebp - 0xc]
push 0x5d49dc
lea ecx, [ebp - 0x10]
mov eax, dword [ebx]
mov edx, 0x5d49e8
call fcn.0040b0a8
push dword [ebp - 0x10]
mov eax, ebx
mov edx, 3
call fcn.00405858
mov eax, dword [0x5eaf0c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0047ce64
mov eax, dword [ebx]
call fcn.0040adcc
test al, al
je 0x5d495a
mov esi, dword [ebx]
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5d495a
mov edx, ebx
mov eax, 0x5d49e8
call fcn.005225e8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040b13c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx]
movzx ecx, byte [ebp - 5]
call fcn.005d453c
test al, al
jne 0x5d497e
mov eax, ebx
call fcn.004054d4
mov eax, dword [0x5eaf0c]
mov eax, dword [eax]
xor edx, edx
call fcn.0047ce64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d49be
lea eax, [ebp - 0x18]
call fcn.004054d4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004054f8
lea eax, [ebp - 4]
call fcn.004054d4
ret
Function at 0x5dbeac
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], al
xor eax, eax
push ebp
push 0x5dbfd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x60ade8]
cmp byte [eax + 0x57], 0
je 0x5dbfb6
xor ebx, ebx
call fcn.005540ec
mov edi, eax
dec edi
test edi, edi
jl 0x5dbefa
inc edi
xor esi, esi
mov eax, esi
call fcn.005540f4
test al, al
je 0x5dbef6
mov bl, 1
inc esi
dec edi
jne 0x5dbee9
test bl, bl
jne 0x5dbf0d
mov eax, 0x5dbfe8
call fcn.004518b0
jmp 0x5dbfb6
lea ecx, [ebp - 4]
movzx edx, byte [ebp - 9]
mov eax, dword [0x5ea27c]
call fcn.005d489c
cmp dword [ebp - 4], 0
je 0x5dbfb6
lea edx, [ebp - 8]
mov eax, dword [0x5ea27c]
call fcn.0040b13c
cmp dword [ebp - 8], 0
jne 0x5dbf46
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b13c
mov eax, dword [0x5ea4d0]
cmp byte [eax], 0
je 0x5dbf66
mov eax, dword [0x60ade8]
call fcn.0047b6a8
mov eax, dword [0x5eaee8]
mov eax, dword [eax]
call fcn.0047b6a8
mov eax, dword [0x5ea4d0]
movzx eax, byte [eax]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00521d84
test al, al
jne 0x5dbf8a
mov eax, 0x5dc01c
call fcn.004518b0
mov eax, dword [0x5ea4d0]
cmp byte [eax], 0
je 0x5dbfa2
mov eax, dword [ebp - 4]
call fcn.00405998
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x5ea4d0]
cmp byte [eax], 0
je 0x5dbfb6
mov eax, dword [0x60ade8]
call fcn.0047b6b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dbfd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054f8
ret

Function at 0x74bd45
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
pop edi
mov esi, 0x36
add esi, edi
mov ecx, 0x10f
push esi
sub esi, 9
mov edi, esi
xor eax, eax
lodsb al, byte [esi]
xor eax, edx
rol edx, 5
imul edx, edx, 0xfb712715
add eax, 0xab358cdf
stosb byte es:[edi], al
dec ecx
jne 0x74bd25
pop esi
mov eax, dword [esp + 0x28]
mov dword [eax + 4], esi
popal
push ebp
mov ebp, esp
push esi
push edi
push ebx
push ecx
push edx
mov eax, dword [ebp + 8]
mov esi, dword [eax]
mov dword [eax + 4], 0
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0xb8]
cmp esi, 0x80000004
je 0x74bda6
cmp esi, 0xc000001d
je 0x74bdfc
cmp esi, 0xc000001e
je 0x74bdfc
cmp esi, 0xc0000094
je 0x74bdfc
add esp, 0x18
jmp 0x735805
jmp 0x74bdc9
mov ebx, 0x73568c
mov edx, 0x16a28
add edx, ebx
mov esi, dword [edx]
mov ecx, 0x16a8c
add ecx, ebx
movzx ecx, byte [ecx]
test esi, esi
je 0x74bde7
xor byte [esi], cl
xor byte [edi], cl
cmp byte [edi], 0x9d
je 0x74bdf8
or dword [eax + 0xc0], 0x100
mov dword [edx], edi
jmp 0x74be36
inc edi
inc edi
mov ebx, dword [eax + 0xb4]
cmp byte [edi], 0xcc
jne 0x74be10
mov edi, 0x8b2
add edi, ebx
mov dword [eax + 0xb8], edi
jmp 0x74be2b
mov dword [ebx + 0xde9], ebx
call int.00736473
xor eax, eax
push eax
push eax
dec eax
push eax
call dword [ebx + 0x16e90]
xor eax, eax
pop edx
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x932058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009321a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x93207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93206a
add dl, dl
jne 0x932089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9320dc
xor eax, eax
add dl, dl
jne 0x932096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x93217d
add dl, dl
jne 0x9320a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9320b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9320bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9320c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9320d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x932075
mov eax, 1
add dl, dl
jne 0x9320ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9320f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9320e1
sub eax, ebx
mov ebx, 1
jne 0x932128
mov ecx, 1
add dl, dl
jne 0x93210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x932119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x932105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x932075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x93213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x93214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x932136
cmp eax, 0x7d00
jae 0x93216d
cmp eax, 0x500
jb 0x932168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x932075
cmp eax, 0x7f
ja 0x932170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x932075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x93219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x932075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
jmp loc.0041579b