joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d04a0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], edx
mov dword [esp], eax
cmp dword [esp], 0
jne 0x4d04e5
mov eax, dword [esp + 4]
mov edx, 0x104
call fcn.00405d90
push 0x104
mov eax, dword [esp + 8]
mov eax, dword [eax]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov edx, eax
mov eax, dword [esp + 4]
call fcn.00405d90
jmp 0x4d05b4
cmp dword [esp], 0
jge 0x4d04ee
inc dword [esp]
call sub.kernel32.dll_GetCommandLineW
mov ebp, eax
test ebp, ebp
je 0x4d05ab
jmp 0x4d05a0
add ebp, 2
cmp word [ebp], 0
setne al
cmp word [ebp], 0x20
setbe dl
and al, dl
jne 0x4d0504
mov esi, ebp
xor eax, eax
mov dword [esp + 8], eax
xor ebx, ebx
jmp 0x4d0539
cmp di, 0x22
je 0x4d0533
inc dword [esp + 8]
jmp 0x4d0536
xor bl, 1
add esi, 2
movzx edi, word [esi]
test di, di
setne al
cmp di, 0x20
seta dl
or dl, bl
and al, dl
jne 0x4d0527
cmp dword [esp], 0
sete al
cmp esi, ebp
setne dl
and al, dl
je 0x4d059b
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
call fcn.00405d90
mov dword [esp + 8], 1
cmp word [ebp], 0x22
je 0x4d0592
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov edx, dword [esp + 8]
movzx ecx, word [ebp]
mov word [eax + edx*2 - 2], cx
inc dword [esp + 8]
add ebp, 2
cmp esi, ebp
ja 0x4d0574
jmp 0x4d05b4
mov ebp, esi
dec dword [esp]
cmp word [ebp], 0
jne 0x4d0507
mov eax, dword [esp + 4]
call fcn.00405834
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d8ac8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405dd4
lea eax, [ebp - 8]
call fcn.00405dd4
xor eax, eax
push ebp
push 0x4d8b2f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00405a10
push eax
mov eax, dword [ebp - 4]
call fcn.00405a10
push eax
push 0x4d8b3c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8b36
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040584c
ret
Function at 0x4dc694
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4dc69c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054dc
xor eax, eax
push ebp
push 0x4dc8c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004050c0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4cb5fc]
call fcn.004cc144
mov ebx, eax
mov eax, ebx
call fcn.004cc3e8
test al, al
jne 0x4dc877
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004ccacc
mov eax, ebx
call fcn.004cc3f0
test eax, eax
jle 0x4dc877
xor edx, edx
mov eax, ebx
call fcn.004ccf54
mov edx, 0x4dc8e0
mov eax, ebx
call fcn.004cc348
mov esi, eax
test esi, esi
jne 0x4dc765
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0040ad8c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4dc8f4
call fcn.00405338
mov eax, dword [ebp - 0x18]
push eax
push 1
push 0x68
mov eax, dword [0x4e2b58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov ecx, 0x4dc904
mov edx, 0x4dc940
call fcn.004cd5e8
mov eax, ebx
call fcn.004041a0
jmp 0x4dc877
push 0
push 0
mov eax, esi
call fcn.0041e64c
lea eax, [ebp - 0x24]
call fcn.0049e810
lea eax, [ebp - 0x24]
mov edx, 0x4dc968
call fcn.00405a2c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.004052b0
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.0041edac
lea eax, [ebp - 0x28]
call fcn.0049e810
lea eax, [ebp - 0x28]
mov edx, 0x4dc968
call fcn.00405a2c
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x4a00b0]
call fcn.004a0ba4
mov esi, eax
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4dc994
mov edx, 0x4dc9a4
mov eax, esi
mov edi, dword [eax]
call dword [edi]
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4dc9b8
mov edx, 0x4dc9a4
mov eax, esi
mov edi, dword [eax]
call dword [edi]
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x4dc9d4
mov edx, 0x4dc9a4
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
call fcn.004052b0
mov eax, esi
call fcn.004041a0
lea eax, [ebp - 0x34]
call fcn.0049e810
lea eax, [ebp - 0x34]
mov edx, 0x4dc968
call fcn.00405a2c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
call fcn.004052b0
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x38]
call fcn.004054ec
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004dc480
test al, al
jne 0x4dc868
mov eax, ebx
call fcn.004041a0
jmp 0x4dc877
mov eax, ebx
call fcn.004041a0
mov eax, dword [ebp - 8]
call fcn.004dbf38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc8d0
lea eax, [ebp - 0x34]
call fcn.00405834
lea eax, [ebp - 0x30]
call fcn.00405028
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040584c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040504c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040584c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040504c
ret
Function at 0x8122c0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x812410
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8122e6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8122d2
add dl, dl
jne 0x8122f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x812344
xor eax, eax
add dl, dl
jne 0x8122fe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8123e5
add dl, dl
jne 0x81230d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x812318
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x812323
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x81232e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x81233a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8122dd
mov eax, 1
add dl, dl
jne 0x812352
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x81235d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x812349
sub eax, ebx
mov ebx, 1
jne 0x812390
mov ecx, 1
add dl, dl
jne 0x812376
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x812381
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x81236d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8122dd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8123a7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8123b2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x81239e
cmp eax, 0x7d00
jae 0x8123d5
cmp eax, 0x500
jb 0x8123d0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8122dd
cmp eax, 0x7f
ja 0x8123d8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8122dd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x812406
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8122dd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x414e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40e015
lea edi, [esi - 0xd015]
push edi
or ebp, 0xffffffff
jmp 0x414e92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414e99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414e88
mov eax, 1
add ebx, ebx
jne 0x414eab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414ea0
jne 0x414ebc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ea0
xor ecx, ecx
sub eax, 3
jb 0x414ed0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414f42
mov ebp, eax
add ebx, ebx
jne 0x414edb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ee8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414f0c
inc ecx
add ebx, ebx
jne 0x414ef8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414eed
jne 0x414f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414eed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414f2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414f1d
jmp 0x414e8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414f2c
add edi, ecx
jmp 0x414e8e
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414f4a
cmp byte [edi], 5
jne 0x414f4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414f4f
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414fbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15848]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x158fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414f7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15900]
or eax, eax
je 0x414fb8
mov dword [ebx], eax
add ebx, 4
jmp 0x414f99
call dword [esi + 0x15910]
mov ebp, dword [esi + 0x15904]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414ff2
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4047d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov esp, ebp
pop ebp
ret 4

Function at 0x404850
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x12c], ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x10], eax
push 0x104
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 3
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp - 0x12c]
call fcn.00404770
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffff
jne 0x4048b4
xor al, al
jmp 0x4049a0
push 0
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x124]
push ecx
mov ecx, dword [ebp - 0x12c]
call fcn.004047a0
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffff
jne 0x404902
push 0
push 0x5567f4
push str.CreateMapFile_fail
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4049a0
mov edx, dword [ebp - 0x128]
push edx
mov ecx, dword [ebp - 0x12c]
call fcn.004047d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404921
xor al, al
jmp 0x4049a0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x12c]
call fcn.004047f0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub edx, ecx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jg 0x40495f
push 0
push 0x556814
push 0x556820
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4049a0
push 3
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042ce80
add esp, 0xc
mov edx, dword [ebp - 0x12c]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x12c]
cmp dword [eax + 0x30], 0xffffffff
jne 0x40499e
push 0
push 0x556840
push str.OpenZip
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x4049a0
mov al, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0052c3ba
mov esp, ebp
pop ebp
ret

Function at 0x4106e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x16c], ecx
push 0x104
lea eax, [ebp - 0x168]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x44
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.0052c7a0
add esp, 0xc
mov dword [ebp - 0x58], 0x44
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x168]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov ecx, dword [ebp - 0x5c]
xor ecx, ebp
call fcn.0052c3ba
mov esp, ebp
pop ebp
ret
Function at 0x410a40
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5469b3
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5a7634]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x410b96
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042d574
add esp, 4
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov byte [ebp - 0x21], 0
movzx edx, byte [ebp - 0x21]
test edx, edx
jne 0x410b52
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x410b06
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
jmp 0x410b50
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x7a
je 0x410b17
jmp 0x410b4c
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0042d569
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042d574
add esp, 4
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
jmp 0x410b50
mov byte [ebp - 0x21], 1
jmp 0x410ad9
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
jmp 0x410b7d
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.0042d569
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416dd0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x24], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x416f0b
lea eax, [ebp - 8]
push eax
push 0x582708
push 1
push 0
push 0x582858
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x416f05
call fcn.00403a90
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x416e37
mov dword [ebp - 0x28], 0
jmp 0x416e84
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3fffffff
jle 0x416e59
mov dword [ebp - 0x2c], 0
jmp 0x416e7e
mov eax, dword [ebp - 0xc]
shl eax, 1
call fcn.0052d210
mov dword [ebp - 0x30], esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.004174f0
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0x50]
call ecx
cmp dword [ebp + 0x10], 0
je 0x416eb6
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0x44]
call eax
lea ecx, [ebp - 0x20]
push ecx
push 0x5827e8
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x416ef7
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
lea esp, [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0052c3ba
mov esp, ebp
pop ebp
ret
Function at 0x416f20
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 8], eax
push edi
cmp dword [ebp + 8], 0
je 0x416f40
cmp dword [ebp + 0xc], 0
jne 0x416f47
xor al, al
jmp 0x417124
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x364], eax
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x368], ecx
mov edx, dword [ebp - 0x368]
mov dword [ebp - 0x36c], edx
mov eax, dword [ebp - 0x364]
mov cl, byte [eax]
mov byte [ebp - 0x36d], cl
mov edx, dword [ebp - 0x368]
mov al, byte [ebp - 0x36d]
mov byte [edx], al
mov ecx, dword [ebp - 0x364]
add ecx, 1
mov dword [ebp - 0x364], ecx
mov edx, dword [ebp - 0x368]
add edx, 1
mov dword [ebp - 0x368], edx
cmp byte [ebp - 0x36d], 0
jne 0x416f68
lea eax, [ebp - 0x360]
add eax, 0xffffffff
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x374]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x375], dl
add dword [ebp - 0x374], 1
cmp byte [ebp - 0x375], 0
jne 0x416fba
mov edi, dword [ebp - 0x374]
mov eax, dword [0x557c8c]
mov dword [edi], eax
mov cx, word [0x557c90]
mov word [edi + 4], cx
mov dl, byte [0x557c92]
mov byte [edi + 6], dl
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x360]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41701e
xor al, al
jmp 0x417124
mov dword [ebp - 0x254], 0
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x417122
push 0x104
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call fcn.00417140
add esp, 0xc
movzx eax, al
test eax, eax
je 0x4170fe
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x37c], ecx
lea edx, [ebp - 0x250]
mov dword [ebp - 0x380], edx
mov eax, dword [ebp - 0x380]
mov cl, byte [eax]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0x37c]
cmp cl, byte [edx]
jne 0x4170da
cmp byte [ebp - 0x381], 0
je 0x4170ce
mov eax, dword [ebp - 0x380]
mov cl, byte [eax + 1]
mov byte [ebp - 0x382], cl
mov edx, dword [ebp - 0x37c]
cmp cl, byte [edx + 1]
jne 0x4170da
add dword [ebp - 0x380], 2
add dword [ebp - 0x37c], 2
cmp byte [ebp - 0x382], 0
jne 0x41707c
mov dword [ebp - 0x388], 0
jmp 0x4170e5
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x388], eax
mov ecx, dword [ebp - 0x388]
mov dword [ebp - 0x38c], ecx
cmp dword [ebp - 0x38c], 0
jne 0x4170fe
mov al, 1
jmp 0x417124
mov edx, dword [ebp - 0x254]
add edx, 1
mov dword [ebp - 0x254], edx
cmp dword [ebp - 0x254], 0x3e8
jle 0x41711d
xor al, al
jmp 0x417124
jmp 0x417028
xor al, al
pop edi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0052c3ba
mov esp, ebp
pop ebp
ret

Function at 0x423be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x78
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x425130
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5a7634]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x134]
cmp dword [eax + 0x28], 0xffffffff
jne 0x425169
mov eax, 0xfffffffe
jmp 0x425344
mov dword [ebp - 0x124], 0
jmp 0x425184
mov ecx, dword [ebp - 0x124]
add ecx, 1
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp - 0x120]
jae 0x4251ae
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebp + eax*4 - 0x11c]
cmp edx, dword [ecx + 0x28]
jne 0x4251ac
jmp 0x4251ae
jmp 0x425175
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x120]
jne 0x4251ea
cmp dword [ebp - 0x120], 0x40
jae 0x4251ea
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x28]
mov dword [ebp + ecx*4 - 0x11c], eax
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
xor edx, edx
jne 0x425169
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
push edx
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x28]
add eax, 1
push eax
call dword [sym.imp.WSOCK32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x42528f
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 0x28]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x42526f
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x134]
mov dword [edx + 0x20], ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x134]
mov dword [ecx + 0x20], eax
jmp 0x42529c
mov edx, dword [ebp - 0x134]
mov dword [edx + 0x20], 0x2710
mov dword [ebp - 0x130], 0
jmp 0x4252b7
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [ebp - 0x120]
jae 0x42532f
mov edx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp + edx*4 - 0x11c]
cmp ecx, dword [eax + 0x28]
jne 0x42532a
mov edx, dword [ebp - 0x120]
sub edx, 1
cmp dword [ebp - 0x130], edx
jae 0x425319
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp + ecx*4 - 0x118]
mov dword [ebp + eax*4 - 0x11c], edx
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
jmp 0x4252dd
mov ecx, dword [ebp - 0x120]
sub ecx, 1
mov dword [ebp - 0x120], ecx
jmp 0x42532f
jmp 0x4252a8
xor edx, edx
jne 0x42529c
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052c3ba
mov esp, ebp
pop ebp
ret 8