joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447800
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
mov byte [esp], 0
mov ebx, dword [0x48d4a8]
mov ebx, dword [ebx]
mov eax, dword [0x48d5dc]
cmp byte [eax], 2
jne 0x447864
mov eax, dword [0x48d4a8]
mov eax, dword [eax]
mov edx, dword [0x48d550]
movzx edx, byte [edx + 0x18ab]
mov ebx, edx
cdq
idiv ebx
mov ebx, eax
mov ecx, dword [0x48d4a8]
mov ecx, dword [ecx]
add ecx, 0xf
add ecx, 0xf
lea eax, [ecx + ecx*4]
add eax, 0x40
mov edx, dword [0x48d4a8]
test ecx, ecx
jns 0x447859
add ecx, 0xf
sar ecx, 4
mov edx, ecx
add edx, edx
add eax, edx
add ebx, eax
mov eax, dword [0x48d5dc]
cmp byte [eax], 1
jne 0x447877
mov eax, dword [0x48d4a8]
mov ebx, dword [eax]
add ebx, ebx
mov eax, dword [0x48d5dc]
cmp byte [eax], 3
jne 0x4478a6
mov eax, dword [0x48d4a8]
mov ebx, dword [eax]
add ebx, ebx
lea ebx, [ebx + ebx*2]
mov eax, dword [0x48d4a8]
mov eax, dword [eax]
test eax, eax
jns 0x44789b
add eax, 0xf
sar eax, 4
lea eax, [eax + eax*2]
add ebx, eax
add ebx, 0x32
mov eax, dword [0x48d5dc]
cmp byte [eax], 4
jne 0x4478d3
mov eax, dword [0x48d4a8]
mov ebx, dword [eax]
lea ebx, [ebx + ebx*4]
mov eax, dword [0x48d4a8]
mov eax, dword [eax]
test eax, eax
jns 0x4478c8
add eax, 0xf
sar eax, 4
lea eax, [eax + eax*2]
add ebx, eax
add ebx, 0x32
cmp ebx, 0xff0000
jg 0x4479e7
inc ebx
push ebx
push 0x2042
call sub.kernel32.dll_GlobalAlloc
mov dword [esi], eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
jne 0x447908
mov eax, dword [0x48d5dc]
mov byte [eax], 0
jmp 0x4479e7
mov eax, dword [0x48d86c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x48d438]
mov dword [edx], eax
mov eax, dword [0x48d5dc]
cmp byte [eax], 0
jne 0x447943
mov ecx, dword [0x48d4a8]
mov ecx, dword [ecx]
mov edx, dword [0x48d438]
mov edx, dword [edx]
mov eax, ebx
call fcn.00405a94
jmp 0x4479ce
mov eax, dword [0x48d5dc]
cmp byte [eax], 1
jne 0x4479a4
mov edi, dword [0x48d4a8]
mov edi, dword [edi]
dec edi
test edi, edi
jl 0x4479c6
inc edi
xor eax, eax
mov edx, dword [0x48d438]
mov edx, dword [edx]
add edx, eax
mov dl, byte [edx]
xor ecx, ecx
mov cl, dl
shr ecx, 4
mov ebp, dword [0x48d638]
mov cl, byte [ebp + ecx]
mov ebp, eax
add ebp, ebp
add ebp, ebx
mov byte [ebp], cl
and edx, 0xff
and edx, 0xf
mov ecx, dword [0x48d638]
mov dl, byte [ecx + edx]
mov ecx, eax
add ecx, ecx
add ecx, ebx
inc ecx
mov byte [ecx], dl
inc eax
dec edi
jne 0x44795d
jmp 0x4479c6
mov eax, dword [0x48d5dc]
cmp byte [eax], 3
jb 0x4479bf
mov edx, dword [0x48d5dc]
mov dl, byte [edx]
mov eax, ebx
call fcn.00447030
jmp 0x4479c6
mov eax, ebx
call fcn.00447278
mov eax, dword [0x48d5dc]
mov byte [eax], 0
mov eax, dword [0x48d86c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GlobalUnlock
mov byte [esp], 1
mov al, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4479f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
add esp, 0xfffffff8
mov byte [esp + 1], dl
mov byte [esp], al
xor ebx, ebx
mov eax, dword [0x48d4a8]
cmp dword [eax], 0xff0000
jg 0x447b6f
mov eax, dword [0x48d4a8]
cmp dword [eax], 0x4fb000
jge 0x447a4b
cmp byte [esp], 0
jne 0x447a4b
lea eax, [esp + 4]
call fcn.00447800
mov byte [esp + 2], al
cmp byte [esp + 2], 0
jne 0x447a50
mov ax, 0x59
call fcn.0040bc04
mov edx, eax
mov ax, 0x1b
call fcn.0040de10
jmp 0x447a50
mov byte [esp + 2], 0
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x447b4f
call sub.user32.dll_EmptyClipboard
mov eax, dword [0x48d7c4]
mov byte [eax], 0
mov eax, dword [0x48d86c]
mov eax, dword [eax]
push eax
mov eax, dword [0x48d8d0]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x447b48
push 4
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov edx, dword [0x48d204]
mov dword [edx], eax
mov eax, dword [0x48d204]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x48d854]
mov dword [edx], eax
mov eax, dword [0x48d854]
cmp dword [eax], 0
je 0x447af7
mov eax, dword [0x48d4a8]
mov eax, dword [eax]
mov edx, dword [0x48d854]
mov edx, dword [edx]
mov dword [edx], eax
mov eax, dword [0x48d204]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [0x48d204]
mov eax, dword [eax]
push eax
mov eax, dword [0x48d814]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
cmp byte [esp + 2], 0
je 0x447b48
mov eax, dword [0x48d550]
cmp byte [eax + 0x189e], 1
jne 0x447b3c
cmp byte [esp + 1], 0
je 0x447b2e
mov eax, dword [0x48d438]
mov eax, dword [eax]
inc eax
cmp byte [eax], 0
jne 0x447b2e
mov eax, dword [esp + 4]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
jmp 0x447b48
mov eax, dword [esp + 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
jmp 0x447b48
mov eax, dword [esp + 4]
push eax
push 7
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
jmp 0x447b79
cmp byte [esp + 2], 0
je 0x447b66
cmp byte [esp], 0
jne 0x447b66
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
call fcn.00446ee4
jmp 0x447b79
mov eax, dword [0x48d7c4]
mov byte [eax], 1
mov bl, 1
test bl, bl
je 0x447b9e
mov eax, dword [0x48d7c4]
cmp byte [eax], 0
jne 0x447bb2
mov eax, dword [0x48d8d0]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x447bb2
mov ax, 0x59
call fcn.0040bc04
mov edx, eax
mov ax, 0x1b
call fcn.0040de10
pop ecx
pop edx
pop ebx
ret
Function at 0x453538
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov byte [ebp - 1], 0
cmp byte [ebp + 8], 0
jne 0x4536f2
test eax, eax
jne 0x453591
mov eax, ebx
add al, 0xb
call fcn.0042aef4
test al, al
je 0x4536f2
mov edx, dword [0x48d370]
lea eax, [ebp - 0x101]
call fcn.00405c48
call fcn.0040f494
mov al, 0x15
call fcn.0042aef4
test al, al
je 0x4536f2
jmp 0x4535a9
lea edx, [ebp - 0x101]
xchg edx, eax
call fcn.00405c48
mov eax, dword [0x48d370]
mov edx, esi
call fcn.00405c48
mov eax, dword [0x48d370]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x4535d7
mov ax, 0x5a
call fcn.0040bc04
mov edx, 3
call fcn.00411d74
jmp 0x4536f2
cmp byte [ebp + 8], 0
jne 0x4536f2
test bl, bl
je 0x4535f4
mov eax, dword [0x48d370]
mov al, byte [eax]
cmp al, byte [ebp - 0x101]
je 0x45366c
xor eax, eax
mov al, bl
add eax, eax
add ax, 0xe0
dec eax
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
lea eax, [ebp - 0x101]
call fcn.0040fb28
mov edx, eax
mov eax, dword [0x48d948]
mov cx, 0x3c
call fcn.00405c80
mov eax, dword [0x48d550]
movzx eax, byte [eax + 0x188c]
lea eax, [eax + eax*4]
mov edx, dword [0x48d4f8]
lea eax, [edx + eax]
push eax
mov eax, dword [0x48d948]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d948]
mov dl, 3
call fcn.0040e810
push 0
call fcn.0040e784
mov eax, 0xa
call fcn.0040f448
test bl, bl
je 0x45369d
mov eax, dword [0x48d370]
call fcn.00412584
test al, al
je 0x453689
mov eax, dword [0x48d370]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [0x48d370]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_MoveFileA
jmp 0x4536b1
push 0
mov eax, dword [0x48d370]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4536d6
call sub.kernel32.dll_GetLastError_1
call fcn.0040f5f0
mov eax, dword [0x48da44]
mov edx, 1
call fcn.00411d74
jmp 0x4536da
mov byte [ebp - 1], 1
test bl, bl
je 0x4536ed
mov eax, dword [0x48d370]
mov al, byte [eax]
cmp al, byte [ebp - 0x101]
je 0x4536f2
call fcn.0040eb04
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45a824
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, dword [0x48d6e4]
mov eax, dword [0x48d838]
mov eax, dword [eax]
call fcn.00412904
mov ecx, 0x10000000
mov edx, 0x80000000
call fcn.0040eba4
mov edx, dword [0x48d528]
mov dword [edx], eax
push 0
push 0
push 0
push 0x8000002
push 0
mov eax, dword [0x48d528]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edx, dword [0x48d58c]
mov dword [edx], eax
mov eax, dword [0x48d58c]
cmp dword [eax], 0
jne 0x45a89a
mov edx, dword [0x48da44]
mov ax, 9
call fcn.0040de10
xor eax, eax
mov dword [ebx], eax
mov eax, dword [0x48d1bc]
mov byte [eax], 0
jmp 0x45aa06
push 0
push 0
push 0
push 4
mov eax, dword [0x48d58c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx], eax
mov eax, dword [ebx]
add eax, 2
mov ax, word [eax]
mov edx, dword [0x48d7d8]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 4
mov ax, word [eax]
mov edx, dword [0x48d6ec]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 6
mov ax, word [eax]
mov edx, dword [0x48d7f4]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 8
mov ax, word [eax]
mov edx, dword [0x48d850]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 0xa
mov ax, word [eax]
mov edx, dword [0x48d834]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 0xc
mov ax, word [eax]
mov edx, dword [0x48d788]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 0xd
mov edx, dword [0x48d6ec]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x45a9eb
mov edx, dword [0x48d6ec]
mov edx, eax
mov eax, dword [0x48d7f4]
movzx eax, word [eax]
add edx, eax
cmp byte [edx], 0
jne 0x45a9eb
mov eax, dword [0x48d6ec]
mov eax, dword [0x48d7f4]
mov eax, edx
mov edx, dword [0x48d850]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x45a9eb
mov edx, dword [0x48d6ec]
mov edx, dword [0x48d7f4]
mov edx, dword [0x48d850]
mov edx, dword [0x48d834]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x45a9eb
mov eax, dword [ebx]
add eax, 0xd
mov edx, dword [0x48d6ec]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x48d7f4]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x48d850]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x48d834]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x48d788]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x45a9eb
mov eax, dword [0x48d1bc]
mov byte [eax], 1
mov eax, dword [0x48d788]
cmp word [eax], 0
jbe 0x45aa06
mov eax, dword [0x48d1bc]
mov byte [eax], 5
jmp 0x45aa06
xor eax, eax
mov dword [ebx], eax
mov eax, dword [0x48d1bc]
mov byte [eax], 0
mov edx, dword [0x48da44]
mov ax, 9
call fcn.0040de10
mov eax, dword [0x48d838]
mov eax, dword [eax + 4]
call fcn.00412904
push eax
call sub.kernel32.dll_LoadLibraryA
mov edx, dword [0x48d64c]
mov dword [edx], eax
mov eax, dword [0x48d64c]
cmp dword [eax], 0
jne 0x45aa3a
mov edx, dword [0x48da44]
mov ax, 9
call fcn.0040de10
pop ebx
ret
Function at 0x45b5c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
call fcn.0040484c
xor eax, eax
push ebp
push 0x45b6ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100c]
mov edx, 0x1000
call fcn.00405a9c
lea esi, [ebp - 0x100c]
mov eax, dword [ebp - 8]
call fcn.0040485c
mov edi, eax
mov eax, edi
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.0040eba4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45b66c
lea eax, [ebp - 0xc]
mov ecx, 0x45b6e4
mov edx, dword [ebp - 8]
call fcn.004046b0
mov eax, dword [ebp - 0xc]
call fcn.0040485c
call fcn.00412584
test al, al
je 0x45b66c
push edi
mov eax, dword [ebp - 0xc]
call fcn.0040485c
push eax
call sub.kernel32.dll_MoveFileA
mov eax, edi
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.0040eba4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45b681
mov eax, dword [0x48d550]
mov word [eax + 0x1858], 0
jmp 0x45b6b3
push 0x1000
push esi
push ebx
call sub.kernel32.dll__lread
mov edx, dword [0x48d498]
mov dword [edx], eax
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x48d498]
cmp dword [eax], 0x19
jl 0x45b6b3
push 1
mov edx, edi
mov cl, byte [ebp - 1]
mov eax, esi
call fcn.0040c374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b6d5
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404434
ret
Function at 0x45cdd0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffec0
mov esi, esp
mov eax, dword [0x48d550]
cmp byte [eax + 0x300], 0x2e
jne 0x45cdf4
mov eax, 0x45ce64
call fcn.00412904
jmp 0x45ce0a
mov edx, dword [0x48d550]
add edx, 0x300
mov eax, dword [0x48da44]
call fcn.00405c48
push 0x45ce68
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x45ce4d
test byte [esi], 0x10
jne 0x45ce3c
lea eax, [esi + 0x2c]
push eax
call sub.kernel32.dll_DeleteFileA_1
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x45ce53
cmp byte [esi + 0x2c], 0
jne 0x45ce2e
push ebx
call sub.kernel32.dll_FindClose
add esp, 0x140
pop esi
pop ebx
ret
Function at 0x4609bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll__lcreat
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4609ef
mov edx, dword [ebp - 4]
mov ax, 3
call fcn.0040de10
jmp 0x460b66
fild qword [ebp + 8]
fdiv dword [0x460b74]
call fcn.004028ac
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0xe000
call fcn.0040fe38
mov dword [ebp - 0x14], eax
mov eax, 0xe000
call fcn.004024e8
mov edi, eax
mov edx, 0xe000
mov eax, edi
call fcn.00405a9c
mov ax, 0xfd
call fcn.0040bc04
mov edx, eax
mov eax, dword [0x48d948]
call fcn.00405c48
mov eax, dword [0x48d948]
xor edx, edx
call fcn.0040e810
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x460b03
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 1
push 0xe000
push edi
push ebx
call sub.kernel32.dll__hwrite
mov esi, eax
push ebx
call sub.kernel32.dll_FlushFileBuffers
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fild dword [ebp - 0x10]
fdivp st(1)
fmul dword [0x460b78]
call fcn.004028a0
mov edx, dword [0x48d1d8]
mov byte [edx], al
mov eax, dword [0x48d1d8]
mov al, byte [eax]
mov edx, dword [0x48d668]
cmp al, byte [edx]
je 0x460aaf
call fcn.00414c64
call fcn.0040f494
cmp esi, 0xe000
je 0x460ac8
mov edx, dword [ebp - 4]
mov ax, 5
call fcn.0040de10
mov eax, dword [0x48d9fc]
cmp byte [eax], 0
jne 0x460ada
cmp esi, 0xe000
je 0x460af7
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileA_1
call fcn.0040eb04
mov eax, edi
call fcn.00402508
jmp 0x460b66
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x460a63
mov eax, dword [0x48d1d8]
mov byte [eax], 0x64
mov eax, dword [0x48d1d8]
mov al, byte [eax]
mov edx, dword [0x48d668]
cmp al, byte [edx]
je 0x460b21
call fcn.00414c64
mov eax, dword [ebp - 0x14]
push eax
push edi
push ebx
call sub.kernel32.dll__hwrite
mov esi, eax
push ebx
call sub.kernel32.dll_FlushFileBuffers
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.0040eb04
mov eax, edi
call fcn.00402508
cmp esi, dword [ebp - 0x14]
je 0x460b62
mov edx, dword [ebp - 4]
mov ax, 5
call fcn.0040de10
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x460b66
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461960
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffd00
mov esi, eax
lea ecx, [esp + 0x200]
mov edx, dword [0x48d200]
movzx edx, byte [edx]
mov eax, dword [0x48d5f8]
mov eax, dword [eax]
call fcn.00402f4c
lea eax, [esp + 0x200]
mov edx, dword [0x48d7ec]
call fcn.00403334
mov edx, 0xd
mov eax, dword [0x48d7ec]
cmp byte [eax], 0x20
jne 0x4619ab
mov byte [eax], 0x30
inc eax
dec edx
jne 0x4619a3
mov eax, esp
mov edx, esi
call fcn.00405c48
mov eax, esp
mov dl, 0x2e
call fcn.00405e00
mov edi, eax
test edi, edi
je 0x461a11
lea eax, [esp + 0x100]
mov edx, edi
call fcn.00405c48
mov byte [edi], 0
mov eax, dword [0x48d550]
add eax, 0x859
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d7ec]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x461a30
push 0x461a44
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d7ec]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push esp
push esi
call sub.kernel32.dll_MoveFileA
mov eax, ebx
add esp, 0x300
pop edi
pop esi
pop ebx
ret
Function at 0x462f70
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, eax
mov eax, dword [0x48d8bc]
cmp dword [eax], 0
je 0x4630d7
cmp byte [esi + 0x55d], 0
jge 0x46301a
mov edx, 0x4630e0
mov eax, esp
call fcn.00405c48
mov bl, byte [esi + 0x55d]
cmp bl, 0xff
jne 0x462fbd
mov edx, 0x4630e4
mov eax, dword [0x48d830]
call fcn.00405c48
jmp 0x46300a
cmp bl, 0xfe
jne 0x462fd3
mov edx, 0x4630e8
mov eax, dword [0x48d830]
call fcn.00405c48
jmp 0x46300a
movsx eax, bl
mov edx, 0x80
sub edx, eax
sub edx, 3
mov dword [esp + 0x100], edx
fild dword [esp + 0x100]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.0040fe88
mov edx, eax
mov eax, dword [0x48d830]
call fcn.00405c48
mov eax, dword [0x48d830]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
cmp byte [esi + 0x55d], 0
jne 0x46304c
mov edx, 0x4630ec
mov eax, esp
call fcn.00405c48
mov eax, dword [esi + 0x14]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4630ec
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
cmp byte [esi + 0x55d], 0
jle 0x46308c
mov edx, 0x4630e0
mov eax, esp
call fcn.00405c48
movsx eax, byte [esi + 0x55d]
add eax, 0x40
mov edx, dword [0x48d830]
mov byte [edx], al
mov eax, dword [0x48d830]
mov byte [eax + 1], 0
mov eax, dword [0x48d830]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push 1
push 0x4630f0
lea eax, [esp + 8]
push eax
mov eax, dword [0x48d8bc]
mov eax, dword [eax]
push eax
push 0
mov eax, dword [esi]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x48d29c]
mov dword [edx], eax
mov eax, dword [0x48d29c]
cmp dword [eax], 0x20
ja 0x4630d7
mov eax, dword [0x48d29c]
cmp dword [eax], 0
jbe 0x4630d7
mov edx, dword [0x48d8bc]
mov edx, dword [edx]
mov ax, 7
call fcn.0040de10
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x4630f4
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
call fcn.00464bb4
test al, al
je 0x463276
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
xor eax, eax
call fcn.0040f3c4
test al, al
je 0x463276
mov edx, dword [0x48d550]
add edx, 0x100
mov eax, esp
call fcn.00405c48
mov eax, dword [ebx + 0x14]
call fcn.0040fb28
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.00412584
test al, al
je 0x4631a3
mov edx, dword [0x48d550]
add edx, 0x100
mov eax, esp
call fcn.00405c48
push 0x463280
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebx + 0x14]
call fcn.0040fb28
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.00412584
test al, al
je 0x4631a3
mov eax, esp
xor edx, edx
call fcn.00411180
test al, al
je 0x463276
push 4
mov ax, word [ebx + 0x534]
call fcn.00412944
mov edx, eax
lea ecx, [esp + 4]
lea eax, [ebx + 0xc]
call fcn.004245b8
test al, al
je 0x463276
push 1
push 0x463284
push 0x463284
lea eax, [esp + 0xc]
push eax
push 0
mov eax, dword [ebx]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x48d29c]
mov dword [edx], eax
mov eax, dword [0x48d29c]
cmp dword [eax], 0x20
ja 0x463226
mov eax, dword [0x48d29c]
cmp dword [eax], 0
jbe 0x463226
mov edx, esp
mov ax, 7
call fcn.0040de10
push esp
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x463276
mov edx, esp
mov ax, 4
call fcn.0040de10
jmp 0x463276
mov eax, 0xfa
call fcn.0040f448
mov eax, dword [0x48dbbc]
mov byte [eax], 1
mov ax, 0x16
call fcn.0040bc04
mov edx, esp
call fcn.0040f5a0
mov eax, dword [0x48da44]
mov edx, 0x13
call fcn.00411d74
cmp al, 1
jne 0x463276
push esp
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x463276
mov edx, esp
mov ax, 4
call fcn.0040de10
add esp, 0x100
pop ebx
ret

Function at 0x464398
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x48d550]
cmp byte [eax + 0x193c], 0
jne 0x4643cf
mov eax, dword [0x48d67c]
cmp dword [eax], 0
je 0x46445a
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_DestroyWindow
mov eax, dword [0x48d67c]
xor edx, edx
mov dword [eax], edx
pop ebx
ret
mov eax, dword [0x48d67c]
cmp dword [eax], 0
jne 0x46442c
call fcn.00485058
push 0
mov eax, dword [0x48d7dc]
movzx eax, byte [eax]
inc eax
push eax
mov eax, dword [0x48d95c]
movsx eax, word [eax]
add eax, 2
push eax
mov eax, dword [0x48d88c]
movzx eax, byte [eax]
add eax, 2
push eax
mov eax, dword [0x48d2f0]
cmp word [eax], 0
sete al
and eax, 0x7f
add eax, eax
mov edx, dword [0x48d2f0]
movsx edx, word [edx]
sub edx, eax
push edx
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_MoveWindow
mov eax, dword [0x48d510]
cmp dword [eax], 0
jle 0x46444b
test bl, bl
je 0x46445a
push 4
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x46445a
push 0
mov eax, dword [0x48d67c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x465de0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, ecx
mov ebx, edx
mov ebp, eax
mov esi, dword [0x48da44]
mov eax, 0x49c1e4
call fcn.004032bc
call fcn.004172d4
mov edx, eax
mov eax, 0x49c1e4
call fcn.00403250
call fcn.004032bc
sub edi, ebx
mov dword [esp], edi
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00412e40
mov edx, esi
mov eax, dword [0x48d830]
call fcn.00405c48
mov ax, 0x251
call fcn.0040bc04
mov edx, dword [0x48d830]
call fcn.0040f5a0
mov edx, esi
mov eax, 0x49c1e4
call fcn.00403250
call fcn.004032bc
test ebx, ebx
jbe 0x465ea5
mov dword [esp], ebx
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00412e40
mov edx, esi
mov eax, 0x49c1e4
call fcn.00403250
call fcn.00402c54
mov ax, 0x33a
call fcn.0040bc04
mov edx, eax
mov eax, 0x49c1e4
call fcn.00403250
call fcn.004032bc
mov eax, dword [0x48d550]
cmp byte [eax + 0x1880], 0
je 0x465eee
mov dword [esp], ebp
xor eax, eax
mov dword [esp + 4], eax
fild qword [esp]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00412e40
mov edx, eax
mov eax, 0x49c1e4
call fcn.00403250
push eax
mov ax, 0x253
call fcn.0040bc04
mov edx, eax
pop eax
call fcn.00403250
call fcn.004032bc
mov eax, 0x49c1e4
call fcn.00402c60
mov edx, dword [0x48d550]
add edx, 0x500
mov eax, esi
call fcn.00405c48
push 0x465f6c
push esi
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d550]
add eax, 0x100
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x48d964]
mov eax, dword [eax]
push eax
push esi
call sub.kernel32.dll_lstrcatA
push 0x465f70
push esi
call sub.kernel32.dll_lstrcatA
push 3
push esi
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x465f62
mov edx, dword [0x48d550]
add edx, 0x500
mov ax, 7
call fcn.0040de10
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret