joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449d10
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
cmp ebx, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
jne 0x449d54
cmp ebp, ebx
jne 0x449d54
mov eax, dword [esp + 0x334]
push eax
call fcn.00449ce0
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x449d6f
mov esi, edi
call fcn.00439120
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
je 0x449da3
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
cmp ebp, 0xffffffff
mov dword [esp + 0x228], eax
je 0x449dea
test ecx, ecx
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
jbe 0x449dd2
cmp dword [esp + eax*4 + 0x24], ebp
je 0x449dd2
add eax, 1
cmp eax, ecx
jb 0x449dc5
cmp eax, ecx
jne 0x449de4
cmp ecx, 0x40
jae 0x449de4
mov dword [esp + eax*4 + 0x24], ebp
add dword [esp + 0x20], 1
cmp ebp, edx
jbe 0x449dea
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
sub ebx, 1
and ebx, ecx
lea ecx, [ecx]
xor eax, eax
cmp edi, eax
jle 0x449e31
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x449e3b
jne 0x449e3b
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x449ea5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x449e6e
cmp eax, 0x2714
jne 0x449ea9
test edi, edi
jle 0x449e00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00439120
push edx
push eax
call fcn.00439150
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x449e00
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x449eb7
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x449ec6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x449efd
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x449eeb
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x449efd
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x449f30
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x449f1e
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x449f30
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x44ba80
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x44ba8f
jmp dword [ecx*4 + 0x44bae4]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x44bc70
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4a71b0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00425496
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x44bcd5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x44bcd5
lea edx, [esp]
push edx
call dword [0x4a83e0]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040fd10
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0040fd10
add esp, 0x108
ret
jmp 0x44bc70

Function at 0x44bcf0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4a71b0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00425496
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x44bcd5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x44bcd5
lea edx, [esp]
push edx
call dword [0x4a83e0]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040fd10
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0040fd10
add esp, 0x108
ret
jmp 0x44bc70

Function at 0x44e830
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x452990
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x480ab3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4a71b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x4be2a8
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x4be2a8
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x48573a
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.00451d20
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x452a40
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x480cd8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a71b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x28]
xor edi, edi
cmp ebp, edi
jne 0x452a82
push edi
push edi
push edi
push 2
call fcn.004541f0
xor al, al
jmp 0x452c1f
mov esi, dword [ebx + 0x18]
cmp esi, edi
je 0x452aa1
lea esp, [esp]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x452a90
push 2
or eax, 0xffffffff
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
push edi
push ebp
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.0045db8b
push ebp
call fcn.0045efc8
push 0
push 0
push ebp
mov edi, eax
call fcn.0045db8b
add esp, 0x1c
test edi, edi
jne 0x452ae5
push edi
push edi
push edi
push 0xd
mov ecx, ebx
call fcn.004541f0
xor al, al
jmp 0x452c1f
mov dword [esp + 0x14], 0x4be2a8
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.00451c80
lea eax, [edi + 1]
push eax
call fcn.0040fb68
push ebp
mov esi, eax
push 1
push edi
push esi
mov dword [esp + 0x3c], esi
mov byte [esi], 0
call fcn.0045d931
add esp, 0x14
cmp eax, 1
je 0x452b55
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.004541f0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp eax, 0x4be2a8
je 0x452b4e
push eax
call fcn.0040fa42
add esp, 4
xor al, al
jmp 0x452c1f
mov ebp, dword [esp + 0x28]
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, esi
je 0x452bc7
mov cl, byte [esi]
cmp cl, 0xa
jne 0x452b85
mov ecx, esi
sub ecx, eax
add ecx, 1
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00451e10
add esi, 1
mov eax, esi
jmp 0x452bc2
cmp cl, 0xd
jne 0x452bbf
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x452b9d
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00451e10
push 1
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xa
call fcn.00451e10
cmp byte [esi + 1], 0xa
jne 0x452b7e
add esi, 2
mov eax, esi
jmp 0x452bc2
add esi, 1
cmp byte [esi], 0
jne 0x452b65
sub esi, eax
je 0x452bd6
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.00451e10
push ebp
call fcn.0040fa42
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, ebx
call eax
cmp byte [ebx + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
jne 0x452b3e
cmp eax, 0x4be2a8
je 0x452c1d
push eax
call fcn.0040fa42
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x45d695
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x45d6d2
cmp dword [ebp + 0x14], edi
je 0x45d6d2
cmp ecx, edi
jne 0x45d6d9
call fcn.00414f53
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00410acc
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x45d6ed
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x45d70e
cmp ebx, 0xffffffff
je 0x45d6fd
push ebx
push edi
push ecx
call fcn.004101c0
add esp, 0xc
cmp esi, edi
je 0x45d6ba
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x45d6ba
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x45d72a
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x45d731
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x45d822
test word [esi + 0xc], 0x10c
je 0x45d785
mov eax, dword [esi + 4]
test eax, eax
je 0x45d785
jl 0x45d883
cmp ebx, eax
mov edi, ebx
jb 0x45d756
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x45d82a
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0040fad4
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x45d81a
cmp ebx, dword [ebp - 0xc]
jb 0x45d7f2
cmp dword [ebp - 0xc], 0
je 0x45d7af
mov ecx, accept
xor edx, edx
cmp ebx, ecx
jbe 0x45d7a4
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x45d7ab
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x45d7ba
mov eax, accept
cmp ebx, eax
ja 0x45d7ba
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x45d856
push eax
push dword [ebp - 8]
push esi
call fcn.0041655d
pop ecx
push eax
call fcn.0042662b
add esp, 0xc
test eax, eax
je 0x45d895
cmp eax, 0xffffffff
je 0x45d883
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x45d81a
push esi
call fcn.00425c6b
cmp eax, 0xffffffff
pop ecx
je 0x45d887
cmp dword [ebp - 4], 0
je 0x45d856
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x45d739
mov eax, dword [ebp + 0x14]
jmp 0x45d6d4
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x45d841
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004101c0
add esp, 0xc
call fcn.00414f53
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x45d6ca
cmp dword [ebp + 0xc], 0xffffffff
je 0x45d86c
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004101c0
add esp, 0xc
call fcn.00414f53
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x45d6ca
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x45d6d4
or dword [esi + 0xc], 0x10
jmp 0x45d887
Function at 0x4786e0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x49d104
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret

Function at 0x478750
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x49d0e8
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret

Function at 0x4787c0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x49d0cc
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret
Function at 0x478960
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [0x4be51c], 0
push 0
push 0x478830
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x49d094
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], edx
cmp dword [0x4be51c], 1
jle 0x478a2d
mov dword [ebp - 0x40], 0
jmp 0x478a00
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [0x4be51c]
jge 0x478a2d
mov edx, dword [ebp - 0x40]
shl edx, 4
mov eax, dword [edx + 0x4be2c0]
cmp eax, dword [ebp - 0x3c]
jle 0x478a2b
mov ecx, dword [ebp - 0x40]
shl ecx, 4
mov edx, dword [ecx + 0x4be2c0]
mov dword [ebp - 0x3c], edx
jmp 0x4789f7
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret

Function at 0x478a90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp - 4]
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x478ae1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
jmp 0x478aeb
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x478b00
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x478b2a
xor eax, eax
jmp 0x478cd3
mov dword [ebp - 8], 0
push 0
push 0x80
push 4
push 0
push 1
push accept
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x478b65
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
call fcn.0040f98e
add esp, 4
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], 0
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xe
mov esi, str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
lea edi, [ebp - 0x130]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xcb
push 0
lea ecx, [ebp - 0xf7]
push ecx
call fcn.004101c0
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
call fcn.0040fd80
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x134], 0
jmp 0x478c1a
mov eax, dword [ebp - 0x134]
add eax, 1
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp - 8]
jge 0x478cd1
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x134]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 0x130]
cmp eax, ecx
jne 0x478ccc
cmp dword [ebp - 0x1c], 0
je 0x478c4f
jmp 0x478cd1
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x138], 0
jmp 0x478c7a
mov eax, dword [ebp - 0x138]
add eax, 1
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x138]
cmp ecx, dword [ebp - 4]
jge 0x478ccc
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax + edx]
mov edx, dword [ebp - 0x138]
movsx eax, byte [ebp + edx - 0x130]
cmp ecx, eax
jne 0x478cc1
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
jne 0x478cbf
mov eax, 1
jmp 0x478cd3
jmp 0x478cca
mov dword [ebp - 0x10], 0
jmp 0x478ccc
jmp 0x478c6b
jmp 0x478c0b
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret
Function at 0x478cf0
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.004101c0
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004101c0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0041071d
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0041071d
add esp, 8
lea eax, [ebp - 0x418]
push eax
call fcn.004140e8
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
call fcn.004140e8
add esp, 4
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0040faa2
add esp, 8
test eax, eax
jne 0x478da4
jmp 0x478ebd
mov dword [ebp - 4], 0
mov dword [ebp - 0x41c], 0
mov ecx, 1
test ecx, ecx
je 0x478ebd
mov word [ebp - 0x628], 0
push 0x206
push 0
lea edx, [ebp - 0x626]
push edx
call fcn.004101c0
add esp, 0xc
cmp dword [ebp - 0x41c], 0
jne 0x478e04
mov eax, dword [ebp + 0xc]
push eax
push 0x49d5bc
lea ecx, [ebp - 0x628]
push ecx
call fcn.00410930
add esp, 0xc
jmp 0x478e23
mov edx, dword [ebp - 0x41c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x49d5cc
lea ecx, [ebp - 0x628]
push ecx
call fcn.00410930
add esp, 0x10
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x478e41
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x628]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004141e8
add esp, 8
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x478e8d
push 5
push 0
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x478ebd
push 5
push 0
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x41c], 0xa
jl 0x478ea9
jmp 0x478ebd
mov edx, dword [ebp - 0x41c]
add edx, 1
mov dword [ebp - 0x41c], edx
jmp 0x478db5
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret
Function at 0x478f50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.004101c0
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.004101c0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x49d580
lea eax, [ebp - 0x7d8]
push eax
call fcn.00410930
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x478fda
jmp 0x478ff4
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret

Function at 0x479010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push eax
call fcn.0040fa47
add esp, 4
test eax, eax
jne 0x479028
jmp 0x47907b
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004101c0
add esp, 0xc
mov dword [ebp - 0x30], 0x49d568
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x49d574
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x47907b
mov ecx, dword [ebp + 8]
push ecx
call fcn.00478f50
add esp, 4
mov esp, ebp
pop ebp
ret