joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f0bc
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, edx
mov ebp, eax
push esp
lea eax, [edi + 0xe]
mov ax, word [eax]
push eax
lea eax, [edi + 0x10]
mov ax, word [eax]
push eax
call sub.kernel32.dll_DosDateTimeToFileTime
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x45f0ec
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
lea eax, [edi + 0x12]
mov ax, word [eax]
push eax
call sub.kernel32.dll_DosDateTimeToFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 0x18], al
cmp byte [esp + 0x18], 0
jne 0x45f117
call sub.kernel32.dll_GetLastError_1
mov esi, eax
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 0x16]
mov ax, word [eax]
push eax
lea eax, [edi + 0x18]
mov ax, word [eax]
push eax
call sub.kernel32.dll_DosDateTimeToFileTime
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 0x19], al
cmp byte [esp + 0x19], 0
jne 0x45f147
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, esp
call fcn.00411360
lea eax, [esp + 0x10]
call fcn.00411360
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 8]
mov edx, ebp
mov al, 1
call fcn.004b3bb4
mov byte [esp + 0x1a], al
cmp byte [esp + 0x1a], 0
jne 0x45f180
call sub.kernel32.dll_GetLastError_1
mov esi, eax
add edi, 0xb
xor eax, eax
mov al, byte [edi]
push eax
push ebp
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
jne 0x45f1a6
call sub.kernel32.dll_GetLastError_1
mov esi, eax
test bl, bl
je 0x45f1c6
cmp byte [esp + 0x18], 0
je 0x45f1c6
cmp byte [esp + 0x19], 0
je 0x45f1c6
cmp byte [esp + 0x1a], 0
je 0x45f1c6
cmp byte [esp + 0x1b], 0
jne 0x45f1cf
mov edx, esi
mov eax, ebp
call fcn.0049d794
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x463970
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdb8
mov byte [esp + 5], cl
mov byte [esp + 4], dl
mov dword [esp], eax
lea esi, [esp + 0x108]
mov ebp, dword [0x4bedb0]
xor edi, edi
lea eax, [esp + 6]
mov edx, dword [esp]
call fcn.004b81b0
lea edx, [esp + 6]
mov eax, ebp
call fcn.004b81b0
mov eax, dword [0x4beb54]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
push ebp
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x463a0a
test byte [esi], 0x10
jne 0x4639f9
inc edi
cmp byte [esp + 5], 0
je 0x4639f9
lea edx, [esp + 6]
mov eax, ebp
call fcn.004b81b0
lea eax, [esi + 0x2c]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
mov edx, ebp
mov eax, 0x4c13ec
call fcn.004035b8
call fcn.00403624
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x463a10
cmp byte [esi + 0x2c], 0
jne 0x4639c6
push ebx
call sub.kernel32.dll_FindClose
lea edx, [esp + 6]
mov eax, ebp
call fcn.004b81b0
mov eax, dword [0x4beb54]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
push ebp
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x463a9d
test byte [esi], 0x10
je 0x463a8c
cmp al, 0x2e
je 0x463a8c
lea edx, [esp + 6]
mov eax, ebp
call fcn.004b81b0
lea eax, [esi + 0x2c]
push eax
push ebp
call sub.kernel32.dll_lstrcatA
push 0x463ab8
push ebp
call sub.kernel32.dll_lstrcatA
mov eax, ebp
mov cl, byte [esp + 5]
mov dl, byte [esp + 4]
call fcn.00463970
add edi, eax
cmp byte [esp + 4], 0
je 0x463a8c
call fcn.004ae0a4
mov eax, dword [0x4bed48]
cmp byte [eax], 0
jne 0x463aa4
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x463aa4
mov al, byte [esi + 0x2c]
test al, al
jne 0x463a3c
push ebx
call sub.kernel32.dll_FindClose
mov eax, edi
add esp, 0x248
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4683e0
Capabilities:
Get disk information
Log keystrokes via polling

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, dword [0x4beecc]
cmp byte [eax], 0
jne 0x468617
mov bl, 1
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl byte [esp + 2]
mov eax, dword [0x4becf8]
push eax
push esi
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x468420
xor ebx, ebx
jmp 0x468617
push 0x468620
push esi
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x468473
mov eax, dword [0x4bed48]
cmp byte [eax], 0
jne 0x468603
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
jne 0x46844c
call fcn.0042de0c
mov eax, dword [0x4be9c8]
mov byte [eax], 1
call fcn.0042eae4
mov eax, dword [0x4be9c8]
mov byte [eax], 0
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_DestroyWindow
jmp 0x468603
cmp byte [esp], 0
je 0x468486
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x4be538]
mov edx, esi
call fcn.004b81b0
mov eax, dword [0x4be538]
cmp byte [eax], 0x3a
jne 0x46855f
mov edx, dword [0x4be55c]
mov eax, dword [0x4be538]
inc eax
call fcn.0049e868
test al, al
je 0x46855f
mov eax, dword [0x4be55c]
cmp byte [eax], 0
jle 0x468547
mov eax, dword [0x4be55c]
mov al, byte [eax]
call fcn.004ab84c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov edx, dword [0x4beed8]
mov word [edx], ax
mov eax, dword [0x4beed8]
cmp word [eax], 4
jne 0x468501
mov edx, dword [0x4bedb0]
mov ax, 0xa
call fcn.004acdac
jmp 0x468617
cmp byte [esp + 2], 0
je 0x46854c
push 1
lea edx, [esp + 5]
mov eax, dword [0x4be55c]
mov al, byte [eax]
xor ecx, ecx
call fcn.0049e91c
test al, al
je 0x46854c
mov dx, 0xfffa
mov eax, dword [0x4beabc]
mov cl, byte [eax]
cmp cl, byte [esp + 1]
jne 0x468539
mov ecx, dword [0x4be55c]
mov byte [ecx], dl
inc edx
inc eax
test dx, dx
jne 0x468529
call fcn.004a7468
jmp 0x46854c
call fcn.004a7468
mov eax, dword [0x4be538]
mov byte [eax + 1], 0
call fcn.0044afac
jmp 0x468603
mov eax, dword [0x4be55c]
mov byte [eax], 0
mov eax, dword [0x4be538]
mov dl, 0x5c
call fcn.004b838c
mov esi, eax
test esi, esi
je 0x4685c8
mov dl, 0x2a
mov eax, esi
call fcn.004b8284
test eax, eax
jne 0x468593
mov dl, 0x3f
mov eax, esi
call fcn.004b8284
test eax, eax
je 0x4685c8
inc esi
mov eax, dword [0x4be784]
add eax, 0x1a5a
mov cx, 0xd
mov edx, esi
call fcn.004b81d8
mov byte [esi], 0
mov eax, dword [0x4be784]
mov byte [eax + 0x18a7], 0
mov eax, dword [0x4be538]
xor edx, edx
call fcn.0044c444
mov bl, 1
jmp 0x468603
mov eax, dword [0x4be538]
call fcn.004b1914
test al, al
jne 0x4685ed
mov eax, dword [0x4be538]
call fcn.004b1960
test al, al
je 0x4685ed
mov al, 1
call fcn.0044c7b4
jmp 0x468603
push 0
push 0
mov cl, 1
mov dl, 1
xor eax, eax
call fcn.0044c078
test ax, ax
jg 0x468603
xor ebx, ebx
cmp byte [esp + 2], 0
je 0x468617
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x468628
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4687ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4beecc]
cmp byte [eax], 0
jne 0x4687d4
mov eax, dword [0x4be8ec]
cmp word [eax], 0x2bc
jbe 0x4686bb
mov eax, dword [0x4becf4]
mov al, byte [eax + 0xb7]
mov edx, dword [0x4be784]
cmp al, byte [edx + 0x1860]
je 0x4686bb
call fcn.00402780
test eax, eax
jne 0x4686bb
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x4686bb
call fcn.004b0054
test al, al
jne 0x4686bb
mov eax, dword [0x4bee68]
cmp byte [eax], 5
je 0x4686bb
call fcn.004b16e8
mov eax, dword [0x4becf4]
mov al, byte [eax + 0xb7]
mov edx, dword [0x4be784]
mov byte [edx + 0x1860], al
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x4686da
mov eax, dword [0x4be784]
cmp byte [eax + 0x185e], 0
je 0x4686da
xor eax, eax
call fcn.00424f80
call fcn.00402780
mov ebx, eax
test bx, bx
jle 0x46870e
mov si, 1
lea edx, [ebp - 4]
movsx eax, si
call fcn.004027e0
lea eax, [ebp - 4]
call fcn.00404d64
xor edx, edx
call fcn.004683e0
test al, al
je 0x46870e
inc esi
dec bx
jne 0x4686ea
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x468744
mov eax, dword [0x4bee68]
cmp byte [eax], 5
jne 0x468744
mov eax, dword [0x4be7e4]
mov byte [eax], 1
call fcn.00402780
test eax, eax
jne 0x468738
call fcn.004b16e8
push 0
call sub.user32.dll_PostQuitMessage
jmp 0x4687d4
call fcn.00402780
test eax, eax
jne 0x4687d4
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x4687d4
mov eax, dword [0x4be784]
cmp byte [eax + 0x1932], 1
jne 0x46877c
mov eax, dword [0x4be784]
cmp dword [eax + 0x176c], 1
jle 0x46877c
call fcn.00476c50
mov eax, dword [0x4be784]
cmp byte [eax + 0x1932], 2
jne 0x4687d4
mov eax, dword [0x4be784]
cmp byte [eax + 0x1883], 0
je 0x4687d4
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x4687d4
mov ax, 0x2f1
call fcn.004aa600
mov edx, eax
lea eax, [ebp - 0x104]
call fcn.004b81b0
lea eax, [ebp - 0x104]
mov dl, 1
call fcn.004b1a60
lea eax, [ebp - 0x104]
mov dl, 1
call fcn.00476190
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4687f1
lea eax, [ebp - 4]
call fcn.0040489c
ret
Function at 0x473508
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
cmp byte [esi + 0x437], 0
je 0x473527
mov eax, esi
xor edx, edx
call fcn.00473240
jmp 0x473765
cmp byte [esi + 0x438], 0
jne 0x473765
cmp byte [esi + 0x442], 0
jne 0x473555
mov eax, dword [esi + 0xc]
push dword [eax + 0x14]
push dword [eax + 0x10]
mov al, 1
call fcn.004adfd4
test al, al
je 0x473765
mov eax, dword [0x4bee20]
cmp byte [eax], 2
jne 0x47356c
cmp byte [esi + 0x443], 0
je 0x473765
mov eax, esi
call fcn.0044f5d0
test al, al
je 0x473765
mov eax, dword [esi + 0xc]
cmp dword [eax + 0x5c], 0
jne 0x4735bb
cmp byte [esi + 0x442], 0
jne 0x4735bb
mov eax, dword [eax + 0xc]
call fcn.004b1914
mov byte [esp], al
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x96], 3
je 0x4735bb
cmp byte [esp], 0
jne 0x4735bb
mov edx, dword [eax + 0xc]
mov ax, 0xa
call fcn.004acdac
jmp 0x473765
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x96], 4
jne 0x4735ce
mov bl, 1
jmp 0x473765
cmp byte [esi + 0x442], 0
je 0x473605
call fcn.0049ea10
test al, al
je 0x473765
mov eax, dword [esi + 0xc]
call fcn.0041c2c0
test al, al
je 0x4735fe
mov bl, 1
mov eax, esi
call fcn.0044ef30
jmp 0x473765
xor ebx, ebx
jmp 0x473765
mov eax, dword [esi + 0xc]
fild qword [eax + 0x10]
fcomp dword [0x47376c]
fnstsw ax
sahf
jbe 0x473624
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
je 0x473765
mov eax, dword [0x4bee20]
cmp byte [eax], 0
jne 0x473649
cmp byte [esp], 0
je 0x473649
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
mov dl, 1
call fcn.004b0584
test al, al
je 0x473765
mov edi, dword [esi + 0xc]
fild qword [edi + 0x10]
fcomp dword [0x473770]
fnstsw ax
sahf
jbe 0x473668
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
je 0x473765
push 2
mov ax, word [esi + 0x424]
call fcn.004b1cb8
mov edx, eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, edi
call fcn.00419530
test al, al
je 0x473765
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x96], 3
jne 0x4736ad
mov edx, dword [0x4be784]
mov dl, byte [edx + 0x18f1]
mov byte [eax + 0xd2], dl
jmp 0x4736e5
cmp byte [eax + 0xa1], 0
je 0x4736d2
mov ax, word [esi + 0x424]
call fcn.004b1cb8
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [esi + 0xc]
mov byte [eax + 0xa1], 0
mov eax, dword [esi + 0xc]
mov word [eax + 0x94], 0
mov byte [eax + 0x96], 1
mov byte [esi + 0x443], 0
mov eax, dword [esi + 0xc]
mov dl, 1
call fcn.00418a58
mov bl, 1
mov eax, dword [esi + 0xc]
cmp byte [eax + 0xa5], 0x3f
jne 0x473733
push 0xff
mov eax, dword [0x4bedb0]
push eax
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_GetShortPathNameA
mov eax, dword [0x4bedb0]
call fcn.004aed10
mov edx, eax
mov eax, dword [esi + 0xc]
add eax, 0xa5
call fcn.004b81b0
mov eax, esi
xor edx, edx
call fcn.0047318c
mov eax, dword [0x4bee20]
cmp byte [eax], 0
jbe 0x473765
mov eax, dword [0x4be42c]
inc word [eax]
mov eax, dword [0x4bef24]
fild qword [eax]
mov eax, dword [esi + 0xc]
fild qword [eax + 0x10]
faddp st(1)
mov eax, dword [0x4bef24]
fistp qword [eax]
wait
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4739dc
Capabilities:
Delete file

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, eax
mov si, word [ebx + 0x428]
mov eax, dword [0x4be938]
cmp si, word [eax]
jne 0x473a39
mov ecx, esp
mov edx, dword [ebx + 0x30]
mov eax, esi
dec eax
call fcn.00430cd4
test al, al
je 0x473a20
push esp
call sub.kernel32.dll_DeleteFileA_1
mov eax, esp
call fcn.004adcfc
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.004b19b4
dec word [ebx + 0x428]
mov eax, dword [0x4bef08]
mov al, byte [eax]
mov byte [ebx + 0x434], al
call fcn.00427d08
mov eax, dword [0x4be938]
mov word [eax], 0xffff
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x473da4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov ebx, edx
mov esi, eax
mov eax, dword [0x4bef50]
cmp dword [eax], 0
je 0x473ef6
cmp si, 0x8a
je 0x473ef6
cmp si, 0xac
je 0x473ef6
cmp si, 0x26fa
je 0x473ef6
mov byte [esp], 0
test bl, bl
je 0x473e53
mov eax, dword [0x4bef50]
mov eax, dword [eax]
cmp dword [eax + 0x168], 0
jne 0x473e53
mov eax, dword [0x4beddc]
mov eax, dword [eax]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push 0xff
mov eax, dword [0x4bedb0]
push eax
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x4bedb0]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push 0x473f00
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.004ab7d8
push 0x473f04
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
movzx eax, si
xor edx, edx
call fcn.004862ec
mov eax, dword [0x4bedb0]
cmp byte [eax], 0
je 0x473e94
mov eax, dword [0x4bedb0]
mov dl, 0x26
call fcn.004aec2c
mov eax, dword [0x4bedb0]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x473ecb
push 0x473f0c
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
movzx eax, si
mov dword [esp + 0x100], eax
fild dword [esp + 0x100]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b849c
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
test bl, bl
jne 0x473ee6
mov edx, esp
mov eax, dword [0x4bef50]
mov eax, dword [eax]
add eax, 0x148
xor ecx, ecx
call fcn.004ac0f4
jmp 0x473ef6
mov edx, esp
mov eax, dword [0x4bef50]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004a9c04
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x475d4c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
push 0
mov eax, dword [0x4bf704]
push eax
push 0x4d2
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0
push 0x44008020
push 0
push 0x475e88
push 0
call sub.user32.dll_CreateWindowExA
mov edx, dword [0x4be8e4]
mov dword [edx], eax
mov eax, dword [0x4be8e4]
cmp dword [eax], 0
jne 0x475db2
call sub.kernel32.dll_GetLastError_1
call fcn.004ae200
mov eax, dword [0x4bedb0]
mov edx, 1
call fcn.004b12a8
jmp 0x475e81
push 0
push 0x11
call sub.gdi32.dll_GetStockObject
push eax
push 0x30
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 0x4496d0
push 0xfffffffffffffffc
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowLongA
mov edx, dword [0x4be458]
mov dword [edx], eax
mov eax, dword [0x4be744]
cmp dword [eax], 0
jle 0x475e81
mov esi, dword [0x4be4ec]
movsx esi, word [esi]
test esi, esi
jle 0x475e60
mov edi, 1
mov ebx, dword [0x4be754]
mov eax, dword [ebx]
test eax, eax
je 0x475e59
push 0xff
mov edx, dword [0x4bedb0]
push edx
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowTextA
mov dword [esp], 9
mov eax, dword [0x4bedb0]
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edi
mov eax, esp
push eax
mov eax, dword [0x4be744]
mov eax, dword [eax]
dec eax
push eax
push 0x1307
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
inc edi
add ebx, 4
dec esi
jne 0x475e0d
push 0
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
call fcn.00472710
push eax
push 0x130c
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x47b324
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47b3b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040489c
mov eax, ebx
add al, 0xfe
sub al, 0x22
jae 0x47b391
test esi, esi
je 0x47b391
mov edi, ebx
and edi, 0xff
mov eax, esi
xor edx, edx
div edi
mov eax, 0x47b3d0
mov dl, byte [eax + edx]
lea eax, [ebp - 0xc]
call fcn.00404a7c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.00404b68
mov eax, esi
xor edx, edx
div edi
mov esi, eax
test esi, esi
jne 0x47b359
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004048f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b3be
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004048c0
ret

Function at 0x47db20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
xor eax, eax
mov dword [ebp - 0x158], eax
xor eax, eax
push ebp
push 0x47dce5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x4c1f10], 0x1000
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov edx, 0x4c1f10
lea eax, [ebp - 4]
call fcn.0047f624
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [0x4bef50]
cmp dword [eax], 0
je 0x47db98
mov edx, dword [0x4be538]
mov eax, dword [0x4bef50]
mov eax, dword [eax]
call fcn.004a9c50
jmp 0x47dbb2
mov eax, 0x47dcf0
call fcn.004b1c50
mov edx, dword [0x4bedb0]
mov eax, dword [0x4be538]
call fcn.004b81b0
mov eax, dword [0x4be538]
call fcn.004aedb4
push 0x47dcf4
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_lstrcatA
mov al, 0x1c
call fcn.00421294
test al, al
je 0x47dcb8
lea eax, [ebp - 0x158]
mov edx, dword [0x4be538]
mov ecx, pe_nt_image_headers32
call fcn.00404b04
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
call fcn.00402bec
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.004032a8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004b8144
mov ecx, eax
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.00402d70
lea eax, [ebp - 0x154]
call fcn.00402d90
mov eax, dword [ebp - 4]
call fcn.004b8144
cmp eax, dword [ebp - 8]
jne 0x47dcb8
mov ax, 0x35d
call fcn.004aa600
mov edx, dword [0x4be538]
call fcn.004ae1b0
mov ax, 0xae
call fcn.004aa600
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
mov edx, 0x14
call fcn.004b12a8
cmp al, 1
jne 0x47dcb8
push 1
push 0x47dcf0
push 0
mov eax, dword [0x4be538]
push eax
push 0
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x47dcb8
test eax, eax
jbe 0x47dcb8
mov edx, dword [0x4be538]
mov ax, 7
call fcn.004acdac
push 0x4000
mov eax, dword [0x4c1f10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dcec
lea eax, [ebp - 0x158]
call fcn.0040489c
ret
Function at 0x47f4d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
add esi, 0xfffffd24
xor ebx, ebx
mov eax, dword [esi]
mov edx, dword [ebp + 8]
add dword [edx - 0x2cc], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffd2c
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffd40
push eax
push 0x2bc
mov eax, dword [ebp + 8]
add eax, 0xfffffd44
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x2e0]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x47f61a
mov eax, dword [ebp + 8]
cmp dword [eax - 0x2c0], 0
je 0x47f61a
mov bl, 1
mov eax, dword [ebp + 8]
cmp dword [eax - 0x2c0], 0x2bc
jne 0x47f5f9
mov eax, 0x47f620
call fcn.004b8144
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x2c0]
sub edx, eax
mov dword [esi], edx
mov eax, 0x47f620
call fcn.004b8144
inc eax
push eax
mov eax, dword [esi]
mov edx, dword [ebp + 8]
lea eax, [edx + eax - 0x2bc]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffd29
push eax
call sub.kernel32.dll_lstrcpynA
jmp 0x47f5b4
dec dword [esi]
mov eax, 0x47f620
call fcn.004b8144
inc eax
push eax
mov eax, dword [esi]
mov edx, dword [ebp + 8]
lea eax, [edx + eax - 0x2bc]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffd29
push eax
call sub.kernel32.dll_lstrcpynA
push 0x47f620
mov eax, dword [ebp + 8]
add eax, 0xfffffd29
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x47f5d0
cmp dword [esi], 0
ja 0x47f58b
push 0x47f620
mov eax, dword [ebp + 8]
add eax, 0xfffffd29
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x47f5f5
mov eax, 0x47f620
call fcn.004b8144
add dword [esi], eax
jmp 0x47f604
xor ebx, ebx
jmp 0x47f604
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x2c0]
mov dword [esi], eax
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov dword [edx - 0x2e4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x2e8], edx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x481748
Capabilities:
Move file

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov eax, dword [0x4c2440]
call fcn.004066d0
mov edx, eax
mov eax, dword [0x4bef50]
mov eax, dword [eax]
mov eax, dword [eax + 0x164]
call fcn.004a9904
mov edx, dword [0x4be650]
mov dword [edx], eax
cmp word [0x4c2440], 0xb
jb 0x48187b
mov bl, byte [0x4c2440]
sub bl, 0xa
movsx esi, bl
mov eax, dword [0x4be650]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x1ac]
call fcn.004aed10
call fcn.004b8404
mov edx, dword [0x4be914]
mov dword [edx], eax
mov dl, 0x56
mov ax, 0x1f
call fcn.0048841c
test eax, eax
je 0x48187b
mov eax, dword [0x4be650]
mov eax, dword [eax]
mov edx, dword [eax + esi*4 + 0x1ac]
mov eax, esp
call fcn.004b81b0
mov eax, esp
call fcn.004aecf0
mov eax, esp
call fcn.004aedb4
mov eax, dword [0x4be914]
mov eax, dword [eax]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push esp
mov eax, dword [0x4be650]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x1ac]
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x481856
mov eax, dword [0x4be650]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x1ac]
call fcn.004b8480
mov eax, esp
call fcn.004b8404
mov edx, dword [0x4be650]
mov edx, dword [edx]
mov dword [edx + esi*4 + 0x1ac], eax
mov eax, dword [0x4be914]
mov eax, dword [eax]
call fcn.00484bbc
mov eax, dword [0x4bef50]
mov eax, dword [eax]
mov byte [eax + 0x163], 1
jmp 0x48186f
call sub.kernel32.dll_GetLastError_1
call fcn.004ae200
mov eax, dword [0x4bedb0]
mov edx, 1
call fcn.004b12a8
mov eax, dword [0x4be914]
mov eax, dword [eax]
call fcn.004b8480
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4818ec
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x4c2440]
call fcn.004066d0
mov edx, eax
mov eax, dword [0x4bef50]
mov eax, dword [eax]
mov eax, dword [eax + 0x164]
call fcn.004a9904
mov edx, dword [0x4be650]
mov dword [edx], eax
mov ax, word [0x4c2440]
cmp ax, 0xb
jb 0x4819ae
movzx eax, ax
mov edx, dword [0x4be650]
mov edx, dword [edx]
cmp dword [edx + eax*4 + 0x184], 0
jne 0x48193d
call fcn.004810c0
ret
mov eax, dword [0x4bedb0]
call fcn.004ae768
test al, al
je 0x4819ae
push 0x4819b0
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
movzx eax, word [0x4c2440]
mov edx, dword [0x4be650]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 0x184]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4819b4
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
push 1
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x4819ae
mov edx, dword [0x4bedb0]
mov ax, 7
call fcn.004acdac
ret