joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x428
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
mov esi, dword [esp + 0x444]
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x440]
mov ecx, esi
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, ecx
xor eax, eax
mov edi, ebp
mov byte [esp + 0xd], 0x59
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x53
and ecx, 3
mov byte [esp + 0xc], dl
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x34]
mov byte [esp + 0xe], dl
rep stosd dword es:[edi], eax
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x17], al
mov byte [esp + 0x22], al
mov byte [esp + 0x26], al
mov byte [esp + 0x2b], al
mov al, 0x73
mov byte [esp + 0x15], cl
mov byte [esp + 0x2c], al
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x438]
mov byte [esp + 0x16], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x27], cl
mov byte [esp + 0x21], dl
mov byte [esp + 0x25], dl
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov byte [esp + 0x1b], 0x54
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], 0x4d
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x43
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x43
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x34], 0x76
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x63
mov byte [esp + 0x39], 0x5c
mov byte [esp + 0x3a], 0x25
mov byte [esp + 0x3c], 0
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x448]
push 0
push esi
push 0
push ebp
push 1
push eax
lea ecx, [esp + 0x58]
push ecx
push connect
call fcn.00404ec0
add esp, 0x2c
pop edi
pop esi
pop ebp
add esp, 0x428
ret
Function at 0x406570
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
sub esp, 0x110
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0xc]
push 0x104
push ecx
call eax
mov al, 0x6f
lea edx, [esp]
mov byte [esp + 1], al
mov byte [esp + 5], al
lea eax, [esp + 0xc]
push edx
push eax
mov byte [esp + 8], 0x5c
mov byte [esp + 0xa], 0x75
mov byte [esp + 0xb], 0x72
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xe], 0x67
mov byte [esp + 0xf], 0x2e
mov byte [esp + 0x10], 0x64
mov byte [esp + 0x11], 0x61
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00405c40
add esp, 0x110
ret

Function at 0x406780
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
push 0
call ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x40bbc8]
xor esi, esi
stosb byte es:[edi], al
mov edi, dword [esp + 0x114]
push edi
call fcn.00404b20
test eax, eax
jbe 0x406814
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__access]
push 0
call ebx
cmp byte [esi + edi], 0x5c
jne 0x406802
mov ecx, dword [0x40bbc8]
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00404a90
lea ecx, [esp + 0x10]
push 0
push ecx
call ebp
add esp, 8
cmp eax, 0xffffffff
jne 0x406802
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [0x40bbc8]
push edi
inc esi
call fcn.00404b20
cmp esi, eax
jb 0x4067c8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x406f10
Capabilities:
Create thread

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x40b574]
test eax, eax
je 0x406f2e
push 0x40bbcc
call fcn.004066f0
add esp, 4
jmp fcn.00406ae0
Function at 0x407160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
push ebx
mov bl, 0x6c
push 0
mov byte [esp + 8], 0x72
mov byte [esp + 9], 0x75
mov byte [esp + 0xa], 0x6e
mov byte [esp + 0xb], 0x64
mov byte [esp + 0xc], bl
mov byte [esp + 0xd], bl
mov byte [esp + 0xe], 0x33
mov byte [esp + 0xf], 0x32
mov byte [esp + 0x10], 0x2e
mov byte [esp + 0x11], 0x65
mov byte [esp + 0x12], 0x78
mov byte [esp + 0x13], 0x65
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 4]
push eax
call fcn.00407f80
add esp, 4
test eax, eax
je 0x40725b
mov cl, 0x2f
mov al, 0x6b
mov byte [esp + 0x1d], cl
mov byte [esp + 0x20], cl
mov byte [esp + 0x17], al
mov byte [esp + 0x18], al
lea ecx, [esp + 0x14]
mov dl, 0x69
mov al, 0x20
push 0
push ecx
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1e], 0x73
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], al
mov byte [esp + 0x26], 0x66
mov byte [esp + 0x27], al
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x6d
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2d], 0x75
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], 0x78
mov byte [esp + 0x37], 0x65
mov byte [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebx
add esp, 0x30
ret
Function at 0x4077a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x12c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
push 0
call ebp
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
call ebp
mov dl, 0x53
mov cl, 0x72
mov al, 0x65
mov bl, 0x74
push 0
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], 0x59
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], 0x54
mov byte [esp + 0x18], 0x45
mov byte [esp + 0x19], 0x4d
mov byte [esp + 0x1a], 0x5c
mov byte [esp + 0x1b], 0x43
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x43
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x5c
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x76
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x63
mov byte [esp + 0x33], al
mov byte [esp + 0x34], 0x73
mov byte [esp + 0x35], 0x5c
mov byte [esp + 0x36], 0
call ebp
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40b228
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
lea eax, [esp + 0x34]
lea ecx, [esp + 0x38]
push eax
push 0xf003f
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x40790a
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x12c
ret
xor eax, eax
add esp, 0x12c
ret
Function at 0x407f00
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x407e70
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x4c4d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x6f8], eax
and dword [ebp - 0x700], 0
jmp 0x4c4d4c
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x38c]
jae 0x4c4d9e
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
invalid

Function at 0x4dd704
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x18
mov ecx, eax
call fcn.00401500
mov eax, dword [ebp - 4]
add eax, 0x24
mov ecx, eax
call fcn.00401500
mov eax, dword [ebp - 4]
add eax, 0x30
mov ecx, eax
call fcn.00401500
mov eax, dword [ebp - 4]
add eax, 0x3c
mov ecx, eax
call fcn.00401500
mov eax, dword [ebp - 4]
add eax, 0x7c
mov ecx, eax
call fcn.00401500
mov eax, dword [ebp - 4]
add eax, 0x8d
mov ecx, eax
call fcn.00401500
mov eax, dword [ebp - 4]
add eax, 0x99
mov ecx, eax
call fcn.00401500
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x50], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov eax, dword [ebp - 4]
mov ecx, 1
mov dword [eax + 0x58], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x60], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x48], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xb7], edx
mov eax, dword [ebp - 4]
mov word [eax + 0x68], 2
movzx eax, word [0x6ea168]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x6a], ax
movzx eax, word [0x6ea16c]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x6c], ax
movzx eax, word [0x6ea170]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x6e], ax
movzx eax, word [0x7009a0]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x70], ax
mov eax, dword [ebp - 4]
mov word [eax + 0x72], 0x5b
mov eax, dword [ebp - 4]
mov word [eax + 0x74], dx
mov eax, dword [ebp - 4]
mov word [eax + 0x76], dx
mov eax, dword [ebp - 4]
mov dword [eax + 0x78], 0xffffffff
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
or eax, 1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
and eax, 0xfffffffd
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
or eax, 4
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
and eax, 0xfffffff7
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
and eax, 0xffffffef
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
or eax, 0x20
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
mov dword [eax + 0xbb], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xbf], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xc3], edx
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4e2130
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov ebp, ecx
cmp dword [0x6ea15c], 0
je 0x4e222d
mov dword [esp + 8], 0
cmp dword [ebp + 0x23], 0
je 0x4e222d
mov ecx, 0x801
call fcn.004dc218
mov ebx, eax
push dword [0x6ea15c]
push str.TallyODBC
push str._s__d
push ebx
call fcn.00697936
add esp, 0x10
push 1
call fcn.00660528
push ebx
call fcn.006604fe
push 2
call fcn.00660528
push ebx
call fcn.006604fe
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 1
push str.Tally_ODBC_Driver
call fcn.00660513
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREODBCODBC.INIODBC_File_DSN
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e221f
mov dword [esp + 8], 0x801
mov ecx, 0x801
call fcn.004dc218
mov dword [esp], eax
xor ecx, ecx
lea eax, [esp + 8]
push eax
mov edx, dword [esp + 4]
push edx
push ecx
push ecx
push str.DefaultDSNDir
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e220d
mov ecx, dword [esp]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4e21b0
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4e219b
dec eax
mov dword [esp + 8], eax
mov edx, dword [esp]
cmp byte [edx + eax - 1], 0x5c
je 0x4e21cb
mov byte [edx + eax], 0x5c
mov eax, dword [esp + 8]
inc eax
mov dword [esp + 8], eax
mov edi, edx
mov byte [edi + eax], 0
mov edx, ebx
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4e21dd
mov edi, dword [esp]
mov edx, str..dsn
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4e21f9
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp]
call fcn.004db958
mov ecx, ebx
call fcn.004db958
mov dword [ebp + 0x23], 0
call sub.WSOCK32.dll_WSACleanup
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x4e223c
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push edi
push ecx
mov eax, 0x18c
call fcn.006977b0
mov ecx, dword [esp + 0x18c]
mov edi, ecx
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [edi + 0x1b], eax
movzx eax, word [0x6ea15c]
push eax
call sub.WSOCK32.dll_htons
push 0
call sub.WSOCK32.dll_htonl
mov dword [0x6ea15c], 0
add esp, 0x190
pop edi
ret 4
Function at 0x4f5cec
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x88
call fcn.006977b0
mov dword [esp + 0x80], 0x80
lea eax, [esp + 0x84]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4f5d2d
xor eax, eax
add esp, 0x88
ret
xor ecx, ecx
lea edx, [esp]
lea eax, [esp + 0x80]
push eax
push edx
push ecx
push ecx
push str.Version
push dword [esp + 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4f5d5c
xor eax, eax
add esp, 0x88
ret
push dword [esp + 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp]
push eax
call fcn.00697b1e
pop ecx
movsx eax, ax
add esp, 0x88
ret
Function at 0x4fab7c
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
push ebp
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fabbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 5
je 0x4fab9e
mov eax, ebp
pop ebp
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fabbb
mov eax, ebp
pop ebp
pop esi
ret
xor eax, eax
pop ebp
pop esi
ret

Function at 0x4fabc0
Capabilities:
Delete file
Set file attributes

Disassembly:
push edi
push esi
push ebp
push ebx
mov ebx, edx
mov eax, 0x700ce0
cmp ecx, eax
je 0x4fabd6
mov ebp, 0x700ce0
jmp 0x4fabdb
mov ebp, 0x700de0
test ecx, ecx
je 0x4fac12
mov esi, ebp
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fabe3
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fac04
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fabef
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fac14
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fac14
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
push ebx
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fac5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x4fac5e
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x4fac5e
xor ebx, ebx
mov eax, ebx
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4fb3f8
Capabilities:
Create directory

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x4fb420
test dword [0x7eeab0], 0xffffffff
jne 0x4fb420
call fcn.006a7fbc
jmp fcn.004fb3f8
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov edi, edx
mov esi, ecx
mov ecx, esi
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fb444
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fb42f
dec eax
mov ebp, eax
lea ecx, [ebp + 0xa]
call fcn.004dc288
mov ebx, eax
cmp byte [esi + ebp - 1], 0x5c
je 0x4fb605
push edi
push 0x5c
push esi
push str._s_c_04.4d
push ebx
call fcn.00697936
add esp, 0x14
movsx eax, byte [ebx]
test eax, eax
je 0x4fb4c7
cmp eax, 0x5c
je 0x4fb5ca
mov edi, ebx
mov ecx, ebx
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fb498
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fb483
dec eax
lea edx, [ebx + eax + 1]
mov esi, ebx
cmp ebx, edx
je 0x4fb5c3
xor ebp, ebp
mov dword [esp + 8], ebx
movsx ebx, byte [esi]
test ebx, ebx
je 0x4fb4b8
cmp ebx, 0x5c
jne 0x4fb4bc
cmp esi, edi
ja 0x4fb4dd
inc esi
cmp esi, edx
jne 0x4fb4ac
mov ebx, dword [esp + 8]
jmp 0x4fb4cc
mov ebp, 3
mov ecx, ebx
call fcn.004db958
mov eax, ebp
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret
movsx eax, byte [esi - 1]
cmp eax, 0x3a
je 0x4fb4bc
cmp eax, 0x5c
je 0x4fb4bc
xor eax, eax
mov byte [esi], al
push eax
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [esp + 4]
cmp eax, 1
je 0x4fb537
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 4]
mov ebp, eax
mov byte [esi], bl
cmp ebp, 0x35
je 0x4fb59c
cmp ebp, 0x7b
je 0x4fb573
cmp ebp, 5
je 0x4fb540
test ebp, ebp
je 0x4fb4bc
cmp ebp, 0xb7
jne 0x4fb4c1
jmp 0x4fb4bc
mov byte [esi], bl
xor ebp, ebp
jmp 0x4fb4bc
mov eax, dword [esp + 8]
push eax
push str.Could_not_create_directory__s_nAccess_denied_
push 3
push 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebp
call fcn.004fc2bc
mov edx, dword [esp + 0x14]
add esp, 0x10
test ebp, ebp
je 0x4fb4bc
mov ebx, dword [esp + 8]
jmp 0x4fb4cc
mov eax, dword [esp + 8]
push eax
push str.Could_not_create_directory__s_nInvalid_directory_name_
push 3
push 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebp
call fcn.004fc2bc
mov edx, dword [esp + 0x14]
add esp, 0x10
cmp ebp, 5
je 0x4fb540
jmp 0x4fb529
mov eax, dword [esp + 8]
push eax
push str.Could_not_create_directory__s_nNetwork_path_not_found_
push 7
push 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebp
call fcn.004fc2bc
mov edx, dword [esp + 0x14]
add esp, 0x10
jmp 0x4fb529
xor ebp, ebp
jmp 0x4fb4cc
cmp byte [ebx + 1], 0x5c
jne 0x4fb47d
lea eax, [ebx + 2]
push 0x5c
push eax
call fcn.006987a0
add esp, 8
test eax, eax
je 0x4fb4c7
inc eax
push 0x5c
push eax
call fcn.006987a0
add esp, 8
mov edi, eax
test edi, edi
je 0x4fb4c7
jmp 0x4fb47f
push edi
push esi
push str._s_04.4d
push ebx
call fcn.00697936
add esp, 0x10
jmp 0x4fb46d
Function at 0x4fbc8c
Capabilities:
Delete file
Set file attributes

Disassembly:
push edi
push esi
push ebp
push ebx
mov ebx, ecx
test edx, edx
jne 0x4fbd41
mov edx, 0x700ce0
mov eax, dword [esp + 0x14]
cmp eax, edx
je 0x4fbcae
mov ebp, 0x700ce0
jmp 0x4fbcb3
mov ebp, 0x700de0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4fbcf4
mov esi, ebp
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fbcc1
mov ecx, dword [esp + 0x14]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fbce6
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fbcd1
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fbcf6
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fbcf6
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
push ebx
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fbdbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4fbdbb
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4fbdbb
mov edx, 0x700ce0
mov eax, dword [esp + 0x14]
cmp eax, edx
je 0x4fbd55
mov ebp, 0x700ce0
jmp 0x4fbd5a
mov ebp, 0x700de0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4fbd9b
mov esi, ebp
mov edi, dword [esp + 0x14]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fbd68
mov ecx, dword [esp + 0x14]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fbd8d
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fbd78
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fbd9d
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fbd9d
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
push ebx
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
mov ecx, ebp
call fcn.004face0
mov eax, 1
pop ebx
pop ebp
pop esi
pop edi
ret 4
Function at 0x5028ec
Capabilities:
Encode data using xor

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x502914
test dword [0x7eeab0], 0xffffffff
jne 0x5029ac
call fcn.006a7fbc
jmp fcn.005028ec
push edi
push esi
push ebp
push esi
mov eax, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea edi, [eax - 4]
movzx esi, dx
mov edx, esi
shr edi, 0x1f
lea eax, [edi + eax - 4]
sar eax, 1
test eax, eax
je 0x50298b
mov dword [esp], ebx
mov edi, esi
shl edi, 8
movzx ebx, byte [ebp]
and esi, 0xffffff00
shr esi, 8
xor ebx, esi
movzx ebx, bl
movzx esi, word [ebx*2 + 0x6f0140]
xor edi, esi
movzx esi, di
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, edx
shl ebx, 8
and edx, 0xffffff00
shr edx, 8
xor edi, edx
and edi, 0xff
movzx edx, word [edi*2 + 0x6f0140]
xor ebx, edx
movzx edx, bx
dec eax
jne 0x502937
mov ebx, dword [esp]
shl esi, 0x10
add esi, edx
cmp esi, dword [ecx]
jne 0x50299d
xor eax, eax
pop ecx
pop ebp
pop esi
pop edi
ret 4
mov eax, 1
pop ecx
pop ebp
pop esi
pop edi
ret 4
push edi
push esi
push ebp
push esi
mov edi, dword [esp + 0x14]
lea ebp, [ecx + 4]
lea esi, [edi - 4]
movzx edx, dx
mov eax, edx
shr esi, 0x1f
lea esi, [esi + edi - 4]
sar esi, 1
test esi, esi
je 0x502a26
mov dword [esp], ebx
movzx edi, byte [ebp]
mov ebx, edx
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl edx, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor edx, ebx
movzx edx, dx
movzx edi, byte [ebp + 1]
add ebp, 2
mov ebx, eax
and ebx, 0xffffff00
shr ebx, 8
xor edi, ebx
and edi, 0xff
shl eax, 8
movzx ebx, word [edi*2 + 0x6f0140]
xor eax, ebx
movzx eax, ax
dec esi
jne 0x5029cf
mov ebx, dword [esp]
shl edx, 0x10
add edx, eax
cmp edx, dword [ecx]
jne 0x502a38
xor eax, eax
pop ecx
pop ebp
pop esi
pop edi
ret 4
mov eax, 1
pop ecx
pop ebp
pop esi
pop edi
ret 4