joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481c78
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x481d4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0044c074
lea eax, [ebp - 0x14c]
mov edx, 0x481d64
call fcn.00403d40
mov eax, dword [ebp - 0x14c]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x481d31
xor eax, eax
push ebp
push 0x481d2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.00481c2c
test al, al
je 0x481cff
mov byte [ebp - 1], 1
jmp 0x481d13
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x481cea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481d31
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481d51
lea eax, [ebp - 0x14c]
call fcn.00403ab8
ret

Function at 0x481d68
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403efc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x481da8
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00403ce8
jmp 0x481daf
mov eax, ebx
call fcn.00403ab8
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x481db8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4b9098]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403efc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x481df8
mov eax, dword [esp + 4]
jmp 0x481dfa
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x481e04
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4b90a0]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x481e48
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x481e3e
mov eax, dword [esp + 4]
jmp 0x481e40
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x481e28
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4b90a0]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x481e48
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x481e3e
mov eax, dword [esp + 4]
jmp 0x481e40
xor eax, eax
add esp, 0x160
pop ebx
ret
Function at 0x48220c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
test dl, dl
je 0x482220
add esp, 0xfffffff0
call fcn.00403130
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0042f2b0
mov eax, dword [0x4822c4]
not eax
and eax, dword [esi + 0x40]
mov dword [esi + 0x40], eax
mov edx, 0x79
mov eax, esi
call fcn.0042c988
mov edx, 0x61
mov eax, esi
call fcn.0042c9a8
xor edx, edx
mov eax, esi
call fcn.0042d2d4
mov dl, 1
mov eax, esi
call fcn.00433470
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jae 0x48227f
mov dx, 0xfffe
mov eax, esi
call fcn.0042d314
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x3c
push 0x1f
call sub.user32.dll_SystemParametersInfoA
test eax, eax
je 0x4822a5
lea eax, [ebp - 0x3c]
push eax
call sub.gdi32.dll_CreateFontIndirectA
mov edx, eax
mov eax, dword [esi + 0x58]
call fcn.00418650
mov eax, esi
test bl, bl
je 0x4822ba
call fcn.00403188
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x483134
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4831f9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov bl, 0x41
test esi, 1
jne 0x48316a
mov eax, ebx
call fcn.00481e58
test al, al
je 0x4831d2
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403c60
lea eax, [ebp - 8]
mov edx, 0x483210
call fcn.00403d40
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00481d68
mov eax, dword [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x14]
call fcn.0040298c
mov edx, 0x483214
lea eax, [ebp - 0x14]
mov cl, 2
call fcn.0040295c
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00403cdc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.00482c9c
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x483157
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483200
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403adc
ret
Function at 0x483218
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4833e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4833b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403d38
cmp eax, 3
jne 0x4832af
mov eax, ebx
call fcn.00482060
test al, al
jne 0x48328f
mov byte [ebp - 1], 0
call fcn.00403628
jmp 0x4833ba
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.00481d68
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00483618
mov byte [ebp - 1], 1
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0044c074
lea eax, [ebp - 0x158]
mov edx, 0x4833f8
call fcn.00403d40
mov eax, dword [ebp - 0x158]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x48339c
xor eax, eax
push ebp
push 0x483395
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00481c2c
test al, al
je 0x48336a
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403ce8
lea edx, [ebp - 0x160]
mov eax, ebx
call fcn.0044c074
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0x10]
call fcn.00403d40
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.00481d68
mov eax, dword [ebp - 0x15c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00482c9c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x483303
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48339c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4833ba
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4833e7
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00403adc
lea eax, [ebp - 0x10]
call fcn.00403ab8
ret
Function at 0x48369c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x483895
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x483721
lea edx, [ebp - 0x154]
mov eax, edi
call fcn.0044c518
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, ebx
call fcn.0044c074
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0044c218
test eax, eax
jne 0x483721
lea edx, [ebp - 4]
mov eax, edi
call fcn.0044c4f0
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x483860
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x15c]
mov eax, ebx
call fcn.0044c074
lea eax, [ebp - 0x15c]
mov edx, 0x4838ac
call fcn.00403d40
mov eax, dword [ebp - 0x15c]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x483849
xor eax, eax
push ebp
push 0x483842
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.00481c2c
test al, al
je 0x483813
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403ce8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0044c218
test eax, eax
je 0x483813
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00482d88
test eax, eax
jne 0x483813
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.0044c074
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 0x10]
call fcn.00403d40
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.00481d68
mov eax, dword [ebp - 0x160]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.00482c9c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x483789
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483849
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483867
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x486984
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x486b09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x408]
mov edx, 0x20
call fcn.0042c988
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x408]
mov edx, 0x20
call fcn.0042c9a8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x20
call fcn.0042c988
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40c]
mov edx, 0x20
call fcn.0042c9a8
xor eax, eax
push ebp
push 0x486ae9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x10
push 0x486b18
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x486a5d
cmp byte [ebp - 0x158], 0
je 0x486a5d
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x4ba4dc]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x408]
call fcn.004868c4
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.0049b19c
cmp dword [ebp - 4], 0
jne 0x486a81
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.0049b19c
cmp dword [ebp - 4], 0
je 0x486adf
push 0x1000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x486adf
cmp byte [ebp - 0x158], 0
je 0x486adf
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x4ba4dc]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x40c]
call fcn.004868c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x486af3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486b10
lea eax, [ebp - 4]
call fcn.00403ab8
ret

Function at 0x48d050
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffbc
mov esi, eax
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00472a00
lea edx, [esp + 4]
mov ecx, 0x40
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
cmp eax, 0x40
jne 0x48d0b6
cmp byte [esp + 4], 0x4d
jne 0x48d0b6
cmp byte [esp + 5], 0x5a
jne 0x48d0b6
cmp dword [esp + 0x40], 0
je 0x48d0b6
mov edx, dword [esp + 0x40]
mov eax, esi
call fcn.00472a00
mov edx, esp
mov ecx, 4
mov eax, esi
mov esi, dword [eax]
call dword [esi + 8]
cmp eax, 4
jne 0x48d0b6
cmp dword [esp], 0x4550
jne 0x48d0b6
mov bl, 1
mov eax, ebx
add esp, 0x44
pop edi
pop esi
pop ebx
ret
Function at 0x48eb84
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x48ed4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [0x4b9954]
mov edx, dword [edx]
mov eax, dword [0x4b98d0]
mov al, byte [eax]
mov cl, byte [0x48ed5c]
call fcn.0048e74c
pop ecx
lea edx, [ebp - 8]
mov eax, dword [0x4b9954]
mov eax, dword [eax]
call fcn.0044c770
mov eax, dword [0x4b9698]
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x48ed26
inc edi
xor esi, esi
mov eax, dword [0x4b9698]
mov eax, dword [eax + 0x18]
mov edx, esi
call fcn.00410df0
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebx + 0x10]
push eax
mov edx, dword [0x4b9640]
mov edx, dword [edx]
mov eax, dword [0x4b9a68]
mov eax, dword [eax]
mov ecx, dword [ebx + 4]
call fcn.00497820
test al, al
je 0x48ed1e
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x48ed68
call fcn.0040aa64
mov eax, dword [ebp - 0x10]
call fcn.00403efc
push eax
call sub.kernel32.dll_OutputDebugStringA
mov edx, esi
mov al, 6
call fcn.0049bab0
mov eax, dword [ebx + 0x18]
call fcn.004974b4
mov al, byte [0x48ed5c]
mov byte [ebp - 1], al
test byte [ebx + 0x36], 1
je 0x48ec6e
or byte [ebp - 1], 1
test byte [ebx + 0x36], 2
je 0x48ec78
or byte [ebp - 1], 4
test byte [ebx + 0x36], 4
je 0x48ec82
or byte [ebp - 1], 2
lea edx, [ebp - 0x20]
mov eax, dword [ebx]
call fcn.0049a230
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0044c3c8
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.0044c770
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x4b98d0]
mov al, byte [eax]
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 0xc]
call fcn.0048e74c
pop ecx
mov eax, dword [0x4b98d0]
mov al, byte [eax]
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.0048d774
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409654
test al, al
je 0x48eced
movsx ecx, word [ebx + 0x34]
mov eax, dword [0x4b98d0]
mov al, byte [eax]
mov edx, dword [ebp - 0xc]
call fcn.0048e98c
test byte [ebx + 0x36], 8
setne al
test al, al
jne 0x48ecfe
test byte [ebx + 0x36], 0x10
je 0x48ed16
test byte [ebx + 0x36], 8
setne dl
mov ecx, eax
mov eax, dword [0x4b98d0]
mov al, byte [eax]
mov edx, dword [ebp - 0xc]
call fcn.0048ea74
mov eax, dword [ebx + 0x14]
call fcn.004974e0
inc esi
dec edi
jne 0x48ebe7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ed55
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00403adc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403adc
ret
Function at 0x48f078
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push 0
push 2
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4b9808]
movzx eax, byte [eax]
mov ecx, dword [eax*4 + 0x4b90e0]
mov edx, 0x80000002
xor eax, eax
call fcn.0044ed04
test eax, eax
jne 0x48f0eb
mov eax, esi
call fcn.00403d38
inc eax
push eax
mov eax, esi
call fcn.00403efc
push eax
push 1
push 0
mov eax, edi
call fcn.00403efc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x48f0e0
mov eax, 0x48f13c
call fcn.00478ff0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x48f0f5
mov eax, 0x48f170
call fcn.00478ff0
test bl, bl
je 0x48f12b
xor ebx, ebx
inc ebx
mov eax, esi
call fcn.00403efc
push eax
call sub.gdi32.dll_AddFontResourceA
test eax, eax
je 0x48f11f
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
jmp 0x48f12b
push 0x64
call sub.kernel32.dll_Sleep
cmp ebx, 5
jle 0x48f0fb
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x491fc4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x49209b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x492085
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00475260
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x4920b4
call fcn.004791f0
mov eax, dword [0x4b9698]
mov eax, dword [eax + 8]
mov edx, ebx
call fcn.00410df0
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.00403d38
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.0047dcdc
test al, al
jne 0x492085
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x49206a
mov eax, 0x4920e8
call fcn.00478ff0
jmp 0x492085
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x492144
call fcn.004791f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4920a2
lea eax, [ebp - 0x18]
call fcn.00403ab8
ret
Function at 0x493828
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x493989
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044c074
lea eax, [ebp - 0x148]
mov edx, 0x4939a0
call fcn.00403d40
mov eax, dword [ebp - 0x148]
call fcn.00403efc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x493963
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00403ce8
mov eax, dword [ebp - 4]
call fcn.00403d38
cmp eax, 9
jl 0x493948
lea eax, [ebp - 0x14c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403f40
mov eax, dword [ebp - 0x14c]
mov edx, 0x4939b4
call fcn.00409600
test eax, eax
jne 0x493948
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
add al, 0xd0
sub al, 0xa
jae 0x493948
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
add al, 0xd0
sub al, 0xa
jae 0x493948
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
add al, 0xd0
sub al, 0xa
jae 0x493948
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x493948
lea eax, [ebp - 0x150]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00403f40
mov eax, dword [ebp - 0x150]
call fcn.00409c1c
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x49389b
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493990
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00403adc
lea eax, [ebp - 4]
call fcn.00403ab8
ret

Function at 0x493f94
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [0x4b95c0]
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
cmp dword [esi], 0
je 0x494003
jmp 0x493fc1
mov edx, 0x494010
mov al, 0x41
call fcn.00493e3c
test al, al
jne 0x493fc1
call fcn.0040c3d8
mov eax, dword [ebx]
call fcn.00409db8
test al, al
je 0x493fac
jmp 0x493fe3
mov edx, 0x494024
mov al, 0x40
call fcn.00493e3c
test al, al
jne 0x493fe3
call fcn.0040c3d8
mov eax, dword [ebx]
call fcn.00403efc
push eax
mov eax, dword [esi]
call fcn.00403efc
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x493fce
mov eax, esi
call fcn.00403ab8
pop esi
pop ebx
pop ebp
ret
Function at 0x4961b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x12], eax
mov eax, dword [esi]
call fcn.00412ba4
mov dword [ebp - 0xe], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa], eax
call fcn.004960e0
lea eax, [ebp - 0x12]
push eax
push 0
push 0x4a
mov eax, dword [0x4bb2bc]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
mov eax, esi
call fcn.0040d774
cmp ebx, 0x6c840001
jne 0x496208
call fcn.0040c434
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x49622c
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4962dc
call fcn.00475058
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x496284
mov ebx, eax
mov edx, 1
mov ax, word [ebp - 6]
call fcn.0049613c
mov esi, eax
mov eax, esi
sub ax, 2
je 0x496284
dec eax
sub ax, 2
jb 0x496298
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x496310
call fcn.00475058
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x496239
mov edx, 2
mov ax, word [ebp - 6]
call fcn.0049613c
movzx ebx, ax
mov edx, 3
mov ax, word [ebp - 6]
call fcn.0049613c
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x496830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402acc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x800540
mov eax, 0x496938
mov dword [ebp - 0x34], eax
mov eax, ebx
call fcn.00403efc
mov dword [ebp - 0x30], eax
mov eax, esi
call fcn.00403efc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x4968a7
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x4c7
jne 0x49689d
call fcn.0040c3d8
mov eax, 0x496948
call fcn.00475154
cmp dword [ebp - 8], 0
jne 0x4968b7
mov eax, 0x496960
call fcn.00475000
xor edx, edx
push ebp
push 0x496929
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0049662c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 8]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4968c5
cmp eax, 0xffffffff
jne 0x4968f2
mov eax, 0x49698c
call fcn.00475154
call fcn.0049662c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x496912
mov eax, 0x4969b0
call fcn.00475154
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496930
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret