joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c715
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44c82d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44c82d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00465c39
mov esi, eax
test esi, esi
je 0x44c82d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44c82d
mov ecx, esi
call fcn.0044c680
cmp edi, eax
jge 0x44c82d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44c7b3
mov dword [esp + 0x34], 1
jmp 0x44c80e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44c82d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044bc30
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x44e9b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44ea16
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44ea16
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44e9f7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x44f550
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0044f6a0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x44f570
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x44f551
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0044f6a0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x44f570
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x44f5a0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44f5f7
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x44f60d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.0044f630
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x44f630
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x44f6c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x44f709
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x44fb80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x472b10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044f730
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044f7b0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044f7b0
lea ecx, [esi + 0xc]
call fcn.004641c1
lea ecx, [esi + 0x10]
call fcn.004641c1
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00451fe0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00451fe0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00451fe0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00464236
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00464236
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x450828
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472d38
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x450838
call fcn.00450d50
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x45091b
cmp byte [edi], 0
je 0x45091b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x45085d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0044f550
test eax, eax
jne 0x45087d
push 0x55c548
lea ecx, [esi + 0x38]
call fcn.00464373
jmp 0x45091b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0044f5a0
test eax, eax
jne 0x4508ac
mov ecx, esi
call fcn.0044f6a0
push edi
add esi, 0x38
push 0x55c524
push esi
call fcn.0046203a
add esp, 0xc
jmp 0x45091b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004515d0
test eax, eax
je 0x450914
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004509f0
test eax, eax
jne 0x450930
push edi
lea eax, [esi + 0x38]
push 0x55c500
push eax
call fcn.0046203a
add esp, 0xc
mov ecx, esi
call fcn.00450d50
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4509d8
mov ecx, dword [0x55c7b8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0046203a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0044f650
test eax, eax
jne 0x45099a
push 0x55c4e4
lea ecx, [esi + 0x38]
call fcn.00464373
jmp 0x4509aa
push 0xfa
mov ecx, esi
call fcn.004515d0
test eax, eax
jne 0x4509c7
mov ecx, esi
call fcn.00450d50
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00464236
jmp 0x45091b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00464236
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x4665dd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x466615
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00464691
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00464669
jmp 0x466621
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x467ccb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x467d0d
call fcn.0046d887
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x467d0d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x467d04
xor eax, eax
jmp 0x467d15
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00467d1b
pop edi
pop esi
pop ebx
ret 4

Function at 0x46ddb7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46dde5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46de03
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046dd1d
jmp 0x46de03
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46de03
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046dd1d
test edi, edi
mov eax, edi
jne 0x46dded
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x423518
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section.sect_0
push section.sect_0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0x10
call 0x423518
lcall 0x5de5, 0x8b04c483
jmp loc.0083172c
Function at 0x401184
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.00412a00
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp dword [ebp + 0xc], ebx
mov esi, dword [ebp + 8]
je 0x4011d6
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4011d6
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41c380
push esi
call edi
push dword [ebp + 0xc]
push esi
call edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401225
cmp dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], ebx
je 0x401210
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp + 0xc]
jmp 0x401261
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x30], bl
lea edi, [ebp - 0x2f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [ebp - 0x30]
push 0x41c37c
push eax
call fcn.0041299f
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x2719
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401389
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x34b]
mov byte [ebp - 0x34c], 0
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x4014d0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
test eax, eax
jle 0x4014d0
push edi
call esi
mov esi, 0x209
cmp eax, esi
jbe 0x4013db
push 0x6f
pop eax
jmp 0x4014d3
push edi
push str._s.
lea eax, [ebp - 0x34c]
push esi
push eax
call fcn.00401362
and dword [ebp + 8], 0
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4014cc
lea eax, [ebp - 0x114]
push 0x41c390
push eax
call fcn.00412b60
test eax, eax
pop ecx
pop ecx
je 0x401490
lea eax, [ebp - 0x114]
push 0x41c38c
push eax
call fcn.00412b60
test eax, eax
pop ecx
pop ecx
je 0x401490
lea eax, [ebp - 0x114]
push eax
push edi
push str._s_s
lea eax, [ebp - 0x34c]
push esi
push eax
call fcn.00401362
add esp, 0x14
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x34c]
jne 0x401477
push eax
call fcn.00401389
pop ecx
jmp 0x401490
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4014b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4014b4
mov dword [ebp + 8], 1
cmp dword [ebp + 8], 0
je 0x401414
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
jmp 0x4014d3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4014d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.00401389
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
xor ebx, ebx
push esi
call edi
cmp eax, 0xffffffff
je 0x40150e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.00401389
inc ebx
cmp ebx, 0xa
pop ecx
jl 0x4014ee
push esi
call edi
inc eax
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret
Function at 0x40151b
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, 0x5220b0
push esi
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x401542
push edi
push str.C:Temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call fcn.00401041
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ebx, ebx
test eax, eax
jne 0x401563
push esi
call fcn.004012f9
pop ecx
push ebx
push esi
call ebp
test eax, eax
je 0x4015c2
push 0x5c
push esi
call fcn.004126f7
cmp eax, ebx
pop ecx
pop ecx
je 0x401578
cmp byte [eax + 1], bl
jne 0x401578
mov byte [eax], bl
push edi
push str.RsdSfxTmp
push esi
call fcn.00412627
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4015ad
push esi
call fcn.00401389
pop ecx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.004012f9
pop ecx
push ebx
push esi
call ebp
push esi
call fcn.00401041
test eax, eax
jne 0x4015d9
cmp dword [esp + 0x14], ebx
jne 0x4015d5
push 0x10
push 9
push ebx
call fcn.00401266
add esp, 0xc
xor eax, eax
jmp 0x4015dc
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401c94
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push str.E5C53971_D80E_4500_BE0D_761BF3CD8457
push 1
push 0
mov dword [0x5222bc], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5222d4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401ce0
push dword [0x5222d4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x5222d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x2711
jmp 0x401dfd
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, 0x41c450
lea edi, [esp + 0x14]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x14]
push ecx
push eax
movsb byte es:[edi], byte [esi]
call section..text
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x401de3
lea eax, [edi - 1]
mov dword [0x5222c0], eax
mov ebp, 0x41c44c
mov ebx, 0x5221b8
mov esi, str.SILENT
push esi
call fcn.0041295a
push eax
push esi
push edi
call fcn.00412814
add esp, 0x10
test eax, eax
je 0x401dc2
mov esi, str.SILENCE
push esi
call fcn.0041295a
push eax
push esi
push edi
call fcn.00412814
add esp, 0x10
test eax, eax
je 0x401dc2
push ebp
call fcn.0041295a
push eax
push ebp
push edi
call fcn.00412814
add esp, 0x10
test eax, eax
jne 0x401dcc
push ebp
call fcn.0041295a
mov esi, eax
add esi, edi
mov al, byte [esi]
cmp al, 0x27
pop ecx
je 0x401d99
cmp al, 0x22
je 0x401d99
push 0x20
push esi
call fcn.004125ac
test eax, eax
pop ecx
pop ecx
jne 0x401daa
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x401db6
movsx eax, al
push eax
inc esi
push esi
call fcn.004125ac
test eax, eax
pop ecx
pop ecx
je 0x401e00
sub eax, esi
inc eax
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [0x5222cc], 1
jmp 0x401dcc
mov dword [0x5222c8], 1
lea eax, [esp + 0x14]
push eax
push edi
call section..text
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x401d1f
push 0
mov dword [0x5222c8], 1
call fcn.004015e1
mov eax, dword [0x5222d8]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, 0x271a
jmp 0x401df9
Function at 0x404b57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x404b70
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + ecx - 4]
mov dword [ebp - 4], ecx
lea esi, [eax + edi]
jmp 0x404b93
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x404b98
inc esi
cmp esi, dword [ebp - 4]
jb 0x404b8a
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 4]
mov dword [ebp - 8], eax
jae 0x404c8c
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x404bce
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp + 0xc], eax
je 0x404bfb
cmp cl, 0xff
je 0x404bfb
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x404b85
dec ecx
shl edx, cl
and edx, 7
je 0x404bb4
movzx ecx, byte [edx + 0x41c850]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x41c848], 0
mov cl, byte [ebx + 4]
je 0x404bf6
test cl, cl
je 0x404bf6
cmp cl, 0xff
jne 0x404bb4
mov dword [ebp + 0xc], eax
jmp 0x404bc3
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x404c24
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x404c2b
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x404c5f
movzx edi, byte [edx + 0x41c850]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
mov eax, ebx
shr eax, cl
test al, al
je 0x404c4a
cmp al, 0xff
jne 0x404c5c
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x404c16
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x404b85
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x408814
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x5223a0], 0
jne 0x40884e
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004082f1
mov eax, dword [eax]
pop ecx
pop ecx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040851c
pop ecx
test esi, esi
pop esi
jmp 0x40885c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x408862
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x408866
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x5223a0], 0
jne 0x40889f
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004082f1
mov eax, dword [eax]
pop ecx
pop ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0040851c
pop ecx
test esi, esi
pop esi
jmp 0x4088ac
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4088b2
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x408e4c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x408e72
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408e72
xor al, al
jmp 0x408e92
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00413280
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x413dbf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x413ddc
call fcn.00415ef2
mov dword [eax], 0x16
xor eax, eax
jmp 0x413e46
push esi
push 0x8c
push 1
call fcn.004179a2
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x413e31
push esi
call fcn.00414973
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x413e0f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x413d2a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x413e45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00413a1d
test ebx, ebx
pop ecx
je 0x413e43
push ebx
call fcn.00415f04
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret