joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500358
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00405bf8
cmp byte [ebp - 1], 0
jne 0x5003b8
mov eax, esi
call fcn.00405964
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5003d2
sub al, 2
jb 0x5003d9
jmp 0x5003de
mov ebx, 2
jmp 0x5003de
mov ebx, 1
mov eax, esi
call fcn.00405964
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x5004c2
test edi, edi
jle 0x50043a
mov eax, esi
call fcn.00405964
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00405964
mov byte [eax + ebx - 1], 0
jmp 0x5004b6
test edi, edi
jge 0x500480
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00405964
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x5004b6
mov eax, esi
call fcn.00405964
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00405964
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x5003f6
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5004d3
sub al, 2
jb 0x50050d
jmp 0x500555
cmp edi, 2
jne 0x5004d9
dec ebx
mov eax, ebx
sub eax, 2
jl 0x500555
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00405964
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x579300]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5004e9
jmp 0x500555
cmp edi, 2
jne 0x500513
dec ebx
test ebx, ebx
jle 0x500550
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00405964
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x579304]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x50051f
jmp 0x500550
inc ebx
mov eax, esi
call fcn.00405964
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x500543
mov eax, esi
mov edx, ebx
call fcn.00405b94
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x505fc0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x506076
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040590c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x506060
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405b94
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040590c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x506060
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x506088
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x506060
cmp dword [ebp - 0xc], 0x34
jne 0x506060
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50607d
lea eax, [ebp - 4]
call fcn.00405448
ret

Function at 0x507a04
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x507a68
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004056b8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP_1
mov edx, eax
pop eax
call fcn.0040d2b4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507a6f
lea eax, [ebp - 0xc]
call fcn.00405448
ret
Function at 0x508144
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x508324
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.005060d4
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x57ad48], eax
mov eax, dword [ebp - 0xc]
mov dword [0x57ad4c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x57ad50], eax
mov eax, dword [0x57b898]
cmp dword [eax], 2
sete byte [0x57a514]
push 0x508330
call sub.KERNEL32.DLL_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.00505e78
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x57a514], 0
jne 0x5081d3
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00505fc0
test al, al
je 0x5081d3
mov eax, dword [ebp - 0x4c]
mov dword [0x583b60], eax
jmp 0x5081da
xor eax, eax
mov dword [0x583b60], eax
call fcn.00507e74
and eax, 0x7f
cmp eax, 0x12
ja case.0x5081eb.0
jmp dword [eax*4 + 0x5081f2]
mov byte [0x57a500], 1
jmp case.0x5081eb.0
mov byte [0x57a504], 1
jmp case.0x5081eb.0
mov byte [0x57a508], 1
jmp case.0x5081eb.0
mov byte [0x57a50c], 1
jmp case.0x5081eb.0
mov byte [0x57a510], 1
jmp case.0x5081eb.0
mov byte [0x57a518], 1
mov byte [0x57a51c], 1
jmp case.0x5081eb.0
mov byte [0x57a518], 1
mov byte [0x57a520], 1
jmp case.0x5081eb.0
mov byte [0x57a518], 1
mov byte [0x57a520], 1
mov byte [0x57a524], 1
jmp case.0x5081eb.0
mov byte [0x57a528], 1
jmp case.0x5081eb.0
mov byte [0x57a52c], 1
jmp case.0x5081eb.0
mov byte [0x57a530], 1
jmp case.0x5081eb.0
mov byte [0x57a534], 1
jmp case.0x5081eb.0
mov byte [0x57a538], 1
jmp case.0x5081eb.0
mov byte [0x57a53c], 1
jmp case.0x5081eb.0
mov byte [0x57a540], 1
jmp case.0x5081eb.0
mov byte [0x57a544], 1
jmp case.0x5081eb.0
mov byte [0x57a548], 1
jmp case.0x5081eb.0
mov byte [0x57a54c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50832b
lea eax, [ebp - 4]
call fcn.00405448
ret

Function at 0x508e50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x508e71
test ah, 4
setne bl
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x509620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058fc
xor eax, eax
push ebp
push 0x5096df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x509655
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x5096bd
push edi
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040596c
lea eax, [ebp - 8]
mov edx, dword [edi]
call fcn.004054e0
mov eax, dword [ebp - 8]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
cmp esi, 0xffffffff
je 0x509692
test esi, 0x400
jne 0x509696
xor eax, eax
jmp 0x509698
mov al, 1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x5096c4
jmp 0x5096a4
dec ebx
test ebx, ebx
jle 0x5096b8
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
sub al, 0x2f
je 0x5096b8
sub al, 0x2d
jne 0x5096a3
dec ebx
test ebx, ebx
jg 0x50965b
mov eax, edi
call fcn.00405448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5096e6
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040546c
ret
Function at 0x5099c4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
xor eax, eax
push ebp
push 0x509baa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x10]
call fcn.00405448
xor eax, eax
push ebp
push 0x509b6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406870
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x509ab0
inc ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4]
lea edx, [ebp - 8]
call fcn.0040ddac
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004054e0
push 1
push 0
mov ecx, 0x509bc4
mov edx, 0x509bd0
mov eax, dword [ebp - 8]
call fcn.00509f3c
test eax, eax
jle 0x509a73
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.0040db48
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0xc]
call fcn.004054e0
mov eax, dword [ebp - 0xc]
call fcn.0050d678
test al, al
je 0x509aa8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00509620
cmp dword [ebp - 0x38], 0
ja 0x509aa8
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x509be0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004057cc
inc esi
dec ebx
jne 0x509a2a
cmp dword [ebp - 0x10], 0
jne 0x509ac0
call fcn.00404e4c
jmp 0x509b74
xor eax, eax
push ebp
push 0x509b0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403bf8
mov dword [ebp - 0x2c], 3
mov eax, dword [ebp - 0x10]
call fcn.0040590c
mov dword [ebp - 0x28], eax
mov word [ebp - 0x20], 0x454
lea eax, [ebp - 0x30]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete byte [ebp - 0x12]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x509b1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509b74
movzx eax, byte [ebp - 0x12]
xor al, 1
and al, byte [ebp - 0x11]
je 0x509b6c
mov byte [ebp - 0x12], 1
mov eax, dword [ebp - 4]
call fcn.00406870
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x509b6c
inc ebx
xor esi, esi
cmp byte [ebp - 0x12], 0
je 0x509b5f
mov eax, dword [ebp - 4]
mov eax, dword [eax + esi*4]
call fcn.00511f64
test al, al
jne 0x509b63
xor eax, eax
jmp 0x509b65
mov al, 1
mov byte [ebp - 0x12], al
inc esi
dec ebx
jne 0x509b4a
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509bb1
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.0040546c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040546c
lea eax, [ebp - 4]
mov edx, dword [0x407934]
call fcn.00406b2c
ret
Function at 0x50ac6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004058fc
xor eax, eax
push ebp
push 0x50ad27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00405448
mov eax, dword [ebp - 4]
call fcn.0040590c
push eax
push ebx
mov eax, dword [0x57e7f8]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov esi, eax
push esi
mov eax, dword [0x57e7f8]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
je 0x50ad0c
push esi
mov eax, dword [0x57e7f8]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov esi, eax
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405b94
lea eax, [ebp - 8]
call fcn.00405964
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.00403250
push ebx
call sub.KERNEL32.DLL_FreeResource
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040549c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ad2e
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040546c
ret
Function at 0x50b99c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 8]
call fcn.004058fc
xor eax, eax
push ebp
push 0x50bbe3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
xor eax, eax
push ebp
push 0x50bbbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0050b61c
test al, al
jne 0x50ba03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50bbc8
mov eax, dword [ebp - 4]
call fcn.0050d604
test al, al
jne 0x50ba1b
mov eax, dword [0x57b378]
mov eax, dword [eax]
call fcn.00403148
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040db48
cmp dword [ebp - 0xc], 0
jbe 0x50ba45
mov eax, dword [ebp - 0xc]
call fcn.0050b8fc
test al, al
jne 0x50ba45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50bbc8
call fcn.00403230
test bl, bl
je 0x50baa7
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x160]
call fcn.0040386c
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00403d9c
call fcn.00403230
test eax, eax
je 0x50ba8a
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00403db8
jmp 0x50bb53
lea eax, [ebp - 0x160]
call fcn.00403bac
mov edx, eax
lea eax, [ebp - 0x160]
call fcn.00403dc4
jmp 0x50bb53
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x170], eax
mov byte [ebp - 0x16c], 0xb
mov eax, 0x7fffffff
call fcn.00403534
mov dword [ebp - 0x168], eax
mov byte [ebp - 0x164], 0
lea edx, [ebp - 0x170]
mov ecx, 1
mov eax, 0x50bc00
call fcn.0040e7d0
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.0050b61c
test al, al
jne 0x50bb35
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x170], eax
mov byte [ebp - 0x16c], 0xb
mov eax, 0x3e7
call fcn.00403534
mov dword [ebp - 0x168], eax
mov byte [ebp - 0x164], 0
lea edx, [ebp - 0x170]
mov ecx, 1
mov eax, 0x50bc14
call fcn.0040e7d0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x160]
call fcn.0040386c
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00403db8
call fcn.00403230
test eax, eax
je 0x50bb66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50bbc8
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 8]
call fcn.0050b88c
test al, al
jne 0x50bb82
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50bbc8
lea eax, [ebp - 0x160]
call fcn.00403a08
test bl, bl
jne 0x50bbb0
mov eax, dword [ebp - 4]
call fcn.0040590c
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_DeleteFileA
push ebx
mov eax, dword [ebp - 0x10]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_MoveFileA
mov byte [ebp - 0x11], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50bbc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bbea
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040546c
ret
Function at 0x50c6cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058fc
xor eax, eax
push ebp
push 0x50c751
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403bf8
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403bf8
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040590c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c758
lea eax, [ebp - 4]
call fcn.00405448
ret

Function at 0x50d4c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
lea edx, [ebp - 0xc]
push edx
push eax
call sub.KERNEL32.DLL_GetFileSize_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x50d4f9
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
je 0x50d4f9
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp 0x50d518
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov edx, eax
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5115a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, edx
test ecx, ecx
js 0x5115b2
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x5115ab
mov eax, esp
lea esi, [edx + 1]
dec esi
test esi, esi
jl 0x5115d8
inc esi
mov ebx, eax
mov edx, dword [0x57b3dc]
movzx edx, byte [edx]
xor dl, 1
mov eax, dword [ebx]
call fcn.00468804
add ebx, 4
dec esi
jne 0x5115bf
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x511f64
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058fc
lea eax, [ebp - 0x168]
mov edx, dword [0x40b814]
call fcn.00405f1c
xor eax, eax
push ebp
push 0x5120ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x169], 0
mov eax, dword [ebp - 4]
call fcn.0040d810
test al, al
je 0x511fce
mov eax, dword [ebp - 4]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x169], al
jmp 0x5120c1
mov edx, 0x512108
mov eax, dword [ebp - 4]
call fcn.00456f5c
test al, al
jne 0x511ffd
mov edx, 0x512114
mov eax, dword [ebp - 4]
call fcn.00456f5c
test al, al
jne 0x511ffd
lea eax, [ebp - 4]
mov edx, 0x512120
call fcn.00405714
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 4]
call fcn.0040d970
test eax, eax
jne 0x5120c1
xor eax, eax
push ebp
push 0x5120ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x154]
mov edx, 0x51212c
call fcn.00405858
je 0x51208a
mov eax, dword [ebp - 0x154]
mov edx, 0x512138
call fcn.00405858
je 0x51208a
push dword [ebp - 4]
push 0x512144
push dword [ebp - 0x154]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004057cc
mov eax, dword [ebp - 0x158]
and eax, 0x10
test al, al
je 0x51207c
mov eax, dword [ebp - 8]
call fcn.00511f64
jmp 0x51208a
mov eax, dword [ebp - 8]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040d9dc
test eax, eax
je 0x512026
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5120c1
lea eax, [ebp - 0x168]
call fcn.0040da18
mov eax, dword [ebp - 4]
call fcn.00403578
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5120f4
lea eax, [ebp - 0x168]
mov edx, dword [0x40b814]
call fcn.00405fec
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040546c
ret
Function at 0x51c9a4
Capabilities:
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 8]
call fcn.004058fc
xor eax, eax
push ebp
push 0x51ca5e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0050d444
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.005184dc
pop ecx
mov edx, 0x51ca74
mov eax, dword [ebp - 0xc]
call fcn.0050ea68
test al, al
je 0x51ca26
mov edx, 0x51ca74
mov eax, dword [ebp - 4]
call fcn.0050ea68
test al, al
jne 0x51ca26
lea eax, [ebp - 0x10]
mov edx, 0x51ca74
call fcn.0040c548
mov eax, dword [ebp - 0x10]
call fcn.0040590c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ca65
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040546c
ret
Function at 0x53cc68
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004058fc
xor eax, eax
push ebp
push 0x53cce1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
call fcn.00405448
lea eax, [ebx + 0x30]
mov edx, dword [0x53a550]
call fcn.00406b2c
lea eax, [ebx + 0x18]
mov edx, dword [0x407934]
call fcn.00406b2c
lea eax, [ebx + 0x10]
mov edx, 0x53ccf4
call fcn.0040549c
lea eax, [ebx + 0x1c]
call fcn.0041417c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0053cfe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53cce8
lea eax, [ebp - 4]
call fcn.00405448
ret

Function at 0x540f3c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058fc
xor eax, eax
push ebp
push 0x540f85
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040590c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
call fcn.00540f08
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540f8c
lea eax, [ebp - 4]
call fcn.00405448
ret
Function at 0x5435bc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
xor edx, edx
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058fc
xor eax, eax
push ebp
push 0x543847
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x170]
xor ecx, ecx
mov edx, 0x160
call fcn.00403bf8
push 0x4000
push 0x160
lea eax, [ebp - 0x170]
push eax
push 0
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 4]
call fcn.0040ddac
mov eax, dword [ebp - 0x174]
call fcn.0040590c
push eax
call sub.shell32.dll_SHGetFileInfoA
cmp dword [ebp - 0x16c], 0
jne 0x543659
mov ebx, 0x25
jmp 0x54381c
mov eax, dword [ebp - 0x170]
test eax, eax
je 0x543669
push eax
call sub.user32.dll_DestroyIcon
mov eax, dword [0x583e88]
call fcn.00406870
dec eax
test eax, eax
jl 0x5436ab
inc eax
mov dword [ebp - 0xc], 0
mov edx, dword [0x583e88]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*8]
cmp edx, dword [ebp - 0x16c]
jne 0x5436a5
mov eax, dword [0x583e88]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax + edx*8 + 4]
jmp 0x54381c
inc dword [ebp - 0xc]
dec eax
jne 0x543680
mov dl, 1
mov eax, dword [0x432948]
call fcn.0043c354
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x54375c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x16c]
mov eax, dword [0x583dac]
call fcn.0047abec
mov eax, dword [0x583c90]
mov eax, dword [eax + 0x368]
mov edx, dword [ebp - 0x10]
call fcn.0047aaf4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00543304
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 8]
call fcn.004f1b4c
mov eax, dword [ebp - 0x178]
push eax
lea edx, [ebp - 0x180]
mov eax, dword [ebp - 0xc]
call fcn.0040d138
mov ecx, dword [ebp - 0x180]
lea eax, [ebp - 0x17c]
mov edx, 0x543860
call fcn.00405758
mov edx, dword [ebp - 0x17c]
mov eax, dword [0x583d84]
pop ecx
call fcn.00423158
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x543763
mov eax, dword [ebp - 0x10]
call fcn.004044ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54384e
lea eax, [ebp - 0x184]
mov edx, 5
call fcn.0040546c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040546c
ret