joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f27e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405474
xor eax, eax
push ebp
push 0x4f289c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 4
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004050bc
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x4f2886
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer_1
test eax, eax
jne 0x4f285d
push 0
lea eax, [ebp - 0xc]
push eax
push 2
mov eax, 0x4f28ac
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x4f285d
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x4f2886
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x4f287a
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x4f2886
push esi
call sub.kernel32.dll_CloseHandle_1
test eax, eax
je 0x4f2886
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f28a3
lea eax, [ebp - 4]
call fcn.00404e5c
ret

Function at 0x4f2950
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x258], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405474
lea esi, [ebp - 0x254]
xor eax, eax
push ebp
push 0x4f2a20
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
lea eax, [ebp - 0x258]
mov ecx, 0x4f2a34
mov edx, dword [ebp - 4]
call fcn.00405138
mov eax, dword [ebp - 0x258]
call fcn.004050bc
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4f29b2
xor ebx, ebx
jmp 0x4f29ff
cmp word [esi + 0x2c], 0x2e
jne 0x4f29c0
cmp word [esi + 0x2e], 0
je 0x4f29de
cmp word [esi + 0x2c], 0x2e
jne 0x4f29d5
cmp word [esi + 0x2e], 0x2e
jne 0x4f29d5
cmp word [esi + 0x30], 0
je 0x4f29de
test byte [esi], 0x10
je 0x4f29de
mov bl, 1
jmp 0x4f29ff
push esi
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4f29b2
push ebx
call sub.kernel32.dll_FindClose_1
test eax, eax
jne 0x4f29fd
mov eax, 0x4f2a44
call fcn.004451e0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2a27
lea eax, [ebp - 0x258]
call fcn.00404e5c
lea eax, [ebp - 4]
call fcn.00404e5c
ret
Function at 0x4f2a50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f2c22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
push edx
push eax
mov edx, ebx
mov eax, 4
call fcn.00409920
lea eax, [ebp - 0x401]
push eax
push 0x400
mov eax, esi
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x808]
mov eax, 4
call fcn.00409920
mov eax, dword [ebp - 0x808]
call fcn.00404bf0
mov ecx, eax
mov edx, 0x4f2c30
mov eax, 0x80000000
call fcn.004f2700
test eax, eax
je 0x4f2c04
xor esi, esi
lea eax, [ebp - 0x401]
cmp byte [eax], 0x3b
je 0x4f2aeb
inc esi
inc eax
cmp esi, 0x101
jne 0x4f2adc
mov eax, ebx
lea edx, [ebp + esi - 0x400]
call fcn.00404930
cmp byte [ebp + esi - 0x400], 0x40
jne 0x4f2c04
lea edx, [esi + 1]
cmp edx, 0xff
jg 0x4f2b2d
lea eax, [ebp + edx - 0x401]
cmp byte [eax], 0x2c
jne 0x4f2b23
mov byte [eax], 0
jmp 0x4f2b2d
inc edx
inc eax
cmp edx, 0x100
jne 0x4f2b19
lea edi, [edx + 1]
cmp edi, 0xff
jg 0x4f2b53
lea eax, [ebp + edi - 0x401]
cmp byte [eax], 0x2d
jne 0x4f2b49
mov byte [eax], 0
jmp 0x4f2b53
inc edi
inc eax
cmp edi, 0x100
jne 0x4f2b3f
xor eax, eax
push ebp
push 0x4f2b8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x80c]
lea edx, [ebp + edi - 0x400]
call fcn.00404930
mov eax, dword [ebp - 0x80c]
call fcn.00409960
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f2b9b
push 0x401
lea eax, [ebp - 0x802]
push eax
inc esi
lea eax, [ebp + esi - 0x400]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x4f2c04
lea eax, [ebp - 0x802]
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4f2c04
push 0x401
lea eax, [ebp - 0x401]
push eax
push edi
push esi
call sub.user32.dll_LoadStringA_1
test eax, eax
jne 0x4f2bea
push esi
call sub.kernel32.dll_FreeLibrary_1
jmp 0x4f2c04
push esi
call sub.kernel32.dll_FreeLibrary_1
test eax, eax
mov eax, ebx
lea edx, [ebp - 0x401]
mov ecx, 0x401
call fcn.004049a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2c29
lea eax, [ebp - 0x80c]
mov edx, 2
call fcn.00404754
ret

Function at 0x4f397c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
mov byte [esp + 4], 0
push 0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4f39e4
push esi
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x4f39d7
push esi
push ebx
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x4f39d7
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp], eax
cmp dword [ebp], 0
je 0x4f39d7
push esi
push ebx
call sub.kernel32.dll_SizeofResource
mov edx, dword [esp]
mov dword [edx], eax
mov byte [esp + 4], 1
mov al, byte [esp + 4]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f46b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f4795
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x4001f
push 0
push 0
push 0
push 0x4f47a8
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4f477f
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
movzx eax, word [esi + 2]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x4f47c8
call fcn.0040a708
mov eax, dword [ebp - 0xc]
call fcn.00404bf0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4f475c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4f477f
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test eax, eax
je 0x4f477d
mov ecx, 0x502
mov edx, 0x4f47dc
mov eax, 0x4f483c
call fcn.0040468c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f479c
lea eax, [ebp - 0xc]
call fcn.00404730
ret

Function at 0x4f4850
Capabilities:
Delete registry key

Disassembly:
push ebx
push ecx
xor ebx, ebx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x4001f
push 0
push 0
push 0
push 0x4f48c4
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4f48bc
push 0x4f48d8
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
je 0x4f4899
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4f48bc
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test eax, eax
je 0x4f48ba
mov ecx, 0x51d
mov edx, 0x4f48e4
mov eax, 0x4f4944
call fcn.0040468c
mov bl, 1
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x4f59ac
Capabilities:
Compress data via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4f59c1
add esp, 0xfffffff0
call fcn.00403c44
mov ebx, edx
mov edi, eax
push 0x4f5ab8
call sub.kernel32.dll_GetModuleHandleA_2
mov esi, eax
push 0x4f5ac4
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x10], eax
push 0x4f5adc
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x14], eax
push 0x4f5afc
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x18], eax
push 0x4f5b10
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x1c], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 2
call dword [edi + 0x14]
cmp dword [edi + 0x10], 0
je 0x4f5a2e
cmp dword [edi + 0x14], 0
je 0x4f5a2e
cmp dword [edi + 0x18], 0
je 0x4f5a2e
cmp dword [edi + 0x1c], 0
jne 0x4f5a3a
push 0x4f5b24
push 0
call sub.kernel32.dll_FatalAppExitA
push 4
push 0x1000
mov eax, dword [ebp - 4]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [edi + 4], eax
push 4
push 0x1000
push 0xf000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [edi + 8], eax
push 4
push 0x1000
push 0xf000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [edi + 0xc], eax
cmp dword [edi + 4], 0
je 0x4f5a8d
cmp dword [edi + 8], 0
je 0x4f5a8d
cmp dword [edi + 0xc], 0
jne 0x4f5a99
push 0x4f5b40
push 0
call sub.kernel32.dll_FatalAppExitA
mov eax, edi
test bl, bl
je 0x4f5aae
call fcn.00403c9c
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f6190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov esi, ecx
mov eax, ecx
mov edx, ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 8]
dec ecx
test ecx, ecx
jl 0x4f621b
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
mov ecx, esi
shr ecx, 3
add esi, ecx
sub esi, 0x11111111
mov ecx, eax
shr ecx, 5
add eax, ecx
sub eax, 0x22222222
mov ecx, edx
shl ecx, 7
sub edx, ecx
add edx, 0x33333333
mov ecx, dword [ebp - 0xc]
shl ecx, 9
mov ebx, dword [ebp - 0xc]
sub ebx, ecx
add ebx, 0x44444444
mov dword [ebp - 0xc], ebx
mov ecx, esi
add cl, al
add cl, dl
add cl, byte [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
xor cl, byte [ebx + edi]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
mov byte [ebx + edi], cl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4f61be
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f6f60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f7076
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x54], eax
xor eax, eax
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0x5c]
push eax
call sub.kernel32.dll_ResetEvent
test eax, eax
jne 0x4f6fe0
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, dword [ebx + 8]
push eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.004f2058
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4f708c
call fcn.00405138
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [0x569f1c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0xc]
mov edx, 2
call fcn.004f501c
jmp 0x4f705b
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push 0
lea eax, [ebx + 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.ws2_32.dll_WSARecv
test eax, eax
je 0x4f7059
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x3e5
je 0x4f7059
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebx + 8]
push eax
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.004f2058
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4f70dc
call fcn.00405138
mov eax, dword [ebp - 0x18]
push eax
push 0
mov eax, dword [0x569f1c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0xc]
mov edx, 2
call fcn.004f501c
jmp 0x4f705b
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f707d
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404e74
ret
Function at 0x4f7120
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f7234
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x68], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
mov eax, dword [ebx + 0x70]
push eax
call sub.kernel32.dll_ResetEvent
test eax, eax
jne 0x4f71a1
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, dword [ebx + 8]
push eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.004f2058
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4f724c
call fcn.00405138
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [0x569f1c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0xc]
mov edx, 2
call fcn.004f501c
jmp 0x4f7219
xor esi, esi
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebx + 0x60]
push eax
push esi
mov eax, dword [ebp + 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.ws2_32.dll_WSASend
test eax, eax
je 0x4f7217
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x3e5
je 0x4f7217
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebx + 8]
push eax
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.004f2058
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4f729c
call fcn.00405138
mov eax, dword [ebp - 0x18]
push eax
push 0
mov eax, dword [0x569f1c]
mov eax, dword [eax]
mov ecx, dword [ebx + 0xc]
mov edx, 2
call fcn.004f501c
jmp 0x4f7219
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f723b
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404e74
ret

Function at 0x4f7c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ebx, ecx
mov ecx, dword [0x56a350]
mov ecx, dword [ecx]
mov dword [esp], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 8], eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x56a27c]
cmp eax, dword [edx]
jne 0x4f7cc7
mov esi, 0xff
jmp 0x4f7cc9
xor esi, esi
call sub.kernel32.dll_GetTickCount
mov edi, eax
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp ebx, eax
jae 0x4f7ce2
mov eax, 0x5b4
jmp 0x4f7d4c
push esi
push ebx
push 0
lea eax, [esp + 0xc]
push eax
push 3
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 0x102
jne 0x4f7d00
mov eax, 0x5b4
jmp 0x4f7d4c
test eax, eax
jne 0x4f7d0b
mov eax, 0x4c7
jmp 0x4f7d4c
cmp eax, 1
jne 0x4f7d17
mov eax, 0x4c7
jmp 0x4f7d4c
cmp eax, 2
jne 0x4f7d20
xor eax, eax
jmp 0x4f7d4c
cmp eax, 3
jne 0x4f7d33
mov eax, dword [0x56a274]
mov eax, dword [eax]
call fcn.0046ec34
jmp 0x4f7cd0
mov ecx, 0x311
mov edx, 0x4f7d5c
mov eax, 0x4f7dc0
call fcn.0040468c
mov eax, 0x4c7
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4f9f1c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 0x25c]
xor eax, eax
push ebp
push 0x4fa01d
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 8]
call fcn.004ba8fc
lea eax, [ebp - 0x260]
mov edx, 0x4fa034
call fcn.004050d8
mov eax, dword [ebp - 0x260]
call fcn.004050bc
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4f9f8c
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
jmp 0x4fa004
xor esi, esi
xor edi, edi
cmp word [ebx + 0x2c], 0x2e
jne 0x4f9f9e
cmp word [ebx + 0x2e], 0
je 0x4f9fdd
cmp word [ebx + 0x2c], 0x2e
jne 0x4f9fb3
cmp word [ebx + 0x2e], 0x2e
jne 0x4f9fb3
cmp word [ebx + 0x30], 0
je 0x4f9fdd
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x28], edi
push ebx
mov eax, dword [ebp - 8]
push eax
push 0x468
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00453e2c
push eax
call sub.user32.dll_SendMessageA
test byte [ebx], 0x10
je 0x4f9fdc
inc esi
jmp 0x4f9fdd
inc edi
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4f9f90
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
test eax, eax
jne 0x4fa002
mov eax, 0x4fa048
call fcn.004451e0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa024
lea eax, [ebp - 0x260]
call fcn.00404e5c
ret
Function at 0x529f0c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov ebx, edx
lea eax, [ebp + 0xc]
call fcn.00405474
lea eax, [ebp + 8]
call fcn.00405474
xor eax, eax
push ebp
push 0x529f8e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], ebx
mov eax, dword [ebp + 0xc]
call fcn.004050bc
mov dword [ebp - 0x16], eax
mov eax, dword [ebp + 8]
call fcn.004050bc
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x615
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
mov ebx, eax
test ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529f95
lea eax, [ebp + 8]
mov edx, 2
call fcn.00404e74
ret
Function at 0x547bd8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x547be0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00405474
xor eax, eax
push ebp
push 0x547d7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004050bc
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x547c2c
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x547c2c
mov eax, 0x547d94
call fcn.004451e0
mov eax, dword [esi + 0x300]
call fcn.004bb078
call fcn.004931dc
dec eax
test eax, eax
jl 0x547d42
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov eax, dword [esi + 0x300]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x10]
lea edx, [ebp - 0x14]
call fcn.00409880
lea eax, [ebp - 0x14]
mov edx, 0x547da8
call fcn.00404a00
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00405040
push dword [ebp - 0x10]
mov eax, dword [esi + 0x300]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
lea edx, [ebp - 0x18]
call fcn.004ba8fc
push dword [ebp - 0x18]
push 0x547db0
mov eax, dword [esi + 0x300]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x1c]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x1c]
push 0x547db0
mov eax, dword [esi + 0x300]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x20]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x20]
push 0x547db0
mov eax, dword [esi + 0x300]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x24]
mov edx, 2
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x24]
push 0x547db8
lea eax, [ebp - 0xc]
mov edx, 9
call fcn.0040519c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004f276c
inc ebx
dec dword [ebp - 8]
jne 0x547c4b
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547d83
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404e74
lea eax, [ebp - 0x14]
call fcn.00404730
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404e74
lea eax, [ebp - 4]
call fcn.00404e5c
ret
Function at 0x548de8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x548df0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00405474
xor eax, eax
push ebp
push 0x548f8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004050bc
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x548e3c
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x548e3c
mov eax, 0x548fa4
call fcn.004451e0
mov eax, dword [esi + 0x324]
call fcn.004bb078
call fcn.004931dc
dec eax
test eax, eax
jl 0x548f52
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov eax, dword [esi + 0x324]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x10]
lea edx, [ebp - 0x14]
call fcn.00409880
lea eax, [ebp - 0x14]
mov edx, 0x548fb8
call fcn.00404a00
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00405040
push dword [ebp - 0x10]
mov eax, dword [esi + 0x324]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
lea edx, [ebp - 0x18]
call fcn.004ba8fc
push dword [ebp - 0x18]
push 0x548fc0
mov eax, dword [esi + 0x324]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x1c]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x1c]
push 0x548fc0
mov eax, dword [esi + 0x324]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x20]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x20]
push 0x548fc0
mov eax, dword [esi + 0x324]
call fcn.004bb078
mov edx, ebx
call fcn.004baabc
mov eax, dword [eax + 0x30]
lea ecx, [ebp - 0x24]
mov edx, 2
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x24]
push 0x548fc8
lea eax, [ebp - 0xc]
mov edx, 9
call fcn.0040519c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004f276c
inc ebx
dec dword [ebp - 8]
jne 0x548e5b
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548f93
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404e74
lea eax, [ebp - 0x14]
call fcn.00404730
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404e74
lea eax, [ebp - 4]
call fcn.00404e5c
ret

Function at 0x5498a4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 4], esi
inc esi
jne 0x5498c5
call sub.wsock32.dll_WSAGetLastError
jmp 0x5498ca
xor eax, eax
mov dword [ebx + 8], edi
pop edi
pop esi
pop ebx
ret

Function at 0x549a5c
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push esi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_listen
test eax, eax
je 0x549a77
call sub.wsock32.dll_WSAGetLastError
jmp 0x549a79
xor eax, eax
pop esi
pop ebx
ret
Function at 0x549a7c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp + 8]
push eax
push edi
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_accept
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x549aac
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
jmp 0x549b9b
xor esi, esi
mov dword [ebp - 8], 0xffffffff
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x549ae2
mov ecx, 0xb5
mov edx, 0x549bb0
mov eax, 0x549c14
call fcn.0040468c
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0xea60
mov dword [ebp - 0x14], 0x1388
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x98000004
mov eax, dword [ebx]
push eax
call sub.ws2_32.dll_WSAIoctl
test eax, eax
je 0x549b2e
mov ecx, 0xbe
mov edx, 0x549bb0
mov eax, 0x549c14
call fcn.0040468c
mov word [ebp - 0xc], 1
mov word [ebp - 0xa], 0xa
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x80
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x549b6a
mov ecx, 0xc6
mov edx, 0x549bb0
mov eax, 0x549c14
call fcn.0040468c
mov dword [ebp - 4], 0xffffffff
push 4
lea eax, [ebp - 4]
push eax
push 1
push 6
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x549b9b
mov ecx, 0xcd
mov edx, 0x549bb0
mov eax, 0x549c14
call fcn.0040468c
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4