joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bc00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f9010
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
lea ebp, [edi + 0xc]
push eax
mov ecx, ebp
call fcn.00452a60
mov ecx, dword [esp + 0x34]
lea esi, [edi + 0x28]
push ecx
mov ecx, esi
call fcn.00452a60
push 0x540cf8
mov ecx, esi
call fcn.00452c40
test al, al
je 0x48bc84
lea ecx, [esp + 0x10]
call fcn.0045b180
push 0
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.0045c2e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.0045b190
push 0x540d00
mov ecx, esi
call fcn.00452c40
test al, al
je 0x48bcc2
lea ecx, [esp + 0x18]
call fcn.0045b180
push 0
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 1
call fcn.0045c2e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0045b190
push 0xa
mov ecx, esi
call fcn.00451680
test al, al
je 0x48bcf1
push 0x5af400
push 0x540d04
mov ecx, esi
call fcn.00452320
push 0x5af400
push 0x546350
mov ecx, esi
call fcn.00452320
push str.user_agent
mov ecx, ebp
call fcn.00452eb0
test al, al
jne 0x48bd21
push str.accept
mov ecx, ebp
call fcn.00452eb0
test al, al
jne 0x48bd21
push str.accept_charset
mov ecx, ebp
call fcn.00452eb0
test al, al
je 0x48bd25
mov byte [edi + 8], 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 8

Function at 0x48d1f0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x48d200
mov ecx, dword [esp + 8]
sub eax, esi
add eax, 1
push eax
mov eax, dword [esp + 0x10]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop esi
ret 0x10
Function at 0x48d230
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f91d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
xor ebp, ebp
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebp
push edi
push edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x48d2b2
push eax
call fcn.004cabe6
mov edx, dword [esp + 0x4c]
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push ebp
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
jmp 0x48d313
cmp ebx, ebp
je 0x48d311
mov esi, dword [esp + 0x50]
cmp esi, ebp
je 0x48d311
lea ecx, [esp + 0x1c]
call fcn.00451c20
push ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], 0
call fcn.00452cc0
mov ebx, dword [esi]
lea ecx, [esp + 0x1c]
call fcn.004c06c0
push eax
mov eax, dword [ebx + 0x28]
push str.RegistryQueryError
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push edi
push str.ValueName
mov ecx, esi
call eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], 0xffffffff
call fcn.00451e70
mov eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc
Function at 0x49e150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f9558
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00465c50
xor edi, edi
mov dword [esi], vtable.ZipWalkEntry.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov word [esi + 0x10], di
mov word [esi + 0x12], di
mov word [esi + 0x14], di
mov word [esi + 0x16], di
mov word [esi + 0x18], di
mov dword [esi + 0x1a], edi
mov dword [esi + 0x1e], edi
mov dword [esi + 0x22], edi
mov word [esi + 0x26], di
mov word [esi + 0x28], di
mov dword [esi + 0x2c], edi
lea ecx, [esi + 0x60]
mov dword [esp + 0x18], edi
mov dword [esi + 0x30], edi
mov word [esi + 0x34], di
mov word [esi + 0x36], di
mov word [esi + 0x38], di
mov word [esi + 0x3a], di
mov word [esi + 0x3c], di
mov word [esi + 0x3e], di
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov word [esi + 0x4c], di
mov word [esi + 0x4e], di
mov word [esi + 0x50], di
mov word [esi + 0x52], di
mov word [esi + 0x54], di
mov dword [esi + 0x56], edi
mov dword [esi + 0x5a], edi
call fcn.00451c20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov word [esi + 0x8c], di
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x49e840
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f9558
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00465c50
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.FileInfo.0
call fcn.00451c20
mov byte [esi + 0x29], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0x50], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x49ebe0
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4f95c8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov byte [esi + 8], 0
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
lea edi, [esi + 0x3c]
mov dword [esi + 0x48], eax
lea ebp, [esi + 0x44]
mov dword [esi + 0x34], eax
lea ebx, [esi + 0x34]
mov dword [ebx + 4], eax
lea ecx, [esi + 0xc]
mov dword [esi + 0x4c], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
call fcn.00451240
mov eax, dword [esp + 0x80]
test eax, eax
mov byte [esi + 0x29], 0
je 0x49ec88
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49ec8f
mov edi, dword [esp + 0x84]
mov eax, dword [esp + 0x80]
push edi
push eax
call fcn.00457620
add esp, 8
test al, al
jne 0x49ec88
test edi, edi
mov byte [esi + 8], 1
je 0x49ec88
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
push str.File_does_not_exist.
mov ecx, edi
call eax
xor al, al
jmp 0x49ed70
mov dword [esi + 0x4c], eax
shr eax, 4
and al, 1
lea ecx, [esp + 0x14]
mov byte [esi + 0x28], al
call fcn.004537d0
mov ecx, dword [esp + 0x80]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x7c], 0
call fcn.00453ac0
lea ecx, [esp + 0x14]
call fcn.00454170
push eax
lea ecx, [esi + 0xc]
call fcn.00452a60
cmp byte [esi + 0x28], 0
je 0x49ece8
mov edx, dword [esp + 0x84]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004569f0
jmp 0x49ecfa
mov ecx, dword [esp + 0x84]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00456880
add esp, 8
cmp eax, 0xffffffff
mov dword [esp + 0x80], eax
je 0x49ed28
push ebx
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x49ed3d
push eax
mov eax, dword [esp + 0x84]
push eax
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0xffffffff
call fcn.00453880
xor al, al
jmp 0x49ed70
mov edi, dword [esp + 0x80]
lea ecx, [esi + 0x30]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
mov dword [esi + 0x2c], eax
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0xffffffff
call fcn.00453880
mov al, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 8

Function at 0x49fbc0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [ecx + 0x18]
movzx eax, word [ecx + 0x14]
push ebx
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
test edi, edi
lea eax, [eax + ecx + 0x18]
jbe 0x49fc01
mov ebx, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x49fbea
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x49fbf7
add edx, ecx
cmp ebx, edx
jb 0x49fc03
add esi, 1
add eax, 0x28
cmp esi, edi
jb 0x49fbe0
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a1090
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f9991
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x488]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x4a8]
mov eax, dword [esp + 0x498]
mov esi, dword [esp + 0x49c]
mov ebx, dword [esp + 0x4a4]
mov ebp, dword [esp + 0x4ac]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], esi
call fcn.00468330
test ebp, ebp
mov dword [esp + 0x490], 0
jne 0x4a1116
lea ebp, [esp + 0x14]
test esi, esi
jne 0x4a1148
test ebp, ebp
je 0x4a112d
push str.No_Zip_filename_in_Zip2Exe_encrypt_to_temp
mov edx, dword [ebp]
mov eax, dword [edx + 0x10]
mov ecx, ebp
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x490], 0xffffffff
call fcn.00468350
xor al, al
jmp 0x4a127e
test ebx, ebx
jne 0x4a1157
test ebp, ebp
je 0x4a112d
push str.No_Zip_password_in_Zip2Exe_encrypt_to_temp
jmp 0x4a1123
mov ecx, dword [esp + 0x4a0]
mov dword [esp + 0x3c], ecx
mov ecx, 7
mov esi, str.01234567890ABCDEF01234567890ABCD
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x28]
movsw word es:[edi], word [esi]
call fcn.004547e0
lea ecx, [esp + 0x18]
mov byte [esp + 0x490], 1
call fcn.0048d700
lea edx, [esp + 0x28]
push edx
push 0x1e
lea eax, [esp + 0x48]
push eax
push ebx
push 0x100
push 1
mov byte [esp + 0x4a8], 2
call fcn.0048d720
add esp, 0x18
lea ecx, [esp + 0x28]
call fcn.004c4070
test eax, eax
je 0x4a11d5
lea ecx, [esp + 0x28]
call fcn.004c4070
mov ecx, 8
mov esi, eax
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
push ebp
push 0x24
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x30]
push str.encrypted
call fcn.004a05c0
lea edx, [esp + 0x164]
push edx
push 0x320
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x60]
push eax
push 0
push str.ckenc
lea ecx, [esp + 0x170]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x60]
push edx
call fcn.00452a60
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4a0]
push ebp
push 0
lea eax, [esp + 0x68]
push eax
push ecx
push ebx
push edx
push 1
call fcn.0048ef00
add esp, 0x1c
lea ecx, [esp + 0x18]
mov byte [esp + 0x490], 1
call fcn.0048d710
lea ecx, [esp + 0x28]
mov byte [esp + 0x490], 0
call fcn.00454dd0
lea ecx, [esp + 0x14]
mov dword [esp + 0x490], 0xffffffff
call fcn.00468350
mov al, 1
mov ecx, dword [esp + 0x488]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.004d99c4
add esp, 0x480
ret 0x18
Function at 0x4a4260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f9e4c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0048d3f0
xor ebx, ebx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.ZipPipeline.0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.00451c20
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov byte [esi + 0x5a], bl
mov byte [esi + 0x5b], bl
call fcn.00451c20
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 2
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
call fcn.004547e0
lea ecx, [esi + 0xb4]
mov byte [esp + 0x18], 3
mov byte [esi + 0x94], 1
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov byte [esi + 0xa0], bl
mov dword [esi + 0xa4], 6
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
call fcn.00451c20
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4a4810
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4f9f58
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00451c20
lea edi, [esi + 0xb4]
mov ecx, edi
mov dword [esp + 0x8c], 0
call fcn.004c49f0
test eax, eax
je 0x4a487c
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004c06c0
push eax
push str.ckZ.dat
call fcn.004587d0
add esp, 0xc
jmp 0x4a488e
lea ecx, [esp + 0x14]
push ecx
push str.ckZ.dat
call fcn.00458a20
add esp, 8
mov edi, dword [esp + 0x94]
push edi
lea edx, [esp + 0x17]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b], 0
call fcn.004c06c0
push eax
call fcn.0048a1f0
add esp, 0xc
cmp byte [esp + 0x13], 0
mov ebx, eax
jne 0x4a48fc
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
push str.Failed_to_create_temporary_output_file
mov ecx, edi
call edx
mov esi, dword [edi]
lea ecx, [esp + 0x14]
call fcn.004c06c0
push eax
mov eax, dword [esi + 0x28]
push str.filename
mov ecx, edi
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x8c], 0xffffffff
call fcn.00451e70
xor al, al
jmp 0x4a4a36
push 0
push 0
push 0
push ebx
lea ecx, [esp + 0x40]
call fcn.0048a3e0
push 0
lea ecx, [esp + 0x54]
mov byte [esp + 0x90], 1
call fcn.004bc6b0
push esi
lea ecx, [esp + 0x54]
mov byte [esp + 0x90], 2
call fcn.0048d470
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x4a4945
push eax
lea ecx, [esp + 0x54]
call fcn.004bc6a0
cmp byte [esi + 0x30], 0
mov byte [esp + 0x13], 0
je 0x4a4969
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esi + 0x5c]
call fcn.004c06c0
push eax
lea ecx, [esp + 0x58]
call fcn.004bd840
jmp 0x4a498d
lea edx, [esp + 0x30]
lea edi, [esi + 0x80]
push edx
mov ecx, edi
call fcn.004c06c0
push eax
mov ecx, edi
call fcn.004c4070
push eax
lea ecx, [esp + 0x5c]
call fcn.004bdc40
push 0
push ebx
mov byte [esp + 0x1b], al
call fcn.004661e0
add esp, 8
cmp byte [esi + 0x5b], 0
je 0x4a49be
lea edi, [esi + 0x5c]
mov ecx, edi
call fcn.004c49f0
test eax, eax
je 0x4a49be
mov ecx, edi
call fcn.004c06c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x14]
mov byte [esi + 0x5b], 1
call fcn.004c06c0
push eax
lea ecx, [esi + 0x5c]
call fcn.00452a60
cmp byte [esi + 0x94], 0
lea ecx, [esi + 0x80]
jne 0x4a49f1
call fcn.004547b0
mov byte [esi + 0x94], 1
jmp 0x4a49f6
call fcn.00454750
mov bl, byte [esp + 0x13]
lea ecx, [esp + 0x50]
mov byte [esi + 0x30], 1
mov byte [esp + 0x8c], 1
call fcn.004bc6d0
lea ecx, [esp + 0x30]
mov byte [esp + 0x8c], 0
call fcn.0048a450
lea ecx, [esp + 0x14]
mov dword [esp + 0x8c], 0xffffffff
call fcn.00451e70
mov al, bl
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x80
ret 4
Function at 0x4a5130
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4fa050
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x30], 0
je 0x4a526e
lea ecx, [esp + 0x24]
call fcn.00451c20
lea eax, [esp + 0x24]
push eax
push str.ckAes.dat
mov dword [esp + 0x50], 0
call fcn.00458a20
mov ebx, dword [esp + 0x58]
add esp, 8
push ebx
push 0
lea ecx, [esp + 0x2c]
lea edi, [esi + 0x5c]
call fcn.004c06c0
push eax
mov ecx, edi
call fcn.004c06c0
push eax
lea ecx, [esi + 0xc]
call fcn.004c06c0
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
call fcn.0048ef00
add esp, 0x1c
test al, al
jne 0x4a5207
push ebx
lea ecx, [esp + 0x28]
call fcn.004c06c0
push eax
call fcn.00458370
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
add esp, 8
push str.Failed_to_AES_encrypt_source_file_data
mov ecx, ebx
call edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 0xffffffff
call fcn.00451e70
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 4
cmp byte [esi + 0x5b], 0
je 0x4a521b
mov ecx, edi
call fcn.004c06c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, 1
lea ecx, [esp + 0x24]
mov byte [esi + 0x5b], bl
call fcn.004c06c0
push eax
mov ecx, edi
call fcn.00452a60
cmp byte [esi + 0x94], 0
lea ecx, [esi + 0x80]
jne 0x4a5250
call fcn.004547b0
mov byte [esi + 0x94], bl
jmp 0x4a5255
call fcn.00454750
lea ecx, [esp + 0x24]
mov byte [esi + 0x30], bl
mov dword [esp + 0x48], 0xffffffff
call fcn.00451e70
jmp 0x4a5342
lea ecx, [esp + 0x10]
call fcn.004547e0
lea eax, [esp + 0x10]
lea edi, [esi + 0x80]
mov ebx, 1
push eax
mov ecx, edi
mov dword [esp + 0x4c], ebx
call fcn.004c06c0
push eax
mov ecx, edi
call fcn.004c4070
push eax
lea ecx, [esi + 0xc]
call fcn.004c06c0
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
call fcn.0048d720
add esp, 0x18
test al, al
jne 0x4a52f0
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.Failed_to_AES_encrypt_source_data
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.00454dd0
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 4
cmp byte [esi + 0x94], 0
mov ecx, edi
jne 0x4a5302
call fcn.004547b0
jmp 0x4a5307
call fcn.00454750
lea ecx, [esp + 0x10]
call fcn.004c06c0
push eax
lea ecx, [esp + 0x14]
call fcn.004c4070
push eax
mov ecx, edi
call fcn.00454eb0
lea ecx, [esp + 0x10]
call fcn.004547b0
lea ecx, [esp + 0x10]
mov byte [esi + 0x94], bl
mov dword [esp + 0x48], 0xffffffff
call fcn.00454dd0
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 4
Function at 0x4a5f10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4fa180
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.00468330
mov edi, dword [esp + 0x44]
test edi, edi
mov dword [esp + 0x38], 0
jne 0x4a5f55
lea edi, [esp + 0x10]
xor bl, bl
cmp byte [esi + 0x5a], bl
je 0x4a5f64
cmp dword [esi + 0x34], 4
jne 0x4a5f64
mov bl, 1
push edi
mov ecx, esi
call fcn.004a5850
test al, al
jne 0x4a5f98
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.00468350
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0xc
push edi
mov ecx, esi
call fcn.004a5a90
test al, al
je 0x4a5f70
mov al, byte [esi + 0x58]
test al, al
je 0x4a6002
cmp byte [esi + 0x59], 0
je 0x4a5fea
test bl, bl
push edi
mov ecx, esi
je 0x4a5fde
call fcn.004a4810
test al, al
je 0x4a5f70
mov edx, dword [esp + 0x40]
push edi
lea eax, [esi + 0xac]
push eax
lea ecx, [esi + 0xa8]
push ecx
push edx
mov ecx, esi
call fcn.004a56e0
jmp 0x4a6032
mov eax, dword [esp + 0x44]
push eax
call fcn.004a5e30
jmp 0x4a6032
test al, al
je 0x4a6002
cmp byte [esi + 0x59], 0
jne 0x4a5ffe
push edi
mov ecx, esi
call fcn.004a4a60
jmp 0x4a6032
test al, al
jne 0x4a6025
cmp byte [esi + 0x59], 0
je 0x4a6025
mov eax, dword [esp + 0x40]
push edi
lea ecx, [esi + 0xac]
push ecx
lea edx, [esi + 0xa8]
push edx
push eax
mov ecx, esi
call fcn.004a56e0
jmp 0x4a6032
mov ecx, dword [esp + 0x40]
push edi
push ecx
mov ecx, esi
call fcn.004a57a0
cmp byte [esi + 0x5b], 0
mov bl, al
je 0x4a6072
lea ecx, [esi + 0x5c]
call fcn.004c06c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4a6072
lea ecx, [esp + 0x14]
call fcn.00451c20
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call fcn.00453240
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.00451e70
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.00468350
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x4a6270
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov esi, ecx
je 0x4a6282
mov dword [edi], 0
mov edx, dword [esp + 0x10]
test edx, edx
jne 0x4a6291
pop edi
xor al, al
pop esi
ret 0x10
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4a628a
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
jne 0x4a62a8
pop edi
mov al, 1
pop esi
ret 0x10
push ebx
push 0
lea ebx, [esp + 0x18]
push ebx
push edx
push ecx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4a62e7
cmp byte [esi + 0xc], al
je 0x4a62d8
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov dword [esi + 0x10], 0xffffffff
mov al, 1
pop esi
ret 0x10
mov ecx, dword [esi + 8]
test ecx, ecx
mov bl, 1
je 0x4a6321
lea edx, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x20], 0
call fcn.0046fee0
cmp byte [esp + 0x18], 0
je 0x4a631d
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4a631b
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push str.Aborted_by_application
call edx
xor bl, bl
mov eax, dword [esp + 0x14]
test edi, edi
je 0x4a6327
mov dword [edi], eax
add dword [esi + 4], eax
mov al, bl
pop ebx
pop edi
pop esi
ret 0x10
Function at 0x4a9a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [eax + 0x25c], 0
jle 0x4a7e5b
push ebx
mov ecx, 0xfffffff8
push edi
mov edi, dword [eax + 0x4c]
mov bl, byte [eax + 0x25b]
mov edx, dword [eax + 0x2c]
mov byte [edx + edi], bl
add dword [eax + 0x4c], 1
shl dword [eax + 0x258], 8
add dword [eax + 0x25c], ecx
cmp dword [eax + 0x25c], 0
jg 0x4a7e30
pop edi
pop ebx
ret
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x44], 0
jle 0x4a9a93
mov eax, dword [esi + 0x260]
mov ecx, dword [esi + 0x264]
not eax
rol ecx, 1
xor ecx, eax
cmp dword [esi + 0x26c], 1
mov dword [esi + 0x260], eax
mov dword [esi + 0x264], ecx
jle 0x4a9a8a
mov dword [esi + 0x4c], 0
push esi
call fcn.004bfae0
add esp, 4
mov edx, dword [esi + 0x14]
add edx, dword [esi + 0x44]
cmp dword [esi + 0x26c], 1
mov dword [esi + 0x2c], edx
jne 0x4a9af6
push 8
mov ecx, 0x42
mov eax, esi
mov dword [esi + 0x25c], 0
mov dword [esi + 0x258], 0
call fcn.004a7e60
push 8
mov ecx, 0x5a
call fcn.004a7e60
push 8
mov ecx, 0x68
call fcn.004a7e60
mov al, byte [esi + 0x270]
add al, 0x30
movzx ecx, al
push 8
mov eax, esi
call fcn.004a7e60
add esp, 0x10
cmp dword [esi + 0x44], 0
jle 0x4a9ba2
push 8
mov ecx, 0x31
mov eax, esi
call fcn.004a7e60
push 8
mov ecx, 0x41
call fcn.004a7e60
push 8
mov ecx, 0x59
call fcn.004a7e60
push 8
mov ecx, 0x26
call fcn.004a7e60
push 8
mov ecx, 0x53
call fcn.004a7e60
push 8
mov ecx, 0x59
call fcn.004a7e60
mov ebx, dword [esi + 0x260]
mov ecx, ebx
shr ecx, 0x18
push 8
call fcn.004a7e60
mov ecx, ebx
shr ecx, 0x10
and ecx, 0xff
push 8
call fcn.004a7e60
movzx ecx, bh
push 8
call fcn.004a7e60
movzx ecx, bl
push 8
call fcn.004a7e60
push 1
xor ecx, ecx
call fcn.004a7e60
mov ecx, dword [esi + 0x1c]
push 0x18
call fcn.004a7e60
add esp, 0x30
call fcn.004a7f50
call fcn.004a8120
cmp byte [esp + 0x10], 0
je 0x4a9c39
push 8
mov ecx, 0x17
mov eax, esi
call fcn.004a7e60
push 8
mov ecx, 0x72
call fcn.004a7e60
push 8
mov ecx, 0x45
call fcn.004a7e60
push 8
mov ecx, 0x38
call fcn.004a7e60
push 8
mov ecx, 0x50
call fcn.004a7e60
push 8
mov ecx, 0x90
call fcn.004a7e60
mov ebx, dword [esi + 0x264]
mov ecx, ebx
shr ecx, 0x18
push 8
call fcn.004a7e60
mov ecx, ebx
shr ecx, 0x10
and ecx, 0xff
push 8
call fcn.004a7e60
movzx ecx, bh
push 8
call fcn.004a7e60
movzx ecx, bl
push 8
call fcn.004a7e60
add esp, 0x28
pop esi
pop ebx
jmp 0x4a7e20
pop esi
pop ebx
ret