joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4986a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4986d2
mov ecx, 0x49873c
mov dl, 1
mov eax, dword [0x497c14]
call fcn.0040df4c
call fcn.00404bdc
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x49872a
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.004032ac
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4986e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x498cf8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x498d7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x497f38]
mov eax, 0x14
call fcn.0040629c
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409898
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.004052c0
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x50fda8]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x50fda8], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498d81
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405290
ret

Function at 0x498d88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x498e04
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x497f60]
mov eax, 0x10
call fcn.0040629c
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409898
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.004052c0
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x50fdac]
mov dword [ebx], eax
mov dword [0x50fdac], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498e0b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405290
ret

Function at 0x498e60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x498e81
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x498e6e
pop edi
pop esi
pop ebx
ret
Function at 0x4a5088
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jl 0x4a50dc
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x505b8c]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x505f8c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x50638c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x50678c]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x4a5096
pop edi
pop esi
pop ebx
ret

Function at 0x4a5f38
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, 0xff
mov ecx, dword [esp]
shr ecx, 8
and ecx, 0xff
mov eax, dword [esp]
shr eax, 0x10
and eax, 0xff
mov esi, dword [esp]
shr esi, 0x18
mov dword [esp + 8], esi
cmp dword [esp + 4], 0x100
jne 0x4a5fc9
movzx ebx, byte [ebx + 0x506dac]
mov esi, dword [edx + 0xc]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x506cac]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x506cac]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x506dac]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
cmp dword [esp + 4], 0xc0
jl 0x4a6023
movzx ebx, byte [ebx + 0x506dac]
mov esi, dword [edx + 8]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x506dac]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x506cac]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x506cac]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
movzx ebx, byte [ebx + 0x506cac]
mov esi, dword [edx + 4]
and esi, 0xff
xor ebx, esi
movzx ebx, byte [ebx + 0x506cac]
mov esi, dword [edx]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x510e7c]
movzx ecx, byte [ecx + 0x506dac]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ecx, esi
movzx ecx, byte [ecx + 0x506cac]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ecx, esi
xor ebx, dword [ecx*4 + 0x51127c]
movzx eax, byte [eax + 0x506cac]
mov ecx, dword [edx + 4]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
movzx eax, byte [eax + 0x506dac]
mov ecx, dword [edx]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
xor ebx, dword [eax*4 + 0x51167c]
mov eax, dword [esp + 8]
movzx eax, byte [eax + 0x506dac]
mov ecx, dword [edx + 4]
shr ecx, 0x18
xor eax, ecx
movzx eax, byte [eax + 0x506dac]
mov edx, dword [edx]
shr edx, 0x18
xor eax, edx
xor ebx, dword [eax*4 + 0x511a7c]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4a60e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
movzx ecx, cl
imul ecx, ecx, 0x1010101
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
mov esi, dword [edx + ebx*4 + 4]
xor esi, ecx
mov dword [eax + ebx*4 + 4], esi
mov esi, dword [edx + ebx*4 + 8]
xor esi, ecx
mov dword [eax + ebx*4 + 8], esi
mov esi, dword [edx + ebx*4 + 0xc]
xor esi, ecx
mov dword [eax + ebx*4 + 0xc], esi
add ebx, 4
cmp ebx, 0x40
jl 0x4a60ed
pop esi
pop ebx
ret

Function at 0x4a6fa4
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], pe_nt_image_headers32
mov esi, 0x506cac
mov ebx, 0x510e7c
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.004a5e20
mov dword [esp + 8], eax
mov eax, edi
call fcn.004a5e30
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.004a5e20
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.004a5e30
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x4a6fbd
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a8f34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056ec
xor eax, eax
push ebp
push 0x4a8fc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040526c
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a8f70
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test bx, bx
jbe 0x4a8faa
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
movzx edx, word [ebp - 6]
xor dx, 0xf
call fcn.00405454
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405538
inc edi
dec bx
jne 0x4a8f7b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8fcf
lea eax, [ebp - 0xc]
call fcn.0040526c
lea eax, [ebp - 4]
call fcn.0040526c
ret
Function at 0x4aad98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056ec
xor eax, eax
push ebp
push 0x4aae2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040526c
mov eax, dword [ebp - 4]
test eax, eax
je 0x4aadd4
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test bx, bx
jbe 0x4aae0e
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
movzx edx, word [ebp - 6]
xor dx, 0xf
call fcn.00405454
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405538
inc edi
dec bx
jne 0x4aaddf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aae33
lea eax, [ebp - 0xc]
call fcn.0040526c
lea eax, [ebp - 4]
call fcn.0040526c
ret
Function at 0x4c9e8c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4c9e94
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ca086
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4ca09c
mov eax, esi
call fcn.004c1d50
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004052c0
lea ecx, [ebp - 0x10]
mov edx, 0x4ca0b0
mov eax, esi
call fcn.004c1d50
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004052c0
lea ecx, [ebp - 0x14]
mov edx, 0x4ca0c8
mov eax, esi
call fcn.004c1d50
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004052c0
lea ecx, [ebp - 0x18]
mov edx, 0x4ca0e4
mov eax, esi
call fcn.004c1d50
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004052c0
lea ecx, [ebp - 0x1c]
mov edx, 0x4ca100
mov eax, esi
call fcn.004c1d50
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004052c0
lea ecx, [ebp - 0x24]
mov edx, 0x4ca118
mov eax, esi
call fcn.004c1d50
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409bfc
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040a058
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4ca130
mov eax, esi
call fcn.004c1d50
mov eax, dword [ebp - 0x28]
call fcn.004bb9b4
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4ca140
mov eax, esi
call fcn.004c1d50
mov eax, dword [ebp - 0x2c]
call fcn.004bb9b4
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4ca158
mov eax, esi
call fcn.004c1d50
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040a058
inc eax
je 0x4ca029
lea ecx, [ebp - 0x34]
mov edx, 0x4ca158
mov eax, esi
call fcn.004c1d50
mov eax, dword [ebp - 0x34]
call fcn.0040a01c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
movzx edx, word [ebp - 4]
movzx eax, word [ebp - 8]
call fcn.0040bde4
fstp qword [ebp - 0x3c]
wait
call fcn.0040c14c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4ca044
lea ecx, [ebp - 0x40]
mov edx, 0x4ca158
mov eax, esi
call fcn.004c1d50
mov eax, dword [ebp - 0x40]
call fcn.004bb9b4
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4ca168
mov eax, esi
call fcn.004c1d50
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004052c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca08d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00405290
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00405290
ret

Function at 0x4ced2c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b20
ret
Function at 0x4d54c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x4d54dd
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x4d54ea
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4d5508
cld
pop edi
pop esi
movzx ecx, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d552c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 0x184], ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
movzx ecx, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4d5572
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, esi
lea edx, [ebp - 0x100]
call fcn.004054d0
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.004054d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db268
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4db296
mov eax, ebx
call fcn.004dbd1c
cmp dword [ebx + 0x40], 0
je 0x4db28f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4db307
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4db2f9
cmp dword [ebx + 8], 0
je 0x4db2b8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4db2ca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4db2f9
cmp dword [ebx + 8], 0
je 0x4db2ab
cmp eax, 3
je 0x4db2dd
dec eax
jne 0x4db2ab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4db2ab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4db2ab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4db325
cmp dword [ebx + 0x14], 0xcc
je 0x4db325
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004db330
pop ebx
ret
Function at 0x4f03f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4f03fc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4f0621
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417e94]
call fcn.00404338
mov edx, dword [0x509858]
mov dword [edx], eax
mov eax, dword [0x509858]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 8]
mov dl, 1
mov eax, dword [0x418500]
call fcn.00404338
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4f05e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4f05cc
inc ebx
xor esi, esi
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 4], 0
je 0x4f05c4
mov eax, dword [ebp - 4]
cmp byte [eax], 0x3b
je 0x4f05c4
push 1
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b584c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004b584c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004b584c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004b584c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004b584c
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.00405304
cmp dword [ebp - 8], 0
je 0x4f05c4
cmp dword [ebp - 0xc], 0
je 0x4f05c4
cmp dword [ebp - 0x14], 0
je 0x4f05c4
mov edx, dword [0x4a8eb8]
mov eax, 0x14
call fcn.0040629c
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.0040a01c
mov dword [edi], eax
lea eax, [edi + 4]
mov edx, dword [ebp - 0xc]
call fcn.004052c0
lea eax, [edi + 8]
mov edx, dword [ebp - 0x10]
call fcn.004052c0
lea eax, [edi + 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004052c0
lea eax, [edi + 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004052c0
mov eax, dword [0x509858]
mov eax, dword [eax]
mov edx, edi
call fcn.0041a51c
inc esi
dec ebx
jne 0x4f0476
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f05e9
mov eax, dword [ebp - 0x20]
call fcn.00404368
ret
Function at 0x4053b7
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, 0x4000000
je 0x4053ca
mov eax, 0x200
push esi
mov esi, ecx
and esi, 0x20000000
push edi
mov edx, 0x40000000
mov edi, 0x80000000
je 0x4053e8
test edx, ecx
je 0x4053e8
test edi, ecx
jne 0x405416
test esi, esi
je 0x4053f5
test edx, ecx
je 0x4053f5
or eax, 0x20
jmp 0x405419
mov esi, ecx
and esi, edx
je 0x405404
test edi, ecx
je 0x40540d
or eax, 4
jmp 0x405419
test edi, ecx
je 0x40540d
or eax, 8
jmp 0x405419
test esi, esi
je 0x405416
or eax, 2
jmp 0x405419
or eax, 0x40
pop edi
pop esi
ret

Function at 0x401730
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov ecx, 0xa
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
xor edi, edi
pop esi
pop ecx
mov dword [0x402418], esi
push edi
dec ecx
jne 0x40174f
lea eax, [ebp - 0x30]
push eax
mov edx, dword [0x402418]
mov dword [ebp - 0x20], edx
lea ecx, str.contents
mov dword [ebp - 0xc], ecx
lea eax, section..text
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x402418]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x402418]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x402418]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x402428], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402428]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401819
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401800
pop ebp
ret 0x10
Function at 0x401870
Capabilities:
Access peb ldr_data
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4036b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
mov ebx, ecx
push ebp
push edi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x10]
mov dword [esp + 0x150], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x150], 1
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x158]
lea ecx, [esp + 0x10]
push ebp
mov byte [esp + 0x154], 2
call sub.MFC42.DLL_CString::operator_1
push ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
push 0x40603c
lea ecx, [esp + 0x10]
call fcn.004020ec
push str..
lea ecx, [esp + 0x14]
call fcn.004020ec
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__findfirst]
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x40194e
lea ecx, [esp + 0xc]
mov byte [esp + 0x150], 1
call fcn.004020f2
lea ecx, [esp + 0x10]
mov byte [esp + 0x150], 0
call fcn.004020f2
lea ecx, [esp + 0x14]
mov dword [esp + 0x150], edi
call fcn.00402176
jmp 0x401a9c
push esi
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push ebp
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0x40603c
lea ecx, [esp + 0x14]
call fcn.004020ec
test byte [esp + 0x34], 0x10
je 0x401a06
lea edx, [esp + 0x48]
lea ecx, [esp + 0x10]
push edx
call fcn.004020ec
lea eax, [esp + 0x48]
push 0x406120
push eax
call esi
add esp, 8
test eax, eax
je 0x401a43
lea ecx, [esp + 0x48]
push str.dbLog
push ecx
call esi
add esp, 8
test eax, eax
je 0x401a43
lea edx, [esp + 0x48]
push str.Mysql
push edx
call esi
add esp, 8
test eax, eax
je 0x401a43
lea eax, [esp + 0x48]
push 0x40610c
push eax
call esi
add esp, 8
test eax, eax
je 0x401a43
lea ecx, [esp + 0x48]
push 0x406108
push ecx
call esi
add esp, 8
test eax, eax
je 0x401a43
mov edx, dword [esp + 0x10]
mov ecx, ebx
push edx
call fcn.00401870
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x401a43
lea ecx, [esp + 0x48]
push 0x4060f8
push ecx
call esi
add esp, 8
test eax, eax
je 0x401a43
lea edx, [esp + 0x48]
lea ecx, [esp + 0x10]
push edx
call fcn.004020ec
mov eax, dword [esp + 0x10]
mov ecx, ebx
push eax
push 0x4060ec
call fcn.00401ee0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x34]
push edx
push edi
call dword [sym.imp.MSVCRT.dll__findnext]
add esp, 8
cmp eax, 0xffffffff
jne 0x401955
push edi
call dword [sym.imp.MSVCRT.dll__findclose]
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], 1
call fcn.004020f2
lea ecx, [esp + 0x14]
mov byte [esp + 0x154], 0
call fcn.004020f2
lea ecx, [esp + 0x18]
mov dword [esp + 0x154], 0xffffffff
call fcn.00402176
pop esi
mov ecx, dword [esp + 0x148]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret 4
Function at 0x401ac0
Capabilities:
Create thread

Disassembly:
mov al, byte [esp + 0x10]
mov edx, dword [esp + 4]
push 0
push 0
push ecx
mov byte [ecx + 0xc], al
mov eax, dword [esp + 0x14]
mov dword [ecx], edx
mov edx, dword [esp + 0x18]
push 0x401b00
push 0
push 0
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 0x10