joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6a84
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4a6a8c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a6c7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4a6c94
mov eax, esi
call fcn.004a4910
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404750
lea ecx, [ebp - 0x10]
mov edx, 0x4a6ca8
mov eax, esi
call fcn.004a4910
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404750
lea ecx, [ebp - 0x14]
mov edx, 0x4a6cc0
mov eax, esi
call fcn.004a4910
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404750
lea ecx, [ebp - 0x18]
mov edx, 0x4a6cdc
mov eax, esi
call fcn.004a4910
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404750
lea ecx, [ebp - 0x1c]
mov edx, 0x4a6cf8
mov eax, esi
call fcn.004a4910
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404750
lea ecx, [ebp - 0x24]
mov edx, 0x4a6d10
mov eax, esi
call fcn.004a4910
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408b04
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040904c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4a6d28
mov eax, esi
call fcn.004a4910
mov eax, dword [ebp - 0x28]
call fcn.0049e3bc
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4a6d38
mov eax, esi
call fcn.004a4910
mov eax, dword [ebp - 0x2c]
call fcn.0049e3bc
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4a6d50
mov eax, esi
call fcn.004a4910
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040904c
inc eax
je 0x4a6c21
lea ecx, [ebp - 0x34]
mov edx, 0x4a6d50
mov eax, esi
call fcn.004a4910
mov eax, dword [ebp - 0x34]
call fcn.00409010
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a998
fstp qword [ebp - 0x3c]
wait
call fcn.0040ad98
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4a6c3c
lea ecx, [ebp - 0x40]
mov edx, 0x4a6d50
mov eax, esi
call fcn.004a4910
mov eax, dword [ebp - 0x40]
call fcn.0049e3bc
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4a6d60
mov eax, esi
call fcn.004a4910
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6c85
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404720
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404720
ret
Function at 0x4ada10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4ada6a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004ada00
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0049ce38
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0049ca38
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ada71
lea eax, [ebp - 4]
call fcn.004046fc
ret

Function at 0x4b1a48
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b1b43
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x1400
xor edx, edx
push ebp
push 0x4b1b21
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
call fcn.00402754
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4b1af1
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x190]
lea eax, [ebx + 0x194]
call fcn.004b12c4
mov edx, dword [ebp - 0x10]
lea eax, [esi + 0xc]
call fcn.00404750
mov ebx, dword [ebx]
test ebx, ebx
je 0x4b1ae2
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x190]
lea eax, [ebx + 0x194]
call fcn.004b12c4
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0x10]
call fcn.00404750
jmp 0x4b1b0b
lea eax, [esi + 0x10]
mov edx, 0x4b1b5c
call fcn.00404750
jmp 0x4b1b0b
lea eax, [esi + 0xc]
mov edx, 0x4b1b5c
call fcn.00404750
lea eax, [esi + 0x10]
mov edx, 0x4b1b5c
call fcn.00404750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1b28
mov eax, dword [ebp - 8]
call fcn.00402774
ret

Function at 0x4b24d0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004075d4
ret

Function at 0x4b5194
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b521e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004046fc
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00416cb0
test al, al
je 0x4b51fe
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 8]
lea eax, [ebp - 0x108]
call fcn.00409850
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004b522c
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5225
lea eax, [ebp - 8]
call fcn.004046fc
ret
Function at 0x4b63cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov edi, edx
mov eax, edi
call fcn.004049bc
mov edx, eax
mov eax, ebp
call fcn.00404d48
mov eax, edi
call fcn.004049bc
mov esi, eax
test esi, esi
jle 0x4b641f
mov ebx, 1
mov eax, ebp
call fcn.00404c14
lea eax, [eax + ebx - 1]
push eax
mov eax, ebx
mov ecx, 5
cdq
idiv ecx
mov al, byte [edx + 0x4eb3ac]
mov dl, byte [edi + ebx - 1]
xor al, dl
pop edx
mov byte [edx], al
inc ebx
dec esi
jne 0x4b63f6
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b806c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4b80bd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4b80a4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4b8094
jmp 0x4b80bd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4b80a5
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c7858
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404bac
xor eax, eax
push ebp
push 0x4c7984
push dword fs:[eax]
mov dword fs:[eax], esp
dec ebx
jne 0x4c793a
lea edx, [ebp - 0x1c]
mov eax, 0x4c7998
call fcn.00497d2c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.004149a0
push 0
push 0x4c79b8
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00410464
add esp, 0x10
mov eax, dword [0x4ebc70]
mov eax, dword [eax]
call fcn.0047e65c
push eax
push 0x4c79c4
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00410464
add esp, 0x10
push 0
push 0x4c79d0
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00410464
add esp, 0x10
mov eax, dword [0x4ebc70]
mov eax, dword [eax]
call fcn.0047e650
sub eax, 0x1e
push eax
push 0x4c79d8
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00410464
add esp, 0x10
push 0xffffffffffffffff
push 0x4c79e4
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00410464
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x4c79f0
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00410464
add esp, 0x10
jmp 0x4c795e
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404bbc
push eax
push 0x4c7a00
mov eax, dword [0x4eba00]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c798b
lea eax, [ebp - 0x1c]
call fcn.0040614c
lea eax, [ebp - 0x18]
call fcn.0041045c
lea eax, [ebp - 4]
call fcn.004046fc
ret
Function at 0x4c7a08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c7ae1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004c7bd4
test al, al
je 0x4c7aaa
push 0x44
mov ecx, 0x4c7af0
mov edx, 0x4c7b08
mov eax, dword [0x4eba00]
mov eax, dword [eax]
call fcn.00480d24
cmp eax, 6
jne 0x4c7ac6
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402ab4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409500
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4c7b64
call fcn.00404a08
push 5
push 0x4c7b70
push 0x4c7b70
mov eax, dword [ebp - 4]
call fcn.00404bbc
push eax
push 0x4c7b74
mov eax, dword [0x4eba00]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4eba00]
mov eax, dword [eax]
call fcn.00480c80
jmp 0x4c7ac6
test bl, bl
je 0x4c7ac6
push 0x40
mov ecx, 0x4c7af0
mov edx, 0x4c7b7c
mov eax, dword [0x4eba00]
mov eax, dword [eax]
call fcn.00480d24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7ae8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404720
ret
Function at 0x4c9d60
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov eax, dword [ebp - 4]
call fcn.00404bac
xor eax, eax
push ebp
push 0x4c9f06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404bbc
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x148]
push eax
push 0x4c9f14
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c9ed5
mov eax, dword [0x4eba00]
mov eax, dword [eax]
call fcn.004809e8
mov esi, dword [ebp - 0x148]
lea eax, [ebp - 8]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.0040496c
mov eax, dword [ebp - 8]
mov edx, 0x4c9f20
call fcn.00404b08
je 0x4c9eba
mov eax, dword [ebp - 8]
mov edx, 0x4c9f2c
call fcn.00404b08
je 0x4c9eba
sub esi, 0x65
jae 0x4c9eba
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
call fcn.004089f4
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x4c9f38
call fcn.004089f4
mov edx, dword [ebp - 0x150]
pop eax
call fcn.00404b08
je 0x4c9eba
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 8]
call fcn.004089f4
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, 0x4c9f48
call fcn.004089f4
mov edx, dword [ebp - 0x158]
pop eax
call fcn.00404b08
je 0x4c9eba
push dword [ebp - 4]
push 0x4c9f5c
push dword [ebp - 8]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404a7c
mov edx, dword [ebp - 0x15c]
mov eax, dword [edi + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4c9dd4
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9f0d
lea eax, [ebp - 0x15c]
mov edx, 5
call fcn.00404720
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404720
ret
Function at 0x4c9f60
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bac
xor eax, eax
push ebp
push 0x4ca1c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x4ca1dc
mov edx, dword [ebp - 4]
call fcn.00404a08
mov eax, dword [ebp - 0x150]
call fcn.00404bbc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
setne al
jmp 0x4ca18b
mov eax, dword [0x4eb718]
cmp byte [eax], 2
je 0x4ca193
mov eax, dword [0x4eba00]
mov eax, dword [eax]
call fcn.004809e8
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.0040496c
push dword [ebp - 4]
push 0x4ca1ec
push dword [ebp - 0xc]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404a7c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.004089f4
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x15c]
mov eax, 0x4ca1f8
call fcn.004089f4
mov eax, dword [ebp - 0x15c]
pop edx
call fcn.00404d00
test eax, eax
jg 0x4ca199
mov eax, dword [ebp - 0x14c]
cmp eax, 0x10
je 0x4ca0b0
cmp eax, 2
je 0x4ca0b0
cmp eax, 4
je 0x4ca0b0
cmp eax, 0x80
je 0x4ca0b0
cmp eax, 0x100
je 0x4ca0b0
cmp eax, 0x13
je 0x4ca0b0
cmp eax, 0x20
je 0x4ca0b0
cmp eax, 0x16
jne 0x4ca178
mov eax, dword [ebp - 0xc]
mov edx, 0x4ca208
call fcn.00404b08
je 0x4ca123
mov eax, dword [ebp - 0xc]
mov edx, 0x4ca214
call fcn.00404b08
je 0x4ca123
push dword [ebp - 4]
push 0x4ca1ec
push dword [ebp - 0xc]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404a7c
mov eax, dword [ebp - 0x160]
call fcn.004c967c
test al, al
je 0x4ca123
push dword [ebp - 4]
push 0x4ca1ec
push dword [ebp - 0xc]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.00404a7c
mov edx, dword [ebp - 0x164]
mov ecx, dword [ebp - 8]
mov eax, esi
call fcn.004c9f60
push dword [ebp - 4]
push 0x4ca1ec
push dword [ebp - 0xc]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00404a7c
mov eax, dword [ebp - 0x168]
call fcn.004093e8
test al, al
je 0x4ca178
push dword [ebp - 4]
push 0x4ca1ec
push dword [ebp - 0xc]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00404a7c
mov edx, dword [ebp - 0x16c]
mov ecx, dword [ebp - 8]
mov eax, esi
call fcn.004c9bfc
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4c9ff6
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca1ce
lea eax, [ebp - 0x16c]
mov edx, 8
call fcn.00404720
lea eax, [ebp - 0xc]
call fcn.004046fc
lea eax, [ebp - 4]
call fcn.004046fc
ret
Function at 0x4ca218
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bac
xor eax, eax
push ebp
push 0x4ca29f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404794
xor eax, eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], 3
mov eax, dword [ebp - 8]
call fcn.00404bbc
mov dword [ebp - 0x1e], eax
xor eax, eax
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x450
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0x4ca2ac
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca2a6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404720
ret
Function at 0x4cb858
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404bac
xor eax, eax
push ebp
push 0x4cbabd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404bbc
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x154]
push eax
push 0x4cbad0
call sub.kernel32.dll_FindFirstFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x4cba89
mov eax, dword [0x4eba00]
mov eax, dword [eax]
call fcn.004809e8
mov ebx, dword [ebp - 0x154]
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.0040496c
mov eax, dword [ebp - 0x10]
mov edx, 0x4cbadc
call fcn.00404b08
je 0x4cba6e
mov eax, dword [ebp - 0x10]
mov edx, 0x4cbae8
call fcn.00404b08
je 0x4cba6e
cmp ebx, 0x10
je 0x4cb94d
cmp ebx, 2
je 0x4cb94d
cmp ebx, 4
je 0x4cb94d
cmp ebx, 0x80
je 0x4cb94d
cmp ebx, 0x100
je 0x4cb94d
cmp ebx, 0x20
je 0x4cb94d
cmp ebx, 0x11
je 0x4cb94d
cmp ebx, 0x12
je 0x4cb94d
cmp ebx, 0x13
je 0x4cb94d
cmp ebx, 0x14
jne 0x4cba6e
mov eax, dword [0x4eb718]
cmp byte [eax], 2
je 0x4cba89
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 0x10]
call fcn.00409534
mov edx, dword [ebp - 0x158]
mov ecx, dword [0x4ebc10]
mov ecx, dword [ecx]
mov eax, 0x4cbaf4
call fcn.004c9220
test al, al
jne 0x4cba6e
mov eax, esi
call fcn.004975dc
mov ebx, eax
mov edx, ebx
mov eax, esi
call fcn.004975f0
mov byte [eax + 0x12], 1
mov edx, ebx
mov eax, esi
call fcn.004975f0
mov byte [eax + 0xc], 1
mov edx, ebx
mov eax, esi
call fcn.004975f0
xor edx, edx
mov dword [eax + 0xe], edx
mov edx, ebx
mov eax, esi
call fcn.004975f0
add eax, 0x13
mov edx, 0x4cbb08
call fcn.00404750
mov edx, ebx
mov eax, esi
call fcn.004975f0
add eax, 0x17
mov edx, 0x4cbaf4
call fcn.00404750
mov edx, ebx
mov eax, esi
call fcn.004975f0
add eax, 0x1b
mov edx, 0x4cbb18
call fcn.00404750
mov edx, ebx
mov eax, esi
call fcn.004975f0
add eax, 0x1f
mov edx, 0x4cbaf4
call fcn.00404750
mov edx, ebx
mov eax, esi
call fcn.004975f0
add eax, 0x23
push eax
lea edx, [ebp - 0x15c]
mov eax, dword [ebp - 0x10]
call fcn.00409534
mov edx, dword [ebp - 0x15c]
pop eax
call fcn.00404750
push dword [ebp - 4]
push 0x4cbb30
push dword [ebp - 0x10]
mov edx, ebx
mov eax, esi
call fcn.004975f0
add eax, 0x2f
mov edx, 3
call fcn.00404a7c
inc dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004c8cf4
lea eax, [ebp - 0x154]
push eax
push edi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4cb8c6
push edi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbac4
lea eax, [ebp - 0x15c]
mov edx, 2
call fcn.00404720
lea eax, [ebp - 0x10]
call fcn.004046fc
lea eax, [ebp - 4]
call fcn.004046fc
ret
Function at 0x4cbb34
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cbbe3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c1b8]
call fcn.0043c2b8
mov dword [ebp - 4], eax
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0043c358
xor eax, eax
push ebp
push 0x4cbbc6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x4cbbfc
mov eax, dword [ebp - 4]
call fcn.0043c3c0
test al, al
je 0x4cbbb0
lea ecx, [ebp - 8]
mov edx, 0x4cbc48
mov eax, dword [ebp - 4]
call fcn.0043c93c
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004cb858
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbbcd
mov eax, dword [ebp - 4]
call fcn.004038e8
ret
Function at 0x4d2494
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d254b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c1b8]
call fcn.0043c2b8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d252e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0043c358
xor ecx, ecx
mov edx, 0x4d2564
mov eax, dword [ebp - 4]
call fcn.0043c3c0
test al, al
je 0x4d2518
lea ecx, [ebp - 8]
mov edx, 0x4d25b0
mov eax, dword [ebp - 4]
call fcn.0043c93c
cmp dword [ebp - 8], 0
je 0x4d2518
push edi
push 0
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004d1db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2535
mov eax, dword [ebp - 4]
call fcn.004038e8
ret

Function at 0x4d25b8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d266f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c1b8]
call fcn.0043c2b8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d2652
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0043c358
xor ecx, ecx
mov edx, 0x4d2688
mov eax, dword [ebp - 4]
call fcn.0043c3c0
test al, al
je 0x4d263c
lea ecx, [ebp - 8]
mov edx, 0x4d26d4
mov eax, dword [ebp - 4]
call fcn.0043c93c
cmp dword [ebp - 8], 0
je 0x4d263c
push edi
push 1
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004d1db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2659
mov eax, dword [ebp - 4]
call fcn.004038e8
ret
Function at 0x4d60a8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bac
mov eax, dword [ebp - 8]
call fcn.00404bac
lea esi, [ebp - 0x14c]
xor eax, eax
push ebp
push 0x4d625e
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
lea eax, [ebp - 0x150]
mov ecx, 0x4d6274
mov edx, dword [ebp - 4]
call fcn.00404a08
mov eax, dword [ebp - 0x150]
call fcn.00404bbc
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
setne al
jmp 0x4d6225
mov eax, dword [0x4eb718]
cmp byte [eax], 2
je 0x4d622d
mov eax, dword [0x4eba00]
mov eax, dword [eax]
call fcn.004809e8
lea eax, [ebp - 0xc]
lea edx, [esi + 0x2c]
mov ecx, 0x104
call fcn.0040496c
mov eax, dword [esi]
cmp eax, 0x10
je 0x4d617e
cmp eax, 2
je 0x4d617e
cmp eax, 4
je 0x4d617e
cmp eax, 0x80
je 0x4d617e
cmp eax, 0x100
je 0x4d617e
cmp eax, 0x13
je 0x4d617e
cmp eax, 0x20
je 0x4d617e
cmp eax, 0x16
jne 0x4d61ef
mov eax, dword [ebp - 0xc]
mov edx, 0x4d6284
call fcn.00404b08
je 0x4d61ef
mov eax, dword [ebp - 0xc]
mov edx, 0x4d6290
call fcn.00404b08
je 0x4d61ef
push dword [ebp - 4]
push 0x4d629c
push dword [ebp - 0xc]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00404a7c
mov eax, dword [ebp - 0x154]
call fcn.004093f8
test al, al
je 0x4d61ef
push dword [ebp - 4]
push 0x4d629c
push dword [ebp - 0xc]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404a7c
mov eax, dword [ebp - 0x158]
mov edx, dword [ebp - 8]
call fcn.004d60a8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404b08
jne 0x4d6218
push dword [ebp - 4]
push 0x4d629c
push dword [ebp - 0xc]
mov eax, 0x4ed274
mov edx, 3
call fcn.00404a7c
jmp 0x4d6233
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4d6126
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6265
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404720
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404720
ret