joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457b38
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004573a8
xor eax, eax
push ebp
push 0x457ca9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x457c93
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x457b83
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x457b8d
call fcn.00404048
jmp 0x457cb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bac0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x457c88
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x457c3b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x457c28
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403960
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00457af0
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x457cbc]
cmp dl, byte [eax + 0x28]
je 0x457c8f
call fcn.0040c838
jmp 0x457c8f
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bae0
jmp 0x457c8f
cmp ecx, ebx
jge 0x457c57
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bae0
jmp 0x457b8d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bac0
cmp edx, dword [esp + 4]
jne 0x457c77
cmp eax, dword [esp]
pop edx
pop eax
jne 0x457b8d
push ebp
call fcn.00457af0
pop ecx
jmp 0x457c8f
push ebp
call fcn.00457af0
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457cb0
mov eax, dword [ebp - 4]
call fcn.004573b4
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457cc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457de2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004573a8
xor eax, eax
push ebp
push 0x457dc5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x457d10
call fcn.00404048
jmp 0x457dcc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x457daf
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x457daf
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403960
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x457daf
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c02c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x457dfc
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x48b7d0]
mov dl, 1
mov eax, dword [0x456194]
call fcn.0040c950
call fcn.00403f9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457dcc
mov eax, dword [ebp - 4]
call fcn.004573b4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457de9
lea eax, [ebp - 0x28]
call fcn.00404620
ret
Function at 0x457e48
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457f92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004573a8
xor eax, eax
push ebp
push 0x457f75
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x457ead
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x457ead
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x457f5f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x457ec0
call fcn.00404048
jmp 0x457f7c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x457f5f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x457f5f
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403960
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x457f5f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c02c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x457fac
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x48b7d0]
mov dl, 1
mov eax, dword [0x456194]
call fcn.0040c950
call fcn.00403f9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457f7c
mov eax, dword [ebp - 4]
call fcn.004573b4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457f99
lea eax, [ebp - 0x28]
call fcn.00404620
ret
Function at 0x459974
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe44
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459a80
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
lea eax, [ebp - 8]
mov edx, 0xff
call fcn.00404c7c
push 0xff
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 8]
call fcn.00404af0
call fcn.004096dc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404c7c
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x1bc], eax
mov byte [ebp - 0x1b8], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 0x1b0], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x1ac], eax
mov byte [ebp - 0x1a8], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 0x1a0], 0
lea edx, [ebp - 0x1bc]
mov ecx, 3
mov eax, 0x459a98
call fcn.00409db8
call sub.wsock32.dll_WSACleanup
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459a87
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404644
ret

Function at 0x459b88
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004048a0
mov eax, dword [ebx]
call fcn.004048f0
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x459bc6
mov eax, ebx
mov edx, 0x459bd8
call fcn.004048f8
add esp, 0x108
pop ebx
ret

Function at 0x459e34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x459ead
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00415c8c
test al, al
je 0x459e90
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00459d70
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00459bdc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404674
lea eax, [ebp - 4]
call fcn.00459db8
jmp 0x459e97
mov eax, ebx
call fcn.00404620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459eb4
lea eax, [ebp - 8]
call fcn.00404620
ret

Function at 0x463cdc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x463d14]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x463cf2
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x463d01
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x463d10
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x4644e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4645a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x464527
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.00402954
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x46457e
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.00418aa8
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x46457e
lea edx, [ebp - 4]
mov eax, dword [0x48b654]
call fcn.004066ac
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004643f4
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4645a9
lea eax, [ebp - 4]
call fcn.00404620
ret

Function at 0x4657f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x104], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46586e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
push 0x1004
push esi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x465855
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004048a0
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00408dfc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465875
lea eax, [ebp - 0x104]
call fcn.00404620
ret
Function at 0x478f70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x479054
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004046b8
lea eax, [ebp - 8]
call fcn.00404b40
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47903e
mov eax, ebx
call fcn.0040274c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x479037
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x479021
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x479068
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x479021
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47903e
mov eax, dword [ebp - 0x10]
call fcn.0040276c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47905b
lea eax, [ebp - 8]
call fcn.00404620
ret
Function at 0x479448
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33
push 0
push 0
dec ecx
jne 0x479450
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0x16c]
mov edx, dword [0x407b78]
call fcn.004051f0
xor eax, eax
push ebp
push 0x4796e7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0047906c
xor ebx, ebx
lea eax, [ebp - 0x170]
call fcn.00459d1c
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 4]
mov ecx, 0x4796fc
call fcn.0040493c
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00478f70
test al, al
je 0x4794ef
lea edx, [ebp - 0x174]
xor eax, eax
call fcn.00402ae0
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00478f70
test al, al
je 0x4794f1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jle 0x4794eb
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x4794f1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jg 0x4794f1
mov bl, 1
jmp 0x4794f1
mov bl, 1
test bl, bl
je 0x479661
lea eax, [ebp - 0x178]
call fcn.004598e0
lea eax, [ebp - 0x178]
mov edx, 0x479710
call fcn.004048f8
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x16c]
mov edx, 0x3f
call fcn.004093c4
test eax, eax
jne 0x479661
mov eax, dword [ebp - 0x164]
and eax, 0x10
cmp eax, 0x10
je 0x47964e
lea eax, [ebp - 0x17c]
call fcn.00459d1c
lea eax, [ebp - 0x17c]
mov edx, dword [ebp - 0x160]
call fcn.004048f8
mov eax, dword [ebp - 0x17c]
xor edx, edx
call fcn.00409318
xor ebx, ebx
push 0
lea eax, [ebp - 0x180]
call fcn.00459d1c
lea eax, [ebp - 0x180]
mov edx, dword [ebp - 0x160]
call fcn.004048f8
mov eax, dword [ebp - 0x180]
call fcn.00404af0
push eax
lea eax, [ebp - 0x184]
call fcn.004598e0
lea eax, [ebp - 0x184]
mov edx, dword [ebp - 0x160]
call fcn.004048f8
mov eax, dword [ebp - 0x184]
call fcn.00404af0
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x479611
push 0x479724
push dword [ebp - 0x160]
push 0x479738
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18c]
call fcn.00408d70
push dword [ebp - 0x18c]
lea eax, [ebp - 0x188]
mov edx, 4
call fcn.004049b0
mov eax, dword [ebp - 0x188]
call fcn.00455878
jmp 0x479634
lea eax, [ebp - 0x190]
mov ecx, dword [ebp - 0x160]
mov edx, 0x47974c
call fcn.0040493c
mov eax, dword [ebp - 0x190]
call fcn.00455878
jmp 0x47964e
inc ebx
cmp ebx, 0xa
jg 0x47964e
call fcn.0047906c
mov eax, 0xa
call fcn.0045a968
jmp 0x47956f
lea eax, [ebp - 0x16c]
call fcn.00409414
test eax, eax
je 0x479532
push 5
lea eax, [ebp - 0x194]
mov ecx, 0x479764
mov edx, dword [ebp - 4]
call fcn.0040493c
mov eax, dword [ebp - 0x194]
call fcn.00404af0
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x4796a9
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x198]
call fcn.0040c02c
mov eax, dword [ebp - 0x198]
xor edx, edx
call fcn.00474458
mov eax, esi
call fcn.00477da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4796ee
lea eax, [ebp - 0x198]
mov edx, 0xb
call fcn.00404644
lea eax, [ebp - 0x16c]
mov edx, dword [0x407b78]
call fcn.004052b4
lea eax, [ebp - 4]
call fcn.00404620
ret
Function at 0x479770
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov ebx, eax
lea eax, [ebp - 0x158]
mov edx, dword [0x407b78]
call fcn.004051f0
xor eax, eax
push ebp
push 0x4798a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x48d0f0]
call fcn.00477b04
test al, al
je 0x4797c2
call fcn.0047906c
lea eax, [ebp - 0x15c]
call fcn.00459d1c
lea eax, [ebp - 0x15c]
mov edx, 0x4798c0
call fcn.004048f8
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
mov edx, 0x3f
call fcn.004093c4
test eax, eax
jne 0x47986a
mov eax, dword [ebp - 0x150]
and eax, 0x10
cmp eax, 0x10
je 0x47985b
lea eax, [ebp - 0x160]
call fcn.00459d1c
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0x14c]
call fcn.004048f8
mov eax, dword [ebp - 0x160]
xor edx, edx
call fcn.00409318
lea eax, [ebp - 0x164]
call fcn.00459d1c
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 0x14c]
call fcn.004048f8
mov eax, dword [ebp - 0x164]
call fcn.00404af0
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x158]
call fcn.00409414
test eax, eax
je 0x4797f7
xor edx, edx
mov eax, ebx
call fcn.00479980
mov eax, ebx
call fcn.00477da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4798b0
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.00404644
lea eax, [ebp - 0x158]
mov edx, dword [0x407b78]
call fcn.004052b4
ret

Function at 0x47abc0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403054
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x47b804
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b877
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.004098c8
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0040d5c0
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.00404674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b87e
lea eax, [ebp - 0x104]
call fcn.00404620
ret
Function at 0x47b884
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47b88c
push ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ae0
mov eax, dword [ebp - 8]
call fcn.00404ae0
xor eax, eax
push ebp
push 0x47baac
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.004091c0
test al, al
je 0x47ba91
mov eax, dword [ebp - 8]
call fcn.004091c0
test al, al
je 0x47b8e6
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.004092f0
jmp 0x47b939
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004095a4
mov eax, dword [ebp - 0x10]
call fcn.004091d0
test al, al
jne 0x47b939
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004095a4
mov eax, dword [ebp - 0x14]
call fcn.004091f4
test al, al
jne 0x47b91b
xor ebx, ebx
jmp 0x47ba91
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004095a4
mov eax, dword [ebp - 0x18]
call fcn.004091d0
test al, al
jne 0x47b939
xor ebx, ebx
jmp 0x47ba91
push 0
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
mov eax, dword [ebp - 4]
call fcn.00404af0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 8]
call fcn.004091c0
test al, al
je 0x47b98d
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0047b680
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0047b680
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00404a3c
jne 0x47b98d
mov ebx, 1
jmp 0x47ba91
lea eax, [ebp - 0xc]
mov ecx, 0x47bac4
mov edx, dword [ebp - 8]
call fcn.0040493c
mov eax, dword [ebp - 0xc]
call fcn.004091c0
test al, al
je 0x47b9be
mov edx, 0x20
mov eax, dword [ebp - 0xc]
call fcn.004092f0
mov eax, dword [ebp - 0xc]
call fcn.00409454
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040946c
push 0
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
mov eax, dword [ebp - 4]
call fcn.00404af0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 8]
call fcn.004091c0
test al, al
je 0x47ba1a
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0047b680
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
call fcn.0047b680
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00404a3c
jne 0x47ba1a
mov ebx, 2
jmp 0x47ba91
call fcn.0047b7d4
test al, al
je 0x47ba64
lea eax, [ebp - 0x2c]
call fcn.0047b804
lea eax, [ebp - 0x2c]
mov edx, 0x47bad4
call fcn.004048f8
mov eax, dword [ebp - 0x2c]
call fcn.00404af0
push eax
mov eax, dword [ebp - 4]
call fcn.00404af0
push eax
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
push 0x47bae0
call sub.kernel32.dll_WritePrivateProfileStringA
mov ebx, 2
jmp 0x47ba91
push 5
mov eax, dword [ebp - 8]
call fcn.00404af0
push eax
mov eax, dword [ebp - 4]
call fcn.00404af0
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb eax, eax
inc eax
xor ecx, ecx
mov edx, 2
call fcn.00429060
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bab3
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00404644
ret
Function at 0x487464
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push ecx
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x4874ac
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x487494
xor ecx, ecx
mov edx, edi
mov eax, esi
call fcn.00474e28
jmp 0x4874a4
call sub.kernel32.dll_GetLastError_1
mov ecx, eax
mov edx, edi
mov eax, esi
call fcn.00474cf4
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x4874bc
call sub.kernel32.dll_GetLastError_1
mov ecx, eax
mov edx, edi
mov eax, esi
call fcn.00474cf4
pop edi
pop esi
pop ebx
ret
Function at 0x403590
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x4035a4
inc dword [0x4c9678]
add dword [0x4c590c], 0x110
mov edx, dword [0x4c590c]
push esi
push edi
mov ecx, 0x44
mov esi, 0x4c8138
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x4035d3
push 0
mov eax, 0x4cb680
call fcn.004165f0
cmp dword [0x4c96a4], 0
mov dword [0x4cc150], 0
mov dword [0x4cc154], 0
je 0x4035fb
push 0x4c9d10
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40367f
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x40362a
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x40362a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4cc15c], 0
je 0x40363c
cmp dword [0x4cc158], 0
jne 0x403645
cmp byte [esi + 0xee], 0
je 0x40367f
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x40367f
cmp dword [0x4cc15c], 0
jge 0x403667
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x4cc15c]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret