joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b73bc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040544c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4b740b
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405614
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b7410
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
pop ebx
ret

Function at 0x4c242c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4c243e
add esp, 0xfffffff0
call fcn.0040418c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00405a6c
lea eax, [ebp + 0x3c]
call fcn.00405a6c
lea eax, [ebp + 0x38]
call fcn.00405a6c
lea eax, [ebp + 0x34]
call fcn.00405a6c
lea eax, [ebp + 0x30]
call fcn.00405a6c
lea eax, [ebp + 0x2c]
call fcn.00405a6c
lea eax, [ebp + 0x28]
call fcn.00405a6c
lea eax, [ebp + 0x24]
call fcn.00405a6c
lea eax, [ebp + 0x20]
call fcn.00405a6c
lea eax, [ebp + 0x1c]
call fcn.00405a6c
lea eax, [ebp + 0x18]
call fcn.00405a6c
lea eax, [ebp + 0x14]
call fcn.00405a6c
lea eax, [ebp + 0x10]
call fcn.00405a6c
lea eax, [ebp + 0xc]
call fcn.00405a6c
lea eax, [ebp + 8]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x4c25ba
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403de4
lea eax, [esi + 8]
mov edx, dword [ebp - 4]
call fcn.00405488
lea eax, [esi + 0xc]
mov edx, dword [ebp + 0x3c]
call fcn.00405488
lea eax, [esi + 0x10]
mov edx, dword [ebp + 0x38]
call fcn.00405488
lea eax, [esi + 0x14]
mov edx, dword [ebp + 0x34]
call fcn.00405488
lea eax, [esi + 0x18]
mov edx, dword [ebp + 0x30]
call fcn.00405488
lea eax, [esi + 0x1c]
mov edx, dword [ebp + 0x2c]
call fcn.00405488
lea eax, [esi + 0x20]
mov edx, dword [ebp + 0x28]
call fcn.00405488
lea eax, [esi + 0x24]
mov edx, dword [ebp + 0x24]
call fcn.00405488
lea eax, [esi + 0x28]
mov edx, dword [ebp + 0x20]
call fcn.00405488
lea eax, [esi + 0x2c]
mov edx, dword [ebp + 0x1c]
call fcn.00405488
lea eax, [esi + 0x30]
mov edx, dword [ebp + 0x18]
call fcn.00405488
lea eax, [esi + 0x34]
mov edx, dword [ebp + 0x14]
call fcn.00405488
lea eax, [esi + 0x38]
mov edx, dword [ebp + 0x10]
call fcn.00405488
lea eax, [esi + 0x3c]
mov edx, dword [ebp + 0xc]
call fcn.00405488
lea eax, [esi + 0x40]
mov edx, dword [ebp + 8]
call fcn.00405488
mov dl, 1
mov eax, dword [0x4bec68]
call fcn.00437b20
mov dword [esi + 0x44], eax
mov dl, 1
mov eax, dword [0x4be9d8]
call fcn.00437b20
mov dword [esi + 0x48], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c25c1
lea eax, [ebp - 4]
call fcn.0040544c
lea eax, [ebp + 8]
mov edx, 0xe
call fcn.00405464
ret
Function at 0x4c25e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4c25e9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
test dl, dl
je 0x4c2602
add esp, 0xfffffff0
call fcn.0040418c
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c2789
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 4]
call fcn.004c0418
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 8]
call fcn.004c0418
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0xc]
call fcn.004c0418
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x10]
call fcn.004c0418
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x14]
call fcn.004c0418
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x18]
call fcn.004c0418
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x1c]
call fcn.004c0418
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x20]
call fcn.004c0418
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebx + 0x24]
call fcn.004c0418
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebx + 0x28]
call fcn.004c0418
mov eax, dword [ebp - 0x30]
push eax
lea edx, [ebp - 0x34]
mov eax, dword [ebx + 0x2c]
call fcn.004c0418
mov eax, dword [ebp - 0x34]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [ebx + 0x30]
call fcn.004c0418
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x3c]
mov eax, dword [ebx + 0x34]
call fcn.004c0418
mov eax, dword [ebp - 0x3c]
push eax
lea edx, [ebp - 0x40]
mov eax, dword [ebx + 0x38]
call fcn.004c0418
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, dword [ebx]
call fcn.004c0418
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004c242c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
test ebx, ebx
je 0x4c276e
mov esi, dword [ebx + 0x3c]
dec esi
test esi, esi
jl 0x4c273b
inc esi
xor edi, edi
imul ecx, edi, 0x1c
add ecx, dword [ebx + 0x40]
mov dl, 1
mov eax, dword [0x4beba4]
call fcn.004c1fc0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call fcn.004c2424
inc edi
dec esi
jne 0x4c2718
mov esi, dword [ebx + 0x44]
dec esi
test esi, esi
jl 0x4c276e
inc esi
xor edi, edi
mov ecx, edi
shl ecx, 3
lea ecx, [ecx + ecx*2]
add ecx, dword [ebx + 0x48]
mov dl, 1
mov eax, dword [0x4be8fc]
call fcn.004c16b8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
call fcn.004c1adc
inc edi
dec esi
jne 0x4c2746
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2790
lea eax, [ebp - 0x44]
mov edx, 0xf
call fcn.00405464
ret
Function at 0x4c5814
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4c5826
add esp, 0xfffffff0
call fcn.0040418c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00405a6c
lea eax, [ebp + 0x34]
call fcn.00405a6c
lea eax, [ebp + 0x2c]
call fcn.00405a6c
lea eax, [ebp + 0x28]
call fcn.00405a6c
lea eax, [ebp + 0x24]
call fcn.00405a6c
lea eax, [ebp + 0x20]
call fcn.00405a6c
lea eax, [ebp + 0x10]
call fcn.00405a6c
lea eax, [ebp + 8]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x4c5944
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403de4
lea eax, [esi + 8]
mov edx, dword [ebp - 4]
call fcn.00405488
lea eax, [esi + 0xc]
mov edx, dword [ebp + 0x34]
call fcn.00405488
mov eax, dword [ebp + 0x30]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x14]
mov edx, dword [ebp + 0x2c]
call fcn.00405488
lea eax, [esi + 0x18]
mov edx, dword [ebp + 0x28]
call fcn.00405488
lea eax, [esi + 0x1c]
mov edx, dword [ebp + 0x24]
call fcn.00405488
lea eax, [esi + 0x20]
mov edx, dword [ebp + 0x20]
call fcn.00405488
mov al, byte [ebp + 0x1c]
mov byte [esi + 0x24], al
mov al, byte [ebp + 0x18]
mov byte [esi + 0x25], al
mov al, byte [ebp + 0x14]
mov byte [esi + 0x26], al
lea eax, [esi + 0x28]
mov edx, dword [ebp + 0x10]
call fcn.00405488
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x30]
mov edx, dword [ebp + 8]
call fcn.00405488
mov dl, 1
mov eax, dword [0x49dc10]
call fcn.0049ee4c
mov dword [esi + 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c594b
lea eax, [ebp - 4]
call fcn.0040544c
lea eax, [ebp + 8]
call fcn.0040544c
lea eax, [ebp + 0x10]
call fcn.0040544c
lea eax, [ebp + 0x20]
mov edx, 4
call fcn.00405464
lea eax, [ebp + 0x34]
call fcn.0040544c
ret
Function at 0x4c596c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4c5975
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
test dl, dl
je 0x4c598f
add esp, 0xfffffff0
call fcn.0040418c
mov ebx, ecx
mov byte [ebp - 1], dl
mov edi, eax
xor eax, eax
push ebp
push 0x4c5aa2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 4]
call fcn.004c0418
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0xc]
call fcn.004c0418
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
call fcn.004c0418
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x1c]
call fcn.004c0418
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x20]
call fcn.004c0418
mov eax, dword [ebp - 0x1c]
push eax
mov al, byte [ebx + 0x24]
push eax
mov al, byte [ebx + 0x25]
push eax
mov al, byte [ebx + 0x26]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x28]
call fcn.004c0418
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x30]
call fcn.004c0418
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebx]
call fcn.004c0418
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, edi
call fcn.004c5814
xor eax, eax
mov dword [edi + 4], eax
test ebx, ebx
je 0x4c5a7f
mov esi, dword [ebx + 0x14]
dec esi
test esi, esi
jl 0x4c5a7f
inc esi
mov dword [ebp - 8], 0
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
shl edx, 2
add edx, dword [ebx + 0x18]
mov edx, dword [edx]
call fcn.00404e88
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040710c
mov edx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x34]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 8]
dec esi
jne 0x4c5a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5aa9
lea eax, [ebp - 0x30]
call fcn.00404c80
lea eax, [ebp - 0x2c]
mov edx, 9
call fcn.00405464
ret
Function at 0x4c9e18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c9f82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c6380]
cmp byte [eax], 0
jne 0x4c9e73
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404f18
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.00447860
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405630
jmp 0x4c9f5a
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.004056ac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4c9ea5
mov eax, esi
call fcn.0040544c
jmp 0x4c9f5a
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x4c9edc
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x5c64e0]
call fcn.00407200
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x447230]
call fcn.0040ee48
call fcn.004045f4
cmp dword [ebp - 8], 1
jne 0x4c9ee9
mov dword [ebp - 8], 2
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, esi
call fcn.00405a24
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.004056ac
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.004056ac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4c9f4a
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x5c68dc]
call fcn.00407200
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x447230]
call fcn.0040ee48
call fcn.004045f4
mov eax, dword [esi]
call fcn.004056ac
mov edx, eax
mov eax, esi
call fcn.004055b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9f89
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404ca4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404ca4
ret
Function at 0x4c9f90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4ca09a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c6380]
cmp byte [eax], 0
jne 0x4ca01b
cmp dword [ebp - 4], 1
jne 0x4c9ff6
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404f18
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00404f18
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.00447808
jmp 0x4ca077
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00404f18
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404f18
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.00447834
jmp 0x4ca077
mov eax, esi
call fcn.004056bc
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.004056ac
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.004056ac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4ca077
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x5c65f4]
call fcn.00407200
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x447230]
call fcn.0040ee48
call fcn.004045f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca0a1
lea eax, [ebp - 0x20]
call fcn.00404c80
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404ca4
ret

Function at 0x4d1130
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5c807c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4d1152
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d1154
shr eax, 1
dec edx
jne 0x4d1140
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d1139
mov byte [0x5c847c], 1
pop esi
pop ebx
ret

Function at 0x4d1170
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5c847c], 0
jne 0x4d1187
call fcn.004d1130
mov eax, edi
dec eax
test eax, eax
jl 0x4d11b0
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5c807c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d1191
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4d3784
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4d37b5
dec al
je 0x4d37f1
dec al
je 0x4d3835
dec al
je 0x4d38a0
jmp 0x4d392a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d392a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d37c5
jmp 0x4d392a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d392a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d3801
jmp 0x4d392a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d392a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d3863
xor ebp, ebp
jmp 0x4d3874
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d387d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d3845
jmp 0x4d392a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d392a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d38f8
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d11b8
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d38b4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d7cb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405a6c
lea eax, [ebp - 8]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x4d7e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004057d8
je 0x4d7d12
mov eax, dword [ebp - 8]
call fcn.004056ac
mov dword [ebp - 0xc], eax
jmp 0x4d7d17
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.004035f8
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
test bl, bl
je 0x4d7d40
mov word [ebp - 0x20], 5
jmp 0x4d7d46
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4d7ded
push dword [ebp - 4]
push 0x4d7e74
push 0x4d7e84
push 0x4d7ed4
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x70]
call fcn.0040a510
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
call fcn.00405630
push dword [ebp - 0x6c]
push 0x4d7ef4
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x78]
call fcn.0040e478
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
call fcn.00405630
push dword [ebp - 0x74]
lea eax, [ebp - 0x68]
mov edx, 7
call fcn.00405790
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
call fcn.00404f18
mov ecx, dword [ebp - 0x64]
mov dl, 1
mov eax, dword [0x408c9c]
call fcn.0040ee0c
call fcn.004045f4
cmp byte [ebp + 8], 0
je 0x4d7e18
jmp 0x4d7e01
mov eax, dword [0x5c66a8]
mov eax, dword [eax]
call fcn.00494340
push 0
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4d7df5
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7e67
lea eax, [ebp - 0x78]
call fcn.00404c80
lea eax, [ebp - 0x74]
call fcn.0040544c
lea eax, [ebp - 0x70]
call fcn.00404c80
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00405464
lea eax, [ebp - 0x64]
call fcn.00404c80
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405464
ret

Function at 0x4d8388
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d8413
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404f00
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0040fb50
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.00405630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d841a
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404ca4
ret
Function at 0x4d8420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d84ab
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404f00
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0040fb50
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.00405630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d84b2
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404ca4
ret

Function at 0x4d84b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d8550
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
je 0x4d84ff
mov ecx, 0x4d8568
mov dl, 1
mov eax, dword [0x408e10]
call fcn.0040ee0c
call fcn.004045f4
jmp 0x4d853a
lea eax, [ebp - 8]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, esi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405614
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8557
lea eax, [ebp - 4]
call fcn.00406d20
ret

Function at 0x4d86b4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d8748
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 0x1a
call fcn.004d84b8
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004057d8
jne 0x4d8705
push 0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4d8758
mov edx, 0x4d876c
mov eax, 0x80000001
call fcn.004d822c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404f18
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040fb50
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d874f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ca4
lea eax, [ebp - 4]
call fcn.0040544c
ret