joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a20
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x24
call fcn.00401e80
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40192d
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp], 0xffffffff
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x401b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401b96
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401c2a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401be5
cmp eax, 0x40
je 0x401be5
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401b89
cmp eax, 0x40
je 0x401b89
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x401b89
mov dword [esp + 8], 0x34
mov dword [esp + 4], 0x404054
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x1007dcb9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1007dcc7
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
mov eax, dword [ebp + 8]
push esi
push edi
not eax
mov ecx, 0xff
jb 0x1007dda9
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
and esi, ecx
xor esi, ebx
mov ebx, eax
mov eax, dword [esi*4 + 0x1008ac60]
shr ebx, 8
xor eax, ebx
movzx ebx, byte [edx + 1]
mov esi, eax
and esi, ecx
xor esi, ebx
mov esi, dword [esi*4 + 0x1008ac60]
shr eax, 8
xor esi, eax
inc edx
movzx ebx, byte [edx + 1]
mov eax, esi
and eax, ecx
xor eax, ebx
mov eax, dword [eax*4 + 0x1008ac60]
shr esi, 8
xor eax, esi
inc edx
movzx ebx, byte [edx + 1]
mov esi, eax
and esi, ecx
xor esi, ebx
mov esi, dword [esi*4 + 0x1008ac60]
shr eax, 8
xor esi, eax
inc edx
movzx ebx, byte [edx + 1]
mov eax, esi
and eax, ecx
xor eax, ebx
mov eax, dword [eax*4 + 0x1008ac60]
shr esi, 8
xor eax, esi
inc edx
movzx ebx, byte [edx + 1]
mov esi, eax
and esi, ecx
xor esi, ebx
mov esi, dword [esi*4 + 0x1008ac60]
inc edx
movzx ebx, byte [edx + 1]
shr eax, 8
xor esi, eax
sub dword [ebp + 0x10], 8
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
mov eax, dword [eax*4 + 0x1008ac60]
movzx ebx, byte [edx + 1]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
mov esi, dword [esi*4 + 0x1008ac60]
shr eax, 8
xor eax, esi
inc edx
dec edi
jne 0x1007dce4
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1007ddca
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
mov esi, dword [esi*4 + 0x1008ac60]
shr eax, 8
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1007ddaf
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1bcb60ef
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5e092e4a
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x9f3aba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp], eax
mov byte [esp + 4], 0xff
lea esp, [esp + 0x30]
jmp 0x9f5fdc

Function at 0x9f3bfd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
std
cmp sp, 0xd0d0
push dword [esp + 0x4c]
popfd
mov byte [esp + 8], 0x23
mov dword [esp], ebx
lea esp, [esp + 0x50]
jmp 0x9f5fdc

Function at 0x9f479f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], 0x48
pushal
lea esp, [esp + 0x24]
ja 0x9f5fdc
aam 0xec
mov edx, esp
cwde
bts ax, sp
lea ecx, [edi + 0x40]
rol di, 0xf
cmc
bt bp, bp
dec eax
sub ecx, edx
movzx di, bl
test al, bl
clc
lea eax, [ebp - 0x80]
not edi
and di, 0x3610
rol di, cl
neg di
and al, 0xfc
stc
inc di
and edi, 0x69a95eaf
btr di, di
sub eax, ecx
push 0x466dc154
lea edi, [esp - 0xc8c2dd4]
call fcn.009f4ce0

Function at 0x9f4b2d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x3c]
pop dword [ebp]
mov byte [esp + 4], bl
pushfd
lea esp, [esp + 0x44]
jmp 0x9f5243

Function at 0x9f5376
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rep movsb byte es:[edi], byte [esi]
shld si, si, 0xf
rcr edi, cl
bt dx, bx
movsx si, cl
mov edi, dword [esp + 0x28]
not si
mov esi, dword [esp + 0x2c]
mov word [esp], 0xeb08
push dword [esp + 0x30]
popfd
push dword [esp]
lea esp, [esp + 0x38]
jmp 0x9f5fdc

Function at 0x9f63fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebp, dword [ebp - 4]
mov dword [esp], esp
mov dword [ebp], eax
pushfd
mov byte [esp + 8], 0xab
pushfd
lea esp, [esp + 0x30]
jmp 0x9f5fdc
pushal
jmp 0x9f3ccb
Function at 0x100c82d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x7119aaa4
jmp 0x100c8a64
pop word [esp]
jmp 0x100c8326
mov eax, ecx
lea ecx, [ebx*4]
jmp 0x100c834a
mov eax, 0x344c570a
lea esp, [esp + 8]
not esi
mov cx, 0x9efb
btc cx, cx
jmp 0x100c8360
ror esi, 0
mov dh, byte [esp]
xchg dx, ax
mov dh, ch
mov ah, byte [esp]
jmp 0x100c8383
jb 0x100c8310
mov eax, ecx
lea ecx, [ebx*4]
jmp 0x100c834a
btr dx, si
js 0x100c83ee
bswap ecx
jmp 0x100c83f0
inc esi
mov eax, 0xb54cc452
rdtsc
mov ecx, 0xa722b7bb
mov ax, word [esp]
jmp 0x100c836d
ror al, 5
lea edx, [edx*4]
jmp 0x100c840b
bt edx, esi
jge 0x100c83b1
ror al, 5
lea edx, [edx*4]
mov dl, byte [esp]
mov ecx, dword [esp]
jmp 0x100c8411
bswap ecx
ror esi, 0
jmp 0x100c83c7
xchg edx, eax
lea edx, [esi + edi]
jmp 0x100c87b0
mov dl, byte [esp]
mov ecx, dword [esp]
rol esi, 0
jmp 0x100c8a4b
xor dl, al
jns 0x100c8511
lea edx, [ecx + edx]
mov dx, word [esp]
jmp 0x100c84a3
mov edx, esi
call fcn.100c8aad
dec ebp
retf
mov edx, esi
jmp fcn.100c84e5
lea edx, [ecx + edx]
mov dx, word [esp]
jmp 0x100c84b9
add esi, dword [ebp]
jmp 0x100c844e
jge 0x100c83f5
xchg edx, eax
lea edx, [esi + edi]
call fcn.100c8650
lea esp, [esp + 3]
jmp 0x100c820e
mov eax, dword [esp]
lea eax, [ebp + 0x9c]
mov eax, dword [esp]
bswap eax
jmp 0x100c8c9c
rol al, cl
push edx
ret
lea eax, [esp + 0x761a]
jmp 0x100c8ad8
mov esp, edi
neg eax
jns 0x100c8be6
lea eax, [esp + 0x761a]
rol al, cl
jmp 0x100c8ada
Function at 0x100ce0bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ebx, byte [edi]
lea edx, [ebp*4]
jmp 0x100ce09d
bsr edx, ecx
rdtsc
jmp 0x100ce086
lea eax, [ebp + ebp]
bswap eax
jmp 0x100ce0b3
btc edx, edi
jp 0x100ce07b
bsr edx, ecx
rdtsc
lea eax, [ebp + ebp]
bswap eax
jmp 0x100ce0b3
sub bl, cl
mov al, ch
call 0x100ce0bd
xor dword [ebp - 0x85306e], ecx
dec dword [eax + 0x35e82424]
add byte [eax], al
add byte [edx + esi*4], dh
and byte [edi - 0x4e], al
add al, 0x33
sub al, byte [ebp - 0xc]
Function at 0x100cea94
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb9b7c
jmp 0x100ceab4
pop word [esp]
mov byte [esp], ch
jmp 0x100cea4e
push esi
lea esp, [esp + 2]
mov dword [esp + 4], ebp
call fcn.100cea38
mov ecx, 0x23d0b121
nop
loopne 0x100cea87
pop edx
mov ch, 0x87
cmp al, 0x24
pushfd
jmp 0x100ce2d6
shr dword [esi], cl
lcall 0x9d5d, 0xaecb5bcd
or dword ds:[eax + 0x247c89cb], ebp
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x100cea7e
cpuid
jmp 0x100cebcf
sub esp, 0x1a
jo 0x100cea9e
cpuid
rdtsc
lea esp, [esp + 2]
jmp 0x100cebd5
rdtsc
lea esp, [esp + 2]

Function at 0x100d2ae1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x100d2c42
jmp 0x100d29e3
call 0x100d25c2
jmp 0x100d2a9a
pop ecx
jmp 0x100d2a03
sub ecx, 0x10018a15
mov dword [ecx + 0x10018e07], eax
movzx ebx, byte [eax]
jmp 0x100d2a63
cmp dword [esp + 4], 0
jne 0x100d2bd6
pushal
jmp 0x100d25bd
add ebx, 0xb4a2261d
cmp ebx, 0xb4a226e9
je 0x100d2acd
jne 0x100d24c5
call 0x100d2a89
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
sub eax, 0xe8
add cl, ch
mov bl, 0xc
add byte [eax], al
pushfd
out dx, eax
mul cl
and byte [eax + 0x2d], bl
pop ebx
cmp esi, dword [esi + edx*8]
pop eax
sub eax, 0xd6343b5b
jmp 0x100d2a77
outsd dx, dword [esi]
imul esp, dword [bp + di + 0x61], 0x6972446c
jbe 0x100d2b3d
push ebx
je 0x100d2b4d
imul ebp, dword [esi + 0x67], 0xeb005773
mov edi, 0xe8
add cl, ch
dec esp
or eax, 0xe8490000
or ebp, dword [eax]
add byte [eax], al
add byte [ebp + edx*2 + 0x424648d], bl
jmp 0x100d2a3e
mov dword [esp + 0x24], eax
jmp 0x100d396e
inc dword [esp + 8]
popfd
ret
jmp 0x100d2b83
popal
popfd
ret
popal
jmp 0x100d3a3c
inc dword [esp + 8]
popfd
ret
Function at 0x100d679a
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x100bcb2b
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x100bcb45
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x100bcb34
pop esi
jmp 0x100bcb50
ret 4
jmp 0x100bcb1e
jmp 0x100d6784

Function at 0x100f18c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cdq
jge 0x100f1853
jp 0x100f1858
invalid
xchg ecx, eax
mov ah, ch
mov ecx, esi
jmp 0x100f190e
push word [esp + 3]
lea esp, [esp + 2]
lea esp, [esp + 4]
and al, 4
jb 0x100f15bd
jae 0x100f18af
inc ecx
rcl byte [esi + 0x31], 0xc0
ja 0x100f18da
jge 0x100f18d0
je 0x100f186c
xor ecx, esp
pop edi
cmpsb byte [esi], byte es:[edi]
ror dword [ebp - 0x387ed0c4], 1
sar bh, 0xff
dec dword [ecx - 0x5214a0e9]
lea esp, [esp + 4]
lea eax, [ebp - 0x40]
call fcn.100f192f
push ebp
rol byte [eax + 0x27], cl
rcl byte [ebx], cl
ror dword [edx - 0x1b], cl
adc al, 0x8d
dec esi
or byte [ebx - 0x2017dbfc], cl
invalid
lea ecx, [esi + 8]
mov eax, dword [esp]
call 0x100f18f8
push word [esp + 2]
mov word [esp + 2], ax
lea esp, [esp + 2]
jmp 0x100f1931
lea esp, [esp + 4]
call fcn.100d6634
mov ax, word [esp]
btr ax, dx
jmp 0x100f1b14
xor eax, eax
jmp fcn.100bb984

Function at 0x101a8029
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 0x15]
lea esp, [esp + 2]
mov bx, cx
mov ecx, dword [esp]
mov cx, word [esp]
jmp 0x101a8041
jmp 0x101a8010
xchg si, cx
mov ch, 0xeb
mov ecx, dword [esp]
mov ecx, dword [esp + 0x18]
bswap esi
jmp 0x101a806f
push ax
lea esi, [ecx - 0xd50]
lea esp, [esp + 2]
mov ebx, dword [esp + 0x14]
bswap ecx
mov cx, 0x5c86
jmp 0x101a802b
lea esi, [edx + edx]
call 0x101a8059
Function at 0x469b3c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
xor eax, eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x469cf5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x470e18], eax
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, 0x7eb2
call fcn.00402da8
add eax, 0x2c
mov dword [0x470e2c], eax
push 0xc9
lea eax, [ebp - 0xcd]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
call sub.KERNEL32.DLL_GetTickCount_1
lea eax, [ebp - 4]
mov dl, byte [ebp - 0xcd]
call fcn.00404344
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, 0xc
call fcn.00402da8
add eax, 4
mov dword [0x470e2c], eax
push dword [ebp - 4]
push 0x469d08
push dword [0x46f6d4]
push 0x469d24
lea eax, [ebp - 4]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 4]
call fcn.0040880c
test al, al
je 0x469ccf
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, dword [ebp - 4]
call fcn.004698b4
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, 0x4f28a
call fcn.00402da8
add eax, 0x348702
mov dword [0x470e2c], eax
cmp dword [0x470e18], 0
jle 0x469ccf
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, dword [ebp - 4]
call fcn.0040441c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004046bc
call sub.KERNEL32.DLL_GetTickCount_1
push 0
push dword [0x46f6d0]
push 0x469d30
push dword [0x46f6d4]
push 0x469d48
lea eax, [ebp - 0xd4]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 0xd4]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_WinExec
call sub.KERNEL32.DLL_GetTickCount_1
mov eax, 0xb
call fcn.00402da8
add eax, 2
mov dword [0x470e2c], eax
push 0
push dword [0x46f6d0]
push 0x469d30
push dword [0x46f6d4]
push 0x469d5c
lea eax, [ebp - 0xd8]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 0xd8]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_WinExec
call sub.KERNEL32.DLL_GetTickCount_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469cfc
lea eax, [ebp - 0xd8]
mov edx, 2
call fcn.00404180
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x469d6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404ac8
xor eax, eax
push ebp
push 0x469e90
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x257]
xor ecx, ecx
mov edx, 0xfb
call fcn.00402d88
push 0xffffffffffffffff
push 8
lea eax, [ebp - 0x257]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 4]
lea edx, [ebp - 0x257]
mov ecx, 0xfb
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, 0x469ea4
call fcn.00404424
lea eax, [ebp - 0x25c]
mov ecx, 0x469eb0
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00408894
test eax, eax
jne 0x469e4e
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x260]
call fcn.00408924
lea eax, [ebp - 0x15c]
call fcn.004088e4
mov dword [0x470e28], 0x392fa
test eax, eax
je 0x469e16
lea eax, [ebp - 0x15c]
call fcn.00408908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469e97
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00404180
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x469eb8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa3c
push ebx
xor edx, edx
mov dword [ebp - 0x5c0], edx
mov dword [ebp - 0x5c4], edx
mov dword [ebp - 0x5bc], edx
mov dword [ebp - 0x5b8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, dword [0x407368]
call fcn.00404ac8
xor eax, eax
push ebp
push 0x46a0d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040415c
lea edx, [ebp - 8]
mov eax, dword [0x46f784]
call fcn.004686c0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, 0x46a0e8
call fcn.00405ac0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x46a0f8
call fcn.00405ac0
push 0xffffffffffffffff
push 8
lea eax, [ebp - 0x267]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 4]
lea edx, [ebp - 0x267]
mov ecx, 0xfb
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, 0x46a110
call fcn.00404424
lea eax, [ebp - 0x5b8]
mov ecx, 0x46a11c
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x5b8]
lea ecx, [ebp - 0x16c]
mov edx, 0x3f
call fcn.00408894
test eax, eax
jne 0x46a077
lea eax, [ebp - 0x5bc]
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x5bc]
lea edx, [ebp - 0x5b2]
mov ecx, 0x20a
call fcn.00404f34
push 0
lea eax, [ebp - 0x5b2]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebp - 0x3a8]
push eax
push 0xfb
lea eax, [ebp - 0x267]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x267]
mov ecx, 0xfb
call fcn.004043cc
mov eax, dword [ebp - 0x14]
call fcn.004087fc
test al, al
je 0x46a064
lea edx, [ebp - 0x5c4]
mov eax, dword [ebp - 0x14]
call fcn.00408a28
mov eax, dword [ebp - 0x5c4]
lea edx, [ebp - 0x5c0]
call fcn.00408014
mov eax, dword [ebp - 0x5c0]
mov edx, 0x46a12c
call fcn.00404568
jne 0x46a064
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.004041b0
lea eax, [ebp - 0x16c]
call fcn.00408908
jmp 0x46a082
lea eax, [ebp - 0x16c]
call fcn.004088e4
test eax, eax
je 0x469fa3
lea eax, [ebp - 0x16c]
call fcn.00408908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a0e0
lea eax, [ebp - 0x5c4]
mov edx, 4
call fcn.00404180
lea eax, [ebp - 0x16c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 0x14]
call fcn.0040415c
lea eax, [ebp - 0x10]
call fcn.00405a7c
lea eax, [ebp - 0xc]
call fcn.00405a7c
lea eax, [ebp - 8]
call fcn.00405a7c
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46a134
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040460c
xor eax, eax
push ebp
push 0x46a1c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040415c
mov eax, dword [ebp - 4]
call fcn.0040441c
mov ebx, eax
test ebx, ebx
jbe 0x46a197
mov esi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
xor dl, 1
call fcn.00404344
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404424
inc esi
dec ebx
jne 0x46a176
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004041b0
mov dword [0x470e28], 0xc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a1cd
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404180
ret
Function at 0x46a1d4
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete file
Get common file path
Move file
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46a41b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0xc8
lea eax, [ebp - 0xd6]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 8]
lea edx, [ebp - 0xd6]
mov ecx, 0xc9
call fcn.004043cc
lea eax, [ebp - 8]
mov edx, dword [0x46f6a8]
call fcn.00404424
lea edx, [ebp - 0xe0]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.00408014
mov eax, dword [ebp - 0xdc]
push eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 8]
call fcn.00408014
mov edx, dword [ebp - 0xe4]
pop eax
call fcn.00404568
je 0x46a3f5
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
call fcn.004087fc
test al, al
jne 0x46a3f5
push 0x40
lea edx, [ebp - 0xe8]
xor eax, eax
call fcn.00402ad4
mov ecx, dword [ebp - 0xe8]
mov dl, 1
mov eax, dword [0x415468]
call fcn.004192a8
mov ebx, eax
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x415468]
call fcn.004192a8
mov esi, eax
push 0
push 0
mov eax, ebx
call fcn.00418e14
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 1
sbb edx, 0
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.00419090
call fcn.00402b34
mov eax, 0xc8
call fcn.00402da8
add al, 0xa
mov byte [ebp - 0xd], al
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, ebx
call fcn.00403390
mov eax, esi
call fcn.00403390
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [0x470e28], 0x421f16
push 7
mov eax, dword [ebp - 8]
call fcn.0040461c
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
call sub.KERNEL32.DLL_GetTickCount_1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46f6b4]
call fcn.0040461c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov eax, dword [0x46f6ac]
call fcn.0040441c
mov esi, eax
push esi
mov eax, dword [0x46f6ac]
call fcn.0040461c
push eax
push 1
push 0
push 0x46a42c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 4
push 0
lea edx, [ebp - 0xec]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0xec]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_MoveFileExA
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [0x470e28], 0xaa19
cmp dword [0x470e18], 0
jle 0x46a3ed
push 0
push 0x46a438
call sub.KERNEL32.DLL_WinExec
jmp 0x46a3f5
push 0
push ebx
call sub.KERNEL32.DLL_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a422
lea eax, [ebp - 0xec]
mov edx, 5
call fcn.00404180
lea eax, [ebp - 8]
call fcn.0040415c
ret
Function at 0x46a44c
Capabilities:
Create process on windows
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor eax, eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404ac8
xor eax, eax
push ebp
push 0x46a5b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0x22c]
call fcn.0040461c
push eax
call sub.KERNEL32.DLL_MoveFileExA
push 0xc8
lea eax, [ebp - 0x225]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 4]
lea edx, [ebp - 0x225]
mov ecx, 0xc9
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, 0x46a5c8
call fcn.00404424
lea eax, [ebp - 0x230]
mov ecx, 0x46a5d4
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00408894
lea eax, [ebp - 0x15c]
call fcn.004088e4
jmp 0x46a551
lea eax, [ebp - 0x238]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x238]
call fcn.0040461c
mov edx, eax
lea eax, [ebp - 0x234]
call fcn.00404354
mov eax, dword [ebp - 0x234]
call fcn.00408924
lea eax, [ebp - 0x15c]
call fcn.004088e4
test eax, eax
je 0x46a51a
push 0
push 0x46a5d8
call sub.KERNEL32.DLL_WinExec
mov dword [0x470e28], 0xde
mov byte [0x470c15], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a5bb
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00404180
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 4]
call fcn.0040415c
ret