joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4575dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x45760b
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x45768a
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00455e98
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x457658
mov cx, word [esp]
sub cx, si
jmp 0x45765a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x457641
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x457680
mov cx, word [esp]
sub cx, si
jmp 0x457682
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x457669
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4576e7
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004572b0
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4576d2
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4576e7
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4575e6
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45dc1c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x491be4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x45dc3e
shr eax, 1
xor eax, 0xedb88320
jmp 0x45dc40
shr eax, 1
dec edx
jne 0x45dc2c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x45dc25
mov byte [0x491fe4], 1
pop esi
pop ebx
ret

Function at 0x45dc5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x491fe4], 0
jne 0x45dc73
call fcn.0045dc1c
mov eax, edi
dec eax
test eax, eax
jl 0x45dc9c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x491be4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x45dc7d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4607b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4607e9
dec al
je 0x460825
dec al
je 0x460869
dec al
je 0x4608d4
jmp 0x46095e
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x46095e
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4607f9
jmp 0x46095e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46095e
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x460835
jmp 0x46095e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46095e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x460897
xor ebp, ebp
jmp 0x4608a8
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4608b1
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x460879
jmp 0x46095e
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46095e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x46092c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0045dca4
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4608e8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46806c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004208c0
cmp ebx, dword [ebp - 8]
jge 0x4680cf
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00420c84
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00420c84
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00420cb0
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x468095
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4680d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004208c0
cmp ebx, dword [ebp - 8]
jge 0x46813b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00420c84
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00420c84
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00420cb0
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x468101
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x478fa8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x478fb0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4791a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4791b8
mov eax, esi
call fcn.00476d38
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004049fc
lea ecx, [ebp - 0x10]
mov edx, 0x4791cc
mov eax, esi
call fcn.00476d38
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004049fc
lea ecx, [ebp - 0x14]
mov edx, 0x4791e4
mov eax, esi
call fcn.00476d38
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004049fc
lea ecx, [ebp - 0x18]
mov edx, 0x479200
mov eax, esi
call fcn.00476d38
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004049fc
lea ecx, [ebp - 0x1c]
mov edx, 0x47921c
mov eax, esi
call fcn.00476d38
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004049fc
lea ecx, [ebp - 0x24]
mov edx, 0x479234
mov eax, esi
call fcn.00476d38
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408b50
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408f44
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x47924c
mov eax, esi
call fcn.00476d38
mov eax, dword [ebp - 0x28]
call fcn.00475e50
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x47925c
mov eax, esi
call fcn.00476d38
mov eax, dword [ebp - 0x2c]
call fcn.00475e50
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x479274
mov eax, esi
call fcn.00476d38
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408f44
inc eax
je 0x479145
lea ecx, [ebp - 0x34]
mov edx, 0x479274
mov eax, esi
call fcn.00476d38
mov eax, dword [ebp - 0x34]
call fcn.00408f08
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a628
fstp qword [ebp - 0x3c]
wait
call fcn.0040a998
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x479160
lea ecx, [ebp - 0x40]
mov edx, 0x479274
mov eax, esi
call fcn.00476d38
mov eax, dword [ebp - 0x40]
call fcn.00475e50
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x479284
mov eax, esi
call fcn.00476d38
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004049fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4791a9
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004049cc
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004049cc
ret
Function at 0x485440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48549a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00485430
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004749c0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004745c0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4854a1
lea eax, [ebp - 4]
call fcn.004049a8
ret

Function at 0x488dc8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404e58
xor eax, eax
push ebp
push 0x488ec2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x488ed8
call fcn.004049fc
mov eax, dword [ebp - 4]
call fcn.004092b4
test al, al
je 0x488eac
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e68
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov eax, esi
call fcn.00402a88
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x488edc
push edi
call sub.version.dll_VerQueryValueA
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0x10]
shr eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebx + 0x10]
and eax, 0xffff
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebx + 0x14]
shr eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [ebx + 0x14]
and eax, 0xffff
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x488ee8
call fcn.00409d14
mov edx, esi
mov eax, edi
call fcn.00402ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488ec9
lea eax, [ebp - 4]
call fcn.004049a8
ret
Function at 0x48921c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4892d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00404c18
lea eax, [ebp - 0x114]
mov edx, 0x4892e8
call fcn.00404c70
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
call fcn.00405210
lea eax, [ebp - 0x118]
mov edx, dword [ebp - 4]
call fcn.00404c30
mov eax, dword [ebp - 0x118]
call fcn.004093e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4892db
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.004049cc
lea eax, [ebp - 4]
call fcn.004050c4
ret

Function at 0x4892f8
Capabilities:
Print debug messages
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x489300
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4894bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004092c4
test al, al
jne 0x48935b
push 0x4894d8
push dword [ebp - 8]
push 0x4894f8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404d28
mov eax, dword [ebp - 0x14]
call fcn.00404e68
push eax
call sub.kernel32.dll_OutputDebugStringA
mov byte [ebp - 9], 0
jmp 0x4894a2
mov dl, 1
mov eax, dword [0x41397c]
call fcn.00403b68
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48949b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00489fa0
mov eax, dword [0x49079c]
mov eax, dword [eax]
call fcn.00454654
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, 0x489518
call fcn.00404cb4
mov eax, dword [ebp - 0x18]
call fcn.00404e68
push eax
call sub.kernel32.dll_OutputDebugStringA
idiv edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4894c4
lea eax, [ebp - 0x30]
mov edx, 8
call fcn.004049cc
ret
Function at 0x489558
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404e58
xor eax, eax
push ebp
push 0x48961e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004092c4
test al, al
je 0x489600
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00407600
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x489634
mov edx, dword [ebp - 4]
call fcn.00404cb4
mov eax, dword [ebp - 0x28]
call fcn.00404e68
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x414
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x489638
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
je 0x4895f3
cmp dword [ebp - 0x10], 1
sbb eax, eax
inc eax
test al, al
jne 0x489600
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.0040760c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489625
lea eax, [ebp - 0x28]
call fcn.004049a8
lea eax, [ebp - 4]
call fcn.004049a8
ret
Function at 0x489868
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x489a7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.00402e4c
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x489a94
call fcn.00404cb4
lea eax, [ebp - 0x22c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404ec8
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 4]
mov ecx, 0x489aac
call fcn.00404cb4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.004031e8
lea eax, [ebp - 0x1d0]
call fcn.00402f84
call fcn.00402c14
mov edx, 0x489ac8
lea eax, [ebp - 0x1d0]
call fcn.00405058
call fcn.00403620
call fcn.00402c14
push 0x489ad8
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402e4c
push dword [ebp - 0x234]
push 0x489ae8
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00404d28
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.00405058
call fcn.00403620
call fcn.00402c14
push 0x489af4
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402e4c
push dword [ebp - 0x23c]
push 0x489ae8
push 0x489b08
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00404d28
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.00405058
call fcn.00403620
call fcn.00402c14
mov edx, 0x489b1c
lea eax, [ebp - 0x1d0]
call fcn.00405058
call fcn.00403620
call fcn.00402c14
lea eax, [ebp - 0x1d0]
call fcn.004032b0
call fcn.00402c14
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00403418
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x489b24
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404e68
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x489a59
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489a86
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.004049cc
lea eax, [ebp - 4]
call fcn.004049a8
ret
Function at 0x489bbc
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb58
xor edx, edx
mov dword [ebp - 0x4a8], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
xor eax, eax
push ebp
push 0x489cc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x4a4], 0x94
lea eax, [ebp - 0x4a4]
push eax
call sub.kernel32.dll_GetVersionExA
lea eax, [ebp - 0x410]
xor ecx, ecx
mov edx, 0x400
call fcn.00403418
lea eax, [ebp - 4]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 8]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.00404c18
cmp dword [ebp - 0x4a0], 6
jne 0x489c99
lea eax, [ebp - 8]
mov edx, 0x489cdc
call fcn.00404c70
lea eax, [ebp - 0x4a8]
mov ecx, 0x489d24
mov edx, dword [ebp - 8]
call fcn.00404cb4
mov edx, dword [ebp - 0x4a8]
lea eax, [ebp - 0x10]
call fcn.00405210
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404c30
push 5
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404e68
push eax
push 0x489d34
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489cce
lea eax, [ebp - 0x4a8]
call fcn.004049a8
lea eax, [ebp - 0x10]
call fcn.004050c4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004049cc
ret

Function at 0x48a040
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x48a0fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42cab8]
call fcn.0042cbf4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48a0de
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0042ccd0
mov cl, 1
mov edx, 0x48a110
mov eax, dword [ebp - 4]
call fcn.0042cd38
test al, al
je 0x48a0b1
lea ecx, [ebp - 8]
mov edx, 0x48a15c
mov eax, dword [ebp - 4]
call fcn.0042d0d4
mov eax, dword [ebp - 4]
call fcn.0042cca0
lea eax, [ebp - 8]
mov edx, 0x48a174
call fcn.00404c70
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004049fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a0e5
mov eax, dword [ebp - 4]
call fcn.00403b98
ret
Function at 0x48a180
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x48a23b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42cab8]
call fcn.0042cbf4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48a21e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0042ccd0
mov cl, 1
mov edx, 0x48a250
mov eax, dword [ebp - 4]
call fcn.0042cd38
test al, al
je 0x48a1f1
lea ecx, [ebp - 8]
mov edx, 0x48a29c
mov eax, dword [ebp - 4]
call fcn.0042d0d4
mov eax, dword [ebp - 4]
call fcn.0042cca0
lea eax, [ebp - 8]
mov edx, 0x48a2b0
call fcn.00404c70
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004049fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a225
mov eax, dword [ebp - 4]
call fcn.00403b98
ret

Function at 0x48a2e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404e58
xor eax, eax
push ebp
push 0x48a469
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.004706b8
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004706d8
mov ebx, eax
jmp 0x48a435
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404c18
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004094b8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004088d8
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004088d8
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404db4
je 0x48a40c
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404c18
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004088d8
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004088d8
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404db4
jne 0x48a426
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004706f8
mov ebx, eax
test ebx, ebx
jne 0x48a367
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a470
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004049cc
lea eax, [ebp - 4]
call fcn.004049a8
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x467e3068
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..rsrc
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x19d123cf
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219