joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474ecc
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475106
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], 0xffffffff
lea eax, [ebx + 8]
mov edx, esi
call fcn.00405540
cmp byte [0x4f006c], 0
je 0x475000
lea eax, [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, 0x475120
call fcn.00405804
mov byte [ebx + 0xc], 1
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
call sub.KERNEL32.DLL_CreateFileA_1
mov esi, eax
mov dword [ebx], esi
cmp esi, 0xffffffff
jne 0x4750e0
mov byte [ebx + 0xc], 0
push 0xf003f
push 0
push 0
call dword [0x4f007c]
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x4750e0
mov eax, ebx
call fcn.00474e58
test al, al
je 0x474fb7
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
call sub.KERNEL32.DLL_CreateFileA_1
mov dword [ebx], eax
mov eax, dword [ebx + 4]
push eax
call dword [0x4f008c]
jmp 0x4750e0
mov edx, edi
mov eax, ebx
call fcn.00474d30
test al, al
je 0x474ff1
mov eax, ebx
call fcn.00474e58
test al, al
je 0x474ff1
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
call sub.KERNEL32.DLL_CreateFileA_1
mov dword [ebx], eax
mov eax, dword [ebx + 4]
push eax
call dword [0x4f008c]
jmp 0x4750e0
lea eax, [ebx + 8]
mov edx, 0x475130
call fcn.00405540
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x111]
call fcn.00404140
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x118]
call fcn.00405750
push dword [ebp - 0x118]
push 0x475144
push dword [ebx + 8]
push 0x475150
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00405880
push edi
push 0x475144
push dword [ebx + 8]
push 0x475150
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405880
mov eax, dword [ebp - 0xc]
call fcn.0046b0d4
test al, al
jne 0x4750a7
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.0040597c
push eax
mov eax, dword [ebp - 8]
call fcn.0040597c
push eax
call sub.KERNEL32.DLL_CopyFileA
mov byte [0x4d9af0], 1
push 0x475120
push dword [ebx + 8]
push 0x475150
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405880
push 0
push 0x4000000
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
call sub.KERNEL32.DLL_CreateFileA_1
mov dword [ebx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47510d
lea eax, [ebp - 0x118]
call fcn.004054ec
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405510
ret
Function at 0x476980
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov bl, 1
xor eax, eax
push ebp
push 0x476a70
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x476a8c
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], esi
push 0x476a9c
push esi
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x476ab0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push 0x476ac0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
push 0x476ad8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
push 0x476aec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
push 0x476b08
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
push 0x476b30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push 0x476b48
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x476a84
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x476f90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
dec ecx
test ecx, ecx
jl 0x476fb6
inc ecx
mov ebx, dword [eax]
xor bl, byte [edx]
and bl, 0xff
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x4d9b90]
mov esi, dword [eax]
shr esi, 8
xor ebx, esi
mov dword [eax], ebx
inc edx
dec ecx
jne 0x476f98
pop esi
pop ebx
ret

Function at 0x476fbc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.004056e4
add esp, 0x108
pop ebx
ret

Function at 0x476fe4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47704a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00476fbc
lea eax, [ebp - 0x109]
push eax
push 0
push 0x477058
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, ebx
lea edx, [ebp - 0x109]
call fcn.004056e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477051
lea eax, [ebp - 4]
call fcn.004054ec
ret
Function at 0x47705c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
or edx, 0xffffffff
mov ecx, eax
test ecx, ecx
je 0x47706c
sub ecx, 4
mov ecx, dword [ecx]
mov esi, ecx
test esi, esi
jle 0x477096
mov edi, 1
movzx ecx, byte [eax + edi - 1]
xor cl, dl
and cl, 0xff
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x4d9b90]
shr edx, 8
xor ecx, edx
mov edx, ecx
inc edi
dec esi
jne 0x477077
mov eax, edx
pop edi
pop esi
ret

Function at 0x47709c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, ecx
dec eax
test eax, eax
jl 0x4770cd
inc eax
xor edi, edi
movzx ecx, byte [edx + edi]
mov ebx, dword [esi]
xor cl, bl
and cl, 0xff
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x4d9b90]
mov ebx, dword [esi]
shr ebx, 8
xor ecx, ebx
mov dword [esi], ecx
inc edi
dec eax
jne 0x4770ab
pop edi
pop esi
pop ebx
ret
Function at 0x47b2c8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffbc
mov ebx, eax
mov dword [esp], 0x40
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
mov eax, dword [0x4ea3e0]
test byte [eax], 8
je 0x47b2f8
mov eax, ebx
mov edx, 0x47b310
call fcn.00405540
jmp 0x47b303
mov eax, ebx
lea edx, [esp + 4]
call fcn.004056e4
add esp, 0x44
pop ebx
ret
Function at 0x4817b8
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov eax, dword [0x4ea718]
cmp dword [eax], 2
je 0x4817d0
mov bl, 1
jmp 0x4818b8
xor ebx, ebx
lea eax, [esp + 8]
push eax
push 0xffffffffffffffff
push 8
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov edi, eax
test edi, edi
jne 0x48180c
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0x3f0
jne 0x48180c
lea eax, [esp + 8]
push eax
push 8
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov edi, eax
test edi, edi
je 0x4818b8
mov eax, 0x400
call fcn.00402ee0
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_GetTokenInformation
mov edi, eax
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
test edi, edi
je 0x4818b1
mov eax, esp
xor ecx, ecx
mov edx, 6
call fcn.00403b08
mov byte [esp + 5], 5
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x28]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4818b1
mov edi, dword [esi]
dec edi
test edi, edi
jl 0x4818a7
inc edi
xor ebp, ebp
mov eax, dword [esi + ebp*8 + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4818a3
mov bl, 1
jmp 0x4818a7
inc ebp
dec edi
jne 0x48188c
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402efc
mov eax, ebx
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x486510
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
mov edi, 0x4f0230
mov bl, 1
push 0x4865ac
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [edi], eax
push 0x4865b8
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov esi, eax
mov dword [0x4f021c], esi
test esi, esi
je 0x4865a6
push 0x4865d0
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov esi, eax
mov dword [0x4f0220], esi
test esi, esi
je 0x4865a6
push 0x4865e0
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov esi, eax
mov dword [0x4f0224], esi
test esi, esi
je 0x4865a6
push 0x4865f4
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov esi, eax
mov dword [0x4f0228], esi
test esi, esi
je 0x4865a6
push 0x48660c
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov ebx, eax
mov dword [0x4f022c], ebx
test ebx, ebx
sete al
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x48eb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
movzx eax, word [esi + 0x74]
push eax
mov ecx, dword [esi + 0x38]
mov dl, 1
mov eax, dword [0x472694]
call fcn.0047271c
mov ebx, eax
mov dword [esi + 0x3c], ebx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x48eb91
cmp eax, 0x14
jae 0x48eb9c
jmp 0x48eb93
jge 0x48eb9c
mov byte [esi + 0x30], 0
jmp 0x48ec51
mov byte [esi + 0xb8], 0
lea ecx, [esi + 0x78]
xor edx, edx
mov eax, dword [esi + 0x3c]
call fcn.0048b0f0
lea edx, [esi + 0x78]
mov eax, dword [esi + 0x3c]
call fcn.0048e208
mov dword [esi + 0xb4], eax
lea edx, [esi + 0x78]
mov eax, dword [esi + 0x3c]
call fcn.0048ea74
test al, al
je 0x48ebd6
mov byte [esi + 0x30], 0
jmp 0x48ec51
xor eax, eax
mov dword [esi + 0x48], eax
mov edi, 1
mov ebx, dword [0x4f0258]
jmp 0x48ec21
cmp edi, dword [ebx + 0x2c]
jne 0x48ec1f
cmp byte [ebx + 0x14], 0
je 0x48ec1f
xor edx, edx
mov eax, esi
call dword [ebx + 0x18]
mov ebp, eax
test ebp, ebp
je 0x48ec1b
mov dword [esi + 0x44], ebp
mov dword [esi + 0x48], ebx
lea eax, [esi + 0x4c]
mov edx, dword [ebx + 0x10]
call fcn.00405540
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x50], eax
xor ebx, ebx
jmp 0x48ec21
mov ebx, dword [ebx]
jmp 0x48ec21
mov ebx, dword [ebx]
test ebx, ebx
je 0x48ec2b
cmp dword [esi + 0x48], 0
je 0x48ebe8
inc edi
cmp edi, 5
jne 0x48ebe0
cmp dword [esi + 0x48], 0
je 0x48ec4d
mov byte [esi + 0x30], 1
push esi
push 0x48e918
mov ebx, dword [esi + 0x48]
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
call dword [ebx + 0x1c]
mov byte [esi + 0x40], 0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4906cc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0x4906e9
xor eax, eax
jmp 0x490770
movzx ecx, byte [esi]
and cl, 0xff
movzx ecx, cl
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
lea edx, [eax + 1]
movzx edx, byte [esi + edx]
and dl, 0xff
movzx edx, dl
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0x49072c
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.004901e4
test al, al
jne 0x490767
xor eax, eax
jmp 0x490770
mov edx, ebx
mov eax, edi
call fcn.004901a0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x494e24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x494eea
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0xc], eax
movzx eax, byte [esi]
mov edx, dword [ebp - 0xc]
xor edx, 1
imul edx, dword [ebp - 0xc]
shr edx, 8
xor al, dl
mov byte [esi], al
mov eax, dword [ecx]
xor edx, edx
push edx
push eax
movzx eax, byte [esi]
cdq
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
movzx eax, al
mov edx, dword [0x4ea6bc]
mov eax, dword [edx + eax*4]
mov edx, dword [ecx]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ecx], eax
mov eax, dword [ecx]
and eax, 0xff
add dword [edi], eax
mov eax, dword [edi]
mov edx, dword [ebp + 8]
imul dword [edx]
inc eax
mov dword [edi], eax
mov eax, dword [ebx]
xor edx, edx
push edx
push eax
mov eax, dword [edi]
shr eax, 0x18
cdq
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
movzx eax, al
mov edx, dword [0x4ea6bc]
mov eax, dword [edx + eax*4]
mov edx, dword [ebx]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebx], eax
inc esi
dec dword [ebp - 0x10]
jne 0x494e4c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49e63c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x49e711
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
call fcn.004056e4
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.0049e5bc
mov edx, dword [ebp - 0x108]
mov eax, 0x509360
call fcn.00405540
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x104]
call fcn.004056e4
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.0049e5bc
mov edx, dword [ebp - 0x110]
mov eax, 0x509364
call fcn.00405540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e718
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00405510
ret

Function at 0x4a01f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a02d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004054ec
mov edi, ebx
dec edi
test di, di
jb 0x4a02ba
inc edi
xor ebx, ebx
mov eax, ebx
and al, 1
xor al, 1
test al, al
je 0x4a0247
movzx edx, bx
cmp byte [esi + edx], 0
jne 0x4a0247
movzx edx, bx
cmp byte [esi + edx + 1], 0
je 0x4a02ba
test al, al
je 0x4a0259
movzx eax, bx
movzx eax, byte [esi + eax]
and al, 0x3f
mov byte [ebp - 5], al
jmp 0x4a0277
movzx eax, bx
movzx edx, byte [esi + eax]
add edx, edx
add edx, edx
movzx eax, byte [esi + eax - 1]
shr eax, 6
add dl, al
sub dl, 0x20
and dl, 0x3f
mov byte [ebp - 5], dl
test bl, 1
je 0x4a028f
movzx eax, bx
cmp byte [esi + eax], 0x48
jne 0x4a028f
movzx eax, bx
test byte [esi + eax - 1], 0xc0
je 0x4a02ba
movzx eax, byte [ebp - 5]
call fcn.004a01a4
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004056d4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004057b8
mov eax, dword [ebp - 4]
inc ebx
dec di
jne 0x4a022a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a02d7
lea eax, [ebp - 0xc]
call fcn.004054ec
ret

Function at 0x4a2124
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403b08
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4a66b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4a66b8
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4a681c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004054ec
mov eax, dword [0x4ea3b0]
cmp byte [eax], 0
je 0x4a67f4
mov dl, 1
mov eax, dword [0x47868c]
call fcn.0047f558
mov ebx, eax
lea ecx, [ebp - 4]
mov edx, 0x4a6834
mov eax, ebx
call fcn.00480ab8
mov eax, ebx
call fcn.004046c0
cmp dword [ebp - 4], 0
je 0x4a67f4
mov eax, dword [ebp - 4]
mov edx, 0x4a684c
call fcn.00405914
jne 0x4a67e2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.004a6554
lea eax, [ebp - 0x14]
call fcn.00476fe4
mov eax, dword [ebp - 0x14]
call fcn.0040597c
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp - 0x14]
call fcn.0040310c
call fcn.004030ec
test eax, eax
jne 0x4a67f4
push dword [ebp - 0x14]
push 0x4a6858
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405880
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.004a6654
push dword [ebp - 0x14]
push 0x4a6858
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405880
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
inc eax
call fcn.004a6654
push dword [ebp - 0x14]
push 0x4a6858
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405880
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, 2
call fcn.004a6654
mov ecx, 0x4a6834
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004a5d84
lea eax, [ebp - 4]
call fcn.004a63a8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6823
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405510
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405510
ret
Function at 0x4a8014
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040596c
xor eax, eax
push ebp
push 0x4a8110
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4ea228]
cmp dword [eax + 4], 6
jb 0x4a80a0
mov edx, dword [ebp - 4]
mov eax, 0x4a8124
call fcn.00405ac8
test eax, eax
jg 0x4a808a
mov edx, dword [ebp - 4]
mov eax, 0x4a8134
call fcn.00405ac8
test eax, eax
jg 0x4a808a
mov edx, dword [ebp - 4]
mov eax, 0x4a8144
call fcn.00405ac8
test eax, eax
jg 0x4a808a
mov edx, dword [ebp - 4]
mov eax, 0x4a8154
call fcn.00405ac8
test eax, eax
jle 0x4a80a0
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004a7e08
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 4]
call fcn.00405584
test ebx, ebx
jne 0x4a80a9
mov ebx, 1
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b08
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], bx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
push eax
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8117
lea eax, [ebp - 0x5c]
call fcn.004054ec
lea eax, [ebp - 4]
call fcn.004054ec
ret

Function at 0x4ad7d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov ebp, eax
mov eax, edi
mov edx, ebx
call fcn.00405540
mov eax, ebx
test eax, eax
je 0x4ad7ef
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
xor esi, esi
mov eax, ebp
and eax, 0x1f
mov edx, 0x20
sub edx, eax
mov ecx, edx
mov bl, 0xd6
shl bl, cl
mov ecx, eax
mov eax, 0x2be674d6
shr eax, cl
inc esi
and al, 0xff
or bl, al
mov eax, edi
call fcn.004059dc
mov edx, dword [edi]
movzx edx, byte [edx + esi - 1]
xor bl, dl
mov byte [eax + esi - 1], bl
inc ebp
cmp esi, dword [esp]
jl 0x4ad7f4
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ad9d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov ebp, edx
mov ebx, eax
lea esi, [esp + 4]
lea edi, [esp + 8]
mov edx, esi
mov eax, ebp
mov ecx, 4
call fcn.00403138
mov edx, edi
mov eax, ebp
add eax, 4
mov ecx, 4
call fcn.00403138
mov eax, dword [esi]
call fcn.004ad988
mov dword [esi], eax
mov eax, dword [edi]
call fcn.004ad988
mov dword [edi], eax
mov eax, dword [ebx + 0x100c]
xor dword [esi], eax
mov eax, 1
mov edx, dword [esi]
shr edx, 0x18
and edx, 0xff
mov edx, dword [ebx + edx*4 + 0xc]
mov ecx, dword [esi]
shr ecx, 0x10
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0x40c]
mov ecx, dword [esi]
shr ecx, 8
and ecx, 0xff
xor edx, dword [ebx + ecx*4 + 0x80c]
mov ecx, dword [esi]
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0xc0c]
xor edx, dword [edi]
xor edx, dword [ebx + eax*4 + 0x100c]
mov dword [edi], edx
mov edx, dword [edi]
shr edx, 0x18
and edx, 0xff
mov edx, dword [ebx + edx*4 + 0xc]
mov ecx, dword [edi]
shr ecx, 0x10
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0x40c]
mov ecx, dword [edi]
shr ecx, 8
and ecx, 0xff
xor edx, dword [ebx + ecx*4 + 0x80c]
mov ecx, dword [edi]
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0xc0c]
xor edx, dword [esi]
xor edx, dword [ebx + eax*4 + 0x1010]
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jl 0x4ada28
mov eax, dword [ebx + 0x1050]
xor dword [edi], eax
mov eax, dword [esi]
call fcn.004ad988
mov dword [esi], eax
mov eax, dword [edi]
call fcn.004ad988
mov dword [edi], eax
mov edx, dword [esp]
mov eax, edi
mov ecx, 4
call fcn.00403138
mov edx, dword [esp]
add edx, 4
mov eax, esi
mov ecx, 4
call fcn.00403138
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4adde4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov ebx, edx
mov esi, eax
lea ebp, [esp + 4]
mov edx, ebp
mov eax, ebx
mov ecx, 4
call fcn.00403138
lea edx, [esp + 8]
lea eax, [ebx + 4]
mov ecx, 4
call fcn.00403138
mov ebx, 0x10
mov eax, dword [esi + ebx*4 + 0x1010]
xor dword [ebp], eax
mov edi, dword [ebp]
mov edx, dword [ebp]
mov eax, esi
call fcn.004adb14
mov dword [ebp], eax
mov eax, dword [esp + 8]
xor dword [ebp], eax
mov dword [esp + 8], edi
dec ebx
test ebx, ebx
jne 0x4ade1a
mov eax, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1010]
xor eax, dword [esp + 0xc]
mov dword [ebp], eax
mov eax, dword [esi + 0x100c]
xor eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov edx, dword [esp]
lea eax, [esp + 0xc]
mov ecx, 4
call fcn.00403138
mov eax, dword [esp]
lea edx, [eax + 4]
mov eax, ebp
mov ecx, 4
call fcn.00403138
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b5f2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5fd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040597c
lea edx, [ebp - 0xa]
mov ecx, 6
call fcn.00403138
mov eax, edi
call fcn.004054ec
mov eax, dword [ebp - 9]
add eax, 0xc
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 5]
test esi, esi
jle 0x4b5fbd
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
movzx ebx, byte [eax + edx]
mov eax, dword [ebp - 9]
add eax, dword [ebp - 0x10]
dec eax
and eax, 0xf
xor bl, byte [eax*4 + 0x4dc2b0]
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004056d4
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.004057b8
inc dword [ebp - 0x14]
inc dword [ebp - 0x10]
dec esi
jne 0x4b5f82
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5fda
lea eax, [ebp - 0x18]
call fcn.004054ec
ret