joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x40251a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x402580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x4025df

Function at 0x4025ee
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4025d0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x402660
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x4026bf

Function at 0x4026ce
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x4026b0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x404d40
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x405260
test edx, edx
je 0x405260
call fcn.00404d57
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x4052a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00404d40
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x405311
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x4052d6
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x4065c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x40669b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x406636
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00406200
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x406604
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x406754
call fcn.00406648
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x4066f3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00406200
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4066ac
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x406754
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00406200
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x40674f
jmp 0x406754
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4067c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x4068a4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x40683f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00406360
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x40680d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x40695d
call fcn.00406851
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x4068fc
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00406490
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4068b5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x40695d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00406490
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x406958
jmp 0x40695d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x440880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x44096a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x4408fd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00440040
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4408c3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x440a33
call fcn.0044090f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4409ca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00440460
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x44097b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x440a33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00440460
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x440a2e
jmp 0x440a33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44c459
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x44c469
push 0xd
pop eax
jmp 0x44c49b
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44c472
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [esp + 0x20]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
ret 0xc
Function at 0x44c49f
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x44c4af
push 0xd
pop eax
jmp 0x44c4f4
push esi
push edi
xor eax, eax
mov edi, edx
mov dword [esp + 0x14], eax
mov esi, eax
push ebp
mov ecx, edi
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x18]
jne 0x44c4c1
sub ecx, ebp
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x44c4bc
pop ebp
push esi
push edx
push 7
xor eax, eax
push eax
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x44c4f8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x758f44]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.0044c3ce
mov esi, eax
test esi, esi
je 0x44c55e
cmp dword [esp + 0xc], ebx
je 0x44c557
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x44c5ed
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44c5a2
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.0044c4f8
mov esi, eax
test esi, esi
jne 0x44c604
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x44c579
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x44c5cc
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.0044c27c
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x44c5eb
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005f9dd5
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x44c54b
Function at 0x471180
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x645704
call fcn.006425cf
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
jne 0x471265
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
cmp esi, 2
jne 0x4711bf
xor eax, eax
inc eax
jmp 0x47126e
push 5
pop ecx
call fcn.00488e9b
test al, al
je 0x471260
push ecx
lea ecx, [ebp - 0xb0]
call fcn.004506fd
mov edx, str.Unable_to_determine_status_of_Windows_Installer_
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xb0]
call fcn.00451714
mov edx, str._Error_code:
mov ecx, eax
call fcn.00451714
push esi
mov ecx, eax
call fcn.00455eec
sub esp, 0x18
mov ecx, 0x6f9854
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00467083
sub esp, 0x18
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x18], esp
mov ecx, 0x6f9720
push eax
call fcn.0047353a
sub esp, 0x18
mov byte [ebp - 4], 2
mov eax, esp
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x14], eax
push eax
call fcn.00450fef
push 0x54
pop edx
push 5
pop ecx
mov byte [ebp - 4], bl
call fcn.00488e21
add esp, 0x48
lea ecx, [ebp - 0xb0]
call fcn.0044ec83
push 2
pop eax
jmp 0x47126e
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
call fcn.0064259d
ret
Function at 0x471d13
Capabilities:
Create process on windows

Disassembly:
push 0xf4
mov eax, 0x648d39
call fcn.00642602
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push str.webex:__
call fcn.0044eb76
mov dword [ebp - 4], ebx
cmp dword [esi + 0x10], ebx
je 0x471d88
mov edx, esi
lea ecx, [ebp - 0x58]
call fcn.0048a584
push eax
mov edx, str.meet
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00459651
pop ecx
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x471d6b
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004510e7
lea ecx, [ebp - 0x40]
call fcn.004510b9
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.004510b9
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 5
cmovae eax, dword [ebp - 0x28]
push ebx
push ebx
push eax
push 0x6f8998
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp ebx, 0x20
push 3
pop ecx
setg byte [ebp - 0x59]
call fcn.00488e9b
test al, al
je 0x471e80
push ecx
lea ecx, [ebp - 0x100]
call fcn.004506fd
cmp byte [ebp - 0x59], 0
lea ecx, [ebp - 0x100]
mov eax, str.failure
mov byte [ebp - 4], 3
mov esi, str.success
mov edx, str.ShellExecute_result:
cmove esi, eax
call fcn.00451714
mov edx, esi
mov ecx, eax
call fcn.00451714
mov edx, str.__errorCode
mov ecx, eax
call fcn.00451714
push ebx
mov ecx, eax
call fcn.0047401d
mov edx, str.__instance:
mov ecx, eax
call fcn.00451714
push ebx
mov ecx, eax
call fcn.0046aed7
sub esp, 0x18
mov ecx, 0x6f9820
mov eax, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.00473442
sub esp, 0x18
mov byte [ebp - 4], 4
mov eax, esp
mov dword [ebp - 0x68], esp
mov ecx, 0x6f9720
push eax
call fcn.0047353a
sub esp, 0x18
mov byte [ebp - 4], 5
mov eax, esp
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x64], eax
push eax
call fcn.00450fef
push 3
mov edx, 0x122
mov byte [ebp - 4], 3
pop ecx
call fcn.00488e21
add esp, 0x48
lea ecx, [ebp - 0x100]
call fcn.0044ec83
mov al, byte [ebp - 0x59]
lea ecx, [ebp - 0x28]
mov byte [edi], al
mov dword [edi + 4], ebx
call fcn.004510b9
mov eax, edi
call fcn.006425b1
ret 8
Function at 0x472b7d
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x68
push 0xffffffffffffffff
push 0x649051
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x758f44]
xor eax, ebp
mov dword [ebp + 0x64], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x70]
mov edi, dword [ebp + 0x74]
push ecx
lea ecx, [ebp - 0x114]
call fcn.00474a7f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
mov edx, str.msiexec.exe__x__
call fcn.004752ac
mov edx, ebx
lea ecx, [ebp + 4]
mov esi, eax
call fcn.0048a63e
mov edx, eax
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.0047546d
mov edx, edi
lea ecx, [ebp + 0x1c]
mov esi, eax
call fcn.0048a63e
mov edx, eax
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.0047546d
mov edx, str.___quiet__norestart
mov ecx, eax
call fcn.004752ac
lea ecx, [ebp + 0x1c]
call fcn.004510b9
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0
call fcn.004510b9
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0060ecf0
add esp, 0xc
mov dword [ebp - 0x7c], esi
lea eax, [ebp + 0x34]
lea ecx, [ebp - 0x110]
push eax
call fcn.00474f05
mov edx, ebx
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x4c]
call fcn.0048a63e
cmp dword [ebp + 0x60], 8
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp + 0x4c]
cmovae ecx, dword [ebp + 0x4c]
lea edx, [ebp - 0x7c]
cmp dword [ebp + 0x48], 8
lea eax, [ebp + 0x34]
push edx
cmovae eax, dword [ebp + 0x34]
push ecx
xor ecx, ecx
push ecx
push 0x8000020
push ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov esi, eax
push 7
xor eax, eax
lea edi, [ebp - 0x38]
pop ecx
xor ebx, ebx
rep stosd dword es:[edi], eax
inc ebx
jmp 0x472cc0
cmp dword [ebp - 0x34], 0x12
je 0x472cd4
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x472ca6
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x472cc0
and dword [ebp], eax
lea eax, [ebp]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test esi, esi
je 0x472d06
cmp dword [ebp], 0
je 0x472d08
xor bl, bl
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp + 0x4c]
call fcn.004510b9
lea ecx, [ebp + 0x34]
call fcn.004510b9
lea ecx, [ebp - 0x114]
call fcn.004717ba
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x64]
xor ecx, ebp
call fcn.005f9dd5
add ebp, 0x68
leave
ret 8
Function at 0x473211
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x264
mov eax, 0x649169
call fcn.00642602
push 0
push 0xf
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x473238
xor al, al
jmp 0x4732fa
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x270], ebx
jmp 0x4732e6
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044eb76
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0048a4b7
mov edx, str.CiscoCollabHost.exe
mov ecx, eax
call fcn.00475482
lea ecx, [ebp - 0x40]
mov bl, al
call fcn.004511a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004510b9
test bl, bl
je 0x4732d2
push dword [ebp - 0x264]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
test edi, edi
je 0x4732d2
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov ebx, eax
push edi
mov dword [ebp - 0x270], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4732d8
mov ebx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x47325e
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
setne al
call fcn.006425b1
ret

Function at 0x473368
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
lea ebp, [esp - 0x5f0]
sub esp, 0x670
mov eax, dword [0x758f44]
xor eax, ebp
mov dword [ebp + 0x5ec], eax
push esi
push edi
mov edi, 0x208
lea eax, [ebp + 0x3e4]
push edi
xor esi, esi
push esi
push eax
call fcn.0060ecf0
add esp, 0xc
lea eax, [ebp + 0x3e4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
jne 0x4733b8
xor al, al
jmp 0x47342b
push ebx
push 0x44
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0060ecf0
push 0x410
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
push esi
push eax
movups xmmword [ebp - 0x3c], xmm0
call fcn.0060ecf0
lea eax, [ebp + 0x3e4]
push eax
push str.cmd.exe__c_timeout__NOBREAK__T_3___nul__del__f__q___s_
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.00471094
add esp, 0x28
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push dword [ebp - 0x38]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop ebx
mov ecx, dword [ebp + 0x5ec]
pop edi
xor ecx, ebp
pop esi
call fcn.005f9dd5
add ebp, 0x5f0
leave
ret
Function at 0x47f690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
mov dword [ecx], eax
mov eax, dword [esp + 0x2c]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [esp + 0x28]
je 0x47f7f8
mov eax, ecx
xor ebx, ebx
mov dword [esp + 0x14], eax
inc ebx
mov edx, dword [esp + 0x34]
mov ebp, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x47f7f8
mov edx, dword [esp + 0x20]
movzx ecx, word [eax]
mov eax, ecx
mov byte [esp + 0x13], 0
movzx edi, word [edx]
cmp bx, di
jae 0x47f717
lea eax, [ecx + 0x2400]
cmp ax, bp
ja 0x47f80b
mov eax, edi
lea edx, [ecx - 0xdc00]
shl eax, 0xa
or edx, eax
mov cl, byte [esp + 0x13]
cmp edx, 0x80
jae 0x47f735
mov bl, dl
xor edi, edi
jmp 0x47f765
mov edx, eax
lea eax, [ecx + 0x2800]
cmp ax, bp
ja 0x47f705
add edx, 0xffff2840
mov cl, bl
shl edx, 0xa
mov byte [esp + 0x13], cl
jmp 0x47f709
mov ebx, edx
cmp edx, 0x800
jae 0x47f74a
shr ebx, 6
xor edi, edi
or bl, 0xc0
inc edi
jmp 0x47f765
cmp edx, 0x10000
jae 0x47f75c
shr ebx, 0xc
or bl, 0xe0
push 2
jmp 0x47f764
shr ebx, 0x12
or bl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [esp + 0x14]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [esp + 0x18], eax
lea ebp, [eax + 1]
mov eax, dword [esp + 0x34]
sub eax, dword [esi]
cmp eax, ebp
jl 0x47f7f8
mov eax, ecx
mov ecx, dword [esp + 0x2c]
add eax, 2
cmp byte [esp + 0x13], 0
mov dword [ecx], eax
jne 0x47f79f
cmp edi, 3
jae 0x47f7a9
mov eax, dword [esi]
mov ebp, dword [esp + 0x18]
mov byte [eax], bl
inc dword [esi]
mov ebx, dword [esi]
test ebp, ebp
je 0x47f7c8
imul ecx, edi, 6
sub ecx, 6
mov eax, edx
shr eax, cl
dec ebp
and al, 0x3f
or al, 0x80
mov byte [ebx], al
inc dword [esi]
mov ebx, dword [esi]
test ebp, ebp
jg 0x47f7b2
xor ebx, ebx
shr edx, 0xa
inc ebx
movzx eax, dx
cmp byte [esp + 0x13], 0
mov ecx, ebx
cmovne ecx, eax
mov eax, dword [esp + 0x20]
mov word [eax], cx
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov eax, ecx
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x28]
jne 0x47f6c0
xor eax, eax
cmp dword [esp + 0x24], ecx
sete al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x1c
push 2
pop eax
jmp 0x47f801