joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422ed4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], dl
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + 1]
add ax, dx
mov word [ebp - 0x10], ax
push ebp
xor eax, eax
call fcn.00422e24
pop ecx
mov word [ebp - 0x1a], ax
mov edi, 1
lea ebx, [ebp - 0x10]
mov esi, dword [ebp - 0x18]
add esi, 2
xor eax, eax
mov al, byte [esi]
shl eax, 8
xor edx, edx
mov dl, byte [esi + 1]
add ax, dx
xor ax, word [ebx]
mov word [ebx + 2], ax
push ebp
mov eax, edi
call fcn.00422e24
pop ecx
xor word [ebp - 0x1a], ax
inc edi
add esi, 2
add ebx, 2
cmp edi, 8
jne 0x422f15
movzx eax, word [ebp - 0x1a]
shr eax, 8
mov dl, byte [ebp - 0x1a]
and dl, 0xff
xor al, dl
xor al, byte [ebp - 0x11]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x422f90
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
test dl, dl
je 0x422fa9
add esp, 0xfffffff0
call fcn.00402ab0
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x423031
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0065deb8
lea eax, [esi + 0x54]
fstp qword [eax]
wait
lea eax, [ebp - 0x18]
call fcn.00622678
lea eax, [esi + 0x54]
add eax, 8
mov dx, word [ebp - 0x18]
mov word [eax], dx
lea eax, [esi + 0x54]
add eax, 8
add eax, 2
mov dx, word [ebp - 0x14]
mov word [eax], dx
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x672258]
mov eax, dword [eax]
call fcn.0065d00c
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
lea eax, [esi + 0x54]
add eax, 8
add eax, 4
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423038
lea eax, [ebp - 0x1c]
call fcn.00403880
ret
Function at 0x42e744
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x1f8]
call fcn.0064a424
mov esi, eax
cmp byte [ebx + 0x170], 1
jne 0x42e7f9
push 0x51
push 0
push 0
lea edx, [esp + 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x168]
cdq
idiv dword [ebx + 0x14c]
sub eax, dword [ebx + 0x158]
mov ebp, dword [ebx + 0x160]
imul ebp
add ecx, eax
mov eax, ebp
mov ebp, 3
cdq
idiv ebp
sub ecx, eax
push ecx
lea edx, [esp + 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx + 0x168]
cdq
idiv dword [ebx + 0x14c]
mov edi, dword [ebx + 0x15c]
imul edx, edi
add ecx, edx
mov eax, edi
mov ebx, 3
cdq
idiv ebx
sub ecx, eax
push ecx
push 0
push esi
call sub.user32.dll_SetWindowPos
push 1
push 0
push 0
push esi
call sub.user32.dll_RedrawWindow
push esi
call sub.user32.dll_UpdateWindow
jmp 0x42e801
push 0
push esi
call sub.user32.dll_ShowWindow
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44e638
Capabilities:
Delete file
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd18
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2d4], edx
mov dword [ebp - 0x2d8], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44e884
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x188]
push eax
call sub.user32.dll_DestroyIcon
mov ebx, dword [edi + 0x268]
cmp byte [ebx + 0x454], 0
je 0x44e68a
lea eax, [ebp - 4]
call fcn.0053595c
jmp 0x44e698
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x158]
call fcn.004038bc
mov eax, dword [ebp - 4]
call fcn.0065cc54
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
xor al, 1
test al, al
je 0x44e6e3
lea edx, [ebp - 0x2d8]
mov eax, dword [ebp - 4]
call fcn.0065d0b8
mov eax, dword [ebp - 0x2d8]
lea edx, [ebp - 0x2d4]
call fcn.00626580
mov edx, dword [ebp - 0x2d4]
lea eax, [ebp - 4]
call fcn.004038bc
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.006261a0
push 0x101
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoW
lea eax, [ebp - 0x2d0]
push eax
mov eax, dword [ebp - 0x2bc]
push eax
call sub.user32.dll_GetIconInfo
mov eax, dword [ebp - 0x2c0]
push eax
call sub.gdi32.dll_DeleteObject
mov dl, 1
mov eax, dword [0x64dec8]
call fcn.006515a0
mov esi, eax
mov edx, dword [ebp - 0x2c4]
mov eax, esi
call fcn.006522fc
mov dl, 1
mov eax, dword [0x64dec8]
call fcn.006515a0
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x28]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.006526e8
mov dl, 6
mov eax, ebx
call fcn.006525b0
mov eax, ebx
call fcn.00651940
mov eax, dword [eax + 0x14]
mov edx, dword [0x672098]
mov edx, dword [edx]
call fcn.0064e7f4
push 3
mov eax, ebx
call fcn.00651940
mov eax, dword [eax + 0x14]
call fcn.0064e828
push eax
push 0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x1c]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x28]
push eax
mov eax, dword [ebp - 0x2bc]
push eax
push 0
push 0
mov eax, ebx
call fcn.00651940
call fcn.0064f1bc
push eax
call sub.user32.dll_DrawIconEx
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
mov dword [ebp - 0x2c0], eax
mov eax, esi
call fcn.00651940
mov eax, dword [eax + 0x14]
xor edx, edx
call fcn.0064e7f4
mov eax, esi
call fcn.00651940
lea edx, [ebp - 0x2e8]
call fcn.0064f198
lea eax, [ebp - 0x2e8]
push eax
mov eax, esi
call fcn.00651940
pop edx
call fcn.0064ed10
lea eax, [ebp - 0x2d0]
push eax
call sub.user32.dll_CreateIconIndirect
mov dword [edi + 0x188], eax
mov eax, ebx
call fcn.004028c0
mov eax, esi
call fcn.004028c0
mov eax, dword [ebp - 0x2bc]
push eax
call sub.user32.dll_DestroyIcon
mov eax, dword [edi + 0x188]
push eax
push 0
push 0x80
mov eax, edi
call fcn.0064a424
push eax
call sub.user32.dll_SendMessageW
mov al, byte [ebp - 5]
xor al, 1
test al, al
je 0x44e85e
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e88b
lea eax, [ebp - 0x2d8]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x45368c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x453826
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004236a0
mov dx, word [edi + 4]
call fcn.00423050
and byte [esi + 0x30], 0xfe
mov eax, dword [edi + 8]
call fcn.006407e4
mov byte [ebp - 5], al
mov al, byte [0x453834]
and al, byte [ebp - 5]
mov dl, byte [0x453838]
cmp dl, al
sete byte [ebp - 6]
push 0x90
call sub.user32.dll_GetKeyState
mov ebx, eax
and bl, 1
cmp byte [ebp - 6], 0
je 0x453720
test bl, bl
jne 0x45370f
mov ax, word [edi + 4]
sub ax, 0xc
je 0x453724
add eax, 0xffffffeb
sub ax, 8
jb 0x453724
sub ax, 4
je 0x453724
test bl, bl
je 0x453720
mov ax, word [edi + 4]
add eax, 0xffffffa0
sub ax, 0xa
jb 0x453724
xor eax, eax
jmp 0x453726
mov al, 1
mov byte [esi + 0x31], al
cmp word [edi + 4], 0x58
jne 0x453797
mov byte [esi + 0x32], 0
call fcn.005397f4
test eax, eax
setne al
and al, byte [ebp - 6]
je 0x453810
xor eax, eax
mov dword [ebp - 4], eax
mov al, byte [0x453838]
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x58
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004538e8
test eax, eax
jge 0x453785
or byte [esi + 0x30], 1
call fcn.00452290
mov edx, 0x453844
call fcn.00451bc0
mov dword [edi + 0xc], 1
jmp 0x453810
mov cl, byte [edi + 4]
mov dl, byte [ebp - 5]
mov eax, esi
call fcn.00453010
mov dword [edi + 0xc], eax
jmp 0x453810
call fcn.005397f4
test eax, eax
setne al
and al, byte [ebp - 6]
je 0x4537ef
test bl, bl
je 0x4537ef
mov ax, word [edi + 4]
add eax, 0xffffffa0
sub ax, 0xa
jae 0x4537ef
cmp byte [esi + 0x32], 0
jne 0x4537c5
lea eax, [esi + 0x34]
call fcn.00403274
mov byte [esi + 0x32], 1
lea eax, [ebp - 0xc]
mov dx, word [edi + 4]
sub dl, 0x60
add dl, 0x30
call fcn.00403418
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x34]
call fcn.00403524
mov dword [edi + 0xc], 1
jmp 0x453810
mov byte [esi + 0x32], 0
mov ax, word [edi + 4]
add eax, 0xfffffff0
sub ax, 3
jb 0x453810
mov cl, byte [edi + 4]
mov dl, byte [ebp - 5]
mov eax, esi
call fcn.00453010
mov dword [edi + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45382d
lea eax, [ebp - 0xc]
call fcn.00403274
ret

Function at 0x45387c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov bx, word [edi + 4]
call fcn.004236a0
mov edx, ebx
call fcn.00423050
test byte [esi + 0x30], 1
jne 0x4538e2
cmp bx, 0x61
jb 0x4538cc
mov eax, dword [0x672164]
mov eax, dword [eax]
call fcn.0062f890
mov eax, dword [0x672164]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov edx, dword [0x672164]
mov edx, dword [edx]
mov edx, dword [edx + 0x1c]
mov eax, dword [edx + eax*4]
push eax
push ebx
call sub.user32.dll_VkKeyScanExW
mov ebx, eax
mov eax, dword [edi + 8]
call fcn.006407e4
mov edx, eax
mov ecx, ebx
mov eax, esi
call fcn.00453010
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebx
ret
Function at 0x4645bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x464668
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 0x24]
dec ebx
cmp ebx, 0
jl 0x46461e
mov eax, dword [esi + 0x20]
lea edi, [eax + ebx*4]
lea ecx, [ebp - 4]
lea edx, [ebp - 8]
mov eax, dword [edi]
call fcn.0046450c
cmp dword [ebp - 8], 0
jne 0x46460b
mov eax, dword [edi]
push eax
call sub.kernel32.dll_DeleteFileW
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x464618
mov eax, edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403b24
dec ebx
cmp ebx, 0xffffffff
jne 0x4645df
mov eax, esi
call fcn.00659018
mov ebx, dword [esi + 0x24]
dec ebx
cmp ebx, 0
jl 0x46464d
mov eax, dword [esi + 0x20]
lea edi, [eax + ebx*4]
mov eax, dword [edi]
call fcn.00403ab8
mov edx, eax
sub edx, 0xe
mov eax, edi
call fcn.00403de4
dec ebx
cmp ebx, 0xffffffff
jne 0x46462e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46466f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x491670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4917d9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x674aa0], 0
je 0x4916af
mov eax, 0x4917e8
mov cx, word [0x49184c]
mov dl, 3
call fcn.0062941c
cmp ax, 6
jne 0x4917b6
xor ecx, ecx
mov dl, 1
mov eax, dword [0x490c44]
call fcn.0062c4f4
mov esi, eax
mov eax, esi
call fcn.00642fd0
dec eax
jne 0x4917af
lea edx, [ebp - 8]
mov eax, dword [esi + 0x1a0]
call fcn.006466a8
mov edx, dword [ebp - 8]
mov eax, 0x674aa0
call fcn.004032c8
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x19c]
call fcn.006466f8
mov edx, dword [ebp - 0xc]
mov eax, 0x674aa4
call fcn.004038bc
mov eax, dword [0x674aa4]
call fcn.00403ab8
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 4]
mov edx, dword [0x674aa4]
call fcn.00403358
mov eax, dword [ebp - 4]
call fcn.0040351c
mov ebx, eax
cmp ebx, 1
jl 0x491749
lea eax, [ebp - 4]
call fcn.004036ec
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0x17
mov byte [eax + ebx - 1], dl
dec ebx
test ebx, ebx
jne 0x49172e
mov eax, dword [0x672604]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dl, 4
call fcn.00622288
lea eax, [ebp - 4]
mov edx, dword [0x674aa0]
call fcn.0040330c
mov eax, dword [ebp - 4]
call fcn.0040351c
mov ebx, eax
cmp ebx, 1
jl 0x491792
lea eax, [ebp - 4]
call fcn.004036ec
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0x17
mov byte [eax + ebx - 1], dl
dec ebx
test ebx, ebx
jne 0x491777
mov eax, dword [0x672604]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dl, 5
call fcn.00622288
mov eax, dword [0x672604]
mov eax, dword [eax]
call fcn.0062239c
mov eax, esi
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4917e0
lea eax, [ebp - 0xc]
call fcn.00403880
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403298
ret
Function at 0x493fcc
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov al, byte [edi + 6]
mov byte [esi + 6], al
mov al, byte [edi + 7]
mov byte [esi + 7], al
mov al, byte [edi + 8]
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov edx, dword [edi + 0xc]
mov eax, dword [esi + 0xc]
call fcn.00656bec
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
mov al, byte [edi + 0x10]
mov byte [esi + 0x10], al
mov al, byte [edi + 0x11]
mov byte [esi + 0x11], al
mov edx, dword [edi + 0x14]
mov eax, dword [esi + 0x14]
call fcn.00656bec
mov edx, dword [edi + 0x18]
mov eax, dword [esi + 0x18]
call fcn.00656bec
mov bl, 0x1f
mov ebp, ebx
and ebp, 0x7f
cmp dword [edi + ebp*4 + 0x1c], 0
jne 0x49405b
cmp dword [esi + ebp*4 + 0x1c], 0
je 0x494078
xor eax, eax
mov al, bl
mov eax, dword [esi + eax*4 + 0x1c]
call fcn.00656ff0
xor eax, eax
mov dword [esi + ebp*4 + 0x1c], eax
jmp 0x494078
cmp dword [esi + ebp*4 + 0x1c], 0
jne 0x49406b
call fcn.00656a20
mov dword [esi + ebp*4 + 0x1c], eax
mov edx, dword [edi + ebp*4 + 0x1c]
mov eax, dword [esi + ebp*4 + 0x1c]
call fcn.00656bec
dec ebx
cmp bl, 0xff
jne 0x494033
mov eax, dword [edi + 0x9c]
mov dword [esi + 0x9c], eax
mov eax, dword [edi + 0xa0]
mov dword [esi + 0xa0], eax
mov edx, dword [edi + 0xa4]
mov eax, dword [esi + 0xa4]
mov ecx, dword [eax]
call dword [ecx]
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49dda0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49de1c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00660e34
sub eax, dword [ebx + 8]
cmp eax, 0xbb8
jl 0x49ddfe
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x49de34
call fcn.00403568
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0065c958
mov eax, dword [ebp - 4]
call fcn.0062a510
mov eax, 0x206c
call fcn.0049dbf8
call fcn.00660e34
mov dword [ebx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49de23
lea eax, [ebp - 8]
call fcn.00403274
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x4a989c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9949
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [0x674b78]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
jne 0x4a9926
mov eax, ebx
call fcn.0065cc54
test al, al
je 0x4a9926
lea ecx, [ebp - 0xc]
mov eax, dword [0x674b78]
mov edx, dword [eax + 0x24]
mov eax, 0x4a9958
call fcn.0065da0c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0065c958
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x674b7c]
call fcn.00403b24
mov edx, ebx
mov eax, dword [0x674b78]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [ebp - 4]
mov eax, dword [0x674b78]
mov ecx, dword [eax]
call dword [ecx + 0x30]
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_CopyFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9950
lea eax, [ebp - 0xc]
call fcn.00403274
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x4a9ad8
Capabilities:
Copy file

Disassembly:
push ebx
push esi
push edi
mov edi, 0x674b78
cmp byte [0x674b74], 0
je 0x4a9b47
call fcn.0052ddf4
mov esi, eax
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x4a9b10
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + ebx*4]
call fcn.00526b08
dec ebx
cmp ebx, 0xffffffff
jne 0x4a9afc
mov eax, dword [esi + 8]
call fcn.00656eec
xor ebx, ebx
jmp 0x4a9b39
push 0
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + ebx*4]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + ebx*4 + 4]
push eax
call sub.kernel32.dll_CopyFileW
add ebx, 2
mov eax, dword [edi]
cmp ebx, dword [eax + 0x24]
jl 0x4a9b1c
mov eax, esi
call fcn.00526f48
pop edi
pop esi
pop ebx
ret
Function at 0x4b414c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
call fcn.00409018
xor ebx, 0xffffffff
lea eax, [edi + esi]
cmp eax, esi
jbe 0x4b418b
mov edx, dword [0x6720dc]
mov edx, dword [edx]
xor ecx, ecx
mov cl, byte [esi]
xor ecx, ebx
and ecx, 0xff
shl ecx, 2
add edx, ecx
mov edx, dword [edx]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
cmp eax, esi
ja 0x4b4164
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x4b456c
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff8
xor edx, edx
push ebp
push 0x4b46bf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx]
cmp byte [eax + 0xc], 0
jne 0x4b4618
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebx]
cmp dword [eax + 0x2c], 0
jne 0x4b45d1
mov eax, dword [ebx]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebx]
lea edx, [eax + 0x448]
mov eax, dword [ebx]
call fcn.004b4194
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebx]
mov dword [eax + 0x2c], 0x4000
mov eax, dword [ebx]
add eax, 0x448
mov edx, dword [ebx]
mov dword [edx + 0x28], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov eax, dword [ebx]
add eax, 0x1c
mov edx, 4
call fcn.00406178
mov edx, dword [ebx]
mov edx, dword [edx + 0x30]
sub edx, esi
mov ecx, dword [ebx]
add dword [ecx + 0x40], edx
dec eax
jne 0x4b4599
mov eax, dword [ebx]
mov eax, dword [eax + 0x40]
test eax, eax
jle 0x4b460e
mov ecx, eax
mov eax, dword [ebx]
lea edx, [eax + 0x448]
mov eax, dword [ebx]
call fcn.004b4194
mov eax, dword [ebx]
add eax, 0x1c
call fcn.00405f08
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebx]
add edx, 0x48
add edx, 0x10
mov dword [edx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x30]
mov edx, dword [ebx]
add edx, 0x48
add edx, 0x14
mov dword [edx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
mov edx, dword [ebx]
add edx, 0x48
add edx, 0x18
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebx]
lea edx, [eax + 0x48]
mov eax, dword [ebx]
mov eax, dword [eax + 0x14]
call fcn.00656758
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
call fcn.006595b4
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x44]
add edx, 0xe
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebx]
call fcn.004b41b8
mov eax, dword [ebx]
mov edx, dword [eax + 0x30]
mov eax, dword [ebx]
call fcn.004b41b8
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
call fcn.004b41b8
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
xor ecx, ecx
mov edx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
inc dword [eax + 0x18]
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b46cb
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b4fe4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b51ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4b4028]
call fcn.004b41e0
mov edi, eax
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004b4218
test al, al
je 0x4b51ae
mov bl, 1
cmp dword [0x674bc4], 0
je 0x4b5072
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.006265c4
mov edx, dword [0x674bc4]
mov eax, dword [ebp - 0x10]
call fcn.006261a0
mov byte [edi + 0xc], 1
mov ecx, 0x4b5200
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004b46d4
mov byte [edi + 0xc], 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_DeleteFileW
call fcn.006562d0
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, 0x4b5218
mov eax, dword [ebp - 4]
call fcn.0062b55c
mov eax, dword [ebp - 0xc]
call fcn.00659018
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
dec eax
test eax, eax
jl 0x4b519d
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x20]
mov edx, dword [edx]
call fcn.004038bc
cmp dword [0x674bc8], 0
je 0x4b5109
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [0x674bc8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov esi, eax
cmp esi, 0xffffffff
je 0x4b5109
mov edx, esi
mov eax, dword [0x674bc8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [0x674bcc]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + eax*4]
lea eax, [ebp - 0x10]
call fcn.004038bc
cmp byte [0x674bd0], 0
je 0x4b514e
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.0065d0b8
mov esi, 0xfffffffd
mov ebx, 0x66b850
lea eax, [ebp - 0x24]
mov edx, dword [ebx]
call fcn.004039a0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.0065ce24
test al, al
je 0x4b5148
mov byte [edi + 0xc], 1
jmp 0x4b514e
sub ebx, 4
inc esi
jne 0x4b5129
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00403ab8
mov edx, eax
inc edx
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.0065c4b0
mov eax, dword [ebp - 0x28]
mov cx, 0x2f
mov dx, 0x5c
call fcn.0065ba18
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004b46d4
mov ebx, eax
mov byte [edi + 0xc], 0
test bl, bl
je 0x4b519d
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x4b50ae
mov eax, dword [ebp - 0xc]
call fcn.004028c0
mov eax, edi
call fcn.004b4a0c
jmp 0x4b51b0
xor ebx, ebx
test bl, bl
jne 0x4b51bd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, edi
call fcn.004028c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b51f3
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403898
ret
Function at 0x4c21f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c231f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x6726f4]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4c2330
call fcn.00403b24
mov eax, dword [ebp - 4]
call fcn.0065cc54
test al, al
jne 0x4c2245
lea edx, [ebp - 0xc]
mov al, 4
call fcn.0062ad70
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x4c2330
call fcn.00403b24
mov eax, dword [ebp - 4]
call fcn.0065cc54
test al, al
jne 0x4c22b4
mov eax, 0x4c234c
mov cl, 0x35
mov dl, 3
call fcn.00629794
cmp ax, 6
jne 0x4c22b4
call fcn.00501d74
mov ecx, 0x4c2440
xor edx, edx
call fcn.004fec24
mov eax, dword [ebp - 4]
push eax
call fcn.00501d74
mov eax, dword [eax + 0x268]
push eax
mov al, byte [0x4c245c]
push eax
lea edx, [ebp - 0xc]
mov eax, 0x4c2460
call fcn.0065ca3c
mov edx, dword [ebp - 0xc]
mov ecx, 0x4c2484
xor eax, eax
call fcn.0048ea4c
call fcn.00501d74
xor edx, edx
call fcn.004fec6c
mov eax, dword [ebp - 4]
call fcn.0065cc54
test al, al
je 0x4c2304
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [0x672428]
mov edx, dword [edx + 0x239]
call fcn.00403a34
mov eax, dword [ebp - 0xc]
mov ecx, ebx
mov edx, 0x4c24b8
call fcn.0065c5e8
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa8
push eax
mov eax, dword [ebp - 4]
push eax
push 0x4c24c0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2326
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403898
ret