joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d45a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4d45d5
dec al
je 0x4d4611
dec al
je 0x4d4655
dec al
je 0x4d46c0
jmp 0x4d474a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d474a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d45e5
jmp 0x4d474a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d474a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d4621
jmp 0x4d474a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d474a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d4683
xor ebp, ebp
jmp 0x4d4694
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d469d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d4665
jmp 0x4d474a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d474a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d4718
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d2010
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d46d4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d9134
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x50ce10
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4d9153
mov esi, 1
mov edx, 0x50cf18
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4d91cd
dec ebx
je 0x4d91f1
dec ebx
je 0x4d9215
dec ebx
je 0x4d9238
jmp 0x4d9251
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d9251
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d9251
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4d9251
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4d91ba
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4d916f
mov esi, 0x20
mov eax, 0x50ce40
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4d9276
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d92b0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x50cec7]
test bl, bl
jbe 0x4d92e1
lea eax, [esi + 0x3e0]
call fcn.004d9290
lea eax, [esi + 0x3fc]
call fcn.004d9290
dec bl
jne 0x4d92c7
mov cl, 0x30
mov edi, 0x50ce98
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x4d9303
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4d9312
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4d92eb
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4d9320
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004d90c8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4d933c
mov bl, 0x1c
mov esi, 0x50ce60
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004d90c8
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004d90c8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4d9358
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004d92b0
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4d9380
mov bl, 1
mov eax, 0x50cd90
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4d93b9
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4d93c6
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4d93a5
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4d93f0
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004d9134
jmp 0x4d9418
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004d9134
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4d9420
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4d93d8
mov bl, 0x40
mov esi, 0x50cdd0
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x4d9486
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4d9495
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4d946e
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004d90f0
inc ebx
inc esi
cmp bl, 0x41
jne 0x4d94a3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4da2e4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4da390
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x4da38b
mov eax, ebp
mov edx, 8
call fcn.004052dc
push 1
mov eax, ebp
call fcn.004051a8
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004d9320
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dbec8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4dbed1
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4dc075
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004dc210
xor eax, eax
push ebp
push 0x4dc053
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4dbf20
call fcn.004046b0
jmp 0x4dc05a
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4dbfe2
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4dbf70
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4dbf70
lea eax, [ebp - 0x10]
call fcn.004dbc98
push dword [ebp - 0x10]
push 0x4dc090
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405010
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4dbfa5
lea eax, [ebp - 0x18]
call fcn.004dbc98
push dword [ebp - 0x18]
push 0x4dc090
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405010
mov eax, dword [ebp - 0x14]
call fcn.00405150
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4dc03d
lea eax, [ebp - 0x20]
call fcn.004dbc98
push dword [ebp - 0x20]
push 0x4dc090
push ebx
push 0x4dc09c
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405010
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004dbe98
jmp 0x4dc03d
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4dc004
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4dc004
push ebx
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4dc01a
mov eax, ebx
call fcn.00405150
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4dc03d
lea eax, [ebp - 0x24]
mov ecx, 0x4dc09c
mov edx, ebx
call fcn.00404f9c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004dbe98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc05a
mov eax, dword [ebp - 4]
call fcn.004dc21c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc07c
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404cb4
ret
Function at 0x4ed7ec
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.004052dc
mov eax, esi
call fcn.004051a8
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.004036c0
cmp byte [ebp - 1], 0
jne 0x4ed85f
mov eax, esi
call fcn.004051a8
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x4ed878
sub al, 2
jb 0x4ed87f
jmp 0x4ed884
mov ebx, 2
jmp 0x4ed884
mov ebx, 1
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4ed966
test edi, edi
jle 0x4ed8e0
mov eax, esi
call fcn.004051a8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0
jmp 0x4ed95a
test edi, edi
jge 0x4ed926
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.004051a8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4ed95a
mov eax, esi
call fcn.004051a8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4ed89c
mov al, byte [ebp - 1]
sub al, 1
jb 0x4ed976
sub al, 2
jb 0x4ed9af
jmp 0x4ed9f6
cmp edi, 2
jne 0x4ed97c
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4ed9f6
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.004051a8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x50d22c]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4ed98c
jmp 0x4ed9f6
cmp edi, 2
jne 0x4ed9b5
dec ebx
test ebx, ebx
jle 0x4ed9f1
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.004051a8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x50d230]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4ed9c1
jmp 0x4ed9f1
inc ebx
mov eax, esi
call fcn.004051a8
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4ed9e4
mov eax, esi
mov edx, ebx
call fcn.004052dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ee058
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405140
mov eax, dword [ebp - 8]
call fcn.00405140
xor eax, eax
push ebp
push 0x4ee135
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040a150
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0040a150
mov eax, dword [ebp - 0x30]
pop edx
call fcn.004092b8
test eax, eax
jne 0x4ee0c1
mov dword [ebp - 0x22], 4
jmp 0x4ee0c8
mov dword [ebp - 0x22], 1
lea eax, [ebp - 0x34]
mov ecx, 0x4ee14c
mov edx, dword [ebp - 4]
call fcn.00404f9c
mov eax, dword [ebp - 0x34]
call fcn.00405150
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x38]
mov ecx, 0x4ee14c
mov edx, dword [ebp - 8]
call fcn.00404f9c
mov eax, dword [ebp - 0x38]
call fcn.00405150
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x410
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee13c
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404cb4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cb4
ret
Function at 0x4f2a88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00404f50
mov edx, eax
cmp edx, 0x20
jge 0x4f2aba
test edx, edx
jle 0x4f2ae4
mov eax, 1
xor bl, byte [esi + eax - 1]
xor ecx, ecx
mov cl, bl
mov bl, byte [ecx + 0x50d254]
inc eax
dec edx
jne 0x4f2aa6
jmp 0x4f2ae4
mov edi, edx
test edi, edi
jns 0x4f2ac3
add edi, 0x1f
sar edi, 5
inc edi
mov eax, 1
cmp edx, eax
jle 0x4f2ae4
xor bl, byte [esi + eax - 1]
xor ecx, ecx
mov cl, bl
mov bl, byte [ecx + 0x50d254]
add eax, edi
cmp edx, eax
jg 0x4f2ad0
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4f2aec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
mov bx, word [0x50d554]
cmp dword [esp], 0x20
jge 0x4f2b31
mov edx, dword [esp]
dec edx
test edx, edx
jl 0x4f2b75
inc edx
xor esi, esi
movzx edi, bx
shr edi, 8
mov di, word [edi*2 + 0x50d354]
shl ebx, 8
xor di, bx
xor ebx, ebx
mov bl, byte [eax + esi]
xor di, bx
mov ebx, edi
inc esi
dec edx
jne 0x4f2b0d
jmp 0x4f2b75
mov edx, dword [esp]
test edx, edx
jns 0x4f2b3b
add edx, 0x1f
sar edx, 5
inc edx
xor esi, esi
mov edi, dword [esp]
dec edi
mov dword [esp + 4], edi
cmp esi, dword [esp + 4]
jge 0x4f2b75
movzx edi, bx
shr edi, 8
mov di, word [edi*2 + 0x50d354]
shl ebx, 8
xor di, bx
xor ebx, ebx
mov bl, byte [eax + esi]
xor di, bx
mov ebx, edi
add esi, edx
cmp esi, dword [esp + 4]
jl 0x4f2b4f
mov esi, 2
movzx eax, bx
shr eax, 8
mov ax, word [eax*2 + 0x50d354]
shl ebx, 8
xor ax, bx
movzx edx, cx
shr edx, 8
xor ax, dx
mov ebx, eax
shl cx, 8
dec esi
jne 0x4f2b7a
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4f2ba8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, dword [0x50d958]
cmp dword [esp], 0x20
jge 0x4f2be8
mov edx, dword [esp]
dec edx
test edx, edx
jl 0x4f2c28
inc edx
xor esi, esi
mov edi, ebx
shr edi, 0x18
mov edi, dword [edi*4 + 0x50d558]
shl ebx, 8
xor edi, ebx
xor ebx, ebx
mov bl, byte [eax + esi]
xor edi, ebx
mov ebx, edi
inc esi
dec edx
jne 0x4f2bc8
jmp 0x4f2c28
mov edx, dword [esp]
test edx, edx
jns 0x4f2bf2
add edx, 0x1f
sar edx, 5
inc edx
xor esi, esi
mov edi, dword [esp]
dec edi
mov dword [esp + 4], edi
cmp esi, dword [esp + 4]
jge 0x4f2c28
mov edi, ebx
shr edi, 0x18
mov edi, dword [edi*4 + 0x50d558]
shl ebx, 8
xor edi, ebx
xor ebx, ebx
mov bl, byte [eax + esi]
xor edi, ebx
mov ebx, edi
add esi, edx
cmp esi, dword [esp + 4]
jl 0x4f2c06
mov esi, 4
mov eax, ebx
shr eax, 0x18
mov eax, dword [eax*4 + 0x50d558]
shl ebx, 8
xor eax, ebx
mov edx, ecx
shr edx, 0x18
xor eax, edx
mov ebx, eax
shl ecx, 8
dec esi
jne 0x4f2c2d
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4f5878
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f58fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.00448224
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404f00
mov eax, dword [ebp - 0x110]
mov edx, esi
call fcn.00409440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5903
lea eax, [ebp - 0x110]
call fcn.00404c90
ret

Function at 0x4f9a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
xor ecx, ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405140
mov eax, dword [ebp - 8]
call fcn.00405140
xor eax, eax
push ebp
push 0x4f9b45
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00407e58
mov word [ebp - 0x20], 5
mov dword [ebp - 0x24], 0x10
mov dword [ebp - 0x28], 0x18
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
lea edx, [ebp - 0x70]
mov ecx, 1
mov eax, 0x4f9b5c
call fcn.0040ab78
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
call fcn.0040a150
mov eax, dword [ebp - 0x74]
call fcn.00405150
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405150
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4f9b1f
mov ebx, dword [ebp - 0x58]
jmp 0x4f9b22
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9b4c
lea eax, [ebp - 0x74]
call fcn.00404c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cb4
ret
Function at 0x4fce38
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x50de28]
mov eax, dword [eax]
call fcn.004aa348
xor eax, eax
push ebp
push 0x4fcf2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x50de28]
mov eax, dword [eax]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4fcf15
mov eax, dword [0x50de28]
mov eax, dword [eax]
mov edx, esi
call fcn.0041a214
mov ebx, eax
cmp byte [ebx + 0x35], 0
jne 0x4fced4
lea eax, [ebp - 0x9c]
push eax
push 0xffffffffffffffff
push 0
call sub.user32.dll_EnumDisplaySettingsA
test eax, eax
je 0x4fced4
mov eax, dword [ebx + 0xd0]
cmp eax, dword [ebp - 0x34]
jne 0x4fcebf
mov eax, dword [ebx + 0xd4]
cmp eax, dword [ebp - 0x30]
jne 0x4fcebf
mov eax, dword [ebx + 0xd8]
cmp eax, dword [ebp - 0x2c]
je 0x4fced4
mov dword [ebx + 0x90], 0x1c0000
push 1
lea eax, [ebx + 0x68]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
mov eax, dword [0x50de28]
mov eax, dword [eax]
mov edx, esi
call fcn.0041a0f0
mov eax, edi
call fcn.004f8e3c
mov edx, eax
dec edx
mov eax, edi
call fcn.004f9074
push 0
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, dword [0x4aaf68]
mov eax, ebx
call fcn.00405ba8
dec esi
cmp esi, 0xffffffff
jne 0x4fce74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcf36
mov eax, dword [0x50de28]
mov eax, dword [eax]
call fcn.004aa354
ret

Function at 0x4fd19c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405140
xor eax, eax
push ebp
push 0x4fd225
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
jbe 0x4fd20f
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00405150
push eax
push edi
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jbe 0x4fd209
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4fd203
cmp dword [ebp - 0x1c], 4
sete bl
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd22c
lea eax, [ebp - 4]
call fcn.00404c90
ret