joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd6c4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4cd7dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, 0x104
call fcn.004036cc
mov ebx, 3
push 0
push 0
push ebx
lea eax, [ebp - 0x108]
push eax
mov eax, esi
call fcn.0040515c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToCacheFileA
mov ebx, eax
test ebx, ebx
jne 0x4cd740
lea eax, [ebp - 4]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404f0c
jmp 0x4cd7a6
lea eax, [ebp - 4]
call fcn.00404c9c
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x120]
mov edx, 4
mov eax, ebx
call fcn.004097c4
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], 0xb
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0xb
lea edx, [ebp - 0x11c]
mov ecx, 1
mov eax, 0x4cd7f4
call fcn.0040aa80
mov eax, dword [ebp - 0x10c]
mov edx, 0x4cd814
call fcn.004cc8d8
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd7e3
lea eax, [ebp - 0x120]
call fcn.00404c9c
lea eax, [ebp - 0x10c]
call fcn.00404c9c
lea eax, [ebp - 4]
call fcn.00404c9c
ret

Function at 0x4cf02c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cf141
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004036cc
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004036cc
xor esi, esi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.0040a0fc
mov eax, dword [ebp - 0x5c]
call fcn.0040515c
push eax
push 0
push esi
push 0
push 0
push 0
push 0x4cf15c
push ebx
push 0x4cf168
push edi
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.0040501c
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00409434
mov eax, dword [ebp - 0x60]
call fcn.0040515c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4cf126
xor eax, eax
push ebp
push 0x4cf11f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x4cf0fb
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf126
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf148
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00404cc0
ret
Function at 0x4cf208
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xfffffff8
push 0x4cf28c
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x4cf288
cmp ebx, 0xffffffff
je 0x4cf288
lea eax, [esp + 4]
push eax
push 0x1004
push 3
push 0
push 0
push 0x9c9
push ebx
call sub.user32.dll_SendMessageTimeoutA
test eax, eax
jne 0x4cf24b
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4cf252
cmp dword [esp + 4], 0
jne 0x4cf257
xor eax, eax
mov dword [esp], eax
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp], 0
je 0x4cf288
mov eax, dword [esp]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x4cf288
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ecx
pop edx
pop ebx
ret

Function at 0x4d00bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, 0x4f5110
xor eax, eax
push ebp
push 0x4d023a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x1c
call fcn.004036cc
lea eax, [esi + 0x1c]
xor ecx, ecx
mov edx, 0x1c
call fcn.004036cc
mov ecx, ebx
mov dl, 1
mov eax, dword [0x437fdc]
call fcn.0043808c
mov ebx, eax
push 0x4d0250
lea eax, [ebp - 8]
push eax
mov ecx, 0x4d0270
mov edx, 0x4d0280
mov eax, ebx
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00404cf0
push 0x50
mov ecx, 0x4d0290
mov edx, 0x4d0280
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 8]
mov dword [esi + 4], eax
cmp byte [ebp - 1], 0
je 0x4d0173
push 0x4d02a0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4d02b0
mov edx, 0x4d0280
mov eax, ebx
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0xc]
lea eax, [esi + 8]
call fcn.00404cf0
jmp 0x4d0180
lea eax, [esi + 8]
mov edx, 0x4d02a0
call fcn.00404cf0
push 0x4d02c4
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4d02d8
mov edx, 0x4d02ec
mov eax, ebx
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x10]
lea eax, [esi + 0xc]
call fcn.00404cf0
lea eax, [esi + 0x10]
mov edx, 0x4d02fc
call fcn.00404cf0
lea eax, [esi + 0x14]
mov edx, 0x4d0318
call fcn.00404cf0
push 0x4d0344
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4d0364
mov edx, 0x4d0280
mov eax, ebx
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0x1c]
call fcn.00404cf0
mov eax, dword [esi + 4]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov edx, dword [esi + 8]
call fcn.00404cf0
lea eax, [esi + 0x28]
mov edx, dword [esi + 0xc]
call fcn.00404cf0
lea eax, [esi + 0x2c]
mov edx, 0x4d02fc
call fcn.00404cf0
lea eax, [esi + 0x30]
mov edx, 0x4d0374
call fcn.00404cf0
mov eax, ebx
call fcn.00403e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0241
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404cc0
ret
Function at 0x4d07a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d0934
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f510c]
mov eax, dword [eax + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d0911
xor eax, eax
push ebp
push 0x4d090a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f510c]
mov eax, dword [eax + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4d08fc
lea ecx, [ebp - 0xc]
mov eax, dword [0x4f510c]
mov eax, dword [eax + 0x3b4]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, 0x4d094c
call fcn.004052a0
mov esi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004051bc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404f5c
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 0xc]
call fcn.004051bc
mov eax, dword [ebp - 8]
call fcn.00409ca8
test al, al
je 0x4d08f2
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.004036cc
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.004036cc
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 8]
call fcn.0040a0fc
mov eax, dword [ebp - 0x64]
call fcn.0040515c
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
call sub.kernel32.dll_CreateProcessA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4f510c]
mov eax, dword [eax + 0x3b4]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x4d0806
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0911
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d093b
lea eax, [ebp - 0x64]
call fcn.00404c9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cc0
ret
Function at 0x4d5aa0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4d5aa8
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d5bed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x418e78]
call fcn.00403e1c
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetCommandLineA_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x4d5bfc
mov eax, 0x4d5c1c
call fcn.0041aff0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d5b59
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.0040a184
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00403098
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
call fcn.0040a184
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00409358
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00409358
mov eax, dword [ebp - 0x24]
pop edx
call fcn.004052a0
test eax, eax
jle 0x4d5b59
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
lea eax, [esi + 4]
mov ecx, 1
mov edx, dword [0x4d56b8]
call fcn.0040607c
add esp, 4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4d5bc5
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, dword [0x4d5688]
mov eax, 0xc
call fcn.00405bd8
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx*4]
add eax, 8
call fcn.00404cf0
inc ebx
dec dword [ebp - 0x14]
jne 0x4d5b8b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5bf4
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00404cc0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404cc0
ret

Function at 0x4d600c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4d6025
add esp, 0xfffffff0
call fcn.004041c4
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4d60b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d5d3c
lea eax, [esi + 8]
mov edx, dword [ebp - 4]
call fcn.00404cf0
lea eax, [ebp - 8]
mov ecx, 0x4d60e4
mov edx, dword [ebp - 4]
call fcn.00404fa8
push 0
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4d608d
lea eax, [esi + 0xc]
mov edx, dword [ebp - 8]
call fcn.00404cf0
push 0x42
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0041e1b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d60bd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cc0
ret
Function at 0x4d6708
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov edi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x4f3400]
cmp eax, dword [edx]
jne 0x4d6737
push 0x40
push edi
push 0
push ebx
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
mov esi, eax
jmp 0x4d6742
push edi
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov esi, eax
dec esi
je 0x4d6764
sub esi, 0x101
jne 0x4d6778
push esp
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetExitCodeThread
mov eax, dword [esp]
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_TerminateThread
jmp 0x4d6778
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_PeekMessageA
jmp 0x4d6717
cmp dword [ebx], 0xffffffff
je 0x4d678b
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebx], 0xffffffff
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x4e0ba8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4e0d0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, 0x4e0d24
call fcn.004052a0
test eax, eax
jne 0x4e0cf7
mov dl, 1
mov eax, dword [0x426870]
call fcn.0042cd28
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0042d2f8
mov ebx, eax
xor eax, eax
push ebp
push 0x4e0cf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044cda8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044cda8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 0x14]
mov edx, 0x8080
call fcn.004280ac
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00419b14
lea edx, [ebp - 0x17c]
mov eax, ebx
call fcn.00428484
push 0x101
push 0x160
lea eax, [ebp - 0x16c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
call sub.shell32.dll_SHGetFileInfoA
push 3
push 0
push 0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
mov eax, dword [ebp - 0x16c]
push eax
push 0
push 0
mov eax, ebx
call fcn.00428904
push eax
call sub.user32.dll_DrawIconEx
mov edx, 0x8080
mov eax, dword [ebp - 0xc]
call fcn.0042e470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0cf7
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
call fcn.00403e4c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0d14
lea eax, [ebp - 8]
call fcn.00404c9c
ret
Function at 0x4e17e8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp edx, dword [eax + 0x21c]
je 0x4e1b0f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x214]
cmp edx, eax
jge 0x4e181a
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], eax
jmp 0x4e183b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
cmp edx, eax
jle 0x4e1832
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], eax
jmp 0x4e183b
mov eax, dword [ebp - 4]
mov dword [eax + 0x21c], edx
mov eax, dword [ebp - 4]
cmp word [eax + 0x28a], 0
je 0x4e185a
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x28c]
call dword [ebx + 0x288]
mov dl, 1
mov eax, dword [0x426870]
call fcn.0042cd28
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e1b08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x48]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 4]
call fcn.0045aef0
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e19ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e1987
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4e1969
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00458ef4
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0042d2f8
call fcn.00428904
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1970
mov eax, dword [ebp - 0x14]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e3110
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e3275
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x4e328c
mov edx, ebx
call fcn.00404fa8
lea eax, [ebp - 8]
mov ecx, 0x4e329c
mov edx, ebx
call fcn.00404fa8
mov eax, dword [ebp - 8]
call fcn.00409ca8
test al, al
jne 0x4e3167
xor ebx, ebx
jmp 0x4e3252
mov eax, dword [ebp - 8]
call fcn.004e33c4
mov eax, ebx
call fcn.00409ca8
test al, al
je 0x4e3224
mov eax, ebx
call fcn.004e33c4
mov eax, ebx
call fcn.004e332c
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.004e332c
cmp esi, eax
jne 0x4e31dd
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004cbaec
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.004cbc48
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004cbaec
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x20]
call fcn.004cbc48
mov eax, dword [ebp - 0x20]
pop edx
call fcn.00409300
test al, al
je 0x4e31dd
mov ebx, 0xa
jmp 0x4e3252
mov eax, dword [ebp - 4]
call fcn.00409ca8
test al, al
je 0x4e3204
mov eax, dword [ebp - 4]
call fcn.004e33c4
mov eax, dword [ebp - 4]
call fcn.00409fa4
test al, al
jne 0x4e3204
mov ebx, 0xfffffffe
jmp 0x4e3252
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409fbc
test al, al
jne 0x4e3224
mov eax, ebx
call fcn.00409fa4
test al, al
jne 0x4e3224
mov ebx, 0xfffffffd
jmp 0x4e3252
push 0
mov eax, ebx
call fcn.0040515c
push eax
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4e3247
mov ebx, 1
jmp 0x4e324a
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00409fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e327c
lea eax, [ebp - 0x20]
call fcn.00404c9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cc0
ret
Function at 0x4e3b50
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e3d23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404c9c
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x410]
xor ecx, ecx
mov edx, 0x400
call fcn.004036cc
mov eax, esi
call fcn.00404f5c
mov dword [ebp - 0x10], eax
mov eax, esi
call fcn.0040515c
lea edx, [ebp - 0x410]
mov ecx, dword [ebp - 0x10]
call fcn.00402e8c
mov eax, dword [ebx + 8]
call fcn.00404f5c
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4e3b2c]
call fcn.0040607c
add esp, 4
mov eax, dword [ebx + 8]
call fcn.00404f5c
push eax
mov eax, dword [ebx + 8]
call fcn.0040515c
mov edx, dword [ebp - 0xc]
pop ecx
call fcn.00402e8c
xor edx, edx
push ebp
push 0x4e3cf5
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
mov eax, dword [ebx + 0xc]
push eax
call sub.advapi32.dll_CryptCreateHash
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405ea0
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
jne 0x4e3c40
call fcn.004046d8
jmp 0x4e3cfc
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push 0x6801
mov eax, dword [ebx + 0xc]
push eax
call sub.advapi32.dll_CryptDeriveKey
test eax, eax
jne 0x4e3c66
call fcn.004046d8
jmp 0x4e3cfc
push 0x400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptEncrypt
test eax, eax
je 0x4e3cbd
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x4e3cbd
inc esi
lea ebx, [ebp - 0x410]
lea ecx, [ebp - 0x414]
xor eax, eax
mov al, byte [ebx]
mov edx, 2
call fcn.004097c4
mov edx, dword [ebp - 0x414]
mov eax, edi
call fcn.00404f64
inc ebx
dec esi
jne 0x4e3c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3cfc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyKey
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptDestroyHash
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4e3b2c]
call fcn.0040607c
add esp, 4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3d2a
lea eax, [ebp - 0x414]
call fcn.00404c9c
lea eax, [ebp - 0xc]
mov edx, dword [0x4e3b2c]
call fcn.00406088
ret