joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541d8b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5875a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 4], 0
mov dword [esi], 0x55296c
mov dword [esi + 0x58], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov dword [esi + 0xf0], 0
mov eax, dword [esi + 0xd0]
and dword [esi + 0xa0], 0xffffff40
and eax, 0xfffffffb
or eax, 3
mov dword [esi + 0xd4], 0
push 8
mov dword [esi + 0xd0], eax
call dword [sym.imp.USER32.dll_GetSysColor]
and dword [esi + 0xa0], 0xffffffbf
xorps xmm0, xmm0
mov dword [esi + 0xd8], eax
mov ecx, esi
mov eax, dword [esi + 0xd0]
and eax, 0xffffffaf
movq qword [ebp - 0x18], xmm0
or eax, 0x28
mov dword [esi + 0xdc], 0x400
mov dword [esi + 0xd0], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xb0], eax
movq qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x18]
mov dword [esi + 0xb4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xb8], eax
mov eax, dword [ebp + 8]
test eax, eax
movups xmmword [esi + 0x88], xmm0
cmovne ecx, eax
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0xcdcdcdcd
mov dword [esi + 0xe8], 4
mov dword [esi + 0xec], 0
mov dword [esi + 0x60], 0
mov byte [esi + 0x64], 1
mov dword [esi + 0xcc], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
movups xmmword [esi + 0xbc], xmm0
mov dword [esi + 8], 0x552730
mov dword [esi + 0x2c], 0x552744
mov dword [esi + 0x30], 0x552770
mov dword [esi + 0x34], 0x552794
mov dword [esi + 0x38], 0x55280c
mov dword [esi + 0x3c], 0x552834
mov dword [esi + 0x40], 0x55284c
mov dword [esi + 0x48], 0x552864
mov dword [esi + 0x4c], 0x552874
mov dword [esi + 0x50], 0x552894
mov dword [esi + 0x54], 0x5528dc
mov dword [esi + 0x58], ecx
mov ecx, dword [0x5893cc]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x480d60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0
push ebx
mov esi, ecx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp edi, ecx
jne 0x480de0
mov edx, dword [esi + 0x2c]
lea eax, [ebp - 0x18]
cmp eax, edx
jb 0x480db5
lea ebx, [ebp - 0x18]
lea eax, [edx + ecx*4]
cmp ebx, eax
mov ebx, dword [ebp + 0xc]
jb 0x480ea2
test ecx, ecx
jne 0x480dbe
lea edi, [ecx + 1]
jmp 0x480dca
add edi, edi
js 0x480df2
cmp edi, 0x1fffffff
ja 0x480df2
push 4
push edi
push edx
call fcn.0052bd97
add esp, 0xc
test eax, eax
je 0x480df2
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
lea eax, [eax + ecx*4]
test eax, eax
je 0x480def
mov dword [eax], ebx
inc dword [esi + 0x30]
mov ecx, dword [ebp - 0x1c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], ecx
mov eax, 1
mov ecx, dword [ebp + 0x14]
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x38], eax
cmp ecx, 0xffffffff
je 0x480e1f
mov eax, 3
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x480e2f
or eax, 8
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
push 0x8000
push 0x133e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.00481790
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub ecx, edx
mov eax, dword [ebp - 0xc]
push 1
push ecx
mov ecx, dword [ebp - 0x14]
sub eax, ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esi + 0x30]
dec eax
cmp dword [ebp + 0x10], 0
jne 0x480e85
test eax, eax
jne 0x480e8d
push eax
mov ecx, esi
call fcn.00487cb0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004db63a
mov esp, ebp
pop ebp
ret 0x14
push 0x80004005
call fcn.00481640
int3
Function at 0x487cb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
js 0x487d37
cmp edi, dword [esi + 0x30]
jge 0x487d37
cmp edi, dword [esi + 0x38]
je 0x487d37
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x487ceb
push 0
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
cmp edi, dword [esi + 0x30]
jge 0x487d3d
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + edi*4]
push eax
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_SetFocus]
push 1
push 0
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push edi
push 0x130c
push dword [esi + 4]
mov dword [esi + 0x38], edi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
ret 4
push 0xc000008c
call fcn.00488540
int3
Function at 0x497b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543e75
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5875a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], method.std::_Facet_base.virtual_4
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], ecx
call fcn.004cdcff
push 0x80
mov byte [ebp - 4], 1
mov dword [esi], 0x553284
call fcn.004db11c
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x497be1
push dword [ebp + 8]
mov ecx, eax
call fcn.00496e60
jmp 0x497be3
xor eax, eax
mov dword [esi + 8], eax
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x2c], 0
movups xmmword [esi + 0x30], xmm0
mov word [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
movsd qword [esi + 0x58], xmm0
mov byte [esi + 0x60], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x499a90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
shr esi, 0xf
and esi, 1
push 0x11
add esi, esi
call ebx
shr eax, 0xf
mov edi, esi
or edi, 4
and al, 1
push 0x12
cmove edi, esi
call ebx
shr eax, 0xf
mov esi, edi
or esi, 8
and al, 1
push 0x90
cmove esi, edi
call ebx
mov edi, esi
or edi, 0x100
and al, 1
push 0x14
cmove edi, esi
call ebx
mov ebx, edi
or ebx, 1
and al, 1
mov eax, dword [ebp + 8]
cmove ebx, edi
add eax, 0xfffffff4
mov esi, ebx
cmp eax, 0x84
ja case.0x499b05.14
movzx eax, byte [eax + 0x499be0]
jmp dword [eax*4 + 0x499bbc]
mov eax, dword [ebp + 0xc]
or esi, 0x200
and eax, 0x1000000
pop edi
cmove esi, ebx
mov eax, esi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
or esi, 0x200
and eax, 0x1000000
pop edi
cmovne esi, ebx
mov eax, esi
pop esi
pop ebx
pop ebp
ret
or esi, 0x200
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call edi
shr eax, 0xf
test al, 1
jne case.0x499b05.91
push 0xa1
call edi
shr eax, 0xf
test al, 1
je case.0x499b05.14
or esi, 0x800
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa2
call edi
shr eax, 0xf
test al, 1
jne case.0x499b05.91
push 0xa3
jmp 0x499b62
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa4
call edi
shr eax, 0xf
test al, 1
jne case.0x499b05.91
push 0xa5
jmp 0x499b62
or esi, 0x400
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x499c70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
shr ecx, 1
mov eax, ebx
and ecx, 4
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
or esi, 2
and al, 4
push 0x12
cmove esi, ecx
call edi
shr eax, 0xf
mov ecx, esi
or ecx, 8
and al, 1
mov eax, ebx
cmove ecx, esi
mov edx, ecx
or edx, 0x10
and al, 1
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x20
and al, 0x10
push 0x90
cmove ecx, edx
mov esi, ecx
or esi, 0x40
and bl, 2
cmove esi, ecx
call edi
mov edi, esi
or edi, 0x100
and al, 1
push 0x14
cmove edi, esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, edi
or ecx, 1
and al, 1
cmove ecx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x49be30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5444c6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x49bedc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x49bedc
call fcn.00481590
mov esi, eax
jmp 0x49bfcc
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x49beff
call fcn.00481590
jmp 0x49bfbf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x49bf1d
call fcn.00481590
jmp 0x49bfbf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x49bf3e
mov esi, 0x8007000e
jmp 0x49bfc1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0049aab0
jmp 0x49bf68
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x49bf7f
mov esi, 0x8007000e
jmp 0x49bfc1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x49bf9f
call fcn.00481590
jmp 0x49bfbf
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0049bc90
mov esi, eax
test edi, edi
je 0x49bfcc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x49bff0
lea ecx, [ebp - 0x418]
call fcn.0049af10
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004db63a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49f320
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x49f36e
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x49f332
jmp 0x49f434
cmp eax, 0x4e0
jb 0x49f434
push ebx
lea esi, [edi + 0x9c4]
mov ebx, 0xe3
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebx, 1
jne 0x49f385
lea esi, [edi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebx, 1
jne 0x49f3c7
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
mov dword [edi], ebx
pop ebx
mov eax, dword [edi]
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x49f4d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
push edi
nop word [eax + eax]
mov edi, dword [ecx]
mov eax, dword [edi]
cmp eax, 0x270
jne 0x49f531
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x49f4f3
jmp 0x49f5f5
cmp eax, 0x4e0
jb 0x49f5f5
lea esi, [edi + 0x9c4]
mov ebx, 0xe3
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebx, 1
jne 0x49f547
lea esi, [edi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebx, 1
jne 0x49f587
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
mov dword [edi], ebx
mov eax, dword [edi]
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
mov ecx, dword [ebp - 4]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ecx + 8]
ja 0x49f4e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4a1d61
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4a1d50
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4a3eb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push edi
mov edi, dword [ebp + 8]
push 0x400
push 0
push eax
call fcn.00520ff0
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x4a3ee9
mov esi, dword [esi]
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [ebp - 0x404]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a3f16
sub ecx, edx
lea eax, [ebp - 0x404]
push ecx
push eax
mov ecx, edi
call fcn.004028b0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004db63a
mov esp, ebp
pop ebp
ret
Function at 0x4a9850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5453b3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5875a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
lea esi, [edi + 0x10]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0xc], eax
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov byte [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 0x14], edi
mov byte [esi + 0x34], 0
push dword [edi]
mov dword [ebp - 4], 0
push dword [edi + 0xc]
push dword [edi + 8]
push esi
push dword [edi + 4]
push dword [edi]
call fcn.004a8980
add esp, 0x18
test al, al
jne 0x4a9917
mov dword [edi + 8], 0
mov dword [edi + 0x4c], 0
lea ecx, [edi + 0x5c]
mov dword [edi + 0x50], 0
mov byte [edi + 0x54], 0
mov dword [edi + 0x58], 0
push 1
mov dword [ebp - 4], 1
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
call fcn.004ad860
test al, al
je 0x4a9975
mov esi, dword [edi + 0x5c]
lea eax, [ebp + 0x14]
push 4
push eax
push esi
call fcn.00521200
lea eax, [esi + 4]
add esp, 0xc
mov dword [edi + 0x60], eax
lea esi, [edi + 0x10]
cmp dword [edi + 8], 0
mov eax, dword [edi + 0x5c]
je 0x4a99c1
mov ecx, dword [edi + 0x58]
mov ebx, dword [eax + ecx*4]
cmp ebx, 0xffffffff
jne 0x4a9991
lea esi, [edi + 0x24]
mov dword [edi + 0x48], esi
jmp 0x4a99f6
mov ecx, dword [esi + 0xc]
mov eax, 0x2aaaaaab
sub ecx, dword [esi + 8]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
ja 0x4a99b3
add esi, 0x2c
mov dword [edi + 0x48], esi
jmp 0x4a99f6
mov eax, dword [esi + 8]
lea ecx, [ebx + ebx*2]
lea esi, [eax + ecx*4]
mov dword [edi + 0x48], esi
jmp 0x4a99f6
mov ecx, dword [edi + 0x60]
cmp eax, ecx
je 0x4a99ef
cmp dword [eax], 0xffffffff
je 0x4a99d4
add eax, 4
cmp eax, ecx
jne 0x4a99c8
cmp eax, ecx
je 0x4a99ef
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x4c]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov byte [edi + 0x54], 1
mov dword [edi + 0x50], eax
mov dword [edi + 0x48], ecx
jmp 0x4a99f6
mov dword [edi + 0x48], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4adef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542708
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4ae036
cmp byte [ebx + 0x3d], 0
je 0x4ae036
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4adf44
xor al, al
jmp 0x4ae038
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00489fd0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4adf9f
sub eax, 1
je 0x4adfa3
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x4adff9
xor bl, bl
jmp 0x4adffb
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x4adfdb
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.0052ca5a
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x4adf9b
cmp byte [ebx + 0x3d], 0
je 0x4adff9
test esi, esi
jne 0x4adf60
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0048d5f0
jmp 0x4adf57
mov bl, 1
cmp edx, 0x10
jb 0x4ae02d
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x4ae024
test al, 0x1f
jne 0x4ae031
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4ae031
sub eax, ecx
cmp eax, 4
jb 0x4ae031
cmp eax, 0x23
ja 0x4ae031
mov eax, ecx
push eax
call fcn.004db150
add esp, 4
mov al, bl
jmp 0x4ae038
call fcn.00525588
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004db63a
mov esp, ebp
pop ebp
ret
Function at 0x4b07a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545a59
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5875a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
cmp dword [esi + 0x10], 0
jbe 0x4b08a5
cmp dword [esi + 0x14], 0x10
mov dword [ebp + 0xc], esi
jb 0x4b0815
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x400]
inc eax
and eax, 0x800000ff
jns 0x4b082a
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [ebx + 0x404]
lea edi, [ebx + eax*4]
mov dword [ebx + 0x400], eax
add edx, dword [edi]
and edx, 0x800000ff
jns 0x4b084b
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebx + 0x404], edx
mov ecx, dword [ebx + edx*4]
mov eax, dword [edi]
mov dword [ebx + edx*4], eax
mov dword [edi], ecx
mov eax, dword [ebx + 0x400]
mov ecx, dword [ebx + 0x404]
mov eax, dword [ebx + eax*4]
add eax, dword [ebx + ecx*4]
and eax, 0x800000ff
jns 0x4b087b
dec eax
or eax, 0xffffff00
inc eax
mov cl, byte [ebx + eax*4]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
xor cl, byte [eax + edx]
movzx ecx, cl
push ecx
mov ecx, edi
call fcn.0049dc50
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [esi + 0x10]
jb 0x4b0807
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8