joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3680
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc625
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 4]
test al, 1
jne 0x4a36db
push dword [0x6d6a90]
and eax, 0xfffffffc
mov esi, dword [eax + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call ebx
test eax, eax
je 0x4a36db
mov edi, edi
cmp dword [eax], esi
je 0x4a36f9
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a36d0
push dword [0x6d6a90]
lea eax, [edi + 1]
mov dword [ebp - 0x20], eax
call ebx
test eax, eax
je 0x4a378c
mov ecx, dword [eax + 4]
jmp 0x4a378e
cmp dword [eax + 4], 0
je 0x4a36db
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ebp + 8], eax
mov dword [ecx], 0
mov dword [ebp - 4], 0
nop
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
push eax
call fcn.004a3ad0
add esp, 8
nop
mov dword [ebp - 4], 3
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a380b
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push ecx
push dword [ebp + 8]
mov edx, 0x28
call fcn.004a1b70
mov ecx, dword [ebp + 8]
mov edx, eax
add esp, 4
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0x4a3a30
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x1c], 0
mov eax, dword [ecx]
mov dword [edx + 0x20], eax
mov dword [ecx], 0
mov ecx, dword [edi + 4]
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + 8]
call fcn.0049b5e0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.004a3830
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a3830
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b4420
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x4a3872
mov dword [ebp - 4], 0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4a386b
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x4a38b1
push dword [0x6d6a90]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a38a1
mov edx, dword [eax + 4]
test edx, edx
je 0x4a38a1
xor eax, eax
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x4a38c1
inc eax
cmp eax, 2
jl 0x4a3892
push esi
call fcn.00583872
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x28]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x4a38aa
Function at 0x4aab90
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
movzx esi, byte [esp + 0xc]
push edi
mov edi, ecx
push esi
mov eax, dword [edi + 0x204]
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x20c]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x210]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x214]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x218]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x21c]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x220]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x224]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x228]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x22c]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x230]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x234]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x238]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x23c]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x240]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x244]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x248]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x24c]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x250]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x254]
push esi
push dword [eax + 8]
call ebx
mov eax, dword [edi + 0x258]
push esi
push dword [eax + 8]
call ebx
cmp byte [esp + 0x10], 0
je 0x4aacc6
mov eax, dword [edi + 0x1f8]
sub eax, dword [edi + 0x1f4]
sar eax, 3
cmp eax, 1
jbe 0x4aacc6
mov eax, dword [edi + 0x194]
push 1
push dword [eax + 8]
call ebx
jmp 0x4aacda
mov eax, dword [edi + 0x194]
push 0
push dword [eax + 8]
call ebx
cmp byte [esp + 0x10], 0
je 0x4aad0e
mov eax, dword [edi + 0x1f8]
sub eax, dword [edi + 0x1f4]
and eax, 0xfffffff8
cmp eax, 8
je 0x4aacf7
cmp dword [edi + 0x1a4], 0
je 0x4aad0e
mov eax, 1
push eax
mov eax, dword [edi + 0x198]
push dword [eax + 8]
call ebx
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
push eax
mov eax, dword [edi + 0x198]
push dword [eax + 8]
call ebx
pop edi
pop esi
pop ebx
ret 4
Function at 0x4c2f20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4430
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [edi], vtable.DialogContactBook.0
call fcn.004c3d00
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREAeroAdmin
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4c2fda
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
shl ecx, 0x10
movzx eax, dx
or ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, edx
mov dword [ebp - 0x14], ecx
movzx ecx, ax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
shl eax, 0x10
push 4
or ecx, eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.contactsWindowPos
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
call esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.contactsWindowSize
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi + 0x2830]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [edi + 0x2834]
mov dword [0x6c5564], 0
call fcn.004cb270
mov eax, dword [edi + 0x2828]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x4c3017
push eax
call esi
mov eax, dword [edi + 0x2824]
test eax, eax
je 0x4c3024
push eax
call esi
mov eax, dword [edi + 0x2820]
test eax, eax
je 0x4c3031
push eax
call esi
mov eax, dword [edi + 0x281c]
test eax, eax
je 0x4c303e
push eax
call esi
mov eax, dword [edi + 0x2818]
test eax, eax
je 0x4c304b
push eax
call esi
mov eax, dword [edi + 0x2814]
test eax, eax
je 0x4c3058
push eax
call esi
mov eax, dword [edi + 0x2810]
test eax, eax
je 0x4c3065
push eax
call esi
lea ecx, [edi + 0xdc]
call fcn.00463e80
mov ecx, edi
call fcn.0053dd10
test byte [ebp + 8], 1
je 0x4c308b
push 0x2840
push edi
call fcn.00583877
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c3150
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x200
lea eax, [esp]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp]
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
lea eax, [eax + 2]
test cx, cx
jne 0x4c3170
mov ecx, dword [str.Aeroadmin_]
mov dword [eax], ecx
mov ecx, dword [0x5eeed4]
mov dword [eax + 4], ecx
mov ecx, dword [0x5eeed8]
mov dword [eax + 8], ecx
mov ecx, dword [0x5eeedc]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x5eeee0]
push esi
mov dword [eax + 0x10], ecx
mov ecx, dword [0x5eeee4]
push edi
mov dword [eax + 0x14], ecx
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [esp + 8]
add edi, 0xfffffffe
jmp 0x4c31d0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4c31d0
mov ecx, 6
mov esi, str.contacts.csv
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 8]
lea edx, [ecx + 2]
movsw word es:[edi], word [esi]
pop edi
pop esi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c31f3
sub ecx, edx
lea eax, [esp]
sar ecx, 1
push ecx
push eax
mov ecx, 0x6ad0ec
call fcn.004496e0
add esp, 0x200
ret
Function at 0x4cd1a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1cc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov esi, edx
push eax
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
and esi, 0xffff0000
lea eax, [esp + 0x10]
push eax
neg esi
lea eax, [esp + 0x18]
push eax
sbb esi, esi
neg esi
push esi
push edi
call dword [sym.imp.USER32.dll_ToAscii]
movsx ecx, byte [esp + 0xc]
xor ebx, ebx
test ecx, ecx
mov esi, eax
lea eax, [esp + 0x110]
cmovns ebx, ecx
push ebx
push str.return_value___d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
cmp esi, 1
cmovne ebx, eax
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x1cc
ret

Function at 0x4d0a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4d0a7a
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4d0a64
pop edi
mov eax, edx
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x4d1010
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
cmp word [0x6d6620], 0
jne 0x4d10d4
push 0x6d6620
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4d10d4
mov ecx, 0x6d6620
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4d1041
mov eax, dword [str.Aeroadmin]
mov dword [ecx], eax
mov eax, dword [0x5ef8f4]
mov dword [ecx + 4], eax
mov eax, dword [0x5ef8f8]
mov dword [ecx + 8], eax
mov eax, dword [0x5ef8fc]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5ef900]
mov dword [ecx + 0x10], eax
mov ax, word [0x5ef904]
push 0x6d6620
mov word [ecx + 0x14], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d1092
test al, 0x10
jne 0x4d10b2
push 0
push 0x6d6620
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4d10b2
xor ecx, ecx
mov eax, 0x6d6620
mov word [0x6d6620], cx
ret
push edi
mov edi, 0x6d6620
add edi, 0xfffffffe
jmp 0x4d10c0
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4d10c0
mov eax, dword [0x5ed894]
mov dword [edi], eax
pop edi
mov eax, 0x6d6620
ret
Function at 0x4d2af0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9acd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push 0x6d37f8
mov esi, ecx
mov dword [ebp - 0x10], 0x6d37f8
call fcn.00571f54
add esp, 4
test eax, eax
jne 0x4d2bf3
mov dword [ebp - 4], eax
call fcn.004d10e0
mov edx, esi
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.004e93a0
cmp dword [eax + 0x14], 8
jb 0x4d2b47
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4d2b84
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4d2b7a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d2bf9
push ecx
push edx
call fcn.00583877
add esp, 8
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x4d2b8e
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, 0x6c53b0
call fcn.00457be0
push 0x5ef940
push edi
call fcn.0059a49e
add esp, 0xc
test eax, eax
je 0x4d2bd6
mov edx, edi
mov ecx, eax
call fcn.004d1160
cmp dword [esi + 0x14], 0x10
mov edi, eax
jb 0x4d2bc0
mov esi, dword [esi]
push esi
push edi
call fcn.004d0ab0
push edi
call fcn.00598e0c
push edi
call fcn.00599929
add esp, 0x10
push 0x6d37f8
call fcn.00571f79
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push eax
call fcn.00570e47
call fcn.00591c98
int3
Function at 0x4d96a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b43f0
push eax
mov dword fs:[0], esp
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0xc], eax
mov eax, ecx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0xf
mov dword [ecx + 0x28], 1
mov word [ecx + 0x18], 0x30
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4da3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x4da3d8
call fcn.004da890
test al, al
jne 0x4da3d8
mov dword [esi + 0x44], str.invalid_BOM__must_be_0xEF_0xBB_0xBF_if_given
mov eax, 0xe
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, esi
call fcn.004da7a0
cmp byte [esi + 8], 0
je 0x4da4e7
lea esp, [esp]
cmp dword [esi + 0xc], 0x2f
jne 0x4da4e7
mov ecx, esi
call fcn.004db0d0
test al, al
je 0x4da5cd
mov ebx, dword [esi + 0xc]
lea esp, [esp]
inc dword [esi + 0x14]
inc dword [esi + 0x18]
cmp byte [esi + 0x10], 0
je 0x4da422
mov byte [esi + 0x10], 0
jmp 0x4da47a
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x1c]
cmp dword [eax], 0
je 0x4da448
mov edx, dword [ecx + 0x2c]
mov eax, dword [edx]
test eax, eax
jle 0x4da448
dec eax
mov dword [edx], eax
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
movzx ebx, byte [edx]
jmp 0x4da44f
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4da477
mov edx, dword [esi]
xor eax, eax
push 0
mov ecx, dword [edx]
mov ecx, dword [ecx + 4]
add ecx, edx
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 1]
or eax, dword [ecx + 0xc]
push eax
call fcn.00436630
mov dword [esi + 0xc], ebx
cmp ebx, 0xffffffff
je 0x4da4a0
mov eax, dword [esi + 0x24]
lea ecx, [esi + 0x20]
mov byte [esp + 0xb], bl
cmp eax, dword [esi + 0x28]
je 0x4da495
mov byte [eax], bl
inc dword [esi + 0x24]
jmp 0x4da4a0
lea edx, [esp + 0xb]
push edx
push eax
call fcn.004e24c0
mov eax, dword [esi + 0xc]
mov ebx, eax
cmp eax, 0xa
jne 0x4da4b9
inc dword [esi + 0x1c]
mov dword [esi + 0x18], 0
jmp 0x4da410
cmp eax, 0x20
je 0x4da410
cmp eax, 9
je 0x4da410
cmp eax, 0xa
je 0x4da410
cmp eax, 0xd
je 0x4da410
cmp byte [esi + 8], 0
jne 0x4da3f0
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 0x7e
ja case.0x4da4fb.1
movzx eax, byte [eax + 0x4da60c]
jmp dword [eax*4 + 0x4da5d8]
mov eax, 8
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 0xa
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 9
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 0xb
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 0xc
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 0xd
pop esi
pop ebx
add esp, 0xc
ret
push 1
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x65757274
push eax
mov ecx, esi
call fcn.004da9a0
pop esi
pop ebx
add esp, 0xc
ret
push 2
push 5
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x736c6166
push eax
mov ecx, esi
mov byte [esp + 0x1c], 0x65
call fcn.004da9a0
pop esi
pop ebx
add esp, 0xc
ret
push 3
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x6c6c756e
push eax
mov ecx, esi
call fcn.004da9a0
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, esi
pop esi
pop ebx
add esp, 0xc
jmp fcn.004db250
mov ecx, esi
pop esi
pop ebx
add esp, 0xc
jmp fcn.004daaa0
mov eax, 0xf
pop esi
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x44], str.invalid_literal
pop esi
mov eax, 0xe
pop ebx
add esp, 0xc
ret
Function at 0x4f09a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push 0
push 2
mov ebx, ecx
mov dword [esp + 0x10], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4f09ce
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret
push esi
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
lea esi, [esp + 0x30]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4f09e2
sub esi, ecx
mov ecx, ebx
sar esi, 1
cmp dword [ebx + 0x14], 8
push edi
mov edi, dword [ebx + 0x10]
jb 0x4f09ff
mov ecx, dword [ebx]
cmp esi, edi
lea edx, [esp + 0x34]
mov eax, edi
cmovb eax, esi
push eax
call fcn.00450520
add esp, 4
test eax, eax
jne 0x4f0a1d
cmp edi, esi
jb 0x4f0a1d
jbe 0x4f0a95
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x4f0a81
lea ecx, [ecx]
lea esi, [esp + 0x34]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4f0a37
mov edi, dword [ebx + 0x10]
sub esi, ecx
sar esi, 1
mov ecx, ebx
cmp dword [ebx + 0x14], 8
jb 0x4f0a53
mov ecx, dword [ebx]
cmp esi, edi
lea edx, [esp + 0x34]
mov eax, edi
cmovb eax, esi
push eax
call fcn.00450520
add esp, 4
test eax, eax
jne 0x4f0a71
cmp edi, esi
jb 0x4f0a71
jbe 0x4f0a95
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4f0a30
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
Function at 0x4f51e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
je 0x4f5323
mov eax, dword [esi]
call dword [eax + 0x24]
mov ecx, dword [ebp + 0xc]
lea edi, [esi + 0xe0]
mov ebx, eax
mov dword [esp + 0x1c], edi
mov eax, dword [esi + 0xec]
sub ebx, eax
cmp ecx, ebx
jb 0x4f5300
mov ecx, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
jmp 0x4f523a
mov ecx, dword [esp + 0x10]
lea edi, [esi + 0xe0]
test ebx, ebx
je 0x4f52fa
mov eax, dword [edi]
mov edx, ebx
add eax, dword [esp + 0x18]
mov esi, ecx
test al, 3
jne 0x4f529a
test cl, 3
jne 0x4f529a
mov esi, ebx
xor edx, edx
shr esi, 2
test esi, esi
je 0x4f5282
mov edi, ecx
mov dword [esp + 0x18], esi
mov edx, eax
sub edi, eax
lea ebx, [ebx]
mov ecx, dword [edi + edx]
lea edx, [edx + 4]
xor dword [edx - 4], ecx
sub esi, 1
jne 0x4f5270
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
lea ecx, [edx*4]
mov edx, ebx
sub edx, ecx
je 0x4f52b2
add eax, ecx
lea esi, [ecx + edi]
jmp 0x4f529e
mov edi, dword [esp + 0x10]
test edx, edx
je 0x4f52b2
sub esi, eax
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x4f52a4
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0xe0]
call fcn.00510910
sub dword [ebp + 0xc], ebx
add edi, ebx
mov dword [esi + 0xec], 0
mov ecx, esi
mov eax, dword [esi]
mov dword [esp + 0x10], edi
call dword [eax + 0x24]
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [esi + 0xec]
sub ebx, eax
mov dword [esp + 0x18], eax
cmp ecx, ebx
jae 0x4f5230
test ecx, ecx
je 0x4f531d
jmp 0x4f5307
mov edi, dword [esp + 0x10]
jmp 0x4f52b6
mov dword [esp + 0x1c], edi
mov edi, dword [ebp + 8]
push ecx
mov ecx, dword [esp + 0x20]
mov edx, edi
mov ecx, dword [ecx]
add ecx, eax
call fcn.004f5430
mov ecx, dword [ebp + 0xc]
add esp, 4
add dword [esi + 0xec], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f5430
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, edx
test cl, 3
jne 0x4f5482
test bl, 3
jne 0x4f5482
mov edx, dword [esp + 0xc]
xor eax, eax
push edi
mov edi, edx
shr edi, 2
test edi, edi
je 0x4f5474
push ebp
mov ebp, ebx
mov dword [esp + 0xc], edi
push esi
mov esi, ecx
sub ebp, ecx
lea ebx, [ebx]
mov eax, dword [esi + ebp]
lea esi, [esi + 4]
xor dword [esi - 4], eax
sub edi, 1
jne 0x4f5460
mov eax, dword [esp + 0x10]
pop esi
pop ebp
shl eax, 2
pop edi
sub edx, eax
je 0x4f549e
add ecx, eax
add ebx, eax
jmp 0x4f5486
mov edx, dword [esp + 0xc]
test edx, edx
je 0x4f549e
sub ebx, ecx
lea esp, [esp]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x4f5490
pop ebx
pop ecx
ret
Function at 0x4f54b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov dword [esp], ecx
push ebx
mov ebx, edx
push esi
test cl, 3
jne 0x4f551f
test bl, 3
jne 0x4f551f
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
test al, 3
jne 0x4f5527
push edi
mov edi, edx
xor esi, esi
shr edi, 2
test edi, edi
je 0x4f550f
push ebp
mov ebp, ebx
mov dword [esp + 0x18], edi
sub ebp, eax
mov esi, eax
sub ecx, eax
mov edx, ecx
jmp 0x4f54f0
mov ecx, dword [esi + ebp]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
mov dword [edx + esi - 4], ecx
sub edi, 1
jne 0x4f54f0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
pop ebp
shl esi, 2
pop edi
sub edx, esi
je 0x4f5547
add ecx, esi
add ebx, esi
add eax, esi
jmp 0x4f5527
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test edx, edx
je 0x4f5547
sub ebx, eax
sub ecx, eax
mov dword [esp + 8], ecx
mov esi, ecx
mov cl, byte [eax + ebx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x4f5535
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4f5550
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
xor cl, cl
push ebp
push esi
test bl, 3
jne 0x4f55d5
test dl, 3
jne 0x4f55d5
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, esi
mov dword [esp + 0x10], eax
shr edi, 2
xor ecx, ecx
test edi, edi
je 0x4f55a4
mov esi, ebx
mov dword [esp + 0x14], edi
sub esi, edx
mov ecx, edx
xor ebp, ebp
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or ebp, eax
sub edi, 1
jne 0x4f5586
mov esi, dword [esp + 0x1c]
mov eax, ebp
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ebp
shl ecx, 2
pop edi
sub esi, ecx
jne 0x4f55b8
pop esi
test eax, eax
pop ebp
sete al
pop ebx
add esp, 8
ret
add ebx, ecx
add edx, ecx
mov ecx, eax
shr eax, 0x10
shr ecx, 0x18
or cl, al
mov eax, dword [esp + 0xc]
shr eax, 8
or cl, al
or cl, byte [esp + 0xc]
jmp 0x4f55d9
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4f55f0
sub ebx, edx
nop
mov al, byte [edx + ebx]
lea edx, [edx + 1]
xor al, byte [edx - 1]
or cl, al
sub esi, 1
jne 0x4f55e0
pop esi
test cl, cl
pop ebp
sete al
pop ebx
add esp, 8
ret