joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x485210
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4851cc
mov eax, dword [ebp - 4]
call fcn.0048679c
cmp ebx, eax
jge 0x4851cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
mov edx, ebx
call fcn.0047a7b0
mov edx, dword [0x47baec]
call fcn.00403f38
mov esi, eax
mov eax, esi
call fcn.0047c84c
test al, al
je 0x4851c2
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x4851b6
xor eax, eax
push ebp
push 0x4851af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004855bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
call fcn.0041d734
mov dword [ebp - 0x10], eax
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x3e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx edx, word [ebp - 0x22]
movzx eax, word [ebp - 0x20]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0x14]
movzx esi, word [ebp - 0x1e]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004052e8
mov eax, dword [ebp - 8]
call fcn.004051b4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004853a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4851fa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4851ae
mov eax, dword [ebp - 4]
call fcn.00485640
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a7b4
jmp 0x4851fa
mov eax, dword [ebp - 8]
call fcn.00404c8c
jmp 0x4851fa
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edx, [ebp - 0x4c]
mov eax, 0xb3
call fcn.00409b94
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x417cd0]
call fcn.0040d828
call fcn.004045e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485217
lea eax, [ebp - 0x4c]
call fcn.00404c8c
ret
Function at 0x48ebbc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48ebc4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48edb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48edcc
mov eax, esi
call fcn.00487170
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404ce0
lea ecx, [ebp - 0x10]
mov edx, 0x48ede0
mov eax, esi
call fcn.00487170
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404ce0
lea ecx, [ebp - 0x14]
mov edx, 0x48edf8
mov eax, esi
call fcn.00487170
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404ce0
lea ecx, [ebp - 0x18]
mov edx, 0x48ee14
mov eax, esi
call fcn.00487170
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404ce0
lea ecx, [ebp - 0x1c]
mov edx, 0x48ee30
mov eax, esi
call fcn.00487170
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404ce0
lea ecx, [ebp - 0x24]
mov edx, 0x48ee48
mov eax, esi
call fcn.00487170
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409458
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409884
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x48ee60
mov eax, esi
call fcn.00487170
mov eax, dword [ebp - 0x28]
call fcn.0046c6a8
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x48ee70
mov eax, esi
call fcn.00487170
mov eax, dword [ebp - 0x2c]
call fcn.0046c6a8
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48ee88
mov eax, esi
call fcn.00487170
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409884
inc eax
je 0x48ed59
lea ecx, [ebp - 0x34]
mov edx, 0x48ee88
mov eax, esi
call fcn.00487170
mov eax, dword [ebp - 0x34]
call fcn.00409848
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b5e0
fstp qword [ebp - 0x3c]
wait
call fcn.0040b990
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48ed74
lea ecx, [ebp - 0x40]
mov edx, 0x48ee88
mov eax, esi
call fcn.00487170
mov eax, dword [ebp - 0x40]
call fcn.0046c6a8
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48ee98
mov eax, esi
call fcn.00487170
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48edbd
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404cb0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404cb0
ret
Function at 0x4a9c90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4a9cea
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004a9c80
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0046abac
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0046a7ac
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9cf1
lea eax, [ebp - 4]
call fcn.00404c8c
ret

Function at 0x4ad914
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ad99f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004036fc
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004ad6c8
lea eax, [ebp - 0x24]
mov edx, 0x4ad9b8
call fcn.00404f64
mov eax, dword [ebp - 0x24]
call fcn.0040515c
mov dword [ebp - 0x16], eax
mov eax, 0x4ad9bc
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad9a6
lea eax, [ebp - 0x24]
call fcn.00404c8c
ret
Function at 0x4b01a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffbf0
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1a58], 0
jne 0x4b01e0
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 1
mov eax, dword [ebp + 8]
mov dword [eax - 0x1a58], 0x10000
mov eax, 0x7fff
mov edx, dword [esi]
mov edx, dword [edx + 0xb6c]
mov word [edx + eax*2], 0
mov eax, edx
xor ecx, ecx
mov edx, 0xfffe
call fcn.00407ef4
mov eax, dword [esi]
mov eax, dword [eax + 0x188]
mov ax, word [eax*8 + 0x4c04de]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a62], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x188]
mov ax, word [eax*8 + 0x4c04dc]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a64], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x188]
movzx eax, word [eax*8 + 0x4c04e0]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a68], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x188]
mov ax, word [eax*8 + 0x4c04e2]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6a], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x188]
cmp eax, 2
jg 0x4b0284
mov eax, dword [esi]
mov eax, dword [eax + 0x244]
or word [eax + 8], 4
jmp 0x4b0296
cmp eax, 8
jl 0x4b0296
mov eax, dword [esi]
mov eax, dword [eax + 0x244]
or word [eax + 8], 2
mov eax, dword [ebp + 8]
mov word [eax - 0x10fe], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1104], edx
mov bx, 0x8000
mov eax, dword [ebp + 8]
lea edi, [eax - 0x420]
mov eax, dword [esi]
mov edx, dword [eax + 0xb64]
mov ecx, ebx
mov eax, dword [edi + 4]
call dword [edi]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a5a], ax
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0
je 0x4b02ee
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0xffff
jne 0x4b0306
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5a], 0
jmp 0x4b036a
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 0
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0x106
jae 0x4b0328
mov eax, dword [ebp + 8]
push eax
call fcn.004affc8
pop ecx
mov eax, dword [ebp + 8]
mov word [eax - 0x1a6c], 0
xor ebx, ebx
movzx eax, bx
mov edx, dword [esi]
mov edx, dword [edx + 0xb64]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
mov dx, word [edx - 0x1a6c]
shl edx, 5
xor ax, dx
and ax, 0x7fff
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6c], ax
inc ebx
cmp bx, 2
jne 0x4b0336
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4b5160
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov esi, edx
mov ebx, eax
cmp dword [ebx + 0x1a0], 0
je 0x4b5184
mov eax, dword [ebx + 0x1a0]
call fcn.0047e06c
test al, al
jne 0x4b519a
push esp
push 0x12d
call sub.kernel32.dll_GetTempPathA
mov edx, esi
mov eax, esp
call fcn.0047e370
jmp 0x4b51a7
mov eax, esi
mov edx, dword [ebx + 0x1a0]
call fcn.00404ce0
add esp, 0x130
pop esi
pop ebx
ret
Function at 0x4b55d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4b55d8
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4b57f1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x1c], 0
jne 0x4b5611
cmp dword [ebx + 0x18], 0xa00000
jb 0x4b570a
jmp 0x4b5617
jl 0x4b570a
push dword [ebx + 0xc]
push 0x4b5808
lea edx, [ebp - 0xc]
xor eax, eax
mov al, byte [ebx + 0x20]
call fcn.0040970c
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 8]
call fcn.00409d2c
test al, al
je 0x4b5650
mov eax, dword [ebp - 8]
call fcn.0040a028
movzx esi, byte [ebx + 0x20]
dec esi
cmp esi, 1
jl 0x4b56bb
push dword [ebx + 0xc]
push 0x4b5808
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040970c
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 8]
call fcn.00409d2c
test al, al
je 0x4b56b6
push dword [ebx + 0xc]
push 0x4b5808
lea edx, [ebp - 0x18]
lea eax, [esi + 1]
call fcn.0040970c
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040501c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040a040
dec esi
test esi, esi
jne 0x4b565a
push 0
lea eax, [ebp - 0x1c]
mov ecx, 0x4b5818
mov edx, dword [ebx + 0xc]
call fcn.00404fa8
mov eax, dword [ebp - 0x1c]
call fcn.0040515c
push eax
mov eax, dword [ebx + 0xc]
call fcn.0040515c
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0
mov eax, dword [ebx + 0x10]
call fcn.0041d7b8
push 0
push 0
mov eax, dword [ebx + 0x10]
call fcn.0041d754
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov edx, dword [ebp - 4]
mov eax, 0x4b5828
call fcn.004052a0
test eax, eax
jle 0x4b5742
mov al, byte [0x4b582c]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4b5838
mov edx, 0x4b5828
mov eax, dword [ebp - 4]
call fcn.0040eea4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.00404d24
mov edx, dword [ebp - 4]
mov eax, 0x4b5844
call fcn.004052a0
test eax, eax
jle 0x4b577a
mov al, byte [0x4b582c]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x4b5838
mov edx, 0x4b5844
mov eax, dword [ebp - 4]
call fcn.0040eea4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00404d24
call fcn.0040b990
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x28]
mov eax, 0x4b5850
call fcn.0040c638
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0x4b5874
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 4]
call fcn.00404f5c
push eax
lea eax, [ebp - 4]
call fcn.004051b4
mov edx, eax
mov eax, dword [ebx + 0x10]
pop ecx
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 4]
call fcn.00404f5c
cdq
add dword [ebx + 0x18], eax
adc dword [ebx + 0x1c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b57f8
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00404cb0
ret
Function at 0x4b5cac
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4b5e45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor edx, edx
mov eax, 2
call fcn.004b5bd4
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.004b5bf4
mov edi, eax
jmp 0x4b5e17
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404f0c
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.0040a29c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004091e0
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.004091e0
mov edx, dword [ebp - 0x140]
pop eax
call fcn.004050a8
je 0x4b5dd7
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404f0c
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004091e0
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.004091e0
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.004050a8
jne 0x4b5e08
cmp bl, 1
jne 0x4b5df9
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
jmp 0x4b5e08
test bl, bl
jne 0x4b5e08
mov eax, dword [ebp - 0x128]
mov dword [ebp - 8], eax
jmp 0x4b5e1f
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.004b5c14
mov edi, eax
test edi, edi
jne 0x4b5d32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5e4c
lea eax, [ebp - 0x14c]
mov edx, 7
call fcn.00404cb0
lea eax, [ebp - 4]
call fcn.00404c8c
ret
Function at 0x4b5e58
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4b5f35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor edx, edx
mov eax, 2
call fcn.004b5bd4
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.004b5bf4
mov edi, eax
jmp 0x4b5f1b
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x130]
call fcn.004b5f48
test al, al
je 0x4b5f0c
cmp bl, 1
jne 0x4b5efd
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
jmp 0x4b5eed
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b5e58
test eax, eax
jge 0x4b5ee3
jmp 0x4b5f0c
test bl, bl
jne 0x4b5f0c
mov eax, dword [ebp - 0x128]
mov dword [ebp - 8], eax
jmp 0x4b5f1f
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.004b5c14
mov edi, eax
test edi, edi
jne 0x4b5eaf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5f3c
lea eax, [ebp - 4]
call fcn.00404c8c
ret

Function at 0x4b625c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b6341
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
test ecx, ecx
jbe 0x4b632b
mov edi, ecx
xor eax, eax
push ebp
push 0x4b6324
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
mov edx, 0x44
call fcn.00407f00
mov dword [ebp - 0x4c], 0x44
mov eax, 0x4b6354
mov dword [ebp - 0x44], eax
cmp byte [ebp + 8], 0
je 0x4b62c8
mov word [ebp - 0x1c], 1
mov ebx, 0x4000000
jmp 0x4b62d3
mov word [ebp - 0x1c], 0
mov ebx, 0x8000000
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push ebx
push 0
push 0
push 0
mov eax, esi
call fcn.0040515c
push eax
push 0
push edi
call sub.advapi32.dll_CreateProcessAsUserA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
lea eax, [ebp - 0x50]
mov ecx, esi
mov edx, 0x4b636c
call fcn.00404fa8
mov eax, dword [ebp - 0x50]
call fcn.004b5278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b632b
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6348
lea eax, [ebp - 0x50]
call fcn.00404c8c
ret
Function at 0x4ba578
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4ba6b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00404c8c
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ba697
mov byte [ebp - 9], 1
mov dword [ebp - 0x18], 0x400
mov eax, dword [ebp - 0x18]
call fcn.00402b40
mov esi, eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x400
cmp byte [ebp + 8], 0
je 0x4ba613
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
jmp 0x4ba62c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x4ba67f
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004052e8
lea eax, [ebp - 0x10]
call fcn.004051b4
mov edx, eax
mov eax, esi
mov ecx, dword [ebp - 0x18]
call fcn.00402e80
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4ba664
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404ce0
jmp 0x4ba67e
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4ba6d0
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040501c
inc edi
test ebx, ebx
je 0x4ba5eb
mov eax, esi
call fcn.00402b70
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba6bc
lea eax, [ebp - 0x10]
call fcn.00404c8c
lea eax, [ebp - 4]
call fcn.00404c8c
ret
Function at 0x41e9c3
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x41ea77
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0041e953
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x41ea50
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ea83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x41ea9e
test ebp, ebp
je 0x41ea9e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x41eaa6
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x41eae6
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x41eb42
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x41eb3d
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41eb28
test dl, dl
je 0x41eb24
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41eb28
add ecx, 2
add eax, 2
test dl, dl
jne 0x41eb08
xor eax, eax
jmp 0x41eb2d
sbb eax, eax
or eax, 1
test eax, eax
je 0x41eb4c
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x41eaf5
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x41eb63
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0041e9c3
test eax, eax
jne 0x41eb7b
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0041ea83
mov esi, eax
test esi, esi
jne 0x41ebb1
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x41ebcb
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret