joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de3bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, edx
test ebx, ebx
js 0x4de3d4
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4de3cd
mov eax, esp
mov esi, ecx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4de429
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004048a0
dec esi
test esi, esi
jl 0x4de413
inc esi
lea eax, [ebp - 4]
mov dl, byte [ebx]
xor dl, 0x3a
call fcn.00404a80
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00404b60
inc ebx
dec esi
jne 0x4de3f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de430
lea eax, [ebp - 4]
call fcn.004048a0
ret
Function at 0x4de48c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4de494
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4de693
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x4de6ac
call fcn.00404938
mov word [ebp - 2], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x40]
call fcn.00404b58
mov esi, eax
test esi, esi
jle 0x4de51d
mov ebx, 1
mov eax, dword [ebp - 0xc]
mov al, byte [eax + ebx - 1]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x40]
mov dl, byte [edx + ebx - 1]
xor al, dl
and eax, 0xff
lea ecx, [ebp - 0x14]
mov edx, 1
call fcn.00409460
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404b60
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x40]
movzx eax, byte [eax + ebx - 1]
add word [ebp - 2], ax
inc ebx
dec esi
jne 0x4de4da
mov ax, word [ebp - 2]
mov byte [ebp - 3], al
mov byte [ebp - 4], ah
mov eax, dword [ebp - 0xc]
call fcn.00404b58
and eax, 0x80000001
jns 0x4de53b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jle 0x4de54c
lea eax, [ebp - 0xc]
mov edx, 0x4de6b8
call fcn.00404b60
mov eax, edi
call fcn.004048a0
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.00404b58
mov esi, eax
sar esi, 1
jns 0x4de568
adc esi, 0
test esi, esi
jle 0x4de61d
mov ebx, 1
cmp byte [ebp - 0xd], 0
je 0x4de5c9
lea eax, [ebp - 0x20]
push eax
mov edx, ebx
add edx, edx
dec edx
mov ecx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404db0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4de6c4
call fcn.00404ba4
mov eax, dword [ebp - 0x1c]
call fcn.0040949c
xor edx, edx
mov dl, byte [ebp - 3]
xor eax, edx
lea ecx, [ebp - 0x18]
mov edx, 1
call fcn.00409460
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00404b60
jmp 0x4de615
lea eax, [ebp - 0x2c]
push eax
mov edx, ebx
add edx, edx
dec edx
mov ecx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404db0
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x4de6c4
call fcn.00404ba4
mov eax, dword [ebp - 0x28]
call fcn.0040949c
xor edx, edx
mov dl, byte [ebp - 4]
xor eax, edx
lea ecx, [ebp - 0x24]
mov edx, 1
call fcn.00409460
mov edx, dword [ebp - 0x24]
mov eax, edi
call fcn.00404b60
inc ebx
dec esi
jne 0x4de575
push dword [edi]
lea ecx, [ebp - 0x30]
xor eax, eax
mov al, byte [ebp - 3]
mov edx, 2
call fcn.00409460
push dword [ebp - 0x30]
mov al, byte [ebp - 3]
xor al, byte [ebp - 4]
and eax, 0xff
lea ecx, [ebp - 0x34]
mov edx, 2
call fcn.00409460
push dword [ebp - 0x34]
lea ecx, [ebp - 0x38]
xor eax, eax
mov al, byte [ebp - 4]
mov edx, 2
call fcn.00409460
push dword [ebp - 0x38]
mov eax, edi
mov edx, 4
call fcn.00404c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de69a
lea eax, [ebp - 0x38]
mov edx, 0xa
call fcn.004048c4
lea eax, [ebp - 0xc]
call fcn.004048a0
ret
Function at 0x4deacc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d40
xor eax, eax
push ebp
push 0x4deb5e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00404b58
mov edi, eax
test edi, edi
jle 0x4deb19
mov eax, 1
mov edx, dword [ebp - 4]
mov cl, byte [edx + eax - 1]
xor bl, cl
mov edx, dword [ebp - 4]
xor edx, edx
mov dl, cl
add esi, edx
inc eax
dec edi
jne 0x4deb03
mov eax, esi
mov edx, esi
shr edx, 8
mov ecx, eax
xor cl, bl
xor cl, dl
and ebx, 0xff
and eax, 0xff
shl eax, 8
add ebx, eax
xor eax, eax
mov al, dl
shl eax, 0x10
add ebx, eax
xor eax, eax
mov al, cl
shl eax, 0x18
add ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4deb65
lea eax, [ebp - 4]
call fcn.004048a0
ret

Function at 0x4f0f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, eax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4f0f75
pop es
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x4f0f89
mov byte [ebp - 1], 0x55
mov al, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop esi
pop ecx
pop ebp
ret
Function at 0x4f2412
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.kernel32.dll__lcreat]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4f2438
jmp 0x4f254e
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll__lopen]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x4f2458
jmp 0x4f254e
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov al, byte [ebp - 4]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f7551
add esp, 4
mov dword [0x50c0a0], 0
mov dword [ebp - 0x420], 0x646c6f47
mov dword [ebp - 0x41c], 0x6f736e65
mov byte [ebp - 0x418], 0x66
mov dword [ebp - 0x20], 0
jmp 0x4f24a5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x4f24c5
mov eax, dword [ebp - 0x20]
movsx eax, byte [eax + ebp - 0x420]
xor al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + ebp - 0x420], al
jmp 0x4f24a2
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x417], al
push 0xa
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4f252d
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004f70f4
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lwrite]
jmp 0x4f24e1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.kernel32.dll__lclose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4f2553
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004f6e8d
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004f6f15
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call fcn.004f778f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 2
jne 0x4f25d6
cmp dword [0x50c2d2], 1
jne 0x4f25d6
cmp dword [ebp - 0xc], 0
je 0x4f25d6
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f2412
add esp, 8
jmp 0x4f25e5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x4f27d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0x4f281b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4f2841
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x50c0a4], ecx
jne 0x4f283f
cmp dword [ebp - 0xc], 0
je 0x4f283d
mov eax, dword [ebp - 0xc]
add dword [eax + 8], 0xa
jmp 0x4f2841
jmp 0x4f2818
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x4f28e4
mov dword [ebp - 0x18], 0
jmp 0x4f286f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4f28e4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp dword [eax*4 + 0x50c0a4], ecx
jne 0x4f28e2
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx*4 + 0x50c1b2]
cmp dword [eax*4 + 0x50c13a], ecx
jb 0x4f28d1
mov eax, dword [ebp - 0x10]
cmp dword [0x50c0a0], eax
je 0x4f28bf
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x50c11c]
push eax
call fcn.004f7551
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [0x50c0a0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f70a8
add esp, 8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add dword [ecx*4 + 0x50c13a], eax
jmp 0x4f28e4
jmp 0x4f286c
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4f28f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x4f2943
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jge 0x4f29a5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [eax*4 + 0x50c0a4], ecx
jne 0x4f29a3
mov eax, dword [ebp - 0xc]
cmp dword [0x50c0a0], eax
je 0x4f297d
mov eax, dword [ebp - 0x18]
mov al, byte [eax + 0x50c11c]
push eax
call fcn.004f7551
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x50c0a0], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f70f4
add esp, 8
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 0
je 0x4f29a1
mov eax, dword [ebp - 8]
add dword [eax + 8], 0xa
jmp 0x4f29a5
jmp 0x4f2940
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x4f29d3
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f70a8
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 0x14
Function at 0x4f7188
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], 0xffffffff
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 0
push 0
push 0x1e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 0xc], 0
jmp 0x4f71c7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jge 0x4f729d
push 0
lea eax, [ebp - 0x14]
push eax
push 0xa
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
xor eax, eax
mov al, byte [ebp - 0x20]
cmp eax, 0x54
jne 0x4f7298
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x44
je 0x4f7217
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
je 0x4f7217
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x53
jne 0x4f7298
mov al, byte [ebp - 0x17]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.004f7551
add esp, 4
xor eax, eax
mov al, byte [ebp - 0x1f]
cmp eax, 0x64
jne 0x4f726a
mov dword [0x50c2d2], 1
mov dword [ebp - 0x10], 0
jmp 0x4f724d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jge 0x4f7268
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x1e]
xor cl, byte [ebp - 0x17]
mov eax, dword [ebp - 0x10]
mov byte [eax + ebp - 0x1e], cl
jmp 0x4f724a
jmp 0x4f7274
mov dword [0x50c2d2], 0
mov eax, dword [ebp - 0x1e]
xor eax, 0x19611225
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a]
xor eax, 0x198931
and eax, 0xffffff
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx]
mov dword [ebp - 8], eax
jmp 0x4f729d
jmp 0x4f71c4
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
jmp 0x4f72b4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4f73de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0xffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 0xa
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov dword [ebp - 8], 0
jmp 0x4f7410
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x4f742b
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + ebp - 0x18]
xor cl, byte [ebp - 0xf]
mov eax, dword [ebp - 8]
mov byte [eax + ebp - 0x18], cl
jmp 0x4f740d
cmp dword [ebp - 0x18], 0x646c6f47
jne 0x4f7475
cmp dword [ebp - 0x14], 0x6f736e65
jne 0x4f7475
xor eax, eax
mov al, byte [ebp - 0x10]
cmp eax, 0x66
jne 0x4f7475
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
push eax
call fcn.004f7551
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x4f746c
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 4], 0xa
jmp 0x4f7485
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
jmp 0x4f748a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f77ea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
nop
leave
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
push edi
push esi
push edx
push ecx
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f6e8d
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004f6f15
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004f7a19
add esp, 8
cmp eax, 0xffffffff
je 0x4f784f
mov dword [ebp - 0x14], 1
jmp 0x4f7856
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 2
jne 0x4f7886
cmp dword [ebp - 8], 0
je 0x4f7886
cmp dword [ebp - 0x14], 0
je 0x4f7886
push 0x50ca80
mov eax, dword [ebp - 4]
push eax
call fcn.004f7897
add esp, 8
pop ebx
pop ecx
pop edx
pop esi
pop edi
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x4f7a67
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 4], eax
push 2
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4f7b3c
cmp dword [ebp - 8], 0
jne 0x4f7b3c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov al, byte [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
push eax
call fcn.004f7551
add esp, 4
mov dword [ebp - 0x41c], 0x646c6f47
mov dword [ebp - 0x418], 0x6f736e65
mov byte [ebp - 0x414], 0x66
mov dword [ebp - 0x1c], 0
jmp 0x4f7af4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jge 0x4f7b16
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax + ebp - 0x41c]
mov ecx, dword [ebp + 0xc]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + ebp - 0x41c], al
jmp 0x4f7af1
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 0x413], al
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xa
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
jmp 0x4f7b4e
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4fb4e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 8]
push 0xfffffffffffffff0
add ecx, 0x646c6f47
pop esi
xor word [eax + 0xc], cx
xor word [eax + 0xe], cx
xor dword [eax + 0x110], ecx
xor byte [eax + 0x114], cl
mov dword [ebp + 8], ecx
lea ecx, [eax + 0x10]
sub esi, eax
mov edi, pe_nt_image_headers32
lea eax, [ecx + esi]
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 8]
xor byte [ecx], al
inc ecx
dec edi
jne 0x4fb51a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4fb532
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov dword [ebp + 0x10], pe_nt_image_headers32
add eax, 0x646c6f47
xor edi, edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 7]
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp - 4]
xor al, byte [esi + edi]
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x4fb55c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4fb579
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x4fb5a1
xor eax, eax
leave
ret
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub eax, ecx
je 0x4fb5d5
dec eax
je 0x4fb5b5
dec eax
je 0x4fb5c7
jmp 0x4fb59d
cmp dword [ebp - 0x8c], ecx
jne 0x4fb5c1
push 4
jmp 0x4fb5d7
jbe 0x4fb5c7
push 5
jmp 0x4fb5d7
cmp dword [ebp - 0x90], 5
sbb eax, eax
add eax, 7
leave
ret
push 3
pop eax
leave
ret

Function at 0x4fb5da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x48
mov eax, dword [edi]
mov cl, byte [eax]
mov al, byte [eax + 1]
mov byte [esi + 3], al
mov eax, dword [edi + 8]
mov byte [esi + 2], cl
mov eax, dword [eax]
mov dword [esi + 4], eax
call fcn.004fb677
mov dword [esi + 8], eax
lea ecx, [eax + 0x646c6f47]
mov eax, dword [edi]
mov dword [ebp + 8], ecx
mov dx, word [eax + 2]
xor dx, cx
mov word [esi + 0xc], dx
mov edx, dword [eax + 0x12]
mov edx, dword [edx]
xor edx, ecx
mov dword [esi + 0x110], edx
mov dx, word [eax + 8]
xor dx, cx
mov word [esi + 0xe], dx
mov dl, byte [eax + 0x16]
xor dl, cl
mov byte [esi + 0x114], dl
mov dx, word [eax + 4]
test dx, dx
jbe 0x4fb673
mov edi, dword [eax + 0xe]
push ebx
movzx eax, dx
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [ebp + 0xc], eax
mov eax, ebx
push 4
cdq
pop esi
idiv esi
mov al, byte [edx + ebp + 8]
xor al, byte [edi + ebx]
inc ebx
mov byte [ecx], al
inc ecx
dec dword [ebp + 0xc]
jne 0x4fb65a
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4fb6ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add dword [ebp + 0x10], 0x646c6f47
mov eax, dword [eax]
mov dx, word [eax + 6]
test dx, dx
jbe 0x4fb711
push ebx
push esi
mov esi, dword [eax + 0xa]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
lea ecx, [eax + 7]
movzx eax, dx
mov dword [ebp + 8], eax
mov eax, edi
push 4
cdq
pop ebx
idiv ebx
mov al, byte [edx + ebp + 0x10]
xor al, byte [ecx]
mov byte [esi + edi], al
inc edi
inc ecx
dec dword [ebp + 8]
jne 0x4fb6f6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4fbbb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, ax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4fbbca
pop es
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
test al, al
jne 0x4fbbdd
add al, 0x55
mov ecx, dword [ebp + 8]
pop esi
mov byte [ecx], al
xor al, al
leave
ret
Function at 0x41247c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.004591cb
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004591cb
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x4124f8
mov eax, dword [0x630814]
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 0x1d
call fcn.004591dd
cmp dword [ebp - 0x18], esp
je 0x412524
push 6
call fcn.004591d7
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x22
call fcn.004591dd
cmp dword [ebp - 0x18], esp
je 0x412552
push 6
call fcn.004591d7
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push str.SeDebugPrivilege
push 0
mov eax, 0x23
call fcn.004591dd
cmp dword [ebp - 0x18], esp
je 0x41257e
push 6
call fcn.004591d7
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x24
call fcn.004591dd
cmp dword [ebp - 0x18], esp
je 0x41260d
push 6
call fcn.004591d7
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0x25
call fcn.004591dd
cmp dword [ebp - 0x18], esp
je 0x412632
push 6
call fcn.004591d7
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x41263a
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004591d1
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004591d1
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8