joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55fa98
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x55fc16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x55faef
call fcn.00471ebc
mov eax, dword [ebx + 0x18]
call fcn.00478298
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x55fae7
push 0
mov eax, dword [ebx + 0x18]
call fcn.00478298
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebx + 0x18]
call fcn.0040f958
xor edx, edx
mov eax, dword [ebx + 0x14]
call fcn.0043d228
mov byte [ebx + 0x1c], 0
mov esi, dword [ebx + 0x20]
test esi, esi
je 0x55fb11
lea edx, [ebp - 8]
mov eax, dword [esi + 0x18]
call fcn.0046ea28
jmp 0x55fb19
lea eax, [ebp - 8]
call fcn.00404be8
mov eax, dword [ebx + 0x28]
mov edx, dword [eax]
call dword [edx + 0x18]
call fcn.00489904
mov esi, eax
cmp byte [ebp - 1], 0
je 0x55fb58
mov eax, dword [ebx + 0x28]
mov edx, dword [eax]
call dword [edx + 0x28]
test al, al
je 0x55fb58
cmp dword [ebp - 8], 0
je 0x55fb58
test esi, esi
je 0x55fb5c
mov eax, esi
call fcn.0047859c
test al, al
je 0x55fb5c
cmp byte [esi + 0x22e], 0
jne 0x55fb5c
xor eax, eax
jmp 0x55fb5e
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x55fc00
mov eax, dword [0x6a8a08]
mov eax, dword [eax]
xor ecx, ecx
mov dl, 1
call dword [eax + 0x2c]
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x10]
call fcn.004a5654
call fcn.0055f948
add dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x6a8f0c]
mov eax, dword [eax]
call fcn.00490210
mov edx, eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov esi, dword [eax]
call dword [esi + pe_nt_image_headers32]
mov edi, dword [ebp - 0xc]
mov eax, edi
add eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
mov esi, dword [ebp - 0x10]
mov ecx, esi
add ecx, dword [ebp - 0x18]
mov edx, edi
mov eax, esi
call fcn.0041d6e8
lea esi, [ebp - 0x30]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x6a87ac]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
mov eax, dword [ebx + 0x18]
call fcn.00471b24
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x18]
mov esi, dword [eax]
call dword [esi + 0xd0]
mov byte [ebx + 0x1c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55fc1d
lea eax, [ebp - 8]
call fcn.00404be8
ret
Function at 0x575858
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x575ab8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x5758bb
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00575320
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e6b4
cmp al, 1
jne 0x5758bb
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00575638
test al, al
je 0x575a47
cmp dword [ebp - 8], 0
jge 0x5758d9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00575320
mov eax, dword [ebp - 0x210]
call fcn.00404eb8
cmp ebx, eax
jge 0x575923
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00575320
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x6a8f5c]
and eax, 0xff
bt dword [edx], eax
jae 0x575923
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x575937
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00575834
cmp ebx, dword [ebp - 8]
je 0x575a39
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x575963
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403f54
and eax, 0x7f
movzx eax, word [eax*2 + 0x6a67e4]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x575a26
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403f54
and eax, 0x7f
movzx eax, word [eax*2 + 0x6a67e4]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.00478298
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403f54
and eax, 0x7f
movzx eax, word [eax*2 + 0x6a67e4]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00478298
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575a2d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x575a9a
cmp dword [ebp - 8], 0
jge 0x575a52
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00575320
mov eax, dword [ebp - 0x218]
call fcn.00404eb8
cmp eax, dword [ebp - 8]
jg 0x575a8c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00575320
mov eax, dword [ebp - 0x21c]
call fcn.00404eb8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00575834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575abf
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404c0c
ret
Function at 0x61ab3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
test byte [eax + 0x250], 2
jne 0x61ab5e
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x61ab5e
xor eax, eax
pop ebp
ret
mov al, 1
pop ebp
ret
Function at 0x63dc08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x63dc21
add esp, 0xfffffff0
call fcn.004040bc
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x63dd8a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00427bfc
mov byte [ebx + 0x30], 0
mov al, byte [0x63ddb0]
mov byte [ebx + 0x31], al
mov eax, ebx
call fcn.0063e99c
mov byte [ebx + 0x32], al
lea eax, [ebx + 0x34]
call fcn.00404be8
mov dword [ebx + 0xe0], 0xffffff
mov dword [ebx + 0x40], 1
xor eax, eax
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x58]
call fcn.00404be8
lea edx, [ebx + 0x5c]
mov eax, dword [0x6a87e8]
call fcn.00407088
mov dl, 1
mov eax, dword [0x429740]
call fcn.0042aeb4
mov esi, eax
mov dword [ebx + 0x64], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x63fb20
lea eax, [ebp - 8]
mov edx, 0x6a71ac
mov ecx, 0x20
call fcn.00404e68
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0042b2b0
mov byte [ebx + 0x68], 0
mov byte [ebx + 0x69], 0
mov byte [ebx + 0x6a], 0
mov dl, 1
mov eax, dword [0x639f24]
call fcn.0061316c
mov esi, eax
mov dword [ebx + 0x6c], esi
mov dword [esi + 0x80], ebx
mov ecx, ebx
mov dl, 1
mov eax, dword [0x634a90]
call fcn.00639c3c
mov dword [ebx + 0x80], eax
mov byte [ebx + 0x84], 1
mov byte [ebx + 0xa6], 0
mov byte [ebx + 0x89], 0
mov byte [ebx + 0x86], 0
mov byte [ebx + 0x87], 1
mov byte [ebx + 0x88], 1
push 0
mov eax, dword [0x6224f0]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
mov dl, 1
mov eax, dword [0x622638]
call fcn.005f6ac8
mov esi, eax
mov dword [ebx + 0x94], esi
mov dword [esi + 0x1c], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xcc]
mov dword [esi + 0x18], eax
mov dword [ebx + 0x8c], 1
xor eax, eax
mov dword [ebx + 0x98], eax
mov byte [ebx + 0x9c], 1
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63dd91
lea eax, [ebp - 8]
call fcn.00404be8
ret
Function at 0x654dac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x654ee2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 4]
mov dl, 1
mov eax, dword [0x603a5c]
call fcn.00606408
mov ebx, eax
mov edx, dword [esi + 0x30]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00471324
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00471344
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x5c4]
call fcn.006072c8
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00607274
mov dl, 1
mov eax, ebx
call fcn.006074fc
mov dl, 2
mov eax, ebx
call fcn.00607828
mov dword [ebx + 0x238], 0xcccccccd
mov dword [ebx + 0x23c], 0xcccccccc
mov word [ebx + 0x240], 0x3ffb
xor eax, eax
mov dword [ebx + 0x280], eax
mov dword [ebx + 0x284], 0x80000000
mov word [ebx + 0x288], 0x3fff
mov dx, word [ebp - 4]
mov eax, ebx
call fcn.004784b4
mov dword [ebx + 0xc], edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov dword [ebx + 0x2ac], eax
mov dword [ebx + 0x2a8], 0x657098
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov dword [ebx + 0x21c], eax
mov dword [ebx + 0x218], 0x6570b4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov dword [ebx + 0x1cc], eax
mov dword [ebx + 0x1c8], fcn.00656ffc
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x47c]
mov edx, ebx
call fcn.004650cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x654ee9
lea eax, [ebp - 0x18]
call fcn.00404be8
ret
Function at 0x65bf7c
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x65bf93
add esp, 0xfffffff0
call fcn.004040bc
mov ebx, edx
mov esi, eax
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.advapi32.dll_GetUserNameA
mov ecx, dword [ebp - 4]
dec ecx
lea edx, [ebp - 0x104]
lea eax, [esi + 0x2c]
call fcn.00404cd8
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
lea edx, [ebp - 0x104]
lea eax, [esi + 0x18]
mov ecx, dword [ebp - 4]
call fcn.00404cd8
mov eax, esi
test bl, bl
je 0x65bffd
call fcn.00404114
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x67dfe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
call fcn.0067e5fc
mov ecx, eax
mov dl, 1
mov eax, dword [0x4968dc]
call fcn.00496f34
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x67e0e6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
call fcn.0067e5fc
mov esi, eax
dec esi
test esi, esi
jl 0x67e07e
inc esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov edx, ebx
call fcn.0067e5dc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0067de58
pop ecx
mov eax, dword [ebp - 4]
call fcn.0049703c
mov edx, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x18]
mov dl, byte [edx + 0xa]
xor dl, 1
mov byte [eax + 0xc], dl
inc ebx
dec esi
jne 0x67e031
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
call fcn.00497190
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
call fcn.0067e5fc
mov esi, eax
dec esi
test esi, esi
jl 0x67e0d0
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00496fcc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2c]
mov dword [edx + ebx*4], eax
inc ebx
dec esi
jne 0x67e0b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67e0ed
mov eax, dword [ebp - 4]
call fcn.00403d58
ret

Function at 0x67fbb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], cl
mov ebp, edx
mov esi, eax
mov eax, esi
call fcn.0067fde0
mov edi, eax
dec edi
test edi, edi
jl 0x67fbf2
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.0067fdf8
mov cl, byte [esp]
xor cl, 1
mov edx, ebp
call fcn.0067f5e4
mov ecx, eax
mov edx, ebx
mov eax, esi
call fcn.0067ffd0
inc ebx
dec edi
jne 0x67fbcd
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x688d84
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol eax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x688d8a
ret
Function at 0x412b49
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x412b91
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], 0x6ed514
call fcn.004247e5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
test eax, eax
jg 0x412bcf
mov al, byte [0x7bde7b]
and eax, 0xff
test eax, eax
je 0x412bc4
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], 0x6ed53a
call fcn.004247e5
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00412b16
nop
leave
ret
Function at 0x4467ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 0x38
mov eax, 0x20
dec eax
lea ebp, [0xcc58]
dec eax
lea edi, [0xc9b9]
dec ecx
mov esp, ecx
mov word [esp + 0x20], ax
dec eax
lea esi, [0xc9ab]
call fcn.0045031d
dec eax
mov edx, dword [0x131f6]
dec eax
lea ecx, [eax*8 + 8]
dec eax
lea ebx, [0xc99d]
call fcn.004486ad
dec esp
lea ebx, [0xc98d]
inc ebp
xor ecx, ecx
inc ebp
xor edx, edx
nop dword [eax + eax]
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
je 0x4468e3
inc ecx
cmp ch, 0x87
je 0x4469fd
jg 0x44690d
inc ecx
cmp ch, 0x83
je 0x4469d1
jg 0x446971
inc ecx
cmp ch, 0x81
je 0x4469ed
inc ecx
cmp ch, 0x82
jne 0x44698d
inc ebp
movsx edx, byte [esp + 1]
dec ebp
lea eax, [esp + 2]
mov edx, 0x24
inc esp
mov ecx, edx
and ecx, 0xf
cmp cl, 0xa
dec esp
mov ecx, ebx
dec eax
cmovne ecx, ebx
dec eax
add ecx, 1
dec ebp
mov esp, eax
nop
dec eax
add eax, 1
dec eax
add ecx, 1
mov byte [eax - 1], dl
movzx edx, byte [ecx - 1]
test dl, dl
jne 0x4468bd
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
jne 0x446860
inc ecx
and ecx, 1
je 0x4468f0
mov byte [eax], 0x22
dec eax
add eax, 1
mov byte [eax], 0
dec eax
mov dword [0x13123], eax
dec eax
add esp, 0x38
pop ebx
pop esi
pop edi
pop ebp
inc ecx
pop esp
inc ecx
pop ebp
ret
inc ecx
cmp ch, 0x24
je 0x446a18
jle 0x44699d
inc ecx
cmp ch, 0x3d
jne 0x446a31
inc ebp
test edx, edx
je 0x446a4c
inc esp
mov edx, edx
inc ebx
lea ecx, [ecx + ecx]
and edx, 0xf
cmp edx, 1
dec eax
arpl dx, dx
inc esp
cmovne ecx, ecx
inc ecx
test dl, 0x10
dec eax
lea ecx, [ebp + edx*4]
je 0x446a54
mov byte [eax], 0x3a
movzx edx, byte [ecx]
dec eax
add eax, 1
dec eax
add ecx, 1
test dl, dl
dec ebp
mov esp, eax
jne 0x4468bd
jmp 0x44684d
inc ecx
cmp ch, 0x84
je 0x4469bd
inc ecx
cmp ch, 0x86
mov edx, 0x24
dec eax
lea ecx, [0xc841]
je 0x4468b4
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x44684d
inc ecx
cmp ch, 0x88
jne 0x446a0e
inc ecx
xor ecx, 1
dec ebp
mov esp, eax
inc ecx
mov ebp, 0x22
inc esp
mov byte [eax], ch
dec eax
add eax, 1
jmp 0x44684d
dec eax
lea ecx, [0xc813]
dec ebp
mov esp, eax
mov edx, 0x24
jmp 0x4468bd
inc ecx
test cl, 1
dec eax
mov ecx, esi
dec eax
cmovne ecx, edi
inc ecx
sar ecx, 1
inc ebp
xor edx, edx
movzx edx, byte [ecx]
adc ecx, ebp
jae 0x4469e7
invalid
invalid
inc ebp
movzx ebp, byte [esp + 1]
dec ecx
add esp, 2
jmp 0x4469b0
mov edx, 0x29
dec eax
lea ecx, [0xc7c3]
jmp 0x4468b4
inc ecx
cmp ch, 0x22
jne 0x44698d
mov byte [eax], 0x5c
inc esp
mov byte [esp + 0x20], ch
inc esp
mov edx, ebp
dec eax
add eax, 1
dec eax
lea ecx, [esp + 0x20]
jmp 0x4468b4
inc ecx
cmp ch, 0x5c
je 0x446a18
inc ecx
cmp ch, 0x27
je 0x446a18
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x44684d
dec ebp
mov esp, eax
jmp 0x4469b0
movzx edx, byte [ecx]
jmp 0x44695d
Function at 0x481515
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4347f7
call fcn.004a7fd9
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0047718e
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0047718e
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0047718e
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0047718e
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0047718e
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.0047718e
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.0047718e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x481c7e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43491f
call fcn.004a7fd9
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00477261
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00477261
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00477261
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00477261
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.00477261
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.00477261
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.00477261
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x48754b
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x487578
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x444740]
xor eax, edi
inc esi
cmp esi, edx
jb 0x487557
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x48a39f
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, ecx
jbe 0x48a4b6
mov ecx, edx
mov edx, dword [esp + 4]
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
dec ecx
jne 0x48a3af
ret 4
Function at 0x48af9b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov dword [ebp - 8], ecx
push esi
xor ebx, ebx
xor eax, eax
push edi
mov dword [ebp - 4], edx
xor ecx, ecx
mov byte [ebp + eax - 0x50], bl
add eax, 1
adc ecx, ebx
jne 0x48afc0
cmp eax, 0x40
jb 0x48afb0
xor edi, edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0xc], ebx
jb 0x48b051
ja 0x48afd5
cmp dword [ebp + 8], ebx
jbe 0x48b051
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
cmp edx, ebx
je 0x48aff7
mov eax, edi
xor ecx, ecx
and eax, 0xff
or eax, ecx
jne 0x48aff7
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 8]
cmp eax, ebx
jne 0x48b053
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov eax, dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebp - 0x50]
push ecx
push esi
call dword [eax + 0x14]
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
cmp eax, 0x40
ja 0x48b05a
xor ecx, ecx
xor edx, edx
cmp eax, ebx
jbe 0x48b031
xor ecx, dword [ebp + edx - 0x50]
add edx, 4
cmp edx, eax
jb 0x48b026
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x48b03c
cmp ecx, dword [eax]
jne 0x48b05a
add edi, 1
adc dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jb 0x48afd8
ja 0x48b051
cmp edi, dword [ebp + 8]
jb 0x48afd8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
push 1
pop eax
jmp 0x48b053

Function at 0x48b8e4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x435422
call fcn.004a7fd9
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.0048b98a
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.00481d93
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret