joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452200
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47caa6
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x4a5eb0]
xor eax, esp
mov dword [esp + 0x328], eax
push esi
push edi
mov eax, dword [0x4a5eb0]
xor eax, esp
push eax
lea eax, [esp + 0x338]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x136]
push ecx
mov word [esp + 0x138], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x130]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x10]
call fcn.00406300
push str.ErrorReport.exe
push 0x48b8ac
lea ecx, [esp + 0x14]
mov dword [esp + 0x348], 0
call fcn.00407fd0
cmp eax, 1
jne 0x4523c1
push 0x2000
call fcn.00467b98
mov esi, eax
add esp, 4
test esi, esi
je 0x4523c1
push 0x1000
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [0x4a643c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4a643c
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x34c]
mov edx, dword [esp + 0x348]
push ecx
push edx
lea eax, [esp + 0x18]
push str.CM_RegiError_d_HR_x
push eax
mov byte [esp + 0x350], 1
call fcn.00402e80
lea ecx, [esp + 0x24]
push ecx
call fcn.00451f40
mov edi, dword [esp + 0x24]
mov edx, dword [eax]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push str.ConnectionManagerError_
push edi
push edx
push str.UnKnown
push eax
push ecx
push str.0.0.0.0
push str.ModuleNameDeviceManager_HiddenIP_sOS_Version_d._dOS_Locale_sSW_Version_sError_sComments_s
push 0xfff
push esi
call dword [sym.imp.MSVCR90.dll__snwprintf]
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 0x3c
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45237d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
push 1
push 0
push esi
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
lea eax, [edi - 0x10]
add esp, 4
mov byte [esp + 0x340], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4523c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x340], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4523e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x338]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.00475d76
add esp, 0x338
ret
Function at 0x452740
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x45276a
push 0x4a46ec
lea ecx, [esp + 8]
call dword [sym.imp.MSVCR90.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49cd78
lea eax, [esp + 8]
push eax
call sub.MSVCR90.dll__CxxThrowException
xor edx, edx
cmp dword [edi + 0x3cc], edx
jle 0x452790
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
lea ecx, [ecx]
mov cl, byte [esi]
xor byte [eax], cl
inc edx
inc esi
inc eax
cmp edx, dword [edi + 0x3cc]
jl 0x452780
pop esi
pop edi
add esp, 0xc
ret 8
Function at 0x456c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47cd71
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a5eb0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [0x4a643c]
mov edx, dword [eax + 0xc]
mov esi, 1
mov ecx, 0x4a643c
mov dword [esp + 0x24], esi
call edx
mov edi, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x30]
push ecx
mov dword [esp + 0x1c], esp
mov ebx, esp
push ecx
mov dword [esp + 0x20], esp
mov ebp, esp
push ecx
mov dword [esp + 0x20], esi
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
push eax
call fcn.004014f0
add esp, 4
add eax, 0x10
push ebp
mov dword [esi], eax
call fcn.00414000
add esp, 8
push ebx
call fcn.00456b60
add esp, 8
call fcn.00456920
add esp, 4
test eax, eax
je 0x456d18
push 0x4a63a4
mov ecx, edi
call fcn.00404450
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x456d3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x45dfa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47d7be
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a5eb0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x1c], ebx
mov dword [ebx], vtable.CXmlParserWMModelProfile.0
mov ebp, dword [ebx + 0x70]
lea edi, [ebx + 0x60]
mov dword [esp + 0x30], 2
cmp dword [edi + 0xc], ebp
jbe 0x45dfec
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov esi, dword [edi + 0xc]
mov eax, dword [edi]
mov dword [esp + 0x14], eax
cmp esi, dword [edi + 0x10]
jbe 0x45e000
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x14]
mov eax, dword [edi]
push ebp
push ecx
push esi
push eax
lea edx, [esp + 0x30]
push edx
mov ecx, edi
call fcn.0045da50
mov ebp, dword [ebx + 0x88]
cmp dword [ebx + 0x84], ebp
lea esi, [ebx + 0x78]
jbe 0x45e02d
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
cmp ecx, dword [esi + 0x10]
jbe 0x45e049
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov eax, dword [esi]
push ebp
push edx
push ecx
push eax
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.0045c850
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.0045cb40
mov ecx, edi
mov byte [esp + 0x30], 0
call fcn.0045db70
mov ecx, ebx
mov dword [esp + 0x30], 0xffffffff
call fcn.0045ad80
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x45ea80
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47d888
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a5eb0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push 0x481880
push eax
lea ecx, [esp + 0x1c]
xor ebx, ebx
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.MSVCR90.dll__wfopen_s]
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jne 0x45eb0d
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45eaf7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [sym.imp.MSVCR90.dll_fseek]
push 2
push ebx
push eax
call esi
add esp, 0xc
cmp eax, ebx
je 0x45eb50
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x45eb32
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x45eaeb
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR90.dll_ftell]
mov edx, dword [esp + 0x18]
push ebx
push ebx
push edx
mov edi, eax
call esi
lea eax, [edi + 2]
push eax
call fcn.00467b98
mov ecx, dword [esp + 0x28]
push ecx
push edi
mov esi, eax
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fread]
mov byte [eax + esi], bl
mov byte [eax + esi + 1], bl
mov al, byte [esi]
add esp, 0x24
cmp al, 0xff
jne 0x45eba2
cmp byte [esi + 1], 0xfe
jne 0x45eba2
lea edx, [esi + 2]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
jmp 0x45ec07
cmp al, 0xef
jne 0x45ec01
cmp byte [esi + 1], 0xbb
jne 0x45ec01
cmp byte [esi + 2], 0xbf
jne 0x45ec01
push ebx
push ebx
push 0xffffffffffffffff
lea edi, [esi + 3]
push edi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ebp, [eax + 1]
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00467b98
add esp, 4
push ebp
mov ebx, eax
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
jmp 0x45ec07
push esi
call fcn.00467290
push esi
mov edi, eax
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x45ec24
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45ec4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x45f8d0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x47d9a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x4a5eb0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
push eax
mov dword [esp + 0x2c], 0
call fcn.004014f0
add eax, 0x10
add esp, 4
mov dword [esp + 0x10], eax
push str.Static_
push str.Cache_
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00407fd0
mov ebp, dword [esp + 0x10]
push ecx
lea esi, [ebp - 0x10]
mov dword [esp + 0x18], esp
mov edi, esp
push esi
call fcn.004014f0
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.0045f720
fst qword [esp + 0x1c]
fldz
add esp, 4
fcompp
fnstsw ax
test ah, 5
jp 0x45f99d
mov eax, dword [esp + 0x30]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.004014f0
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.0045f720
fcomp qword [esp + 0x1c]
add esp, 4
fnstsw ax
test ah, 0x41
jp 0x45f99d
mov eax, dword [esp + 0x30]
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [esp + 0x28], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45f9bb
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45f9e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x460190
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47dab0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a5eb0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
add ecx, eax
push ecx
xor ebx, ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ebx
call fcn.004034c0
mov edx, dword [0x4a643c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4a643c
mov dword [esp + 0x28], ebx
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x18]
push ecx
push 0x491f78
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
mov dword [esp + 0x24], ebx
call fcn.0045fa00
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 2
call fcn.00403090
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x460241
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x34]
jmp 0x460250
push 0x488314
push edi
call dword [sym.imp.MSVCR90.dll__mbscmp]
add esp, 8
test eax, eax
setne al
test al, al
je 0x46032d
mov eax, ebx
sub eax, 1
je 0x46031f
cmp ebx, 1
je 0x46032d
lea ecx, [esp + 0x18]
push ecx
push 0x491f78
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x3c]
call fcn.0045fa00
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
mov byte [esp + 0x28], 3
cmp eax, esi
je 0x4602f4
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4602e2
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4602e2
push eax
call fcn.00401570
mov ebp, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4602d9
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebp + 0x10]
mov dword [esp + 0x34], edi
jmp 0x4602f4
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x3c]
call fcn.00402ba0
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x460319
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
jmp 0x460250
push edi
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 4
mov dword [esp + 0x14], eax
lea eax, [edi - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46034e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x460376
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x466b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x24
mov eax, dword [0x4a5eb0]
xor eax, esp
mov dword [esp + 0x20], eax
push 0x492728
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x466b7c
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00475d76
add esp, 0x24
ret
push esi
push 0x49270c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x466b9f
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00475d76
add esp, 0x24
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push esi
mov dword [esp + 0x20], 0
call ebx
lea edx, [esp + 0x14]
push edx
mov edi, eax
push 5
mov ecx, method.ATL::CComObject_class_CDeviceManager_.2.virtual_304
lea eax, [esp + 0x24]
sub ecx, esi
push eax
sub ecx, 5
push esi
mov byte [esp + 0x2c], 0xe9
mov dword [esp + 0x2d], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, eax
test edi, edi
je 0x466c00
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
push 5
push esi
call ebx
mov ecx, dword [esp + 0x30]
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.00475d76
add esp, 0x24
ret

Function at 0x466c20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
push 0x1c
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x466c3f
pop edi
add esp, 0x1c
ret
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x466c5f
pop esi
pop edi
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
push ebx
push ebp
movzx ebp, word [eax + 6]
sub edi, esi
xor ebx, ebx
lea ecx, [ecx + eax + 0x18]
test ebp, ebp
jbe 0x466ca0
lea eax, [ecx + 0x10]
mov edi, edi
mov ecx, dword [eax]
mov edx, dword [eax - 8]
mov esi, dword [eax - 4]
cmp ecx, edx
ja 0x466c8e
mov ecx, edx
cmp edi, esi
jb 0x466c98
add ecx, esi
cmp edi, ecx
jbe 0x466caa
inc ebx
add eax, 0x28
cmp ebx, ebp
jb 0x466c80
pop ebp
pop ebx
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebx
pop ebp
mov dword [edx], ebx
sub edi, esi
pop ebx
mov dword [eax], edi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret
Function at 0x467a62
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4a6458], 0
push esi
jne 0x4679d5
call fcn.004678fb
test eax, eax
je 0x467a18
mov eax, dword [0x4a6458]
cmp eax, 1
jne 0x4679f6
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x467a18
pop esi
ret
push eax
call dword [0x4a6460]
test eax, eax
jne 0x467a60
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x467a1c
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4a6458]
call dword [0x4a6460]
mov edi, eax
test edi, edi
je 0x467a41
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x467a5d
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4a6458]
call dword [0x4a645c]
add edi, 0x10
cmp edi, esi
jb 0x467a49
mov eax, edi
pop edi
pop esi
ret
jmp 0x4679c2

Function at 0x469f2e
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x100]
mov byte [ebp + 0xb], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 1], cl
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x469f8e
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], ecx
inc byte [ebp + 0xb]
movzx ecx, byte [ebp + 0xb]
lea esi, [ecx + eax]
mov dl, byte [esi]
add byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
add ecx, eax
mov bl, byte [ecx]
mov byte [esi], bl
mov byte [ecx], dl
xor ecx, ecx
mov cl, byte [esi]
add ecx, edx
and ecx, 0xff
mov cl, byte [ecx + eax]
xor byte [edi], cl
inc edi
dec dword [ebp + 0xc]
jne 0x469f59
pop edi
pop esi
pop ebx
mov cl, byte [ebp + 0xb]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 1]
mov byte [eax + 0x101], cl
leave
ret
Function at 0x46a08b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [0x4a7170], 0
mov eax, dword [0x4a5eb0]
mov dword [ebp - 4], eax
jne 0x46a179
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x46a16e
xor eax, eax
cmp dword [ebp - 0x88], 2
push esi
sete al
test eax, eax
mov dword [0x4a5e8c], eax
je 0x46a13c
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x46a16d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push edi
call esi
test eax, eax
mov dword [0x4a715c], eax
je 0x46a120
mov dword [0x4a5e88], 0x4000
push str.NtOpenFile
push edi
call esi
push str.RtlInitUnicodeString
push edi
mov dword [0x4a7160], eax
call esi
mov dword [0x4a7164], eax
jmp 0x46a16d
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46a16d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetCursorPos
push edi
call esi
push str.GetMessageTime
push edi
mov dword [0x4a7154], eax
call esi
mov dword [0x4a7158], eax
pop esi
mov dword [0x4a7170], 1
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [0x4a5e8c]
call fcn.00475d76
leave
ret
Function at 0x46ad53
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x46ada0
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x46ad77
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x46af7f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x46afcc
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x46afa3
pop edi
pop esi
pop ebx
pop ebp
ret 0x10