joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461844
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x46184c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x461a3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x461a54
mov eax, esi
call fcn.0045f5d4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404810
lea ecx, [ebp - 0x10]
mov edx, 0x461a68
mov eax, esi
call fcn.0045f5d4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404810
lea ecx, [ebp - 0x14]
mov edx, 0x461a80
mov eax, esi
call fcn.0045f5d4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404810
lea ecx, [ebp - 0x18]
mov edx, 0x461a9c
mov eax, esi
call fcn.0045f5d4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404810
lea ecx, [ebp - 0x1c]
mov edx, 0x461ab8
mov eax, esi
call fcn.0045f5d4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404810
lea ecx, [ebp - 0x24]
mov edx, 0x461ad0
mov eax, esi
call fcn.0045f5d4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408e6c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040924c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x461ae8
mov eax, esi
call fcn.0045f5d4
mov eax, dword [ebp - 0x28]
call fcn.0045e6ec
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x461af8
mov eax, esi
call fcn.0045f5d4
mov eax, dword [ebp - 0x2c]
call fcn.0045e6ec
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x461b10
mov eax, esi
call fcn.0045f5d4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040924c
inc eax
je 0x4619e1
lea ecx, [ebp - 0x34]
mov edx, 0x461b10
mov eax, esi
call fcn.0045f5d4
mov eax, dword [ebp - 0x34]
call fcn.00409210
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ad60
fstp qword [ebp - 0x3c]
wait
call fcn.0040b0c4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4619fc
lea ecx, [ebp - 0x40]
mov edx, 0x461b10
mov eax, esi
call fcn.0045f5d4
mov eax, dword [ebp - 0x40]
call fcn.0045e6ec
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x461b20
mov eax, esi
call fcn.0045f5d4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461a45
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004047e0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004047e0
ret
Function at 0x46dcdc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x46dd36
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0046dccc
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0045d358
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0045cf58
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46dd3d
lea eax, [ebp - 4]
call fcn.004047bc
ret

Function at 0x479be8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
xor ebx, ebx
mov eax, esi
call fcn.0040505c
test eax, eax
jle 0x479c15
mov edx, 1
mov ecx, ebx
shl ecx, 2
shr ebx, 0x1e
or ecx, ebx
movzx ebx, word [esi + edx*2 - 2]
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x479bfe
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x47d124
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47d1b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004095f8
test al, al
je 0x47d160
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404854
jmp 0x47d168
lea eax, [ebp - 4]
call fcn.0047d0f4
lea eax, [ebp - 0x108]
push eax
xor bl, 1
xor eax, eax
mov al, bl
push eax
push 0x47d1c0
mov eax, dword [ebp - 4]
call fcn.00404c7c
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, edi
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d1b9
lea eax, [ebp - 4]
call fcn.004047bc
ret

Function at 0x47d230
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x47d2ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00409bec
mov edx, dword [ebp - 4]
mov eax, 0x47d304
call fcn.0042edd0
test al, al
je 0x47d279
lea eax, [ebp - 4]
mov ecx, 8
mov edx, 1
call fcn.00404d1c
jmp 0x47d29c
mov edx, dword [ebp - 4]
mov eax, 0x47d318
call fcn.0042edd0
test al, al
je 0x47d29c
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.00404d1c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409ad8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040db58
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404854
mov eax, dword [ebp - 4]
call fcn.00404c7c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d2f3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047e0
ret

Function at 0x47e0a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x47e0ce
inc ecx
mov ebx, edx
xor bl, byte [esi]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4c1810]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x47e0ac
mov dword [eax], edx
pop esi
pop ebx
ret
Function at 0x47eff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
sub ecx, 1
jno 0x47f001
call fcn.00403908
test ecx, ecx
jl 0x47f026
inc ecx
mov ebx, edx
xor bl, byte [esi]
and ebx, 0xff
mov edi, dword [0x4c8464]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
add esi, 1
dec ecx
jne 0x47f006
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x480b7c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x480bc2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.0047fff8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480bc9
lea eax, [ebp - 4]
call fcn.004047bc
ret
Function at 0x4894e4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4896b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00480164
cmp ebx, eax
jl 0x48954b
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x4c8b0c]
call fcn.00406a70
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x416250]
call fcn.0040ce54
call fcn.00404154
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00480150
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 0x6a]
sub al, 2
jne 0x489576
mov dl, 1
mov eax, dword [0x47b840]
call fcn.0047cdc0
call fcn.00404154
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x6a], 1
jne 0x4895c0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404a7c
cmp eax, 0x64
jge 0x4895af
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00487470
mov eax, dword [ebp - 0x24]
call fcn.00404a7c
cmp eax, 0x64
jl 0x4895c0
mov dl, 1
mov eax, dword [0x47b840]
call fcn.0047cdc0
call fcn.00404154
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
test al, al
je 0x4895d9
mov eax, dword [ebp - 8]
call fcn.0047d024
jmp 0x489672
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x416d00]
call fcn.0041b768
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x489640
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48962f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489636
mov eax, dword [ebp - 0xc]
call fcn.004039c8
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x48]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 8]
call fcn.0047e384
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0047e43c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4896bd
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004047e0
ret
Function at 0x4896c4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4897ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
call fcn.00480164
cmp ebx, eax
jl 0x489722
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x4c8b0c]
call fcn.00406a70
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x416250]
call fcn.0040ce54
call fcn.00404154
mov edx, ebx
mov eax, dword [esi + 0x30]
call fcn.00480150
mov ebx, eax
mov al, byte [ebx + 0x6a]
sub al, 2
jne 0x489746
mov dl, 1
mov eax, dword [0x47b840]
call fcn.0047cdc0
call fcn.00404154
cmp byte [ebx + 0x6a], 1
jne 0x48978b
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00404a7c
cmp eax, 0x64
jge 0x48977a
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00487470
mov eax, dword [ebp - 0x14]
call fcn.00404a7c
cmp eax, 0x64
jl 0x48978b
mov dl, 1
mov eax, dword [0x47b840]
call fcn.0047cdc0
call fcn.00404154
mov eax, dword [ebx + 0xac]
shl eax, 9
cdq
add eax, dword [ebx + 0xa0]
adc edx, dword [ebx + 0xa4]
push edx
push eax
mov eax, dword [esi + 4]
call fcn.0041b2d4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
cmp edx, 0
jne 0x4897ba
cmp eax, 0
je 0x4897cf
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push edx
push eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.0041b550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4897f1
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004047e0
ret
Function at 0x48a620
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
cmp eax, dword [esp]
jge 0x48a64f
mov ecx, 0xf0
mov edx, 0x48a770
mov eax, 0x48a7c8
call fcn.00404718
mov eax, dword [esp + 4]
cmp eax, dword [esp]
je 0x48a676
mov eax, dword [esp]
dec eax
cmp eax, dword [esp + 4]
je 0x48a676
mov ecx, 0xf2
mov edx, 0x48a770
mov eax, 0x48a810
call fcn.00404718
mov eax, dword [ebx + 0x28]
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jle 0x48a683
inc eax
mov edx, dword [ebx + 0x18]
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x48a6c3
inc esi
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, eax
and edi, dword [ebx + 0x58]
mov ebp, dword [esp + 8]
lea ebp, [ebp + edi*4]
mov edi, dword [ecx + edx*4]
mov dword [ebp], edi
mov dword [ecx + edx*4], eax
inc eax
dec esi
jne 0x48a69a
mov esi, dword [esp + 8]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x48a6fc
mov eax, dword [esp]
add dword [ebx + 0x44], eax
mov eax, dword [esp]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x48a716
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x48a716
mov eax, ebx
call fcn.0048ab98
jmp 0x48a716
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x5c]
jl 0x48a716
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x5c]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x48a74e
mov eax, dword [esp]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x48a74e
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
fmul dword [0x48a84c]
fild dword [ebx + 0x50]
fdivp st(1)
call fcn.00402bf4
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x48a75d
mov eax, ebx
call fcn.0048ab98
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48d824
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x48d853
mov ecx, 0xc8
mov edx, 0x48d8f0
mov eax, 0x48d948
call fcn.00404718
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
dec esi
test esi, esi
jl 0x48d8c4
inc esi
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
mov dl, byte [ebx]
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
mov edx, dword [edi]
mov al, byte [ebx]
call fcn.0047e0d4
mov ebp, eax
mov dword [edi], ebp
and ebp, 0xff
add dword [edi + 4], ebp
imul ebp, dword [edi + 4], 0x8088405
inc ebp
mov dword [edi + 4], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.0047e0d4
mov dword [edi + 8], eax
inc ebx
dec esi
jne 0x48d873
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48d990
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x48d9b8
mov ecx, 0xf8
mov edx, 0x48da40
mov eax, 0x48da98
call fcn.00404718
mov edx, esi
mov eax, ebx
call fcn.0048dacc
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
mov al, byte [esi]
call fcn.0047e0d4
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.0047e0d4
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x48d9ce
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48dacc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.00404a7c
mov esi, eax
test esi, esi
jle 0x48db3a
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.0047e0d4
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.0047e0d4
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x48dafe
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b66ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x4b6772
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
mov eax, dword [eax]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
shr ecx, 9
add eax, ecx
cmp eax, 0x100
jae 0x4b670a
movsx edx, byte [eax + 0x4c7bf8]
mov ecx, 9
sub ecx, edx
shl eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x4c7cf8]
shl edx, 8
add eax, edx
add ebx, eax
jmp 0x4b6772
cmp eax, 0x10000
jae 0x4b6722
mov edx, eax
shr edx, 8
movsx edx, byte [edx + 0x4c7bf8]
add edx, 8
jmp 0x4b6749
cmp eax, 0x1000000
jae 0x4b673a
mov ecx, eax
shr ecx, 0x10
movsx edx, byte [ecx + 0x4c7bf8]
add edx, 0x10
jmp 0x4b6749
mov ecx, eax
shr ecx, 0x18
movsx edx, byte [ecx + 0x4c7bf8]
add edx, 0x18
lea ecx, [edx - 9]
shr eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x4c7cf8]
mov ecx, edx
shl ecx, 8
add eax, ecx
mov edx, eax
add ebx, eax
test esi, esi
je 0x4b6772
cmp esi, edx
jg 0x4b6772
or eax, 0xffffffff
jmp 0x4b6783
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x4b66c9
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x4bd4dc
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004047bc
push esp
push 0xf003f
push 0
push 0x4bd5ac
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4bd5a2
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.00404c7c
mov edi, eax
push edi
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4bd540
cmp dword [esp + 8], 1
jne 0x4bd540
cmp dword [esp + 8], 2
je 0x4bd546
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jne 0x4bd558
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4bd5a2
mov eax, ebx
mov ecx, dword [esp + 4]
xor edx, edx
call fcn.004048ac
lea eax, [esp + 4]
push eax
mov eax, dword [ebx]
call fcn.00404c7c
push eax
lea eax, [esp + 0x10]
push eax
push 0
push edi
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebx]
call fcn.00404c7c
call fcn.00409db4
mov edx, eax
mov eax, ebx
call fcn.00404e08
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4bd5f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, esi
call fcn.00404c7c
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4bd658
mov eax, ebx
call fcn.00404a7c
inc eax
push eax
mov eax, ebx
call fcn.00404c7c
push eax
push 1
push 0
mov eax, edi
call fcn.00404c7c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4bd664
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.004047bc
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.00404c7c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4bd732
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, esi
call fcn.00404c7c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4bd6cf
cmp dword [ebp - 0x10], 1
je 0x4bd6d4
cmp dword [ebp - 0x10], 2
je 0x4bd6d4
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4bd6e5
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4bd732
mov eax, ebx
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.004048ac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
call fcn.00404c7c
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, esi
call fcn.00404c7c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebx]
call fcn.00404c7c
call fcn.00409db4
mov edx, eax
mov eax, ebx
call fcn.00404e08
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bdae8
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bdced
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.00402b48
mov eax, dword [ebp - 0x228]
lea ecx, [ebp - 4]
mov edx, 0x4bdd00
call fcn.004099bc
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402efc
lea eax, [ebp - 0x1d0]
call fcn.00402c98
call fcn.004028ac
mov edx, 0x4bdd10
lea eax, [ebp - 0x1d0]
call fcn.00404e98
call fcn.00403370
call fcn.004028ac
lea eax, [ebp - 0x22c]
push eax
lea edx, [ebp - 0x238]
xor eax, eax
call fcn.00402b48
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x234], eax
mov byte [ebp - 0x230], 0xb
lea edx, [ebp - 0x234]
xor ecx, ecx
mov eax, 0x4bdd20
call fcn.0040a490
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x1d0]
call fcn.00404e98
call fcn.00403370
call fcn.004028ac
lea eax, [ebp - 0x23c]
push eax
lea edx, [ebp - 0x240]
xor eax, eax
call fcn.00402b48
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x234], eax
mov byte [ebp - 0x230], 0xb
lea edx, [ebp - 0x234]
xor ecx, ecx
mov eax, 0x4bdd34
call fcn.0040a490
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 0x1d0]
call fcn.00404e98
call fcn.00403370
call fcn.004028ac
mov edx, 0x4bdd54
lea eax, [ebp - 0x1d0]
call fcn.00404e98
call fcn.00403370
call fcn.004028ac
lea eax, [ebp - 0x1d0]
call fcn.00402fc4
call fcn.004028ac
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00403168
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404c7c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4bdcb7
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bdcf4
lea eax, [ebp - 0x240]
mov edx, 3
call fcn.004047e0
lea eax, [ebp - 0x22c]
mov edx, 2
call fcn.004047e0
lea eax, [ebp - 4]
call fcn.004047bc
ret

Function at 0x4bdd5c
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x4bdd74
push 0
push 0
call sub.shell32.dll_ShellExecuteA
ret