joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f530
Capabilities:
Get socket status
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 0x10], 0
je 0x48f6f7
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x48f6f7
push 1
call fcn.004ed2f0
add esp, 4
test eax, eax
jne 0x48f6f7
push 0x2c
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00460010
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.004ed480
add esp, 0x10
test eax, eax
jne 0x48f6bf
test byte [ebp - 5], 0x80
lea eax, [ebp - 0x10]
cmovne eax, dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004f09e0
add esp, 8
test eax, eax
jne 0x48f6bf
mov eax, dword [ebx + 0x10]
shl eax, 3
call fcn.005b0700
mov esi, dword [ebx + 4]
mov edi, esp
cmp esi, ebx
je 0x48f618
lea eax, [ebp - 4]
mov dword [edi + 4], eax
lea eax, [esi + 0x10]
cmp byte [eax + 0xb], 0
jge 0x48f5d8
mov ecx, dword [eax]
jmp 0x48f5da
mov ecx, eax
mov dword [edi], ecx
cmp byte [eax + 0xb], 0
jge 0x48f5e4
mov eax, dword [eax]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x330]
push ecx
push eax
call fcn.0048f470
push edi
push 0x48f710
push 2
push eax
push dword [ebp + 8]
call fcn.004eeaa0
push esi
call fcn.0049fd70
mov esi, eax
add esp, 0x24
add edi, 8
cmp esi, ebx
jne 0x48f5c5
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x230], 0
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x12c], 0
push eax
push dword [ebp + 8]
call fcn.004ef2e0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x48f6bf
mov edi, dword [sym.imp.WS2_32.dll_select]
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call fcn.004ef420
add esp, 0xc
push eax
push 0
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
call edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
call fcn.004efab0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x230], 0
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x12c], 0
push eax
push dword [ebp + 8]
call fcn.004ef2e0
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x48f651
push dword [ebp + 8]
call fcn.004ee9b0
add esp, 4
call fcn.004ed2a0
test byte [ebp - 5], 0x80
mov esi, dword [ebp - 4]
je 0x48f6e8
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x48f6e8
push ecx
call fcn.0044d750
add esp, 4
mov eax, esi
lea esp, [ebp - 0x33c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x33c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f950
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0
push 0x2000
call fcn.0049f9b0
add esp, 0x18
mov esi, eax
xor eax, eax
mov ecx, 0x800
mov edi, esi
rep stosd dword es:[edi], eax
push esi
push eax
push eax
push 0x801c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x48f9a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_get_local_AppData_folder__error__d
call fcn.004631b0
add esp, 8
xor bl, bl
jmp 0x48fa21
xor eax, eax
mov byte [ebp - 1], 5
mov word [ebp - 0xc], ax
mov eax, esi
cmp word [esi], 0
je 0x48f9c9
nop word [eax + eax]
add eax, 2
cmp word [eax], 0
jne 0x48f9c0
sub eax, esi
lea ecx, [ebp - 0xc]
sar eax, 1
lea eax, [esi + eax*2]
push eax
push esi
call fcn.00440a30
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00460b60
mov ecx, dword [ebp + 8]
add esp, 8
push eax
call fcn.0045cdb0
test byte [ebp - 0xd], 0x80
je 0x48fa09
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x48fa09
push eax
call fcn.0044d750
add esp, 4
test byte [ebp - 1], 0x80
je 0x48fa1f
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x48fa1f
push eax
call fcn.0044d750
add esp, 4
mov bl, 1
test esi, esi
je 0x48fa2e
push esi
call fcn.0044d750
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490960
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x490a57
cmp esi, 0xffffffff
je 0x490a57
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push 0x490810
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4909dc
push ebx
push edi
push str.Process__d_main_window_found__p__sending_close_message
call fcn.004631b0
add esp, 0xc
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
setne al
jmp 0x4909df
mov al, byte [ebp + 0xc]
test al, al
je 0x490a37
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x490a10
push edi
push str.Process__d_has_been_terminated
call fcn.004631b0
add esp, 8
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Couldnt_terminate_process__d__error__d
call fcn.004631b0
add esp, 0xc
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.Process__d_has_been_stopped
call fcn.004631b0
add esp, 8
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.Couldnt_open_process__d_for_killing
call fcn.004631b0
add esp, 8
test esi, esi
je 0x490a80
xor bl, bl
cmp esi, 0xffffffff
je 0x490a80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490a90
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0
push 0x2000
call fcn.0049f9b0
add esp, 0x18
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], ebx
mov ecx, 0x800
mov edi, ebx
rep stosd dword es:[edi], eax
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test edi, edi
je 0x490c5e
cmp edi, 0xffffffff
je 0x490c5e
push 0x124
lea eax, [ebp - 0x168]
mov dword [ebp - 0x16c], 0x128
push 0
push eax
call fcn.005d6d60
add esp, 0xc
lea eax, [ebp - 0x16c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x490c57
nop dword [eax]
push dword [ebp - 0x164]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x490c3c
cmp esi, 0xffffffff
je 0x490c3c
push 0x1000
push ebx
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x490c17
cmp word [ebx], 0
je 0x490c31
lea eax, [ebp - 1]
push eax
push ebx
lea ecx, [ebp - 0x14]
call fcn.0043f570
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00460b60
add esp, 8
lea ecx, [ebp - 0x44]
push eax
call fcn.0045cc50
test byte [ebp - 0x15], 0x80
je 0x490ba0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x490ba0
push eax
call fcn.0044d750
add esp, 4
test byte [ebp - 9], 0x80
je 0x490bb6
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x490bb6
push eax
call fcn.0044d750
add esp, 4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
call fcn.00490600
mov ecx, dword [ebp - 0x164]
mov dword [eax], ecx
test byte [ebp - 0x21], 0x80
je 0x490be0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x490be0
push eax
call fcn.0044d750
add esp, 4
test byte [ebp - 0x2d], 0x80
je 0x490bf6
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x490bf6
push eax
call fcn.0044d750
add esp, 4
test byte [ebp - 0x39], 0x80
je 0x490c31
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x490c31
push eax
call fcn.0044d750
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x490c42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x164]
push str.Couldnt_get_command_line_for_process__d__error__d
call fcn.004631b0
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x490c42
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x16c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x490b20
push edi
mov bl, 1
call esi
jmp 0x490c84
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_get_process_snapshot__error__d
call fcn.004631b0
add esp, 8
test edi, edi
je 0x490c82
xor bl, bl
cmp edi, 0xffffffff
je 0x490c82
push edi
call esi
jmp 0x490c84
xor bl, bl
mov eax, dword [ebp - 8]
test eax, eax
je 0x490c94
push eax
call fcn.0044d750
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [ebp + 0xc]
cmovae edx, edi
test eax, eax
js 0x494c8c
push ebx
push esi
lea ebx, [ebp + 0xc]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x494c68
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret

Function at 0x498b20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ecx, 0x1505
test edi, edi
jne 0x498b39
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov bl, byte [edi]
test bl, bl
je 0x498b60
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x498b40
pop ebx
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x499710
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jb 0x4997e7
mov eax, dword [ebp + 0x14]
ja 0x499735
test eax, eax
je 0x4997e7
mov eax, dword [ebp - 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp - 0x10]
push edi
movzx ecx, word [ebx + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop dword [eax + eax]
cmp dword [ebp + 0x1c], 0
mov eax, dword [ebp + 0x10]
mov dl, byte [esi + eax]
mov byte [ebp - 1], dl
jne 0x499775
movzx eax, cx
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebp - 1], dl
test edi, edi
je 0x49977c
mov byte [esi + edi], dl
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebx + 0xc]
not eax
push eax
call fcn.004adcf0
not eax
mov dword [ebx + 0xc], eax
movzx eax, al
add eax, dword [ebx + 0x10]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [ebx + 0x10], eax
shr eax, 0x18
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
mov eax, dword [ebx + 0x14]
not eax
push eax
call fcn.004adcf0
mov edx, dword [ebp - 8]
add esp, 0x18
add esi, 1
not eax
mov dword [ebx + 0x14], eax
adc edx, 0
movzx ecx, ax
mov dword [ebp - 8], edx
cmp edx, dword [ebp + 0x18]
jb 0x499750
ja 0x4997e4
cmp esi, dword [ebp + 0x14]
jb 0x499750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49bd30
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0049dda0
add esp, 0xc
lea eax, [edi + 0x128]
pop edi
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.0049de10
Function at 0x49de10
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov ecx, dword [esi + 0x9c]
cmp ecx, 0xffffffff
je 0x49dee8
cmp ecx, 0x40
jbe 0x49de4a
lea eax, [esi + 0x40]
push eax
push esi
call fcn.0049e250
add esp, 8
mov dword [esi + 0x9c], 0x14
mov ecx, 0x14
jmp 0x49de4c
jae 0x49de62
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.005d6d60
add esp, 0xc
movups xmm0, xmmword [esi]
lea edi, [esi + 0x40]
movaps xmm2, xmmword [str.6666666666666666jjjjjjjjjjjjjjjj_s_04d__02d__02d]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [esi], xmm1
push edi
movups xmm0, xmmword [esi + 0x10]
push 0x40
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
push esi
movups xmm0, xmmword [esi + 0x20]
pxor xmm0, xmm2
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [esi + 0x30]
pxor xmm2, xmm0
movups xmmword [esi + 0x30], xmm2
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0x67452301
mov dword [edi + 0xc], 0xefcdab89
mov dword [edi + 0x10], 0x98badcfe
mov dword [edi + 0x14], 0x10325476
mov dword [edi + 0x18], 0xc3d2e1f0
call fcn.0049e360
add esp, 0xc
mov dword [esi + 0x9c], 0xffffffff
jmp 0x49deeb
lea edi, [esi + 0x40]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x49deff
push edi
push eax
push dword [ebp + 8]
call fcn.0049e360
add esp, 0xc
pop edi
pop esi
pop ebp
ret

Function at 0x49df10
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x9c], 0xffffffff
je 0x49df31
push edi
push 0
push 0
call fcn.0049de10
add esp, 0xc
lea esi, [edi + 0x40]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0049e250
movups xmm0, xmmword [edi]
push esi
movaps xmm2, xmmword [0x607e20]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi], xmm1
push 0x40
movups xmm0, xmmword [edi + 0x10]
push edi
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
pxor xmm1, xmm0
movups xmmword [edi + 0x20], xmm1
movups xmm0, xmmword [edi + 0x30]
pxor xmm0, xmm2
movups xmmword [edi + 0x30], xmm0
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.0049e360
push esi
lea eax, [ebp - 0x14]
push 0x14
push eax
call fcn.0049e360
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0049e250
add esp, 0x28
cmp dword [ebp + 0xc], 0
pop edi
pop esi
jbe 0x49dfe5
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.005d67e0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x49dff0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 0x9c]
cmp ecx, 0xffffffff
jne 0x49e007
or eax, ecx
pop edi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ecx + ebx]
cmp eax, 0x40
jbe 0x49e076
push esi
lea esi, [edi + 0x40]
cmp ecx, 0x40
ja 0x49e05c
push esi
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
push dword [edi + 0x9c]
push edi
call fcn.0049e360
add esp, 0xc
push esi
push ebx
push dword [ebp + 8]
call fcn.0049e360
add dword [edi + 0x9c], ebx
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
push ebx
push dword [ebp + 8]
lea eax, [ecx + edi]
push eax
call fcn.005d67e0
add dword [edi + 0x9c], ebx
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop ebp
ret
Function at 0x49e0a0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
add esi, 0x1c
mov ecx, dword [esi]
lea esi, [esi + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
and ecx, 0xff00ff
and eax, 0xff00ff00
or eax, ecx
mov dword [ebp + edx*4 - 0x150], eax
inc edx
cmp edx, 0x10
jb 0x49e0b4
lea eax, [ebp - 0x148]
mov edx, 0x40
mov ecx, dword [eax + 0x2c]
lea eax, [eax + 4]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax - 0xc]
xor ecx, dword [eax - 4]
rol ecx, 1
mov dword [eax + 0x34], ecx
sub edx, 1
jne 0x49e0e6
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov eax, dword [ecx + 8]
mov esi, eax
mov ebx, dword [ecx + 0xc]
mov edi, dword [ecx + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
nop
mov ecx, ebx
mov edx, esi
not ecx
rol esi, 5
and ecx, eax
mov eax, edi
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 0xc]
add esi, ecx
add eax, 0x5a827999
mov ecx, dword [ebp - 8]
add esi, dword [ebp + ecx*4 - 0x150]
inc ecx
add esi, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 4], eax
ror edi, 2
mov ebx, edx
cmp ecx, 0x14
jb 0x49e120
mov edx, 0x14
xor eax, edi
mov ecx, esi
xor eax, ebx
rol esi, 5
add esi, eax
mov eax, dword [ebp - 0xc]
add esi, dword [ebp + edx*4 - 0x150]
add eax, 0x6ed9eba1
add esi, eax
inc edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 4], eax
ror edi, 2
mov ebx, ecx
cmp edx, 0x28
jb 0x49e167
mov dword [ebp - 8], 0x28
mov ecx, edi
mov edx, esi
xor ecx, ebx
rol esi, 5
add esi, dword [ebp - 0xc]
and ecx, eax
mov eax, edi
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 8]
add ecx, 0x8f1bbcdc
add ecx, dword [ebp + eax*4 - 0x150]
mov eax, edi
mov edi, ebx
add esi, ecx
mov ecx, dword [ebp - 4]
mov ebx, edx
mov edx, dword [ebp - 8]
inc edx
ror edi, 2
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
cmp edx, 0x3c
jb 0x49e1a2
mov edx, 0x3c
nop dword [eax + eax]
xor eax, edi
mov dword [ebp - 8], esi
xor eax, ebx
rol esi, 5
add eax, 0xca62c1d6
add esi, ecx
add eax, dword [ebp + edx*4 - 0x150]
inc edx
mov ecx, dword [ebp - 4]
add esi, eax
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 8]
ror edi, 2
mov dword [ebp - 4], eax
cmp edx, 0x50
jb 0x49e1f0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
add eax, esi
mov ecx, dword [ebp + 8]
add dword [ecx + 0x10], edi
mov dword [ecx + 8], eax
mov eax, ebx
add dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
add dword [ecx + 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [ecx + 0x18], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e580
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x49e5c7
push dword [ebp + 8]
movzx eax, word [ebp + 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x49e5c7
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x49e5c7
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4b7cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movups xmm0, xmmword [str.SOFTWAREMicrosoftCryptography]
mov eax, dword [0x604ce4]
push esi
mov esi, dword [ebp + 8]
push 0
push 0
movups xmmword [ebp - 0x30], xmm0
push 0
movups xmm0, xmmword [0x604ccc]
push 0
push 0
movups xmmword [ebp - 0x20], xmm0
push 0x104
movq xmm0, qword [str.MachineGuid]
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
mov byte [esi], 0
mov byte [esi + 0xb], 0xb
call fcn.0049f9b0
add esp, 0x18
mov dword [esi], eax
mov dword [esi + 8], 0x80000103
mov dword [esi + 4], 0
mov byte [eax], 0
lea eax, [ebp + 8]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x30]
mov dword [ebp + 8], 0
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4b7d82
mov al, byte [esi + 0xb]
test al, al
jns 0x4b7d4d
mov eax, dword [esi]
jmp 0x4b7d4f
mov eax, esi
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b7d82
mov ecx, dword [ebp - 4]
mov al, byte [esi + 0xb]
dec ecx
test al, al
jns 0x4b7d79
mov dword [esi + 4], ecx
jmp 0x4b7d9d
mov al, 0xb
sub al, cl
mov byte [esi + 0xb], al
jmp 0x4b7d9d
mov al, byte [esi + 0xb]
test al, al
jns 0x4b7d94
mov eax, dword [esi]
mov dword [esi + 4], 0
jmp 0x4b7d9a
mov byte [esi + 0xb], 0xb
mov eax, esi
mov byte [eax], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b7dab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b9450
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push edi
mov edi, ecx
cmp dword [edi + 0x28], 0
je 0x4b9469
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004b93a0
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
jne 0x4b9480
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [edi + 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], eax
lea eax, [edi + 0x38]
mov dword [ebp - 0x54], eax
lea eax, [edi + 0x3c]
mov dword [ebp - 0x50], eax
lea eax, [edi + 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [edi + 0x1c]
push 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 4]
push eax
push 0x2c
lea eax, [ebp - 0x34]
mov dword [ebp - 0x60], 1
push eax
push 0x2c
lea eax, [ebp - 0x60]
mov dword [ebp - 0x58], esi
push eax
push ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
pop esi
test eax, eax
je 0x4b9596
cmp dword [ebp - 0x34], 2
jne 0x4b9596
cmp dword [ebp - 0x30], 0
je 0x4b9596
cmp dword [ebp - 0x14], 0
je 0x4b9596
cmp dword [ebp - 0x10], 0
je 0x4b9596
cmp dword [ebp - 0xc], 0
je 0x4b9596
lea ecx, [ebp - 0x8c]
call fcn.004b92d0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 0x8c], 3
push eax
push 0x2c
lea eax, [ebp - 0x8c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b9596
mov eax, dword [ebp - 0x14]
mov bl, 1
push dword [ebp - 8]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [edi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4c3d80
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4c3e16
push esi
call fcn.004d3b60
add esp, 4
test al, al
jne 0x4c3e16
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4c3da5
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004df2a0
add esp, 0xc
test eax, eax
je 0x4c3dd9
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004df2a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4c3ddb
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x4c3e0e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.004d1b90
movzx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x4c3df0
pop edi
movzx eax, bl
pop ebx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret