joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461790
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x461798
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a18
xor eax, eax
push ebp
push 0x46192c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4618c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404acc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
call fcn.004069a8
push eax
push 0
push 0x10
push 0x461940
push 0x46194c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
call fcn.00406ab4
lea eax, [ebp - 0x14]
call fcn.00404acc
lea eax, [ebp - 0x2c]
call fcn.004069a8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
call fcn.00406ab4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
mov ecx, 0x461994
call fcn.004069ec
jmp 0x461893
push 0x4619a4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00405afc
add esp, 0xc
lea eax, [ebp - 0x3c]
lea edx, [ebp - 0x18]
call fcn.00411290
cmp dword [ebp - 0x18], 0
je 0x461893
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x4619bc
push 0x4619c0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00405afc
add esp, 0xc
lea eax, [ebp - 0x50]
lea edx, [ebp - 0x40]
call fcn.00411290
push dword [ebp - 0x40]
push 0x4619d8
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404e44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
call fcn.00405bd4
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x46182d
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00404b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4618d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461933
lea eax, [ebp - 0x50]
call fcn.00405bd4
lea eax, [ebp - 0x40]
call fcn.00404acc
lea eax, [ebp - 0x3c]
call fcn.00405bd4
lea eax, [ebp - 0x2c]
call fcn.004069a8
lea eax, [ebp - 0x28]
call fcn.00405bd4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404af0
lea eax, [ebp - 0xc]
call fcn.004069a8
lea eax, [ebp - 8]
call fcn.004069a8
lea eax, [ebp - 4]
call fcn.004069a8
ret

Function at 0x463790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4637ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
lea eax, [ebp - 5]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 5]
call fcn.00404cbc
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00408ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4637f1
lea eax, [ebp - 0xc]
call fcn.00404acc
ret
Function at 0x463f40
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x463f49
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4641e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [0x4bafe8], 0
je 0x4641bc
cmp dword [0x4bafd4], 0
je 0x463fc1
lea eax, [ebp - 0x11c]
call fcn.00463ecc
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0045b3e0
push dword [ebp - 0x118]
push 0x464200
push ebx
push 0x464214
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404e44
jmp 0x464001
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x111]
call fcn.00404cbc
push dword [ebp - 0x120]
push 0x464200
push ebx
push 0x464224
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404e44
mov eax, dword [ebp - 8]
call fcn.0045b0c4
test al, al
jne 0x46413c
test esi, esi
je 0x46413c
push esi
push 0x464234
push ebx
push 0x464224
lea eax, [ebp - 0x124]
mov edx, 4
call fcn.00404e44
mov eax, dword [ebp - 0x124]
call fcn.0045b0c4
test al, al
je 0x46405f
push esi
push 0x464234
push ebx
push 0x464224
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404e44
jmp 0x4640a3
push esi
push 0x464240
push ebx
push 0x464224
lea eax, [ebp - 0x128]
mov edx, 4
call fcn.00404e44
mov eax, dword [ebp - 0x128]
call fcn.0045b0c4
test al, al
je 0x4640a3
push esi
push 0x464240
push ebx
push 0x464224
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404e44
push 0
mov eax, dword [ebp - 8]
call fcn.00404f7c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x464135
call sub.KERNEL32.DLL_GetLastError
mov esi, eax
lea eax, [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x464250
call fcn.00404dd0
mov eax, dword [ebp - 0x12c]
call fcn.00463da8
push 0x464264
lea edx, [ebp - 0x134]
mov eax, esi
call fcn.0045b054
push dword [ebp - 0x134]
push 0x464274
lea edx, [ebp - 0x138]
mov eax, esi
call fcn.004092fc
push dword [ebp - 0x138]
push 0x464280
lea eax, [ebp - 0x130]
mov edx, 5
call fcn.00404e44
mov eax, dword [ebp - 0x130]
call fcn.00463da8
mov byte [0x4b5ed4], 1
mov edx, dword [ebp - 8]
mov eax, 0x46428c
call fcn.004050c0
test eax, eax
jle 0x464167
push 0x464298
push dword [ebp - 8]
push 0x464298
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404e44
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404f7c
push eax
push 1
push 3
push 1
push 0xf01ff
mov eax, ebx
call fcn.00404f7c
mov esi, eax
push esi
push esi
push edi
call dword [0x4bafe8]
mov ebx, eax
call sub.KERNEL32.DLL_GetLastError
mov esi, eax
test ebx, ebx
jne 0x4641b0
cmp esi, 0x431
je 0x4641b0
xor eax, eax
jmp 0x4641b2
mov al, 1
mov byte [ebp - 1], al
push ebx
call dword [0x4baff0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4641ee
lea eax, [ebp - 0x138]
mov edx, 9
call fcn.00404af0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404af0
ret
Function at 0x464438
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464672
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], 0xffffffff
lea eax, [ebx + 8]
mov edx, esi
call fcn.00404b20
cmp byte [0x4bafd0], 0
je 0x46456c
lea eax, [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, 0x46468c
call fcn.00404dd0
mov byte [ebx + 0xc], 1
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
mov dword [ebx], esi
cmp esi, 0xffffffff
jne 0x46464c
mov byte [ebx + 0xc], 0
push 0xf003f
push 0
push 0
call dword [0x4bafe0]
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x46464c
mov eax, ebx
call fcn.004643c4
test al, al
je 0x464523
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebx], eax
mov eax, dword [ebx + 4]
push eax
call dword [0x4baff0]
jmp 0x46464c
mov edx, edi
mov eax, ebx
call fcn.0046429c
test al, al
je 0x46455d
mov eax, ebx
call fcn.004643c4
test al, al
je 0x46455d
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebx], eax
mov eax, dword [ebx + 4]
push eax
call dword [0x4baff0]
jmp 0x46464c
lea eax, [ebx + 8]
mov edx, 0x46469c
call fcn.00404b20
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x111]
call fcn.00403850
lea edx, [ebp - 0x218]
lea eax, [ebp - 0x118]
call fcn.00404d28
push dword [ebp - 0x118]
push 0x4646b0
push dword [ebx + 8]
push 0x4646bc
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404e44
push edi
push 0x4646b0
push dword [ebx + 8]
push 0x4646bc
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404e44
mov eax, dword [ebp - 0xc]
call fcn.0045b0c4
test al, al
jne 0x464613
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00404f7c
push eax
mov eax, dword [ebp - 8]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_CopyFileA
mov byte [0x4b5ed4], 1
push 0x46468c
push dword [ebx + 8]
push 0x4646bc
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404e44
push 0
push 0x4000000
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464679
lea eax, [ebp - 0x118]
call fcn.00404acc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404af0
ret
Function at 0x465f24
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov bl, 1
xor eax, eax
push ebp
push 0x466014
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x466030
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], esi
push 0x466040
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x466054
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push 0x466064
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
push 0x46607c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
push 0x466090
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
push 0x4660ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
push 0x4660d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push 0x4660ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x466028
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x466560
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
dec ecx
test ecx, ecx
jl 0x466589
inc ecx
mov ebx, dword [eax]
xor bl, byte [edx]
and bl, 0xff
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4b5f74]
mov esi, dword [eax]
shr esi, 8
xor ebx, esi
mov dword [eax], ebx
inc edx
dec ecx
jne 0x466568
pop esi
pop ebx
ret

Function at 0x46658c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x466609
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 4]
lea edx, [ebp - 0x109]
call fcn.00404cbc
lea eax, [ebp - 0x109]
push eax
push 0
push 0x466618
mov eax, dword [ebp - 4]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, ebx
lea edx, [ebp - 0x109]
call fcn.00404cbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466610
lea eax, [ebp - 4]
call fcn.00404acc
ret
Function at 0x46661c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, eax
or ebx, 0xffffffff
mov eax, edi
call fcn.00404d84
test eax, eax
jle 0x466655
mov esi, 1
mov dl, byte [edi + esi - 1]
xor dl, bl
and dl, 0xff
and edx, 0xff
mov edx, dword [edx*4 + 0x4b5f74]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
dec eax
jne 0x466634
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x46665c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, ecx
dec eax
test eax, eax
jl 0x46668f
inc eax
xor edi, edi
mov cl, byte [edx + edi]
mov ebx, dword [esi]
xor cl, bl
and cl, 0xff
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b5f74]
mov ebx, dword [esi]
shr ebx, 8
xor ecx, ebx
mov dword [esi], ecx
inc edi
dec eax
jne 0x46666b
pop edi
pop esi
pop ebx
ret

Function at 0x469760
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffbc
mov ebx, eax
mov dword [esp], 0x40
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
mov eax, dword [0x4b8f20]
test byte [eax], 8
je 0x469790
mov eax, ebx
mov edx, 0x4697a8
call fcn.00404b20
jmp 0x46979b
mov eax, ebx
lea edx, [esp + 4]
call fcn.00404cbc
add esp, 0x44
pop ebx
ret
Function at 0x46f450
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov eax, dword [0x4b9368]
cmp dword [eax], 2
je 0x46f468
mov bl, 1
jmp 0x46f550
xor ebx, ebx
lea eax, [esp + 8]
push eax
push 0xffffffffffffffff
push 8
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov edi, eax
test edi, edi
jne 0x46f4a4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3f0
jne 0x46f4a4
lea eax, [esp + 8]
push eax
push 8
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov edi, eax
test edi, edi
je 0x46f550
mov eax, 0x400
call fcn.00402760
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_GetTokenInformation
mov edi, eax
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x46f549
mov eax, esp
xor ecx, ecx
mov edx, 6
call fcn.004032a8
mov byte [esp + 5], 5
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x28]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x46f549
mov edi, dword [esi]
dec edi
test edi, edi
jl 0x46f53f
inc edi
xor ebp, ebp
mov eax, dword [esi + ebp*8 + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x46f53b
mov bl, 1
jmp 0x46f53f
inc ebp
dec edi
jne 0x46f524
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402780
mov eax, ebx
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4740c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
mov edi, 0x4bb19c
mov bl, 1
push 0x47415c
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [edi], eax
push 0x474168
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x4bb188], esi
test esi, esi
je 0x474156
push 0x474180
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x4bb18c], esi
test esi, esi
je 0x474156
push 0x474190
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x4bb190], esi
test esi, esi
je 0x474156
push 0x4741a4
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x4bb194], esi
test esi, esi
je 0x474156
push 0x4741bc
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
mov dword [0x4bb198], ebx
test ebx, ebx
sete al
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4805c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x480699
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
call fcn.00404cbc
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.0048054c
mov edx, dword [ebp - 0x108]
mov eax, 0x4d3288
call fcn.00404b20
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x104]
call fcn.00404cbc
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.0048054c
mov edx, dword [ebp - 0x110]
mov eax, 0x4d328c
call fcn.00404b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4806a0
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00404af0
ret

Function at 0x4849f8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x484a00
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x484b5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404acc
mov eax, dword [0x4b90b8]
cmp byte [eax], 0
je 0x484b3c
mov dl, 1
mov eax, dword [0x466bb4]
call fcn.0046d1a0
mov ebx, eax
lea ecx, [ebp - 4]
mov edx, 0x484b74
mov eax, ebx
call fcn.0046e764
mov eax, ebx
call fcn.00403d60
cmp dword [ebp - 4], 0
je 0x484b3c
mov eax, dword [ebp - 4]
mov edx, 0x484b8c
call fcn.00404ec8
jne 0x484b2a
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.0048489c
lea eax, [ebp - 0x18]
call fcn.0046658c
mov eax, dword [ebp - 0x18]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp - 0x18]
call fcn.00402998
call fcn.00402978
test eax, eax
jne 0x484b3c
push dword [ebp - 0x18]
push 0x484b98
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404e44
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0048499c
push dword [ebp - 0x18]
push 0x484b98
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404e44
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
inc eax
call fcn.0048499c
push dword [ebp - 0x18]
push 0x484b98
push dword [ebp - 0x14]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404e44
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
add eax, 2
call fcn.0048499c
mov ecx, 0x484b74
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.0048412c
lea eax, [ebp - 4]
call fcn.004846f0
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484b66
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404af0
lea eax, [ebp - 4]
call fcn.00404acc
ret
Function at 0x486060
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f6c
xor eax, eax
push ebp
push 0x486158
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4b8f64]
cmp dword [eax + 4], 6
jb 0x4860ec
mov edx, dword [ebp - 4]
mov eax, 0x48616c
call fcn.004050c0
test eax, eax
jg 0x4860d6
mov edx, dword [ebp - 4]
mov eax, 0x48617c
call fcn.004050c0
test eax, eax
jg 0x4860d6
mov edx, dword [ebp - 4]
mov eax, 0x48618c
call fcn.004050c0
test eax, eax
jg 0x4860d6
mov edx, dword [ebp - 4]
mov eax, 0x48619c
call fcn.004050c0
test eax, eax
jle 0x4860ec
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00485e64
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 4]
call fcn.00404b64
test ebx, ebx
jne 0x4860f5
mov ebx, 1
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004032a8
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], bx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f7c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48615f
lea eax, [ebp - 0x5c]
call fcn.00404acc
lea eax, [ebp - 4]
call fcn.00404acc
ret

Function at 0x48c840
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov ebx, edx
mov ebp, eax
mov eax, edi
mov edx, ebx
call fcn.00404b20
mov eax, ebx
call fcn.00404d84
mov dword [esp], eax
xor esi, esi
mov eax, ebp
and eax, 0x1f
mov edx, 0x20
sub edx, eax
mov ecx, edx
mov bl, 0xd6
shl bl, cl
mov ecx, eax
mov eax, 0x2be674d6
shr eax, cl
inc esi
and al, 0xff
or bl, al
mov eax, edi
call fcn.00404fd4
mov edx, dword [edi]
mov dl, byte [edx + esi - 1]
xor bl, dl
mov byte [eax + esi - 1], bl
inc ebp
cmp esi, dword [esp]
jl 0x48c860
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48ca70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov ebp, edx
mov ebx, eax
lea esi, [esp + 4]
lea edi, [esp + 8]
mov edx, esi
mov eax, ebp
mov ecx, 4
call fcn.004029c4
mov edx, edi
mov eax, ebp
add eax, 4
mov ecx, 4
call fcn.004029c4
mov eax, dword [esi]
call fcn.0048ca24
mov dword [esi], eax
mov eax, dword [edi]
call fcn.0048ca24
mov dword [edi], eax
mov eax, dword [ebx + 0x100c]
xor dword [esi], eax
mov eax, 1
mov edx, dword [esi]
shr edx, 0x18
and edx, 0xff
mov edx, dword [ebx + edx*4 + 0xc]
mov ecx, dword [esi]
shr ecx, 0x10
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0x40c]
mov ecx, dword [esi]
shr ecx, 8
and ecx, 0xff
xor edx, dword [ebx + ecx*4 + 0x80c]
mov ecx, dword [esi]
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0xc0c]
xor edx, dword [edi]
xor edx, dword [ebx + eax*4 + 0x100c]
mov dword [edi], edx
mov edx, dword [edi]
shr edx, 0x18
and edx, 0xff
mov edx, dword [ebx + edx*4 + 0xc]
mov ecx, dword [edi]
shr ecx, 0x10
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0x40c]
mov ecx, dword [edi]
shr ecx, 8
and ecx, 0xff
xor edx, dword [ebx + ecx*4 + 0x80c]
mov ecx, dword [edi]
and ecx, 0xff
add edx, dword [ebx + ecx*4 + 0xc0c]
xor edx, dword [esi]
xor edx, dword [ebx + eax*4 + 0x1010]
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jl 0x48cac4
mov eax, dword [ebx + 0x1050]
xor dword [edi], eax
mov eax, dword [esi]
call fcn.0048ca24
mov dword [esi], eax
mov eax, dword [edi]
call fcn.0048ca24
mov dword [edi], eax
mov edx, dword [esp]
mov eax, edi
mov ecx, 4
call fcn.004029c4
mov edx, dword [esp]
add edx, 4
mov eax, esi
mov ecx, 4
call fcn.004029c4
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48ce98
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov ebx, edx
mov esi, eax
lea ebp, [esp + 4]
mov edx, ebp
mov eax, ebx
mov ecx, 4
call fcn.004029c4
lea edx, [esp + 8]
lea eax, [ebx + 4]
mov ecx, 4
call fcn.004029c4
mov ebx, 0x10
mov eax, dword [esi + ebx*4 + 0x1010]
xor dword [ebp], eax
mov edi, dword [ebp]
mov edx, dword [ebp]
mov eax, esi
call fcn.0048cbb0
mov dword [ebp], eax
mov eax, dword [esp + 8]
xor dword [ebp], eax
mov dword [esp + 8], edi
dec ebx
test ebx, ebx
jne 0x48cece
mov eax, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1010]
xor eax, dword [esp + 0xc]
mov dword [ebp], eax
mov eax, dword [esi + 0x100c]
xor eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov edx, dword [esp]
lea eax, [esp + 0xc]
mov ecx, 4
call fcn.004029c4
mov eax, dword [esp]
lea edx, [eax + 4]
mov eax, ebp
mov ecx, 4
call fcn.004029c4
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x494fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x495046
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f7c
lea edx, [ebp - 0xa]
mov ecx, 6
call fcn.004029c4
mov eax, edi
call fcn.00404acc
mov eax, dword [ebp - 9]
add eax, 0xc
mov dword [ebp - 0x14], eax
movzx esi, byte [ebp - 5]
test esi, esi
jle 0x495030
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov bl, byte [eax + edx]
mov eax, dword [ebp - 9]
add eax, dword [ebp - 0x10]
dec eax
and eax, 0xf
xor bl, byte [eax*4 + 0x4b842c]
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404cac
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00404d8c
inc dword [ebp - 0x14]
inc dword [ebp - 0x10]
dec esi
jne 0x494ff6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49504d
lea eax, [ebp - 0x18]
call fcn.00404acc
ret