joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8abc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c8c3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004c879c
mov eax, ebx
call fcn.00422884
dec al
je 0x4c8b00
dec al
je 0x4c8b06
jmp 0x4c8b0c
mov byte [ebp - 0x77], 2
jmp 0x4c8b10
mov byte [ebp - 0x77], 1
jmp 0x4c8b10
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.004227e0
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov eax, ebx
call fcn.0042283c
test al, 1
je 0x4c8b5c
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.0042283c
test al, 2
je 0x4c8b6e
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.0042283c
test al, 4
je 0x4c8b80
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.0042283c
test al, 8
je 0x4c8b92
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.00422758
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040b2f8
mov edi, dword [ebx + 0x18]
cmp edi, 0x80000008
je 0x4c8bc5
cmp edi, 0x20000000
jne 0x4c8bd1
mov dword [ebp - 0x88], 0x40000000
jmp 0x4c8bdb
mov eax, edi
call fcn.00421e94
mov dword [ebp - 0x7c], eax
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.004228cc
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.00422538
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x4c8c18
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004c8808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8c45
lea eax, [ebp - 0x94]
call fcn.004048bc
ret

Function at 0x4ce174
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffb8
mov esi, ecx
lea edi, [esp]
mov ecx, 0x11
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov cl, 0x47
mov eax, esp
mov ebx, edx
shr ebx, 8
and ebx, 0xffffff
movzx esi, byte [eax]
xor edx, esi
and edx, 0xff
mov edx, dword [edx*4 + 0x57b540]
xor ebx, edx
mov edx, ebx
inc eax
dec cl
jne 0x4ce18d
mov eax, edx
add esp, 0x48
pop edi
pop esi
pop ebx
ret
Function at 0x4d0720
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d0825
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebx + 0x3c]
lea eax, [ebp - 0xc]
call fcn.00403488
mov edx, 0x4d0834
lea eax, [ebp - 0xc]
mov cl, 3
call fcn.00403458
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
mov cl, 3
call fcn.004034a4
lea eax, [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00404b08
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 7]
call fcn.0040b2c4
lea eax, [ebp - 7]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x4d078f
jmp dword [eax*4 + 0x4d0796]
mov edi, esi
mov esi, 0x4d0838
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
jmp case.default.0x4d078f
mov edi, esi
mov esi, 0x4d084c
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.default.0x4d078f
mov edi, esi
mov esi, 0x4d086c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.default.0x4d078f
mov edi, esi
mov esi, 0x4d0878
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.default.0x4d078f
mov edi, esi
mov esi, 0x4d0880
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.default.0x4d078f
mov edi, esi
mov esi, 0x4d0888
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.default.0x4d078f
mov edi, esi
mov esi, 0x4d0890
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d082c
lea eax, [ebp - 0x10]
call fcn.004048bc
ret
Function at 0x4d0ad0
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4d0b6c
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x57ba54]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
push dword [edx + 0x57ba54]
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
push dword [edx + 0x57ba54]
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x57ba54]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4d0aef
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4d0b82
dec edx
je 0x4d0bb7
jmp 0x4d0c08
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x57ba54]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x57ba54]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4d0c08
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x57ba54]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x57ba54]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x57ba54]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d0c68
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4d0c87
add edx, 3
sar edx, 2
test edx, edx
jle 0x4d0d94
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4d0cbd
je 0x4d0cfd
sub ecx, 0x2b
je 0x4d0cf3
sub ecx, 4
je 0x4d0cf8
dec ecx
sub ecx, 0xa
jb 0x4d0ce6
jmp 0x4d0d00
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4d0ccf
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4d0cd9
jmp 0x4d0d00
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4d0d00
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4d0d00
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4d0d00
mov byte [eax], 0x3e
jmp 0x4d0d00
mov byte [eax], 0x3f
jmp 0x4d0d00
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4d0c9f
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x4d0d51
cmp byte [esp + 7], 0xff
jne 0x4d0d51
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4d0d89
cmp dl, 0xff
je 0x4d0d89
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4d0c96
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x4d2e78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x24], 0
jne 0x4d2ea2
mov ecx, 0x4d2f00
mov dl, 1
mov eax, dword [0x4d2578]
call fcn.0040e378
call fcn.00404208
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4d2eef
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x34]
mov edx, dword [ebx + 0x30]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x34]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x38]
dec ecx
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x30]
inc eax
call fcn.004031ac
mov eax, dword [ebx + 0x30]
add eax, dword [ebx + 0x38]
dec eax
mov dl, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4d2eb2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d2f18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x24], 0
jne 0x4d2f42
mov ecx, 0x4d2fa8
mov dl, 1
mov eax, dword [0x4d2578]
call fcn.0040e378
call fcn.00404208
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4d2f97
mov dword [ebp - 0x10], eax
mov al, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x34]
mov edx, dword [ebx + 0x30]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x34]
mov al, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x38]
dec ecx
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x30]
inc eax
call fcn.004031ac
mov eax, dword [ebx + 0x30]
add eax, dword [ebx + 0x38]
dec eax
mov dl, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4d2f54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d3560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d35e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d289c]
mov eax, 0x14
call fcn.004056fc
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409f2c
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00404910
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x580ae0]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x580ae0], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d35e9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048e0
ret
Function at 0x4d35f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4d366c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d28c4]
mov eax, 0x10
call fcn.004056fc
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409f2c
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404910
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x580ae4]
mov dword [ebx], eax
mov dword [0x580ae4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3673
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048e0
ret

Function at 0x4d36c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4d36e8
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4d36d6
pop edi
pop esi
pop ebx
ret

Function at 0x4d8ef0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4d8f28]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4d8f06
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4d8f15
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4d8f24
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4dcc94
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4dccf9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4dccdc
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e2bec
mov eax, dword [ebp - 8]
call fcn.004e2b50
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x4dccde
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcd00
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048e0
ret
Function at 0x4dcd08
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4dcdd4
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4dcdaf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x60]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4dcd94
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004e2bec
mov eax, dword [ebp - 0x10]
call fcn.004e2b50
push eax
call sub.kernel32.dll_GetVolumeInformationA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
jmp 0x4dcd98
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcdb6
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4dd0ac
Capabilities:
Get file size

Disassembly:
push ebx
push ecx
push esp
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4dd0c9
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4dd0c9
xor ebx, ebx
jmp 0x4dd0d2
mov eax, dword [esp]
mov edx, eax
neg eax
add ebx, eax
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x4dd188
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x581c2c
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x57f050]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x57f050]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x4dd2a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4dd2d1
call fcn.004dd288
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.004dd188
inc dword [esi]
dec ebx
jne 0x4dd2ba
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4dd2d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4dd30c
call fcn.004dd288
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.004dd188
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x4dd2eb
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4dd334
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4dd3e3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x4dd3cd
mov eax, dword [ebp + 8]
call fcn.004dd1ec
test eax, eax
jne 0x4dd3cd
xor ebx, ebx
call fcn.004dd288
xor edx, edx
mov dl, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
call fcn.004dd188
xor eax, eax
mov al, bl
mov dl, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x4dd370
mov bl, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x4dd3bb
mov eax, dword [ebp - 4]
call fcn.00408cc0
call fcn.00408cc4
cmp bl, al
sete al
mov ebx, eax
jmp 0x4dd3cd
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd3ea
lea eax, [ebp + 8]
call fcn.004048bc
ret
Function at 0x4e0db4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4e0ea0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004de7ec
test al, al
je 0x4e0e74
xor edx, edx
push ebp
push 0x4e0e1e
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004dee04
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
call fcn.0040a924
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e0e28
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ded04
test al, al
jne 0x4e0e4e
push 0x4e0eb8
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb90], 0
je 0x4e0e8a
cmp dword [ebp + 8], 0x20
je 0x4e0e8a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404d28
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4e0e8a
mov eax, dword [ebp - 4]
add eax, 0xa38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xb98]
call fcn.00404910
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0ea7
lea eax, [ebp - 0xc]
call fcn.004048bc
ret

Function at 0x4e15e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x4e1610
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x57f0b0]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x4e15ea
pop esi
pop ebx
ret

Function at 0x4e2d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x4e2d51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4e2d35
test al, 0x10
jne 0x4e2d39
xor ebx, ebx
jmp 0x4e2d3b
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2d58
lea eax, [ebp - 4]
call fcn.004048bc
ret

Function at 0x4e31fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404d28
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4e3215
test al, 0x10
jne 0x4e3219
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4e3698
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, dword [0x57d90c]
mov dword [ebp - 4], ecx
mov esi, eax
xor ecx, ecx
push ebp
push 0x4e36f6
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, edx
dec eax
test al, al
jb 0x4e36ec
inc eax
xor edx, edx
mov dl, byte [esi]
xor edx, dword [ebp - 4]
and edx, 0xff
mov ecx, dword [0x57f050]
mov edx, dword [ecx + edx*4]
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xffffff
xor edx, ecx
mov dword [ebp - 4], edx
inc esi
dec al
jne 0x4e36c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e3700
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e6788
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov byte [0x57d920], 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xf0]
mov edx, dword [ebp + 0xc]
call fcn.0040b2c4
push eax
lea eax, [ebp - 0xa0]
mov edx, dword [ebp + 0x10]
call fcn.0040b2c4
push eax
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.0040b2c4
push eax
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f26a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4f274e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dl, 1
mov eax, dword [0x412fe4]
call fcn.004039b8
mov esi, eax
mov dword [ebx + 0xc], esi
mov edx, dword [ebx + 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx]
mov esi, dword [ebx + 0xc]
mov eax, esi
call fcn.00417488
mov edx, eax
mov eax, esi
call fcn.00417468
lea eax, [ebp - 4]
mov edx, 0x4f2764
call fcn.00404954
mov eax, dword [ebp - 4]
call fcn.00404d28
mov edx, eax
mov ecx, 1
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
call dword [esi + 8]
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2755
lea eax, [ebp - 4]
call fcn.004048bc
ret

Function at 0x4f27e8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fmul qword [ebp + 8]
call fcn.00403420
push eax
push 0
push 0x400
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
fild qword [ebp - 0x30]
fmul qword [ebp + 8]
call fcn.00403420
call fcn.00407b05
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jge 0x4f2847
mov eax, 0x10000
mov esp, ebp
pop ebp
ret 8