joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fc8c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45fd2b
cmp dword [ebx + 0x94], 0
jne 0x45fd25
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45fc14
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45fd25
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45fceb
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45fd25
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bc28
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45fcfa
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45ff44
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4beca0]
cmp dword [eax + 0x30], 0
je 0x4600a1
test bl, bl
jne 0x45fff2
cmp dword [esi + 0x9c], 0
jne 0x45ffe7
mov eax, esi
call fcn.00462624
push eax
push 0x45fe70
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45ffb8
mov eax, dword [0x4beca0]
call fcn.00462c14
test al, al
je 0x45ffb8
mov eax, dword [0x4becc4]
call fcn.00406258
mov edi, eax
cmp edi, 0
jl 0x45ffb8
push 0
mov eax, dword [0x4becc4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45ffa2
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45ffe7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041bc28
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45ffc7
inc dword [esi + 0x9c]
jmp 0x4600a1
cmp dword [esi + 0x9c], 0
jle 0x4600a1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4600a1
cmp dword [esi + 0x44], 0
je 0x46004d
mov eax, dword [0x4beca0]
call fcn.00462c14
test al, al
je 0x46004d
mov eax, dword [0x4becc4]
call fcn.00406258
mov edi, eax
cmp edi, 0
jl 0x46004d
push 5
mov eax, dword [0x4becc4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x460037
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46007c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041bc28
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46005c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4becc4
mov ecx, 1
mov edx, dword [0x45fe50]
call fcn.0040640c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x460b88
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x460bf2
mov eax, ebx
call fcn.00462c14
test al, al
jne 0x460bf2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ecc
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x460bdf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x460bff
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e30
jmp 0x460bff
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e30
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x461e28
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461e96
mov eax, esi
call fcn.0044add8
test al, al
je 0x461e96
mov eax, dword [ebx + 0x84]
call fcn.0044aa38
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461e96
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x461e8a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044aa38
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004429f8
jmp 0x461e96
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00461c64
pop esi
pop ebx
ret
Function at 0x4631f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40fe00]
call fcn.004058dc
xor eax, eax
push ebp
push 0x463391
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b6a18], 0
jne 0x46324b
mov ecx, dword [0x4b893c]
mov dl, 1
mov eax, dword [0x408360]
call fcn.0040dbec
call fcn.004046a4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.0040364c
mov eax, ebx
call fcn.0040572c
mov dword [ebp - 0x24], eax
mov esi, 0x4633a0
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406afc
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.0040573c
test eax, eax
jle 0x463334
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x463320
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.0040504c
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4632c6
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405064
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4632dc
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405064
mov eax, dword [ebp - 0x54]
call fcn.0040526c
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.0040504c
mov eax, dword [ebp - 0x58]
call fcn.0040526c
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x463322
xor eax, eax
test al, al
je 0x46332d
mov ebx, 0x15
jmp 0x463339
mov ebx, 0x10
jmp 0x463339
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4b6a18]
call fcn.00463070
mov eax, dword [ebp - 4]
call fcn.00463070
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463398
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404e00
lea eax, [ebp - 0xc]
mov edx, dword [0x40fe00]
call fcn.004059ac
ret
Function at 0x46b7d4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x4b6ca8]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x46b80c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x46b824
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x46b81d
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.0040364c
xor edx, edx
mov eax, 0x4b6ea8
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x46b88b
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x46b842
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x46bacc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x46bae5
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x46bade
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x46baf7
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x46baf0
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0046b6c4
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x46bb11
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.0046b7d4
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x46bb99
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x46bbb7
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0046b754
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x46bbe1
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46bbf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x46bc11
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x46bc0a
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x46bc25
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046b5c4
test bl, bl
jne 0x46bcff
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4bed28
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x46bc5d
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x46bc72
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046bacc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x46bca5
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x46bc52
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x46bcc9
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x46bcdb
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x46bcf0
jmp 0x46bdc0
cmp bl, 1
jne 0x46bdc0
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4bed82
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x46bd1f
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x46bd34
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046bacc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x46bd67
sub ebx, 6
inc dword [ebp - 8]
jne 0x46bd14
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x46bd8f
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x46bda1
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x46bdb6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046b644
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x48a120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48a17a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0048a110
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00487a00
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00487518
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a181
lea eax, [ebp - 4]
call fcn.00404ddc
ret
Function at 0x4ad140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a810
cmp ebx, dword [ebp - 8]
jge 0x4ad1a3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042aa74
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042aa74
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042aaa0
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4ad169
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4ad1ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a810
cmp ebx, dword [ebp - 8]
jge 0x4ad20f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042aa74
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042aa74
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042aaa0
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4ad1d5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4b193c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4b1944
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040525c
xor eax, eax
push ebp
push 0x4b1b79
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4b8dc4]
mov eax, dword [eax]
call fcn.00461748
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409f7c
mov eax, dword [ebp - 0x14]
mov ecx, 3
mov edx, 1
call fcn.004052d4
mov eax, dword [0x4b89e0]
cmp byte [eax], 6
je 0x4b19b0
mov eax, dword [0x4b89e0]
cmp byte [eax], 7
jne 0x4b19d5
lea eax, [ebp - 0x20]
call fcn.0046b240
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409f7c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, 0x4b1b94
call fcn.004050f4
jmp 0x4b19ef
push dword [ebp - 0xc]
push 0x4b1ba8
push 0x4b1b94
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405170
xor eax, eax
push ebp
push 0x4b1a2f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x419dc4]
call fcn.0041eb14
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x370]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0048f5e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1a5b
mov esi, dword [0x4b89c0]
mov esi, dword [esi]
mov edx, dword [0x4b89c0]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, 0x4b1bdc
call fcn.004050f4
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
call fcn.0040526c
push eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
call fcn.0040526c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [0x4b89c0]
mov edx, dword [edx]
mov eax, dword [ebp - 0x10]
call fcn.004b18b8
test al, al
je 0x4b1ae3
mov edx, dword [0x4b89c0]
mov edx, dword [edx]
lea eax, [ebp - 0x30]
mov ecx, 0x4b1bdc
call fcn.004050f4
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
call fcn.0040526c
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4b1b26
mov edx, dword [0x4b89c0]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4b1bdc
call fcn.004050f4
mov esi, dword [ebp - 0x34]
mov edi, dword [0x4b89c0]
mov edi, dword [edi]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
call fcn.0040526c
push eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
call fcn.0040526c
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 0x10]
call fcn.00403e30
mov eax, dword [ebp - 8]
call fcn.0040526c
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1b80
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00404e00
lea eax, [ebp - 0x24]
call fcn.00404ddc
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404e00
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e00
ret
Function at 0x4b22e4
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov esi, eax
mov eax, 0x4b2468
call fcn.00409d74
test al, al
je 0x4b230b
mov eax, 0x4b2468
call fcn.0040526c
push eax
call sub.kernel32.dll_DeleteFileA
cmp esi, 0x64
jg 0x4b245a
xor edx, edx
xor edi, edi
xor eax, eax
xor ecx, ecx
mov dword [esp], ecx
cmp ebp, 0xa
jg 0x4b245a
mov byte [ebx + edx], 0xe9
mov esi, eax
sub si, dx
test si, si
jae 0x4b233b
and si, 0xffff
sub si, 3
movzx ecx, si
and ecx, 0xff
mov byte [ebx + edx + 1], cl
movzx ecx, si
shr ecx, 8
mov byte [ebx + edx + 2], cl
mov byte [ebx + edx + 3], 0x90
mov byte [ebx + edx + 4], 0x90
mov byte [ebx + edx + 5], 0x90
mov byte [ebx + edx + 6], 0x90
mov byte [ebx + edx + 7], 0x90
mov byte [ebx + edx + 8], 0x90
mov byte [ebx + edx + 9], 0x90
mov byte [ebx + edx + 0xa], 0x90
mov byte [ebx + eax - 3], 0x90
mov byte [ebx + eax - 2], 0x90
mov byte [ebx + eax - 1], 0x90
mov byte [ebx + eax], 0xb8
mov byte [ebx + eax + 1], 0
mov byte [ebx + eax + 2], 0
mov byte [ebx + eax + 3], 0xcd
mov byte [ebx + eax + 4], 0x16
mov byte [ebx + eax + 5], 0x3d
mov byte [ebx + eax + 6], 0
mov byte [ebx + eax + 7], 0x42
mov byte [ebx + eax + 8], 0x75
mov byte [ebx + eax + 9], 6
mov byte [ebx + eax + 0xa], 0x66
mov byte [ebx + eax + 0xb], 0xb8
mov byte [ebx + eax + 0xc], 0
mov byte [ebx + eax + 0xd], 0
mov byte [ebx + eax + 0xe], 0
mov byte [ebx + eax + 0xf], 0
mov byte [ebx + eax + 0x10], 0x3d
mov byte [ebx + eax + 0x11], 0
mov byte [ebx + eax + 0x12], 0x3f
mov byte [ebx + eax + 0x13], 0x75
mov byte [ebx + eax + 0x14], 6
mov byte [ebx + eax + 0x15], 0x66
mov byte [ebx + eax + 0x16], 0xb8
mov byte [ebx + eax + 0x17], 0
mov byte [ebx + eax + 0x18], 0
mov byte [ebx + eax + 0x19], 0
mov byte [ebx + eax + 0x1a], 0
mov byte [ebx + eax + 0x1b], 0x66
mov byte [ebx + eax + 0x1c], 0x25
mov byte [ebx + eax + 0x1d], 0xff
mov byte [ebx + eax + 0x1e], 0xff
mov byte [ebx + eax + 0x1f], 0
mov byte [ebx + eax + 0x20], 0
mov byte [ebx + eax + 0x21], 0xe9
mov edx, edi
sub dx, word [esp]
dec edx
and dx, 0xffff
movzx esi, dx
mov ecx, esi
and ecx, 0xff
mov byte [ebx + eax + 0x22], cl
mov edx, esi
shr edx, 8
mov byte [ebx + eax + 0x23], dl
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x42b01c]
push edi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x2ac0416
nop
push eax
nop
call 0x77f1296e
mov ebx, eax
push 0x434fb0
mov dword [ebp - 4], ebx
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
mov byte [ebx + edi], 0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x404a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x6ff643d3
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x434fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404a26
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x2ac041b
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7f2cc3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xca03e6
jmp 0xc877b3
pop esp
mov dword [esp], edx
jmp 0xc87823
push edx
mov dword [esp], eax
mov eax, esp
add eax, 4
push esi
mov esi, 4
sub eax, esi
pop esi
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
jmp 0xc877aa
jmp 0xca0777
jmp 0xc8c47d
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0xc8c4f0
push 0x5b1c74b4
mov dword [esp], esp
add dword [esp], 4
mov ebp, dword [esp]
push 0x79901852
mov dword [esp], edi
mov edi, esp
jmp 0xc8c41e
jmp 0xca0638
jmp 0xc94438
push 0x20838e42
mov dword [esp], eax
push ebp
push 0x48609e43
pop ebp
mov dword [esp + 4], ebp
pop ebp
mov dword [esp], ebx
jmp 0xc94454
jmp 0xc9e803
jmp 0xc9e910
push edi
push ecx
mov ecx, 0xce5343b
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], edx
mov dword [esp], edi
mov dword [esp], ecx
jmp 0xc9e92a
jmp 0xc876fd
jmp 0xca0476
push ecx
mov ecx, esp
push ebp
mov dword [esp], eax
push 4
jmp 0xca04e1
pop eax
add ecx, eax
pop eax
sub ecx, 4
xchg dword [esp], ecx
pop esp
mov dword [esp], ebp
jmp 0xca04f4
jmp 0xc8c3b7
jmp 0xca06ac
mov dword [esp], esi
mov esi, esp
push ebx
mov ebx, 4
add esi, ebx
pop ebx
sub esi, 0x14
xchg dword [esp], esi
pop esp
jmp 0xca0772
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
jmp 0xca063d
jmp 0xc9433d
jmp 0xca07cd