joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4545d8
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x4d3750
mov dword [esp + 0x1c], 6
mov dword [esp + 0x24], 6
mov dword [esp + 0x28], 0x4d3750
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0046e0d0
mov ecx, 0x4d7070
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + edx*4]
mov edx, dword [edi + 0xa0]
mov dword [esp], edx
call fcn.00469d90
test eax, eax
je 0x4546ab
mov dword [esp + 8], 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4d7070
mov ecx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + ecx*4]
mov edx, dword [edi + 0xa0]
mov dword [esp], edx
call fcn.0046e258
mov ecx, 0x45991c
mov esi, 0x459918
mov dword [esp + 0x38], esi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x34]
push edx
push esi
call fcn.00456cd4
jmp 0x454748
lea eax, [esp + 0x1c]
mov edi, 0xc
mov dword [esp + 0xc], eax
mov ecx, 0x4d4350
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edx, dword [esi + edx*4]
lea esi, [edx + 0xa0]
mov dword [esp], esi
call fcn.00466894
mov esi, 0x4cf3d0
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4d4350
mov ecx, dword [0x50a40c]
mov edx, dword fs:[0x2c]
mov esi, dword [edx + ecx*4]
lea edi, [esi + 0xa0]
mov dword [esp], edi
call fcn.00466894
mov ebx, eax
mov eax, 0x45991c
mov dword [esp + 0x2c], eax
mov ecx, 0x459918
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x30]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebx + 8], 0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x3c
ret
Function at 0x454760
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x4d3820
mov dword [esp + 0x1c], 3
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x4d3820
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0046e0d0
mov ecx, 0x4d7070
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + edx*4]
mov edx, dword [edi + 0xa0]
mov dword [esp], edx
call fcn.00469d90
test eax, eax
je 0x454833
mov dword [esp + 8], 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x4d7070
mov ecx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edi, dword [esi + ecx*4]
mov edx, dword [edi + 0xa0]
mov dword [esp], edx
call fcn.0046e258
mov ecx, 0x45b178
mov esi, 0x45b174
mov dword [esp + 0x38], esi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x34]
push edx
push esi
call fcn.00456cd4
jmp 0x4548d0
lea eax, [esp + 0x1c]
mov edi, 0xc
mov dword [esp + 0xc], eax
mov ecx, 0x4d4350
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov edx, dword [0x50a40c]
mov esi, dword fs:[0x2c]
mov edx, dword [esi + edx*4]
lea esi, [edx + 0xa0]
mov dword [esp], esi
call fcn.00466894
mov esi, 0x4cf3d0
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0x4d4350
mov ecx, dword [0x50a40c]
mov edx, dword fs:[0x2c]
mov esi, dword [edx + ecx*4]
lea edi, [esi + 0xa0]
mov dword [esp], edi
call fcn.00466894
mov ebx, eax
mov eax, 0x45b178
mov dword [esp + 0x2c], eax
mov ecx, 0x45b174
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x30]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebx + 8], 0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x3c
ret
Function at 0x45f748
Capabilities:
Hash data using murmur3

Disassembly:
push eax
mov ecx, dword [esp + 8]
push eax
imul edx, ecx, 0xcc9e2d51
rol edx, 0xf
mov dword [esp], ebx
imul ebx, edx, 0x1b873593
xor ebx, dword [esp + 4]
rol ebx, 0xd
lea eax, [ebx + ebx*4 - 0x19ab949c]
mov ebx, dword [esp]
add esp, 8
ret 4
Function at 0x4668dc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.00471a10
lea esi, [esp + 0x24]
lea edi, [esp + 8]
mov dword [esp + 0x1c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 8]
call fcn.00471b34
xor al, 1
je 0x466933
lea eax, [esp + 8]
call fcn.00471ad4
push edx
push eax
lea eax, [esp + 0x24]
call fcn.00471c8c
lea eax, [esp + 8]
call fcn.00471b4c
lea eax, [esp + 8]
call fcn.00471b34
xor al, 1
jne 0x466909
lea eax, [esp + 0x1c]
call fcn.00471eac
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 0x20
ret 0x14

Function at 0x466b74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x466d4f
push edx
mov edx, 2
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x1000
test dword [esp], esp
dec edx
jne 0x466b95
sub esp, 0x28
lea eax, [ebp - 0x2014]
push eax
mov eax, 0x1000
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], esi
mov dword [ebp - 0x2030], edi
call fcn.004720ec
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov ecx, 0x466d5c
mov edx, 0x4d9120
push eax
mov eax, 0xd5c
push ecx
push 0
push edx
push 0xa
call fcn.004720f4
mov ebx, eax
cmp eax, 0x1000
jae 0x466c22
lea esi, [ebp - 0x2014]
push esi
push ebx
call fcn.0047214c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x2038]
mov esi, dword [ebp - 0x2034]
mov edi, dword [ebp - 0x2030]
mov esp, ebp
pop ebp
ret
mov eax, ebx
call fcn.0047215c
mov dword [ebp - 0x2024], eax
lea eax, [ebp - 0x2024]
push 2
call fcn.00472178
mov dword [ebp - 0x2020], eax
lea eax, [ebp - 0x2020]
call fcn.0047218c
mov dword [ebp - 0x203c], eax
call fcn.004b8988
mov dword [ebp - 0x201c], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2024]
call fcn.0047218c
mov edi, dword [ebp - 0x201c]
mov esi, eax
push dword [ebp - 0x201c]
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
je 0x466c98
lea eax, [ebp - 0x2024]
push ebx
call fcn.00472194
test eax, eax
jg 0x466c9c
xor edx, edx
jmp 0x466ca1
mov edx, 1
mov ecx, 0x466d68
mov eax, 0xd69
push edx
mov edx, 0x4d9120
push ecx
push 0
push edx
push 0xa
call fcn.004721a8
push dword [ebp - 0x201c]
push ebx
call fcn.0047214c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x202c], eax
mov dword [ebp - 0x2028], edx
call fcn.00466d16
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov edx, dword [ebp - 0x2028]
mov eax, dword [ebp - 0x202c]
mov ebx, dword [ebp - 0x2038]
mov esi, dword [ebp - 0x2034]
mov edi, dword [ebp - 0x2030]
mov esp, ebp
pop ebp
ret
Function at 0x46a13c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x2c], 0x38
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [0x50ed00], ecx
mov dword [0x50ed04], edx
call sub.KERNEL32.DLL_GetCommandLineW
mov edi, eax
push eax
call fcn.004b91f8
xor ecx, ecx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
push edi
call sub.shell32.DLL_CommandLineToArgvW
mov ecx, dword [ebp - 0x20]
shl ecx, 3
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.004ba0e4
mov edx, dword [ebp - 0x20]
push 0
push 0
push 0
push 0
push dword [ebp - 0x18]
push edi
push 0
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
push 0xfde9
call sub.KERNEL32.DLL_WideCharToMultiByte
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
push eax
call fcn.004ba0e4
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x14], ecx
add esp, 0xc
cmp ecx, ebx
jle 0x46a24a
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push dword [edx + esi*4]
call fcn.004b91f8
add esp, 4
push eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ecx + esi*4]
push 0
push 0xfde9
call sub.KERNEL32.DLL_WideCharToMultiByte
mov edi, eax
add eax, ebx
mov edx, dword [ebp - 0x10]
lea ecx, [ebx + edx]
mov edx, dword [ebp - 8]
mov dword [edx + esi*8 + 4], ecx
sub eax, ebx
test edi, edi
mov dword [edx + esi*8], eax
je 0x46a244
push 0
add ebx, edi
push 0
push edi
mov ecx, dword [ebp - 8]
lea edx, [ecx + esi*8]
push dword [edx + 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ecx + esi*4]
push 0
push 0xfde9
call sub.KERNEL32.DLL_WideCharToMultiByte
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x46a1d9
push dword [ebp - 4]
call sub.KERNEL32.DLL_LocalFree
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
mov dword [ebp - 0x20], 0
push dword [ebp - 0x28]
call fcn.004734b4
add esp, 0x10
mov ebx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
mov esp, ebp
pop ebp
ret

Function at 0x46a3dc
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 0x28
lea ecx, [esp + 0x14]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
push ecx
call fcn.0046a37c
lea eax, [esp + 0x14]
call fcn.0046ad30
xor al, 1
je 0x46a444
lea eax, [esp + 0x14]
call fcn.0046ac54
mov dword [esp + 4], eax
lea eax, [esp + 4]
mov dword [esp + 8], edx
call fcn.00473850
mov ecx, dword [eax]
push ecx
lea eax, [esp + 8]
call fcn.0047384c
pop ecx
sub ecx, dword [eax]
add ebx, ecx
lea eax, [esp + 0x14]
call fcn.0046ad20
lea eax, [esp + 0x14]
call fcn.0046ad30
xor al, 1
jne 0x46a403
mov eax, ebx
mov ebx, dword [esp]
add esp, 0x28
ret
Function at 0x4705b4
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], ebp
mov ebp, eax
test ebp, ebp
mov dword [esp + 8], esi
mov esi, dword [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 0xc], edi
je 0x4705dd
mov ecx, dword [esi]
mov eax, esi
call dword [ecx + 0x20]
mov ebx, eax
test eax, eax
jne 0x4705f4
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
xor eax, eax
ret 8
mov eax, esi
call fcn.00470690
xor al, 1
je 0x470636
mov esi, ebx
imul esi, ebp
mov edi, dword [esp + 0x20]
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
push edx
push eax
xor eax, eax
call fcn.0041fa40
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
ret 8
mov dword [esp + 0x18], ebx
xor edi, edi
xor ebx, ebx
test ebp, ebp
je 0x470677
mov edx, ebx
imul edx, dword [esp + 0x18]
mov ecx, dword [esi]
mov eax, esi
add edx, dword [esp + 0x20]
push edx
call dword [ecx + 0x14]
inc ebx
imul edx, eax, 0xcc9e2d51
rol edx, 0xf
imul ecx, edx, 0x1b873593
xor ecx, edi
rol ecx, 0xd
lea edx, [ecx + ecx*4 - 0x19ab949c]
mov edi, edx
cmp ebx, ebp
jb 0x470642
mov eax, edi
mov ebx, dword [esp]
mov ebp, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
ret 8
Function at 0x471320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], edi
mov edi, 0xffff
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
mov esi, dword [ecx]
cmp esi, dword [esp + 0x30]
jae 0x4714f3
mov ecx, dword [esp + 0x34]
movzx ebx, byte [ecx + esi]
test bl, 0x80
je 0x47148d
mov byte [esp + 0x24], bl
mov edx, 1
movzx ecx, byte [esp + 0x24]
mov ebx, ecx
mov al, bl
mov cl, dl
shl al, cl
test al, 0x80
jne 0x471382
mov bl, byte [esp + 0x24]
cmp edx, 1
je 0x4714ab
jmp 0x47138e
inc edx
cmp edx, 4
ja 0x4714ab
jmp 0x471369
mov ecx, 7
mov edi, 1
sub ecx, edx
shl edi, cl
dec edi
movzx ecx, bl
and edi, ecx
lea ecx, [edx + esi - 1]
cmp ecx, dword [esp + 0x30]
jae 0x4714ab
lea ecx, [esi + 1]
cmp ecx, dword [esp + 0x30]
jae 0x47151b
mov ecx, dword [esp + 0x34]
add ecx, esi
movzx eax, byte [ecx + 1]
mov cl, bl
and cl, 0xfe
cmp cl, 0xc0
je 0x4714ab
cmp bl, 0xe0
jne 0x4713eb
mov cl, al
and cl, 0xe0
cmp cl, 0x80
je 0x4714ab
cmp bl, 0xf0
jne 0x4713fe
mov cl, al
and cl, 0xf0
cmp cl, 0x80
je 0x4714ab
cmp bl, 0xf8
jne 0x471411
mov cl, al
and cl, 0xf8
cmp cl, 0x80
je 0x4714ab
cmp bl, 0xfc
jne 0x471424
mov cl, al
and cl, 0xfc
cmp cl, 0x80
je 0x4714ab
mov ebx, 1
cmp edx, ebx
je 0x471465
lea ecx, [ebx + esi]
cmp ecx, dword [esp + 0x30]
jae 0x471543
lea ecx, [ebx + esi]
mov eax, dword [esp + 0x34]
movzx ecx, byte [ecx + eax]
mov byte [esp + 0x24], cl
and cl, 0xc0
cmp cl, 0x80
jne 0x4714ab
mov cl, byte [esp + 0x24]
shl edi, 6
inc ebx
and ecx, 0x3f
or edi, ecx
cmp ebx, edx
jne 0x47142d
cmp edi, 0xd800
jb 0x47147f
lea ecx, [edi - 0xe000]
cmp ecx, 0x101fff
jbe 0x47147f
xor ecx, ecx
jmp 0x471484
mov ecx, 1
xor cl, 1
jne 0x4714ab
add esi, edx
jmp 0x471491
movzx edi, bl
inc esi
mov edx, dword [esp + 0x28]
mov eax, edi
mov dword [edx], esi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x2c
ret 8
mov ecx, 0x4ee930
mov ebx, 0x17
mov edx, 0x4ee950
mov dword [esp + 0x14], 0x124
mov eax, 0x16
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00477f38
mov eax, edi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 0x2c
ret 8
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xdf
mov dword [esp], 0x4ee930
call fcn.00462c8c
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x107
mov dword [esp], 0x4ee930
call fcn.00462c8c
mov dword [esp + 8], 0
mov edx, dword [esp + 0x30]
lea ecx, [esi + ebx]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x111
mov dword [esp], 0x4ee930
call fcn.00462c8c
int3

Function at 0x472ed8
Capabilities:
Create directory

Disassembly:
push eax
push 0
mov eax, dword [esp + 4]
add eax, 0xfffffee4
call fcn.00449110
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
pop ecx
ret
Function at 0x4751b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x475335
push edx
mov dword fs:[0], esp
sub esp, 0x54
mov dword [ebp - 0x5c], esi
mov esi, eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x54]
call fcn.004827f8
lea ecx, [ebp - 0x1c]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp + 8]
push ecx
call fcn.0041a2d4
mov dword [ebp - 4], 1
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x1c]
push edx
call fcn.0046a450
lea eax, [ebp - 0x44]
call fcn.0046a530
xor al, 1
je 0x475276
lea eax, [ebp - 0x44]
call fcn.0046a528
mov ebx, eax
call fcn.0046b15c
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], edx
call fcn.0046b314
xor al, 1
je 0x475262
lea eax, [ebp - 0x2c]
call fcn.0046b290
mov ebx, eax
push eax
lea eax, [ebp + 8]
call fcn.0041aa9c
lea eax, [ebp - 0x2c]
call fcn.0046b328
lea eax, [ebp - 0x2c]
call fcn.0046b314
xor al, 1
jne 0x47523b
lea eax, [ebp - 0x44]
call fcn.0046a53c
lea eax, [ebp - 0x44]
call fcn.0046a530
xor al, 1
jne 0x47521a
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ebx, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], edx
call fcn.00419a98
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [esi], eax
lea ecx, [ebp - 0xc]
mov eax, esi
push esi
push 0xffffffffffffffff
push ecx
mov dword [esi + 4], edx
push 0x4f61c0
call fcn.004669c8
add esp, 0xc
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x60]
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x58]
mov esp, ebp
pop ebp
ret 8

Function at 0x4794d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ecx
ret
Function at 0x4805b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
xor ecx, ecx
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov eax, dword [0x50a488]
cmp eax, ecx
js 0x4805e2
cmp eax, 0x3c
jl 0x4805d5
jmp 0x4805e2
mov edx, dword [0x50a488]
mov ecx, dword [edx*4 + 0x50a31c]
lea eax, [esp + 0x44]
xor edx, edx
mov dword [esp + 0x34], ecx
push eax
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov word [eax + 0x14], dx
push ecx
call sub.KERNEL32.DLL_GetConsoleScreenBufferInfo
test eax, eax
setne cl
mov byte [esp + 0x5a], cl
mov dword [esp + 4], 0x50d6a0
mov dword [esp], 0x50a478
call fcn.004ba1f4
test eax, eax
jg 0x4806fa
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
push ebx
mov ecx, fcn.004807d0
push ecx
lea esi, [esp + 0x24]
push esi
call fcn.00488f44
cmp dword [esp + 0x1c], 0
je 0x4807a2
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
test ebx, ebx
je 0x48067d
mov edi, dword [ebx]
mov eax, dword [edi]
push dword [eax + 0x14]
push dword [eax + 0x10]
lea eax, [esp + 0x1c]
call fcn.004807d0
mov ecx, 0x50d6a4
push ecx
call sub.KERNEL32.DLL_LoadLibraryW
mov ebx, eax
test eax, eax
je 0x4806d7
mov edx, 0x50d6bc
push edx
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4806d7
cmp dword [esp + 0x1c], 0
je 0x4806b3
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov word [edi + esi*2], 0
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0
je 0x4806cc
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov word [esi + edx*2], 0
push 0x10
push dword [esp + 0x18]
push ecx
push 0
call eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.004b86e8
mov edi, dword [esp + 0x1c]
mov dword [esp], edi
call fcn.004b86e8
jmp 0x4807a2
cmp byte [esp + 0x5a], 0
je 0x4807b2
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
push ebx
mov edi, fcn.004807d0
push edi
lea eax, [esp + 0x2c]
push eax
call fcn.00488f44
cmp dword [esp + 0x24], 0
je 0x4807a2
call sub.KERNEL32.DLL_GetConsoleOutputCP
mov dword [esp + 0x30], eax
push 0
push 0
push 0
push 0
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0
push eax
call sub.KERNEL32.DLL_WideCharToMultiByte
mov dword [esp + 0x2c], eax
mov dword [esp], eax
call fcn.004b8988
mov ebx, eax
test eax, eax
je 0x480796
push 0
push 0
push dword [esp + 0x34]
push ebx
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0
push dword [esp + 0x4c]
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
push 0
push dword [esp + 0x34]
push ebx
push dword [esp + 0x44]
call sub.KERNEL32.DLL_WriteFile
mov dword [esp], ebx
call fcn.004b86e8
mov edx, dword [esp + 0x24]
mov dword [esp], edx
call fcn.004b86e8
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add esp, 0x5c
ret
push ebx
mov esi, 0x480878
push esi
push 0
call fcn.00488f44
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add esp, 0x5c
ret
Function at 0x48251c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x48260f
push edx
mov dword fs:[0], esp
sub esp, 0x64
mov dword [ebp - 0x70], ebx
mov ebx, eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], edi
mov dword [ebp - 4], 0
mov ecx, 0xe
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
push eax
lea eax, [ebp - 0x54]
call fcn.0048a0e8
lea ecx, [ebp - 0x64]
lea eax, [ebp + 8]
push ecx
call fcn.0046a37c
lea eax, [ebp - 0x64]
call fcn.0046ad30
xor al, 1
je 0x4825a9
lea eax, [ebp - 0x64]
call fcn.0046ac54
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x54]
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
push dword [ebp - 0x18]
push 1
call fcn.0048a1a4
lea eax, [ebp - 0x64]
call fcn.0046ad20
lea eax, [ebp - 0x64]
call fcn.0046ad30
xor al, 1
jne 0x482577
push ebx
lea eax, [ebp - 0x54]
call fcn.0048a230
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.004825e3
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x68]
mov esp, ebp
pop ebp
ret 8

Function at 0x4829c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.00475414
xor al, 1
je 0x4829eb
inc ebx
lea eax, [esp + 8]
call fcn.00475460
lea eax, [esp + 8]
call fcn.00475414
xor al, 1
jne 0x4829d4
mov eax, ebx
pop ebx
ret 0x30

Function at 0x4829f4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov ecx, 0xc
mov dword [esp], esi
lea esi, [esp + 0x44]
mov dword [esp + 4], edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 8]
call fcn.00475414
xor al, 1
je 0x482a43
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0xc]
call fcn.00475438
call fcn.0048a474
lea eax, [esp + 8]
call fcn.00475460
lea eax, [esp + 8]
call fcn.00475414
xor al, 1
jne 0x482a1a
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 0x38
ret 0x38

Function at 0x482c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.0048a66c
xor al, 1
je 0x482cbb
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00449b40
push eax
mov eax, ebx
call fcn.0040962c
lea eax, [esp + 8]
call fcn.00449dbc
lea eax, [esp + 8]
call fcn.0048a66c
xor al, 1
jne 0x482c90
pop ebx
ret 8

Function at 0x488b2c
Capabilities:
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
pop ecx
ret

Function at 0x48a678
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
mov ecx, 9
xor eax, eax
mov dword [esp], edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [esp + 8]
mov dword [0x50ef10], edx
mov edi, dword [esp]
add esp, 0x28
ret