joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482666
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov edi, ecx
cmp word [edi], 0x22
jne 0x482680
inc edi
inc edi
push 0x22
lea eax, [edi + 2]
push eax
jmp 0x482683
push 0x20
push edi
call sub.msvcrt.dll_wcschr
and dword [ebp - 4], 0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4826a1
movzx eax, word [esi]
mov dword [ebp - 4], eax
xor eax, eax
mov word [esi], ax
inc esi
inc esi
mov ecx, edi
call fcn.00482110
test al, al
jne 0x4826b4
push 2
pop eax
jmp 0x48273d
push ebx
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x44]
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x34], edi
add esp, 0xc
xor edi, edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
inc edi
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], 0x540
xor ebx, ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
jne 0x48272e
cmp dword [ebp - 0xc], ebx
je 0x48272e
push 0x493e0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48271a
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x482725
mov ebx, dword [ebp - 8]
jmp 0x482725
mov ecx, 0x102
cmp eax, ecx
jne 0x482725
mov ebx, ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x48273a
mov ax, word [ebp - 4]
mov word [esi - 2], ax
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret

Function at 0x482781
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
mov eax, edx
push esi
mov ebx, ecx
push edi
mov edx, 0x526058
mov ecx, eax
call fcn.004b7a3f
mov esi, eax
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dl, 1
mov ecx, esi
mov edi, eax
call fcn.00479b79
cmp edi, 0xffffffff
je 0x482802
cmp byte [ebp + 8], 0
jne 0x4827cd
cmp word [ebp - 0x224], 0x2e
je 0x4827e9
lea ecx, [ebp - 0x224]
call fcn.0042876e
push 4
mov ecx, ebx
mov esi, eax
call fcn.004a16f5
test eax, eax
je 0x4827e9
mov dword [eax], esi
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4827bd
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x482809
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ecx
test edx, edx
jne 0x482829
mov edx, 0x526058
mov ecx, dword [ebp - 4]
call fcn.004b7a3f
mov esi, eax
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dl, 1
mov ecx, esi
mov edi, eax
call fcn.00479b79
cmp edi, 0xffffffff
jne 0x482855
xor eax, eax
jmp 0x48289d
lea ecx, [ebp - 0x22c]
call fcn.0042876e
mov ecx, dword [ebp - 8]
push 4
mov esi, eax
call fcn.004a16f5
test eax, eax
je 0x482872
mov dword [eax], esi
lea eax, [ebp - 0x258]
push eax
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x482855
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 4]
push dword [ebp + 8]
push ebx
call fcn.00466ca2
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4828ce
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x148
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 4]
mov ecx, ebx
mov dword [edi], 0x526060
call fcn.004a0e93
lea ecx, [edi + 8]
call fcn.004a0e93
lea ecx, [edi + 0xc]
call fcn.004a0e93
lea ecx, [edi + 0x10]
call fcn.004a0e93
lea eax, [ebp - 0xd0]
push eax
mov dword [ebp - 0xd0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4829e1
push dword [ebp - 0xc4]
lea eax, [ebp + 0x70]
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
push 0x5260a0
push eax
call fcn.004a15fa
movzx eax, byte [ebp + 0x4a]
add esp, 0x14
dec eax
mov esi, 0x513a50
je 0x482971
dec eax
je 0x482968
dec eax
je 0x48295f
mov dword [ebp + 0x74], esi
jmp 0x482978
mov dword [ebp + 0x74], 0x526098
jmp 0x482978
mov dword [ebp + 0x74], 0x526084
jmp 0x482978
mov dword [ebp + 0x74], 0x526078
push 0x526070
mov ecx, ebx
call fcn.004a0eb9
push dword [ebp + 0x74]
lea ecx, [edi + 8]
call fcn.004a0eb9
push dword [ebp + 0x70]
lea ecx, [edi + 0xc]
call fcn.004a0eb9
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp + 0x4c]
test eax, eax
je 0x4829ca
cmp eax, 6
je 0x4829c3
lea ecx, [edi + 0x10]
cmp eax, 9
je 0x4829bc
push esi
jmp 0x4829d2
push 0x51a4f0
jmp 0x4829d2
push 0x526068
jmp 0x4829cf
push 0x526064
lea ecx, [edi + 0x10]
call fcn.004a0eb9
lea ecx, [ebp + 0x70]
call fcn.004a0c7d
jmp 0x482a18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00466ca2
add esp, 4
mov esi, 0x513a50
push esi
mov ecx, ebx
call fcn.004a0eb9
push esi
lea ecx, [edi + 8]
call fcn.004a0eb9
push esi
lea ecx, [edi + 0xc]
call fcn.004a0eb9
push esi
lea ecx, [edi + 0x10]
call fcn.004a0eb9
lea ecx, [edi + 0x10]
call fcn.004a0e99
push eax
lea ecx, [edi + 0xc]
call fcn.004a0e99
push eax
lea ecx, [edi + 8]
call fcn.004a0e99
push eax
mov ecx, ebx
call fcn.004a0e99
push eax
call fcn.00466ca2
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x485e64
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x110
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x23c]
push edi
mov dword [ebp + 0x74], esi
call fcn.00484140
mov esi, dword [esi + 0x110]
push 5
pop ecx
mov dword [ebp + 0x5c], 0x32716572
lea edi, [ebp + 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x98]
call fcn.00501c46
push 0x18
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x98]
call fcn.00502f43
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0xc]
rep movsd dword es:[edi], dword [esi]
push 5
pop ecx
mov esi, ebx
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor eax, eax
mov ecx, dword [ebx + eax + 0x14]
xor dword [ebp + eax - 0xc], ecx
add eax, 4
cmp eax, 0x14
jb 0x485ebf
mov al, byte [0x559966]
mov esi, dword [ebp + 0x74]
shr al, 2
not al
and al, 1
or al, 2
mov dword [ebp + 0x10], edi
mov byte [ebp + 0x13], al
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
mov byte [ebx], al
push dword [esi + 0x110]
xor eax, eax
mov word [ebp + 0x14], ax
mov eax, 0x4400
mov word [ebp + 0x16], ax
lea eax, [ebp + 0x18]
push eax
mov ecx, esi
call fcn.004840d0
push 0x14
push dword [esi + 0x110]
mov ecx, esi
call fcn.00485d7f
lea eax, [ebp + 8]
push eax
push eax
push 0x54
lea eax, [ebx + 9]
push eax
call fcn.004962b2
lea eax, [ebx + 1]
push eax
push eax
mov dword [ebx + 5], edi
push 8
add ebx, 0x10b
push ebx
mov dword [eax], edi
call fcn.004962b2
push edi
push 0x7c
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0047ef05
lea ecx, [ebp - 0x98]
call fcn.00501c70
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x4880ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb0
push ebx
push esi
mov esi, dword [ebp + 0x7c]
mov ebx, ecx
mov edx, dword [ebx + 0x23c]
push edi
mov dword [ebp + 0x6c], edx
push 5
lea eax, [esi + 0x14]
sub edx, esi
lea ecx, [ebp + 0x3c]
pop esi
mov edi, dword [edx + eax]
xor edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
dec esi
jne 0x4880f5
and dword [ebp + 0x70], esi
cmp dword [0x88de2c], esi
je 0x488166
mov eax, dword [0x88de24]
mov ecx, dword [ebp + 0x70]
mov esi, dword [eax + ecx*4]
push 5
pop ecx
mov dword [ebp + 0x50], 0x32716572
lea edi, [ebp + 0x54]
mov dword [ebp + 0x68], esi
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x3c]
call fcn.00501c46
push 0x18
lea eax, [ebp + 0x50]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00502f43
push eax
lea ecx, [ebp + 0x3c]
call fcn.0040cb8e
lea ecx, [ebp - 0x3c]
test al, al
jne 0x488170
call fcn.00501c70
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [0x88de2c]
jne 0x488110
push 0x526e44
jmp 0x4881fa
call fcn.00501c70
push 0x14
push dword [ebp + 0x68]
mov ecx, ebx
call fcn.00485d7f
mov edi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x6c]
and dword [ebx + 0xa8], 0
lea esi, [edi + 0x28]
push esi
push esi
add eax, 9
push 0xe
mov dword [ebx + 0xa4], eax
or byte [ebx + 0xe], 0x40
push eax
call fcn.004962b2
mov ax, word [edi + 0x34]
rol ax, 8
cmp dword [esi], 0
movzx edx, ax
jne 0x4881f5
cmp dword [edi + 0x2c], 0
jne 0x4881f5
cmp edx, 0x200
ja 0x4881f5
mov al, byte [edi + 0x33]
mov ecx, dword [ebp + 0x6c]
mov byte [ecx], al
test al, 2
je 0x4881e4
test byte [0x559966], 4
jne 0x4881df
test al, 1
jne 0x4881e4
mov byte [ecx], 2
jmp 0x4881e8
and al, 1
mov byte [ecx], al
add edx, 2
mov dword [ebx + 0x1f0], edx
mov al, 1
jmp 0x488203
push 0x526e18
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
xor al, al
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4
Function at 0x48d329
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x80]
sub eax, 0
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
je 0x48d354
dec eax
jne 0x48d377
mov ebx, 0x6bf
jmp 0x48d359
mov ebx, 0xff06bd
mov eax, dword [esi + 4]
push ebx
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x48d377
mov eax, dword [esi + 4]
push ebx
push eax
call edi
push 0
push eax
call ebp
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x8c]
test eax, eax
je 0x48d3c0
xor ecx, ecx
cmp word [eax], cx
sete cl
test cl, cl
jne 0x48d3c0
mov eax, dword [edx + 0x94]
sub eax, 0
je 0x48d3b9
dec eax
jne 0x48d3f3
mov ebx, 0x6c0
mov eax, dword [esi + 4]
push ebx
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x48d3f3
push ebx
jmp 0x48d3e8
mov ebx, 0xff06be
jmp 0x48d3a4
mov eax, dword [esi + 4]
mov ebx, 0xff06be
push ebx
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x48d3e3
mov eax, dword [esi + 4]
push ebx
push eax
call edi
push 0
push eax
call ebp
push 0x6c0
mov esi, dword [esi + 4]
push esi
call edi
push 0
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x48d601
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x3c]
call fcn.004a1968
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x6a9
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
xor ebp, ebp
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6b1
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6bf
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6bf
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0xff06bd
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48d67c
mov eax, dword [esi + 4]
push 0xff06bd
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0xff06be
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48d6a1
mov eax, dword [esi + 4]
push 0xff06be
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0xff06b2
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6c2
push eax
call edi
push ebp
push eax
call ebx
push 0x510fe0
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0x4e4
call fcn.004a0e73
mov eax, dword [esi + 4]
push 0x6b3
push eax
call edi
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.004a0e99
push eax
lea eax, [esp + 0x18]
push eax
push 0x461
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
call ebp
mov ecx, esi
call fcn.0048d28e
mov eax, dword [esi + 4]
push 0x6b5
push eax
call edi
push 0x640000
push 0
push 0x401
push eax
call ebp
mov eax, dword [esi + 4]
push 0x6b5
push eax
call edi
push 0
push 1
push 0x40a
push eax
call ebp
mov eax, dword [esi + 4]
push 0x6b3
push eax
call edi
push 5
pop ebp
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6af
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6b5
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
push 0x6c1
push eax
call edi
push ebp
push eax
call ebx
mov eax, dword [esi + 4]
xor edi, edi
push edi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
cmp eax, edi
je 0x48d798
push edi
push 0xf060
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor ebx, ebx
inc ebx
push ebx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x10]
mov dword [0x88d208], ebx
call fcn.004a0c7d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x48d99b
Capabilities:
Hide graphical window

Disassembly:
call fcn.0048d94a
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0048d94a
mov ecx, eax
jmp fcn.0048cbe3
Function at 0x48dabd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
call fcn.0048d329
lea ecx, [edi + 0x78]
mov eax, dword [ecx + 8]
add edi, 0x8c
xor edx, edx
sub eax, edx
mov dword [ebp + 8], edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
je 0x48db49
dec eax
jne 0x48db89
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0xff06bd
call fcn.004a1682
push 0x22
push 0x27
lea ecx, [ebp - 4]
call fcn.0048d18c
lea eax, [ebp - 4]
push eax
mov ebx, 0x6bd
push ebx
mov ecx, esi
call fcn.0048d9ce
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
push 0x50010000
push ebx
mov ecx, esi
call fcn.0048d073
lea ecx, [ebp - 4]
call fcn.004a0c7d
jmp 0x48db89
mov eax, dword [esi + 4]
mov ebx, 0x6bf
push ebx
push eax
mov dword [ebp - 8], ebx
call edi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004a0ff9
push eax
push 0
push 0xc
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov ecx, esi
call fcn.0048d3fa
mov eax, dword [esi + 4]
push ebx
push eax
call edi
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ebx, 0x6c0
test eax, eax
je 0x48dc43
xor ecx, ecx
cmp word [eax], cx
sete cl
test cl, cl
jne 0x48dc43
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
sub eax, 0
je 0x48dc08
dec eax
jne 0x48dc43
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], 0xff06be
call fcn.004a1682
push 0x22
push 0x27
lea ecx, [ebp - 4]
call fcn.0048d18c
lea eax, [ebp - 4]
push eax
lea edi, [ebx - 2]
push edi
mov ecx, esi
call fcn.0048d9ce
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
push 0x50010000
push edi
mov ecx, esi
call fcn.0048d073
lea ecx, [ebp - 4]
call fcn.004a0c7d
jmp 0x48dc43
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 0xc], ebx
call edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
call fcn.004a0ff9
push eax
push 0
push 0xc
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov ecx, esi
call fcn.0048d3fa
mov eax, dword [esi + 4]
push ebx
push eax
call edi
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
test eax, eax
je 0x48dc76
xor ecx, ecx
cmp word [eax], cx
sete cl
test cl, cl
jne 0x48dc76
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
cmp eax, dword [edx + 4]
jne 0x48dc76
push eax
push dword [ebp - 0xc]
mov ecx, esi
push dword [ebp - 8]
call fcn.0048cdaf
mov edi, dword [ebp + 8]
jmp 0x48dca8
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.0048cd16
mov edi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
je 0x48dca8
xor ecx, ecx
cmp word [eax], cx
sete cl
test cl, cl
jne 0x48dca8
push dword [edi + 4]
mov ecx, esi
push dword [ebp - 0xc]
call fcn.0048cd16
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x10], 0
je 0x48dcb8
push 0x6bf
jmp 0x48dcbf
cmp byte [edi + 0x10], 0
je 0x48dcc6
push ebx
mov ecx, esi
call fcn.0048ccd9
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x48efb8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
cmp ebx, edi
je 0x48f0d9
mov ecx, ebx
call fcn.0040dab1
push edi
push 0x80
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.004a0ff9
push 4
pop edx
mov ecx, eax
call fcn.00482361
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x48f0d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
call fcn.004a0ff9
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.004b8491
mov ecx, dword [ebp - 0x18]
mov eax, ecx
or eax, dword [ebp - 0x14]
mov dword [ebp + 8], edi
je 0x48f046
call fcn.00479b81
push edi
lea ecx, [ebp + 8]
push ecx
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ebp - 0xc]
call fcn.00481ff4
push dword [ebx + 0x628]
push 0x50fab0
call fcn.0049f991
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x218]
pop ecx
pop ecx
cmp eax, edi
jne 0x48f075
mov eax, 0x510d20
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
push 0x5282d0
call fcn.0049f991
mov ebx, eax
push ebx
push dword [esi + 0x10]
call fcn.0045413e
add esp, 0x18
mov dl, 1
mov ecx, ebx
call fcn.00479b79
mov ecx, dword [ebp - 0x10]
mov dl, 1
call fcn.00479b79
cmp dword [ebp + 8], edi
je 0x48f0c0
mov ecx, dword [esi + 0x10]
push edi
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0047efd7
jmp 0x48f0ca
mov ecx, dword [ebp - 8]
mov dl, 1
call fcn.00479b79
mov ecx, esi
call fcn.0048ea24
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x490efb
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
inc dword [esi + 0xbc]
mov eax, dword [esi + 0xbc]
cmp eax, dword [esi + 0xb8]
jb 0x490f16
xor al, al
pop esi
ret
push edi
lea edi, [esi + 0x98]
mov ecx, dword [edi]
call fcn.00451395
and dword [edi], 0
lea ecx, [esi + 0x9c]
call fcn.00481ff4
lea edi, [esi + 0xa0]
mov ecx, edi
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.004a0cb3
mov ecx, dword [esi + 0xbc]
imul ecx, ecx, 0x1c
add ecx, dword [esi + 0xb0]
call fcn.004a0e99
push eax
mov ecx, esi
call fcn.00494fb5
pop edi
mov al, 1
pop esi
ret
Function at 0x4962b2
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x49633a
push ebp
push ebx
push esi
push edi
push eax
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
movzx eax, byte [ebp]
movzx ebx, byte [ebp + 1]
mov edi, dword [esp + 0x24]
inc al
add ebp, 2
lea edx, [edx + esi - 1]
mov dword [esp], edx
movzx ecx, byte [ebp + eax]
sub edi, esi
jmp 0x4962f2
add ebx, ecx
and ebx, 0xff
movzx edx, byte [ebp + ebx]
mov byte [ebp + ebx], cl
mov byte [ebp + eax], dl
add edx, ecx
and edx, 0xff
movzx edx, byte [ebp + edx]
add eax, 1
and eax, 0xff
xor dl, byte [esi]
movzx ecx, byte [ebp + eax]
cmp esi, dword [esp]
mov byte [esi + edi], dl
lea esi, [esi + 1]
jb 0x4962f2
dec eax
pop ecx
mov byte [ebp - 1], bl
mov byte [ebp - 2], al
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x498efa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp dword [0x88d718], ebx
je 0x498f64
push esi
mov dword [ebp - 8], ebx
push edi
mov eax, dword [0x88d710]
mov ecx, dword [ebp - 8]
lea edi, [ecx + eax]
cmp dword [edi + 0x24], ebx
je 0x498f50
mov dword [ebp - 4], ebx
mov esi, dword [edi + 0x1c]
add esi, dword [ebp - 4]
push dword [edi + 0x10]
mov edx, dword [esi + 8]
mov ecx, dword [esi + 4]
call fcn.00498168
add dword [ebp - 4], 0x54
add al, al
xor al, byte [esi + 0x3c]
and al, 2
xor byte [esi + 0x3c], al
inc ebx
cmp ebx, dword [edi + 0x24]
jne 0x498f26
xor ebx, ebx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], 0x2c
cmp eax, dword [0x88d718]
jne 0x498f13
pop edi
pop esi
pop ebx
leave
ret

Function at 0x49a633
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, edx
call fcn.0042876e
and dword [ebp - 4], 0
mov edi, eax
jmp 0x49a693
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x49a688
call fcn.004c9f32
test eax, eax
jne 0x49a688
push edi
push dword [0x896bac]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x32
call fcn.00477c73
add esp, 0xc
cmp eax, 5
je 0x49a6a2
cmp eax, 3
je 0x49a6cb
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov ecx, ebx
call fcn.0040c80c
mov esi, eax
cmp esi, 3
je 0x49a64b
cmp esi, 1
jne 0x49a6b5
push edi
push dword [0x896bb0]
call fcn.004263e6
pop ecx
pop ecx
mov dl, 1
mov ecx, edi
call fcn.00479b79
xor eax, eax
pop edi
cmp esi, 1
pop esi
setle al
pop ebx
leave
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x49cfa5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
call fcn.0040cb36
test al, al
je 0x49cfd7
push dword [esi + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
push eax
call esi
push eax
push 0x52b5c4
call fcn.0049f991
pop ecx
pop ecx
jmp 0x49d0b8
push edi
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push 0x5114f4
movsd dword es:[edi], dword [esi]
call fcn.0049f991
mov esi, eax
movzx eax, byte [esi]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 4]
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi + 6]
push eax
movzx eax, byte [esi + 7]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xf]
push eax
movzx eax, byte [esi + 0x10]
push eax
movzx eax, byte [esi + 0x11]
push eax
movzx eax, byte [esi + 0x12]
push eax
movzx eax, byte [esi + 0x13]
push eax
movzx eax, byte [esi + 0x14]
push eax
movzx eax, byte [esi + 0x15]
push eax
movzx eax, byte [esi + 0x16]
push eax
movzx eax, byte [esi + 0x17]
push eax
movzx eax, byte [esi + 0x18]
push eax
movzx eax, byte [esi + 0x19]
push eax
movzx eax, byte [esi + 0x1a]
push eax
movzx eax, byte [esi + 0x1b]
push eax
movzx eax, byte [esi + 0x1c]
push eax
movzx eax, byte [esi + 0x1d]
push eax
movzx eax, byte [esi + 0x1e]
push eax
movzx eax, byte [esi + 0x1f]
push eax
push 0x52b558
call fcn.0049f991
add esp, 0x8c
mov dl, 1
mov ecx, esi
mov edi, eax
call fcn.00479b79
mov eax, edi
pop edi
pop esi
leave
ret