joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48c1e8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48c1b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047e5b0
call fcn.0047f6b8
call fcn.004a8dcc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4874e4]
call fcn.0048b18c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48c1a7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004723b4
mov edi, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], edi
cmp edi, 0x20
setne al
push eax
mov edx, dword [0x4b95bc]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0048b4ac
mov edx, dword [0x4b97f4]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0048b3c4
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00407a6c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0048b2d4
mov ebx, eax
test ebx, ebx
je 0x48c191
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x30]
mov cl, 7
call fcn.004723f4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48c18a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00472e78
call fcn.0046b5a0
mov ecx, eax
mov edx, dword [ebx + 0x58]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.00476438
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebx + 0x74]
mov eax, dword [ebx + 0x70]
call fcn.0043beec
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0048a848
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00407a80
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 8]
mov dl, 1
mov eax, dword [0x48bf28]
call fcn.0048c300
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48c16d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c174
mov eax, dword [ebp - 0xc]
call fcn.00404ed4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c1ae
mov eax, dword [ebp - 8]
call fcn.00404ed4
ret
Function at 0x498dc4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.00408afc
test eax, eax
jl 0x498e7f
cmp word [esi], 0xd
jne 0x498e66
mov edi, dword [ebx + 0x18]
cmp byte [edi + 0x4a7], 0
je 0x498e4e
mov eax, edi
call fcn.00471e3c
push eax
mov eax, dword [ebx + 0x18]
call fcn.00471b80
dec eax
pop edx
cmp edx, eax
jne 0x498e1f
mov eax, ebx
call fcn.004a0810
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00472064
jmp 0x498e8f
mov eax, dword [ebx + 0x18]
call fcn.00471e3c
mov edi, eax
mov eax, dword [ebx + 0x18]
call fcn.00471b80
sub eax, 2
cmp edi, eax
jne 0x498e44
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00472064
jmp 0x498e8f
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.00472064
push 0
push 0xd
push 0x464
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_SendMessageW
cmp word [esi], 0x1b
jne 0x498e7f
mov eax, dword [ebx + 0x18]
cmp byte [eax + 0x4a7], 0
je 0x498e7f
xor edx, edx
call fcn.00472064
cmp word [esi], 0x21
jae 0x498e8f
mov eax, dword [ebx + 0x18]
mov dword [eax + 0x2e], 3
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x49d7e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49d8f2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49d8d2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047e5b0
call fcn.0047f6b8
call fcn.0047e4cc
mov dword [ebx + 0x10], eax
call fcn.004a8dcc
lea eax, [ebp - 0x10]
mov edx, 1
mov cl, 1
call fcn.0042d900
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x49d904
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x88]
push 0x49d914
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4bf2bc], eax
push 0x49d938
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4bf2c0], eax
push 0x49d95c
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4bf2c4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
cmp dword [ebx + 0x18], 0
jne 0x49d8c1
cmp dword [0x4b92c0], 0xffffffff
je 0x49d8c1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d8dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d8f9
lea eax, [ebp - 0x10]
call fcn.00428254
ret

Function at 0x49f074
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x49f103
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x24], 0
je 0x49f0ed
cmp dword [ebx + 0x18], 0
je 0x49f0ed
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x18]
call fcn.00470208
cmp dword [ebp - 4], 0
jne 0x49f0dc
mov eax, dword [ebx + 0x18]
call fcn.00470638
test al, al
je 0x49f0dc
mov edx, dword [ebx + 0xf8]
mov eax, dword [ebx + 0x24]
call fcn.00470278
push 4
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x24]
call fcn.004756c8
jmp 0x49f0ed
push 0
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f10a
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x4aa904
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00406c24
xor eax, eax
push ebp
push 0x4aa9c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a64
push ebp
call fcn.004aa83c
pop ecx
xor eax, eax
push ebp
push 0x4aa9a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.00407984
push eax
call sub.wininet.dll_InternetCrackUrlW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.004079dc
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.004079dc
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004079dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa9ae
push ebp
call fcn.004aa8c4
pop ecx
ret
Function at 0x4180b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, ecx
push edi
mov ecx, 6
mov esi, edx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
pop edi
pop esi
xor ecx, ecx
push ebx
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x4180c6
mov dl, byte [eax + 1]
mov ecx, 2
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x4180e0
mov dl, byte [eax + 2]
mov ecx, 4
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x4180fa
mov dl, byte [eax + 3]
mov ecx, 6
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x418114
mov dl, byte [eax + 0x17]
mov ecx, 1
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x41812e
mov dl, byte [eax + 0x16]
mov ecx, 3
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x418148
mov dl, byte [eax + 0x15]
mov ecx, 5
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x418162
mov dl, byte [eax + 0x14]
mov ecx, 7
mov bl, byte [ecx + eax + 4]
add ecx, 8
xor bl, dl
cmp ecx, 0x10
mov byte [ecx + eax - 4], bl
jl 0x41817c
pop ebx
ret

Function at 0x418670
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, edx
push ebp
push esi
push edi
mov ebp, ecx
lea esi, [ebx + 4]
mov ecx, 6
xor eax, eax
mov edi, ebx
mov edx, esi
rep stosd dword es:[edi], eax
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41868c
push 0x14
mov edx, 9
mov ecx, ebx
call fcn.004f6444
mov edx, 0x13
mov ecx, ebx
push 0x14
call fcn.004f63a4
mov cl, byte [ebx]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dl, byte [eax + esi]
add eax, 8
xor dl, cl
cmp eax, 0x10
mov byte [eax + esi - 8], dl
jl 0x4186b9
mov cl, byte [ebx + 1]
mov eax, 2
mov dl, byte [eax + esi]
add eax, 8
xor dl, cl
cmp eax, 0x10
mov byte [eax + esi - 8], dl
jl 0x4186d2
mov cl, byte [ebx + 2]
mov eax, 4
mov dl, byte [eax + esi]
add eax, 8
xor dl, cl
cmp eax, 0x10
mov byte [eax + esi - 8], dl
jl 0x4186eb
mov cl, byte [ebx + 3]
mov eax, 6
mov dl, byte [eax + esi]
add eax, 8
xor dl, cl
cmp eax, 0x10
mov byte [eax + esi - 8], dl
jl 0x418704
mov cl, byte [ebx + 0x17]
mov eax, 1
mov dl, byte [eax + esi]
add eax, 8
xor dl, cl
cmp eax, 0x10
mov byte [eax + esi - 8], dl
jl 0x41871d
mov cl, byte [ebx + 0x16]
mov eax, 3
mov dl, byte [eax + esi]
add eax, 8
xor dl, cl
cmp eax, 0x10
mov byte [eax + esi - 8], dl
jl 0x418736
mov cl, byte [ebx + 0x15]
mov eax, 5
mov dl, byte [eax + esi]
add eax, 8
xor dl, cl
cmp eax, 0x10
mov byte [eax + esi - 8], dl
jl 0x41874f
mov bl, byte [ebx + 0x14]
mov eax, 7
mov cl, byte [eax + esi]
add eax, 8
xor cl, bl
cmp eax, 0x10
mov byte [eax + esi - 8], cl
jl 0x418768
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4e2548
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push edi
push esi
push ebp
push ebx
push ecx
mov eax, 0x448
call fcn.00602270
mov ecx, dword [esp + 0x448]
mov dword [esp + 8], 0x62cde0
xor edx, edx
mov dword [esp + 0xc], edx
xor ebp, ebp
push edx
push edx
push edx
push edx
push str.Tally
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
je 0x4e26eb
xor edx, edx
push edx
push edx
push 3
push edx
push edx
push edx
push str.experts.tallysolutions.com
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov esi, eax
test esi, esi
je 0x4e26e4
mov dword [esp + 0x10], 0
call fcn.00602206
lea edx, [esp + 0x14]
push eax
push 0x62cac4
push edx
call fcn.006023f6
add esp, 0xc
lea edi, [esp + 0x14]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4e25dc
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4e25d4
mov dword [esp + 4], eax
lea edx, [esp + 0x48]
push str.TallyShop.php
push edx
call fcn.006023f6
add esp, 8
lea edx, [esp + 0x48]
xor ecx, ecx
lea edi, [esp + 8]
push ecx
push 0x84200000
push edi
push ecx
push ecx
push edx
push 0x62ce18
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x4e26dd
xor edx, edx
push edx
push edx
push edx
push edx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x4e26d6
lea edx, [esp + 0x48]
lea ecx, [esp + 0x448]
push ecx
push 0x3ff
push edx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4e26d6
lea ebp, [esp + 0x48]
mov edx, dword [esp + 0x448]
mov byte [esp + edx + 0x48], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
mov eax, dword [esp + 4]
push eax
call fcn.004e30bc
mov edx, dword [esp + 0x448]
cmp edx, 0x80
jbe 0x4e26b4
xor eax, eax
shr edx, 7
je 0x4e26bf
mov dword [esp], ebx
mov ebx, eax
mov ecx, ebp
mov edx, dword [esp + 0x10]
call fcn.005468e6
add ebp, 0x80
mov edx, dword [esp + 0x448]
shr edx, 7
inc ebx
cmp ebx, edx
jb 0x4e268f
mov ebx, dword [esp]
jmp 0x4e26bf
mov ecx, ebp
mov edx, dword [esp + 0x10]
call fcn.005468e6
mov ecx, dword [esp + 0x10]
call fcn.004dbbc0
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x48], 0
mov ebp, 1
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebp
add esp, 0x44c
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4ee29c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x88
call fcn.00602270
mov dword [esp], 0x80
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4ee2d6
xor eax, eax
add esp, 0x88
ret
xor ecx, ecx
lea edx, [esp + 8]
lea eax, [esp]
push eax
push edx
push ecx
push ecx
push str.Version
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ee2ff
xor eax, eax
add esp, 0x88
ret
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 8]
push eax
call fcn.006025da
pop ecx
movsx eax, ax
add esp, 0x88
ret
Function at 0x4f0f64
Capabilities:
Create directory

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov ebx, edx
mov esi, ecx
mov edi, esi
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4f0f83
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4f0f7b
mov ebp, eax
lea ecx, [ebp + 0xa]
call fcn.004dbf10
mov edi, eax
cmp byte [esi + ebp - 1], 0x5c
je 0x4f1138
push ebx
push 0x5c
push esi
push str._s_c_04.4d
push edi
call fcn.006023f6
add esp, 0x14
mov dl, byte [edi]
test dl, dl
je 0x4f100a
cmp dl, 0x5c
je 0x4f10ef
mov ebx, edi
xor esi, esi
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4f0fd1
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4f0fc9
lea eax, [edi + eax + 1]
mov ebp, edi
cmp edi, eax
je 0x4f100f
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp], edi
mov esi, eax
mov bl, byte [ebp]
cmp bl, 0x5c
je 0x4f0ff4
test bl, bl
jne 0x4f0ffc
mov edx, dword [esp + 8]
cmp ebp, edx
ja 0x4f1020
inc ebp
cmp ebp, esi
jne 0x4f0fe8
mov esi, dword [esp + 4]
mov edi, dword [esp]
jmp 0x4f100f
mov esi, 3
mov ecx, edi
call fcn.004dbbc0
mov eax, esi
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret
mov dl, byte [ebp - 1]
cmp dl, 0x3a
je 0x4f0ffc
cmp dl, 0x5c
je 0x4f0ffc
xor eax, eax
mov byte [ebp], al
xor edx, edx
mov dword [esp + 4], edx
push eax
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
je 0x4f1075
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
mov byte [ebp], bl
mov edx, eax
cmp edx, 0x35
je 0x4f10c5
cmp edx, 0x7b
je 0x4f10a5
cmp edx, 5
je 0x4f107a
test edx, edx
je 0x4f0ffc
cmp edx, 0xb7
jne 0x4f10e5
jmp 0x4f0ffc
mov byte [ebp], bl
jmp 0x4f0ffc
mov edx, dword [esp]
push edx
push str.Could_not_create_directory__s_nAccess_denied_
push 3
push 4
call fcn.004f1c34
add esp, 0x10
mov edx, dword [esp + 4]
test edx, edx
je 0x4f0ffc
mov esi, edx
mov edi, dword [esp]
jmp 0x4f100f
mov edx, dword [esp]
push edx
push str.Could_not_create_directory__s_nInvalid_directory_name_
push 3
push 4
call fcn.004f1c34
add esp, 0x10
mov edx, dword [esp + 4]
cmp edx, 5
je 0x4f107a
jmp 0x4f1067
mov edx, dword [esp]
push edx
push str.Could_not_create_directory__s_nNetwork_path_not_found_
push 7
push 4
call fcn.004f1c34
add esp, 0x10
mov edx, dword [esp + 4]
cmp edx, 0x7b
je 0x4f10a5
jmp 0x4f1067
mov esi, edx
mov edi, dword [esp]
jmp 0x4f100f
cmp byte [edi + 1], 0x5c
je 0x4f10fc
mov ebx, edi
jmp 0x4f0fbd
lea edx, [edi + 2]
push 0x5c
push edx
call fcn.00603250
add esp, 8
test eax, eax
je 0x4f112e
inc eax
push 0x5c
push eax
call fcn.00603250
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4f0fbd
mov esi, 3
jmp 0x4f100f
mov esi, 3
jmp 0x4f100f
push ebx
push esi
push str._s_04.4d
push edi
call fcn.006023f6
add esp, 0x10
jmp 0x4f0fac
Function at 0x4f1720
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
push ebp
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4f175f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 5
je 0x4f1742
mov eax, ebp
pop ebp
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4f175f
mov eax, ebp
pop ebp
pop esi
ret
xor eax, eax
pop ebp
pop esi
ret

Function at 0x4f1bec
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [0x65f344]
test eax, eax
jne 0x4f1c2f
mov dword [0x65f344], 1
mov eax, dword [0x74c198]
test eax, eax
je 0x4f1c15
mov dword [0x74c338], 1
test ebx, ebx
je 0x4f1c28
push dword [esp + 0xc]
push dword [esp + 0xc]
mov ecx, ebx
call fcn.004f1aac
push ebx
call fcn.00602e4b
pop ecx
pop ebx
ret 8
Function at 0x4f63a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov ebx, edx
mov eax, dword [esp + 0x10]
and ebx, 0xffff
mov edx, ebx
add eax, 0x80000000
adc eax, 0x80000000
sar eax, 1
je 0x4f6433
mov dword [esp + 4], esi
mov dword [esp], edi
mov esi, ecx
mov edi, ebx
shl edi, 8
xor ecx, ecx
mov cl, byte [esi]
and ebx, 0xff00
sar ebx, 8
xor ecx, ebx
and ecx, 0xff
movzx ebx, word [ecx*2 + 0x64d140]
xor edi, ebx
mov ebx, edi
and ebx, 0xffff
mov edi, edx
shl edi, 8
xor ecx, ecx
mov cl, byte [esi + 1]
and edx, 0xff00
sar edx, 8
xor ecx, edx
and ecx, 0xff
movzx edx, word [ecx*2 + 0x64d140]
xor edi, edx
mov edx, edi
and edx, 0xffff
add esi, 2
dec eax
jne 0x4f63cd
mov esi, dword [esp + 4]
mov edi, dword [esp]
shl ebx, 0x10
add ebx, edx
mov eax, ebx
add esp, 8
pop ebx
ret 4

Function at 0x4f6444
Capabilities:
Encode data using xor

Disassembly:
push edi
push ebp
sub esp, 8
mov eax, edx
mov edx, dword [esp + 0x14]
lea edi, [ecx + 4]
lea ebp, [edx - 4]
and eax, 0xffff
mov edx, eax
add ebp, 0x80000000
adc ebp, 0x80000000
sar ebp, 1
je 0x4f64d7
mov dword [esp], ebx
mov dword [esp + 4], esi
mov esi, eax
shl esi, 8
xor ebx, ebx
mov bl, byte [edi]
and eax, 0xff00
sar eax, 8
xor ebx, eax
and ebx, 0xff
movzx eax, word [ebx*2 + 0x64d140]
xor esi, eax
mov eax, esi
and eax, 0xffff
mov esi, edx
shl esi, 8
xor ebx, ebx
mov bl, byte [edi + 1]
and edx, 0xff00
sar edx, 8
xor ebx, edx
and ebx, 0xff
movzx ebx, word [ebx*2 + 0x64d140]
xor esi, ebx
mov edx, esi
and edx, 0xffff
add edi, 2
dec ebp
jne 0x4f6473
mov ebx, dword [esp]
mov esi, dword [esp + 4]
shl eax, 0x10
add eax, edx
mov dword [ecx], eax
add esp, 8
pop ebp
pop edi
ret 4

Function at 0x4f64e8
Capabilities:
Encode data using xor

Disassembly:
push edi
push ebp
sub esp, 8
mov eax, dword [esp + 0x14]
lea edi, [ecx + 4]
lea ebp, [eax - 4]
and edx, 0xffff
mov eax, edx
add ebp, 0x80000000
adc ebp, 0x80000000
sar ebp, 1
je 0x4f657a
mov dword [esp], ebx
mov dword [esp + 4], esi
mov esi, edx
shl esi, 8
xor ebx, ebx
mov bl, byte [edi]
and edx, 0xff00
sar edx, 8
xor ebx, edx
and ebx, 0xff
movzx edx, word [ebx*2 + 0x64d140]
xor esi, edx
mov edx, esi
and edx, 0xffff
mov esi, eax
shl esi, 8
xor ebx, ebx
mov bl, byte [edi + 1]
and eax, 0xff00
sar eax, 8
xor ebx, eax
and ebx, 0xff
movzx eax, word [ebx*2 + 0x64d140]
xor esi, eax
mov eax, esi
and eax, 0xffff
add edi, 2
dec ebp
jne 0x4f6516
mov ebx, dword [esp]
mov esi, dword [esp + 4]
shl edx, 0x10
add edx, eax
cmp edx, dword [ecx]
jne 0x4f658d
xor eax, eax
add esp, 8
pop ebp
pop edi
ret 4
mov eax, 1
add esp, 8
pop ebp
pop edi
ret 4
Function at 0x50c388
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebp
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x50c3ff
xor ebp, ebp
push dword [edi + 0x14]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x50c3f9
mov eax, dword [edi + 0x18]
test eax, eax
je 0x50c3c0
xor edx, edx
push edx
push edx
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x50c3d5
mov ebp, 1
jmp 0x50c3e7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x50c3e7
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov eax, ebp
pop ebp
pop esi
pop edi
ret
xor eax, eax
pop ebp
pop esi
pop edi
ret

Function at 0x50c628
Capabilities:
Read file via mapping

Disassembly:
push edi
mov edi, ecx
xor eax, eax
push 0x100
push eax
push eax
push 6
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x20], eax
test eax, eax
je 0x50c64d
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x50dd60
Capabilities:
Connect to http server

Disassembly:
push ebx
mov ebx, ecx
movzx edx, word [esp + 0x14]
xor eax, eax
push eax
push eax
push 3
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edx
push dword [esp + 0x20]
push dword [ebx + 8]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x50dd91
xor eax, eax
pop ebx
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx + 4]
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x4a]
test eax, eax
je 0x50ddb6
mov edx, dword [eax]
push str.Internet_Connect_nfailure_
push eax
call dword [edx + 0x48]
add esp, 8
pop ebx
ret 0x10
mov eax, 1
pop ebx
ret 0x10
Function at 0x543bfc
Capabilities:
Generate random numbers via winapi

Disassembly:
push edi
push esi
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
push eax
call fcn.00602229
mov edi, eax
add esp, 4
call fcn.00602206
mov ecx, eax
mov eax, edi
cdq
mov esi, edx
add edi, 0
adc esi, ecx
mov dword [esp], edi
mov dword [esp + 4], esi
xor ecx, ecx
mov dword [esp + 8], ecx
lea eax, [esp + 8]
push 0xf0000000
push 1
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x543c72
lea ecx, [esp]
push ecx
push 8
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x543c66
mov dword [esp], edi
mov dword [esp + 4], esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop esi
pop edi
ret

Function at 0x5468b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, ecx
mov edi, edx
mov ecx, 0x80
shr ecx, 3
mov eax, 0
mov ebx, 0
xor dword [esi], eax
xor dword [esi + 4], ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
call fcn.00593060
mov dword [esi], eax
mov dword [esi + 4], ebx
add esi, 8
loop 0x5468c9
pop ebx
pop edi
pop esi
ret