joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4933a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4933d5
dec al
je 0x493410
dec al
je 0x493455
dec al
je 0x4934be
jmp 0x493548
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x493548
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4933e5
jmp 0x493548
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x493548
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x493420
jmp 0x493548
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x493548
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x493484
xor ebp, ebp
jmp 0x493494
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x49349d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x493465
jmp 0x493548
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x493548
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x493517
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0048eeb4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4934d2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49f92c
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49face
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi + 5], eax
mov byte [esi], 0
xor ecx, ecx
mov edx, 6
mov eax, ebx
call fcn.0049f854
test al, al
je 0x49f998
mov eax, dword [0x4d3a6c]
cmp byte [eax], 0
je 0x49f989
mov ecx, 0x3ebe
mov edx, 0x49fae8
mov eax, 0x49fb4c
call fcn.00405274
push 0x49fb90
call sub.kernel32.dll_OutputDebugStringW
jmp 0x49fab3
mov eax, ebx
call fcn.0049f4cc
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x49fab3
mov byte [ebp - 0xd], 0xe9
sub edi, ebx
sub edi, 5
mov dword [ebp - 0xc], edi
movzx eax, byte [esi]
cmp al, byte [ebp - 0xd]
jne 0x49fa68
push 0x49fbb8
call sub.kernel32.dll_OutputDebugStringW
movzx eax, byte [esi]
mov byte [ebp - 0xd], al
mov byte [esi], 0
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0xd], 0xe9
jne 0x49fa12
mov edi, ebx
add edi, 5
add edi, dword [esi + 1]
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x1c]
push eax
movzx eax, byte [ebp - 0xd]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x49fbf4
call fcn.0040d8dc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x49fc2c
call fcn.004061f4
mov eax, dword [ebp - 0x18]
mov ecx, 0x3ee5
mov edx, 0x49fae8
call fcn.00405274
jmp 0x49fab3
mov dword [esi + 5], ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
lea eax, [ebp - 4]
push eax
push 5
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test esi, esi
je 0x49fab3
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fad5
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405d18
ret
Function at 0x49fc68
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp byte [esi], 0
je 0x49fd14
test ebx, ebx
je 0x49fd14
xor ecx, ecx
mov edx, 6
mov eax, ebx
call fcn.0049f854
test al, al
je 0x49fcbf
mov eax, dword [0x4d3a6c]
cmp byte [eax], 0
je 0x49fcb3
mov ecx, 0x3f04
mov edx, 0x49fd28
mov eax, 0x49fd8c
call fcn.00405274
push 0x49fdd0
call sub.kernel32.dll_OutputDebugStringW
jmp 0x49fd14
mov eax, ebx
call fcn.0049f4cc
mov ebx, eax
test ebx, ebx
je 0x49fd14
lea eax, [esp + 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
push esp
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
mov edi, eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test edi, edi
je 0x49fd11
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
mov byte [esi], 0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4a55d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a563f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x4a5658
call fcn.0040d8dc
mov eax, dword [ebp - 4]
call fcn.00405dac
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5646
lea eax, [ebp - 4]
call fcn.00405d10
ret

Function at 0x4a5760
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a57bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4a57d4
call fcn.0040d8dc
mov eax, dword [ebp - 4]
call fcn.00405dac
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a57c4
lea eax, [ebp - 4]
call fcn.00405d10
ret
Function at 0x4a5884
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4a5af9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d92c0], 0
je 0x4a5ade
mov ebx, dword [0x4d92c0]
call fcn.004042e8
mov eax, ebx
call fcn.00404608
or edx, 0xffffffff
call fcn.00404394
xor eax, eax
push ebp
push 0x4a5ad7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d92c0]
mov edx, dword [eax + 0x30]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4a59ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d92c0]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x4d92c0]
mov edx, dword [0x48aa1c]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x49b23c
mov eax, dword [0x4d92c0]
call fcn.004a45b8
mov eax, dword [0x4d92c0]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
mov eax, dword [0x4d92c0]
mov ebx, dword [eax + 0x38]
cmp byte [0x4d92fc], 0
je 0x4a598e
test ebx, ebx
je 0x4a598e
xor edi, edi
test ebx, ebx
je 0x4a598e
cmp dword [ebx + 4], 0xfffffffe
jne 0x4a5987
inc edi
push 0x4a5b14
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040c4f8
push dword [ebp - 0x14]
push 0x4a5b54
push dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004062d8
mov eax, dword [ebp - 0x10]
call fcn.00405dac
push eax
call sub.kernel32.dll_OutputDebugStringW
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x4a594c
mov eax, dword [0x4d92c0]
mov ebx, dword [eax + 0x38]
test ebx, ebx
je 0x4a59c5
mov esi, dword [ebx + 0x10]
xor eax, eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], 0xfffffffe
mov dword [ebx + 8], 0xe6
mov edx, dword [ebx + 0xc]
mov ecx, ebx
mov eax, dword [0x4d92c0]
call fcn.004a4874
mov ebx, esi
test ebx, ebx
jne 0x4a599a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a59f5
mov eax, dword [0x4d92c0]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x4d92c0]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5b00
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405d18
ret
Function at 0x4c48e4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
test dl, dl
je 0x4c4903
add esp, 0xfffffff0
call fcn.00404230
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c49a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, esi
call fcn.004c4a5c
mov dword [esi + 0x18], 0xf003f
mov byte [esi + 0xc], 1
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x110], 5
jne 0x4c4959
call fcn.004865b0
test al, al
jne 0x4c4987
cmp dword [ebp - 0x110], 5
ja 0x4c4987
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.00484cf8
mov eax, dword [ebp - 0x118]
mov edx, 0x4c49d8
call fcn.0040bfd0
test al, al
jne 0x4c4987
xor eax, eax
jmp 0x4c4989
mov al, 1
mov byte [0x51934c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c49ae
lea eax, [ebp - 0x118]
call fcn.00405d10
ret
Function at 0x4c4ee8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c509b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405d74
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405dac
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x4c5044
cmp dword [ebp - 0x14], 4
jne 0x4c4fbd
mov dword [ebp - 0x1c], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405dac
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x4c4f9e
mov eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov bl, 1
jmp 0x4c505e
lea edx, [ebp - 0x2c]
mov eax, edi
call fcn.0040c4f8
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 0x4c50bc
call fcn.004061f4
jmp 0x4c505e
cmp dword [ebp - 0x14], 0xb
jne 0x4c5023
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405dac
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x4c5007
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov bl, 1
jmp 0x4c505e
lea edx, [ebp - 0x30]
mov eax, edi
call fcn.0040c4f8
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x4c50ec
call fcn.004061f4
jmp 0x4c505e
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.0040c704
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 4]
mov edx, 0x4c511c
call fcn.004061f4
jmp 0x4c505e
lea edx, [ebp - 0x38]
mov eax, edi
call fcn.0040c4f8
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 0x4c5144
call fcn.004061f4
test bl, bl
jne 0x4c5078
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004061f4
mov eax, dword [ebp - 0x3c]
call fcn.004c47ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c50a2
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.00405d18
lea eax, [ebp - 4]
call fcn.00405d10
ret
Function at 0x4c516c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004c488c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00405dac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4c51cb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4d3aac]
mov dl, 1
mov eax, dword [0x4c46dc]
call fcn.00411a70
call fcn.00404b20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c5208
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4c5354
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.004c488c
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.00405d20
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x4c525d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x4c5260
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4c51d4]
call fcn.0040760c
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00403618
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00405dac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x4c52b6
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405ecc
mov edx, dword [esi]
mov eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4c52c9
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x802
jle 0x4c531e
mov eax, edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4c52e1
sub esi, 4
mov esi, dword [esi]
push 0x4c5370
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c4f8
push dword [ebp - 0x1c]
push 0x4c53b0
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0040c4f8
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004062d8
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.004c47c4
mov eax, dword [ebp - 0xc]
call fcn.004c48bc
mov edx, dword [ebp + 0xc]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c535b
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405d18
lea eax, [ebp - 4]
mov edx, dword [0x4c51d4]
call fcn.00407618
ret
Function at 0x4c560c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403618
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
mov ebx, eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c624c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d08
xor eax, eax
push ebp
push 0x4c632c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4c630e
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408040
mov eax, dword [ebp - 8]
test eax, eax
je 0x4c62ad
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4c62ad
lea eax, [ebp - 8]
mov cx, 0xfde9
mov edx, dword [ebp - 8]
call fcn.00405528
test eax, eax
je 0x4c62b6
sub eax, 4
mov eax, dword [eax]
mov esi, eax
lea eax, [esi + 4]
mov dword [edi], eax
mov eax, dword [edi]
push eax
call fcn.00407f04
pop ecx
mov dword [ebx], eax
mov ebx, dword [ebx]
mov eax, edi
mov edx, ebx
mov ecx, 4
call fcn.004031cc
add ebx, 4
lea eax, [ebp - 8]
call fcn.004057f0
mov ecx, esi
mov edx, ebx
call fcn.004031cc
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x4c630e
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + 0x4d3744]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4c62f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6333
lea eax, [ebp - 8]
call fcn.00405348
lea eax, [ebp - 4]
call fcn.00405d10
ret
Function at 0x4cbe28
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, 0x4ca8dc
call fcn.0040855c
mov eax, 0x4cbf70
call fcn.00413e20
test al, al
jne 0x4cbe58
push 0x4cbf78
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4cbf5c
push 0x4cbfa4
push 0xffffffffffffffff
push 0
call fcn.00408d28
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4cbe83
push 0x4cbfc8
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4cbf5c
xor eax, eax
push ebp
push 0x4cbf52
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004865b0
test al, al
jne 0x4cbea9
push 0x4cbff0
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4cbf3d
call fcn.004c8668
test al, al
jne 0x4cbebe
push 0x4cc014
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4cbf3d
call fcn.004c8a14
test al, al
jne 0x4cbed3
push 0x4cc04c
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4cbf3d
call fcn.004c8a4c
test al, al
jne 0x4cbee8
push 0x4cc094
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4cbf3d
mov eax, dword [0x4d3b54]
mov eax, dword [eax]
call fcn.00482c7c
mov eax, dword [0x4d3b54]
mov eax, dword [eax]
xor edx, edx
call fcn.004847e0
mov eax, dword [0x4d3b54]
mov eax, dword [eax]
mov byte [eax + 0x57], 1
mov ecx, dword [0x4d38c8]
mov eax, dword [0x4d3b54]
mov eax, dword [eax]
mov edx, dword [0x4c9050]
call fcn.00482c94
mov eax, dword [0x4d38c8]
mov eax, dword [eax]
call fcn.004c93e4
mov eax, dword [0x4d3b54]
mov eax, dword [eax]
call fcn.00482de4
call fcn.004c8bb4
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cbf5c
pop edi
pop esi
pop ebx
call fcn.00405130
mov al, 4
add al, byte [eax]
Function at 0x4025bb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x4025c3
mov dword [ecx*4 + 0x49eea0], eax
inc ecx
cmp ecx, 0x100
jb 0x4025be
mov edx, 0x800
jmp 0x402610
mov eax, dword [ecx*4 + 0x49eaa0]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x49eea0]
inc ecx
mov dword [ecx*4 + 0x49ee9c], eax
cmp ecx, edx
jb 0x4025ef
mov dword [0x49d3b8], 0x402633
call int.004149b9
test eax, eax
jne 0x402631
mov dword [0x49d3b8], 0x4026cf
pop esi
ret
Function at 0x408af3
Capabilities:
Check if file exists
Check mutex on windows
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x610
mov eax, dword [0x41228c]
xor eax, esp
mov dword [esp + 0x60c], eax
push ebx
xor bl, bl
call fcn.004089cc
test eax, eax
je 0x408cb1
call fcn.0040a0af
test eax, eax
je 0x408cb1
push esi
mov esi, dword [esp + 0x624]
push edi
push 0xa
mov edi, str._shutdown
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x408b3d
inc bl
push ebp
push str.SunJavaBrokerMutex
push 1
xor ebp, ebp
push ebp
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, ebp
je 0x408ca5
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x408c9e
test bl, bl
jne 0x408cae
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
push ebp
push ebp
push 3
push ebp
push ebp
push 0xc0000000
push 0x40eef4
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x408c4a
push 0x1ff
lea eax, [esp + 0x21]
push ebp
push eax
mov byte [esp + 0x28], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebp
lea eax, [esp + 0x1c]
push eax
push 0x200
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
cmp eax, ebp
jne 0x408bda
call edi
cmp eax, 0xea
je 0x408bb6
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x220]
push 0x40ef0c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
lea eax, [esp + 0x228]
push eax
call fcn.00408580
add esp, 0x10
mov edi, str.SUCCESS
test eax, eax
jne 0x408c10
mov edi, str.FAILED
push ebp
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
push eax
push edi
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
mov edi, eax
cmp edi, ebp
jne 0x408c38
push str.Pipe__close_pipe_n
call fcn.0040a0af
pop ecx
push esi
call ebx
cmp edi, ebp
je 0x408c96
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x408b7d
call edi
cmp eax, 2
jne 0x408c61
push 0x1f4
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x408b7d
cmp eax, 0xe7
jne 0x408c84
push 0xffffffffffffffff
push str..pipejbrokerpipe
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
jne 0x408b7d
call edi
jmp 0x408b7d
push eax
push str.pipe_CreateFile_error:__d_n
call fcn.0040a0af
pop ecx
pop ecx
jmp 0x408b7d
push dword [esp + 0x10]
call ebx
jmp 0x408cae
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test bl, bl
je 0x408cae
call fcn.004089c0
pop ebp
pop edi
pop esi
mov ecx, dword [esp + 0x610]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040b376
add esp, 0x610
ret 0x10