joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a130
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c8718
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
call fcn.0050d7a0
test eax, eax
jne 0x45a259
lea eax, [ebp - 0x14]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x18], 0
jne 0x45a24f
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx + 0x44], 0
je 0x45a230
lea ecx, [ebp - 0x38]
call fcn.00405380
mov dword [ebp - 4], 0
call fcn.004d88c0
add eax, 0xb8
mov ecx, eax
call fcn.00405490
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x70
call fcn.00405490
push eax
push 0x6f5cf4
lea edx, [ebp - 0x38]
push edx
call fcn.0042f540
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.004054a0
shl eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
lea ecx, [ebp - 0x38]
call fcn.00405490
push eax
push 2
push 0
call fcn.004d88c0
add eax, 0xb8
mov ecx, eax
call fcn.00405490
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00405410
jmp 0x45a24f
call fcn.004d88c0
add eax, 0xb8
mov ecx, eax
call fcn.00405490
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x3c]
add ecx, 0x54
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x70
push edx
call fcn.0050dc00
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret
Function at 0x45a290
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c874b
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x844], ecx
mov eax, dword [ebp - 0x844]
add eax, 0x70
push eax
lea ecx, [ebp - 0x840]
push ecx
call fcn.0050d930
add esp, 8
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
mov dword [ebp - 0x84c], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x84c]
push eax
mov ecx, dword [ebp - 0x844]
add ecx, 0x54
call fcn.00405440
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.00405410
call fcn.0050d7a0
test eax, eax
jne 0x45a3eb
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x45a3df
mov dword [ebp - 0x1c], 0x400
xor edx, edx
mov word [ebp - 0x824], dx
push 0x7fe
push 0
lea eax, [ebp - 0x822]
push eax
call fcn.005a7100
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.004d88c0
add eax, 0xb8
mov ecx, eax
call fcn.00405490
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x45a3d2
push 0x71fb50
lea edx, [ebp - 0x824]
push edx
call fcn.005a7ebb
add esp, 8
test eax, eax
je 0x45a3d2
mov eax, dword [ebp - 0x844]
mov dword [eax + 0x44], 1
jmp 0x45a3df
mov ecx, dword [ebp - 0x844]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45a3f8
mov eax, dword [ebp - 0x844]
mov dword [eax + 0x44], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret
Function at 0x47a620
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x20]
call fcn.0047e510
movzx eax, al
test eax, eax
je 0x47a68e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00460c10
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00460c10
push eax
push 0x4e
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.004275a0
mov ecx, eax
call fcn.00427030
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47a72c
mov ecx, dword [ebp - 0x20]
call fcn.0047c450
movzx edx, al
test edx, edx
je 0x47a6dc
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00460c10
and eax, 0xffff
movzx edx, ax
push edx
push 0x111
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.004275a0
mov ecx, eax
call fcn.00427030
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x47a72c
push 1
push 0
push 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x28]
push edx
push 0x6f7650
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
mov eax, 0x20
cmp eax, dword [ebp - 0x14]
sbb ecx, ecx
neg ecx
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x47a72c
mov eax, dword [ebp - 0x20]
mov cl, byte [eax + 0x58]
or cl, 2
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x58], cl
push 1
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.0041eae0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x47b480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x47b489
xor ecx, ecx
jne 0x47b489
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47b4d0
mov eax, dword [ebp - 0xc]
jmp 0x47b52d
cmp dword [ebp - 4], 1
je 0x47b4e3
cmp dword [ebp - 4], 2
je 0x47b4e3
mov eax, 0xd
jmp 0x47b52d
cmp dword [ebp + 0xc], 0
je 0x47b521
cmp dword [ebp - 8], 0
je 0x47b519
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x47b510
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x47b517
mov eax, 0xd
jmp 0x47b52d
jmp 0x47b521
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x486142
Capabilities:
Parse pe header

Disassembly:
push 0x2c
push 0x6f7770
call fcn.005b128c
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x4861ae
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
je 0x486186
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x4861b4
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x48617e
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x48617e
mov al, 1
jmp 0x486180
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.005b12c7
ret
Function at 0x4862ec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x7ff80000
push edi
jbe 0x48630b
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x486312
mov dword [ebp - 4], 0x10000
cmp esi, 0x80000000
jae 0x486325
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x48632c
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x764078]
test eax, eax
mov ecx, dword [0x764074]
jne 0x486346
test ecx, ecx
je 0x48635b
mov eax, ecx
mov dword [0x764078], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x48635b
cmp edx, dword [ebp - 4]
jb 0x48635b
cmp edx, dword [ebp - 8]
jbe 0x48648c
mov eax, ecx
test ecx, ecx
jmp 0x48637f
test eax, eax
je 0x48637a
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x48637a
cmp ecx, dword [ebp - 4]
jb 0x48637a
cmp ecx, dword [ebp - 8]
jbe 0x48648c
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x764078], eax
jne 0x486361
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp - 4]
mov dword [ebp + 8], esi
mov ebx, 0x3000
jbe 0x48644e
cmp esi, 0x70000000
jb 0x4863bb
cmp esi, 0x80000000
ja 0x4863bb
mov esi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4863fb
mov eax, 0x10000
cmp dword [ebp - 0x30], eax
jne 0x4863db
cmp dword [ebp - 0x34], eax
jae 0x4863eb
mov esi, dword [ebp - 0x3c]
add esi, 0xffff0000
cmp esi, dword [ebp - 4]
ja 0x4863a6
jmp 0x4863fb
push 0x40
push ebx
push eax
push esi
call edi
test eax, eax
mov dword [0x764078], eax
jne 0x48645a
mov esi, dword [ebp + 8]
jmp 0x48644e
cmp esi, 0x70000000
jb 0x486415
cmp esi, 0x80000000
ja 0x486415
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x486453
mov eax, 0x10000
cmp dword [ebp - 0x14], eax
jne 0x486445
cmp dword [ebp - 0x18], eax
jb 0x486445
push 0x40
push ebx
push eax
push esi
call edi
test eax, eax
mov dword [0x764078], eax
jne 0x48645a
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x486400
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [0x764074]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x764074], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x48647e
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x486453
cmp esi, dword [ebp - 8]
ja 0x486453
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.005a7100
add esp, 0xc
mov eax, esi
jmp 0x486455
Function at 0x4864d4
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x6f7780
call fcn.005b128c
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x48652f
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x48652b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x48652b
cmp word [eax + 0x14], 0
jne 0x486520
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x486531
mov eax, ecx
jmp 0x48651a
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.005b12c7
ret

Function at 0x486555
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x764080], edi
jne 0x486578
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x764080
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x48657f
mov eax, 0x10dd
jmp 0x4865c3
push esi
mov esi, dword [0x764074]
mov dword [0x76407c], edi
mov dword [0x764090], edi
mov dword [0x76408c], edi
mov dword [0x764084], edi
mov dword [0x764088], edi
jmp 0x4865bc
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x4865a6
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x4865c6
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x764080], eax
je 0x4865dc
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x764090]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x486627
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x486618
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x486618
call fcn.004864b3
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.005a6a8e
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4865eb
mov dword [0x764090], ebx
call fcn.004862c5
mov esi, dword [0x76408c]
cmp esi, ebx
je 0x486654
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.005a6a8e
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x48663c
pop edi
pop esi
mov dword [0x76408c], ebx
mov dword [0x764080], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4868a7
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x764084]
test eax, eax
jne 0x486917
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x4868c3
xor eax, eax
jmp 0x486916
push esi
push 8
call fcn.005a7c1e
mov esi, eax
test esi, esi
pop ecx
jne 0x4868d7
push 8
pop edi
jmp 0x4868f2
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x486903
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.005a6a8e
pop ecx
and dword [0x764088], 0
mov dword [0x764084], edi
mov eax, edi
jmp 0x486915
mov eax, dword [0x76408c]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x76408c], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x486b5c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x764080], eax
je 0x486b78
mov eax, 0x10dd
jmp 0x486c54
mov eax, dword [0x764084]
test eax, eax
jne 0x486c54
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x486b95
push 6
pop eax
jmp 0x486c53
cmp dword [edi], 0
push ebx
push esi
jne 0x486ba9
push 6
pop eax
mov dword [0x764084], eax
jmp 0x486c4b
push 0x18
call fcn.005a7c1e
mov esi, eax
test esi, esi
pop ecx
jne 0x486bbc
push 8
pop edi
jmp 0x486c35
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.00486537
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x486c2a
cmp ecx, 0x17
ja 0x486c2a
cmp dword [edi + 0x1c], eax
jne 0x486c2a
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push ebx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x486c00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x486c35
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x764090]
mov dword [esi], eax
mov dword [0x764090], esi
xor eax, eax
jmp 0x486c51
cmp dword [0x76407c], edx
push 9
pop edi
jne 0x486c3b
mov dword [0x764084], edi
test esi, esi
je 0x486c46
push esi
call fcn.005a6a8e
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x764088], edi
pop esi
pop ebx
pop edi
leave
ret 8

Function at 0x489850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov byte [0x7640f8], 0
mov byte [0x7640f9], 0
push 0x7640c0
call fcn.00489990
add esp, 4
call fcn.00488500
push 0
push 0
push 0
push 0x4898e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x7640fc], eax
push 0
push 0
push 0
push 0x4898b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x764100], eax
pop ebp
ret
Function at 0x489d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x45
mov byte [ebp - 5], 0x46
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x489dc9
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
jae 0x489e1c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x1c]
mov al, byte [edx]
mov byte [ebp - 0x1d], al
movsx ecx, byte [ebp - 0x1d]
and ecx, 0xf0
sar ecx, 4
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x18]
mov al, byte [ebp + ecx - 0x14]
mov byte [edx], al
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
movsx edx, byte [ebp - 0x1d]
and edx, 0xf
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x18]
mov cl, byte [ebp + edx - 0x14]
mov byte [eax], cl
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x489dc0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret
Function at 0x4963e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cd675
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp - 0x70]
add ecx, 0x20
call fcn.0041dbf0
movzx eax, al
test eax, eax
je 0x496424
xor eax, eax
jmp 0x496594
push 0x6f9b2c
lea ecx, [ebp - 0x2c]
call fcn.004053a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x70]
cmp dword [ecx], 0
jne 0x49644d
push 0x6f9b38
lea ecx, [ebp - 0x2c]
call fcn.00405460
lea ecx, [ebp - 0x4c]
call fcn.00405380
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00405490
push eax
mov ecx, dword [ebp - 0x70]
add ecx, 4
call fcn.00405490
push eax
push str._USER_CONFIG__LAST_USER__s__LAST_USER__AUTO_LOGIN__s__AUTO_LOGIN__USER_LIST_
lea edx, [ebp - 0x4c]
push edx
call fcn.0042f540
add esp, 0x10
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x3c
call fcn.004057f0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], edx
jmp 0x4964a3
lea ecx, [ebp - 0x54]
call fcn.004095e0
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x3c
call fcn.00405820
push eax
lea ecx, [ebp - 0x54]
call fcn.00406120
movzx ecx, al
test ecx, ecx
je 0x4964e5
lea ecx, [ebp - 0x54]
call fcn.004967d0
mov ecx, eax
call fcn.00405490
push eax
push str._U__s__U_
lea edx, [ebp - 0x4c]
push edx
call fcn.00480bd0
add esp, 0xc
jmp 0x49649b
push str.__USER_LIST___USER_CONFIG_
lea ecx, [ebp - 0x4c]
call fcn.0040bb20
mov dword [ebp - 0x30], 0
push 0x6f9c2c
mov ecx, dword [ebp - 0x70]
add ecx, 0x20
call fcn.00405490
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.005b1600
add esp, 0xc
cmp dword [ebp - 0x30], 0
jne 0x496543
mov dword [ebp - 0x68], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00405410
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405410
mov eax, dword [ebp - 0x68]
jmp 0x496594
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.004054a0
push eax
push 2
lea ecx, [ebp - 0x4c]
call fcn.00405490
push eax
call fcn.005ab8a9
add esp, 0x10
mov edx, dword [ebp - 0x30]
push edx
call fcn.005ab232
add esp, 4
mov dword [ebp - 0x6c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00405410
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405410
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret
Function at 0x49dcd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ce05a
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x10c], 0
jne 0x49dd0e
xor al, al
jmp 0x49de83
push str.peer_service_id
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x10c]
push edx
call fcn.00401000
add esp, 8
test eax, eax
je 0x49dd44
push 0x6fab00
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x10c]
push ecx
call fcn.00401000
add esp, 8
test eax, eax
jne 0x49dd4b
xor al, al
jmp 0x49de83
push str._X_GET_PEER_SERVICE_LIST_RESPONSE
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x10c]
push eax
call fcn.00401000
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x14]
sub edx, dword [ecx + 0x10c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x110]
sub ecx, edx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x19], 0
lea ecx, [ebp - 0x28]
call fcn.004db640
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.004db6a0
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24]
call fcn.004877f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004db780
push eax
lea ecx, [ebp - 0x24]
call fcn.00487990
movzx edx, al
test edx, edx
je 0x49de5f
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0xac]
call fcn.004d7ec0
mov byte [ebp - 0x19], al
movzx edx, byte [ebp - 0x19]
test edx, edx
je 0x49de5f
push str.PeerList.xml
mov eax, dword [ebp - 0x54]
add eax, 0x3c
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 2
mov dword [ebp - 0x4c], 0
push 0x6fab64
lea ecx, [ebp - 0x48]
call fcn.00405490
push eax
lea edx, [ebp - 0x4c]
push edx
call fcn.005b1600
add esp, 0xc
cmp dword [ebp - 0x4c], 0
je 0x49de53
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 1
mov edx, dword [ebp - 0x14]
push edx
call fcn.005ab8a9
add esp, 0x10
mov eax, dword [ebp - 0x4c]
push eax
call fcn.005ab232
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00405410
mov cl, byte [ebp - 0x19]
mov byte [ebp - 0x4d], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00487820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004db660
mov al, byte [ebp - 0x4d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret