joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8450
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
mov eax, ecx
sub esi, ecx
mov edi, 8
mov dl, byte [esi + eax]
or dl, 0x80
mov byte [eax], dl
inc eax
dec edi
jne 0x4c8467
mov eax, 1
mov dl, byte [eax + ebp - 1]
mov bl, byte [eax + ecx]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, 8
jl 0x4c8478
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4c88f0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf0
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x58b258]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 0x38
jl 0x4c8903
xor edx, edx
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x84]
lea ebp, [esp + eax*4 + 0x80]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x58b300]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4c8963
mov bl, byte [esp + ecx + 0x48]
jmp 0x4c8967
mov bl, byte [esp + ecx + 0x2c]
mov byte [esp + eax + 0x10], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4c8958
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4c8985
mov bl, byte [esp + ecx + 0x48]
jmp 0x4c8989
mov bl, byte [esp + ecx + 0x2c]
mov byte [esp + eax + 0x10], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4c897a
xor ecx, ecx
mov eax, 0x58b268
xor ebx, ebx
mov bl, byte [ecx + 0x58b310]
cmp byte [esp + ebx + 0x10], 0
je 0x4c89b4
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x58b328]
cmp byte [esp + ebx + 0x10], 0
je 0x4c89cb
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4c899b
inc edx
cmp edx, 0x10
jl 0x4c892e
mov edx, dword [esp + 0x10c]
mov ecx, dword [esp + 0x104]
lea eax, [esp + 0x80]
push edx
push eax
push ecx
call fcn.004c8a10
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf0
ret
Function at 0x4cb210
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x40]
push ebp
push esi
push edi
mov edi, dword [esp + 0x44]
lea esi, [esp + 0x20]
lea ebp, [esp + 0x30]
sub esi, edi
sub ebx, edi
mov eax, edi
sub ebp, edi
mov dword [esp + 0x44], 0x10
mov dl, byte [eax]
mov cl, byte [ebx + eax]
mov byte [esi + eax - 0x10], dl
mov byte [esi + eax], cl
xor cl, dl
mov byte [eax + ebp], cl
mov ecx, dword [esp + 0x44]
inc eax
dec ecx
mov dword [esp + 0x44], ecx
jne 0x4cb237
xor eax, eax
xor edx, edx
xor ecx, ecx
mov al, byte [eax + str._.C]
mov bl, byte [esp + ecx + 0x10]
xor bl, al
mov al, bl
mov byte [esp + ecx + 0x10], bl
and eax, 0xff
inc ecx
cmp ecx, 0x30
jb 0x4cb25a
add eax, edx
and eax, 0xff
inc edx
cmp edx, 0x12
jb 0x4cb258
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x4c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov eax, dword [esp + 0x48]
mov dword [edi + 0xc], ecx
xor ecx, ecx
sub esi, eax
mov cl, byte [eax + 0xf]
mov edi, 0x10
xor edx, edx
mov dl, byte [esi + eax]
xor edx, ecx
mov cl, byte [edx + str._.C]
mov dl, byte [eax]
xor dl, cl
mov cl, dl
mov byte [eax], dl
and ecx, 0xff
inc eax
dec edi
jne 0x4cb2b3
push 0x30
lea edx, [esp + 0x14]
push 0
push edx
call fcn.004caa10
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x4cd540
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00509cd1
add esp, 4
mov ebx, eax
call fcn.004cd5d0
mov byte [ebx], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 1]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea eax, [esi - 1]
test eax, eax
jle 0x4cd5ad
mov cl, byte [eax + ebx - 1]
mov dl, byte [eax + ebx]
xor dl, cl
mov byte [eax + ebx], dl
dec eax
test eax, eax
jg 0x4cd59c
push 0x100
push 0x5b36f4
push esi
push ebx
call fcn.004cd410
push ebx
call fcn.00509cfa
add esp, 0x14
mov eax, 0x5b36f4
pop edi
pop esi
pop ebx
ret
Function at 0x4cd610
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x5b35f4
mov ebx, ecx
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov eax, ebx
and eax, reloc.WSOCK32.dll_accept
jns 0x4cd63f
dec eax
or eax, 0xfffffffe
inc eax
je 0x4cd64a
pop edi
pop ebp
mov eax, 0x5b35f4
pop ebx
ret
mov eax, ebx
push esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
add esi, 2
push esi
call fcn.00509cd1
mov edi, eax
push esi
push edi
push ebx
push ebp
call fcn.004cd4d0
sub esi, 2
mov eax, 1
add esp, 0x14
cmp esi, eax
jle 0x4cd688
mov cl, byte [eax + edi - 1]
mov bl, byte [eax + edi]
xor bl, cl
mov byte [eax + edi], bl
inc eax
cmp eax, esi
jl 0x4cd677
push 0
lea edx, [edi + 1]
push 0xffffffffffffffff
push edx
push 0x100
push 0x5b35f4
mov byte [eax + edi], 0
call fcn.004cce00
push edi
call fcn.00509cfa
add esp, 0x18
mov eax, 0x5b35f4
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x4cdc0b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cdc63
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x59758c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4cdc56
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4cdc65
xor eax, eax
pop esi
leave
ret 4

Function at 0x4d1b30
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4d5b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53f907
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x5927d4]
push ebx
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push eax
push eax
push ecx
lea edx, [esp + 0x14]
mov ebx, 1
push str._s___s___s
push edx
mov dword [esp + 0x44], ebx
call fcn.00505f09
mov eax, dword [esp + 0x1c]
add esp, 0x14
lea ecx, [esp + 0x10]
push eax
call fcn.0040afea
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x30], 2
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x10]
push eax
call fcn.0040b0c8
test eax, eax
je 0x4d5bee
mov esi, dword [esp + 0x38]
push ebx
push esi
lea ecx, [esp + 0x18]
call fcn.0040b190
mov dword [esp + 0xc], ebx
jmp 0x4d5c02
mov esi, dword [esp + 0x38]
push 0x59758c
mov ecx, esi
call fcn.00509ffe
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.0040b08a
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.00509f90
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4d5da0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x53f981
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], esi
mov dword [esi + 4], 0x5522fc
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
lea ebp, [esi + 0x18]
mov dword [esp + 0x28], ebx
mov dword [ebp], method.CCommandLineInfo.virtual_0
mov dword [ebp + 4], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], ebx
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x24
mov byte [esp + 0x2c], 1
mov byte [esi + 0x30], al
mov byte [esi + 0x31], cl
mov byte [esi + 0x38], bl
call fcn.00509cd1
mov edi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x20], 1
call fcn.004fec76
cmp dword [0x5b3e44], ebx
jne 0x4d5e47
mov dword [0x5b3e44], edi
mov dword [edi], ebx
mov edx, dword [0x5b3e44]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x5b3e40]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x5b3e40], edx
call fcn.004fed12
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4d5e6e
push eax
call fcn.00509cfa
add esp, 4
mov edi, dword [0x5b3e44]
push 0x24
call fcn.00509cd1
mov dword [eax + 4], edi
mov dword [eax + 0x20], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x34]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi], 0x5522ec
mov dword [esi + 0x2c], ebx
mov edi, dword [esi + 0x20]
mov byte [esp + 0x28], 2
dec edi
js 0x4d5ecd
cmp edi, ebx
jl 0x4d5eca
cmp edi, dword [esi + 0x20]
jge 0x4d5eca
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + edi*4]
cmp ecx, ebx
je 0x4d5eca
mov edx, dword [ecx]
push 1
call dword [edx + 4]
push 1
push edi
mov ecx, ebp
call fcn.004d6a10
dec edi
jns 0x4d5ea6
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 4]
mov dword [esi + 0x2c], ebx
call fcn.004472cd
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4d85b0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
xor edi, edi
cmp ebx, edi
jne 0x4d85c2
pop edi
or eax, 0xffffffff
pop ebx
ret
push esi
push 0x20
call fcn.00509cd1
add esp, 4
cmp eax, edi
je 0x4d8602
mov ecx, dword [0x5927d4]
mov esi, eax
mov dword [eax], ecx
mov edx, dword [0x5927d4]
mov dword [eax + 4], edx
mov ecx, dword [0x5927d4]
mov dword [eax + 0x1c], ecx
mov dword [eax + 8], 3
mov dword [eax + 0xc], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x18], edi
jmp 0x4d8604
xor esi, esi
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
call fcn.0050a119
mov eax, dword [esp + 0x18]
lea ecx, [esi + 4]
push eax
call fcn.0050a119
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x14], ecx
push eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
call fcn.0050a119
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push 0x4d84d0
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
neg eax
sbb eax, eax
pop esi
neg eax
pop edi
dec eax
pop ebx
ret

Function at 0x4d8b60
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
mov eax, dword [esp + 8]
push esi
push 0
push 0x59758c
push 0x59758c
push 0
mov esi, ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 0x30d65], eax
jne 0x4d8b98
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 0x14
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0x4400000
push 3
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 0x30d69], eax
jne 0x4d8be5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x30d71], eax
mov eax, dword [esi + 0x30d65]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop esi
ret 0x14
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x4d8c1d
push edi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [esi + 0x30d69]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
mov dword [esi + 0x30d71], eax
call edi
mov edx, dword [esi + 0x30d65]
push edx
call edi
pop edi
xor eax, eax
pop esi
ret 0x14
mov eax, 1
pop esi
ret 0x14
Function at 0x4d8ec0
Capabilities:
Send data
Send http request

Disassembly:
mov eax, 0xa000
call fcn.004eef30
mov al, byte [0x59758c]
push esi
mov esi, ecx
push edi
mov byte [esp + 8], al
mov ecx, 0x27ff
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
push 0xa000
push ecx
mov ecx, esi
stosb byte es:[edi], al
call fcn.004d9630
mov edx, dword [esp + 0xa00c]
mov eax, dword [esi + 0x30d69]
push 0
push 0x4400000
push 0
push 0x59758c
push str.HTTP_1.0
push edx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edx, eax
test edx, edx
mov dword [esi + 0x30d6d], edx
jne 0x4d8f4a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x30d71], eax
pop edi
xor eax, eax
pop esi
add esp, 0xa000
ret 4
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Content_Type:_application_x_www_form_urlencoded_r_n
push ecx
lea ecx, [esp + 0xc]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4d8f95
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x30d71], eax
pop edi
xor eax, eax
pop esi
add esp, 0xa000
ret 4
pop edi
mov eax, 1
pop esi
add esp, 0xa000
ret 4
Function at 0x4d91d0
Capabilities:
Read data from internet
Receive data

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x30d6d]
test eax, eax
jne 0x4d91ef
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 8
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, edx
push ebp
mov ebp, ecx
push edi
xor eax, eax
mov edi, ebx
push 0x5b3e5c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push edx
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x30d6d]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
pop edi
pop ebp
test eax, eax
pop ebx
jne 0x4d923b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 8
mov eax, dword [0x5b3e5c]
pop esi
ret 8
Function at 0x4d99c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
push edi
xor edi, edi
cmp eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jae 0x4d9a51
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateFileA]
push esi
lea ebx, [eax + 0x100]
mov edx, dword [ebx + 0x400]
dec edx
je 0x4d9a2b
dec edx
jne 0x4d9a31
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebx
call ebp
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push esi
lea edi, [edi + eax + 0x1800]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x4d9a31
add edi, 0x2000
mov edx, dword [ecx + 0xc]
add eax, 0x504
add ebx, 0x504
cmp eax, edx
mov dword [esp + 0x10], eax
jb 0x4d99e7
pop esi
pop ebp
mov eax, edi
pop ebx
pop edi
add esp, 8
ret
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x4d9a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0xc], 0x400
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x4d9a9d
lea edi, [esi + ebx]
push 1
push 0x58398c
push edi
call fcn.004f1b1a
add esp, 0xc
test eax, eax
je 0x4d9a9d
dec esi
dec edi
test esi, esi
ja 0x4d9a83
lea eax, [esp + 0x14]
add esi, ebx
push eax
push 1
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d9b11
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0x5b3e60
push eax
push eax
push str.Content_Type
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4d9afa
mov edi, str.application_octet_stream
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.application_octet_stream
push 0x5b3e60
call fcn.004ef7c5
add esp, 0xc
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x5b3e60
pop ebx
pop ecx
ret 4
mov edi, str.application_octet_stream
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.application_octet_stream
push 0x5b3e60
call fcn.004ef7c5
add esp, 0xc
mov eax, 0x5b3e60
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x4da290
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x53fca0
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
push 0
push 0x583ad0
push 0x583ad8
lea ecx, [esi + 4]
call fcn.0041f425
mov al, byte [esi + 0xbe]
test al, al
je 0x4da3b0
push 0xa
lea ecx, [esp + 0x14]
call fcn.00509677
mov dword [esp + 0xc], 0x54f8f8
lea eax, [esp + 4]
push str.passport
push eax
mov ecx, esi
mov dword [esp + 0x5c], 0
call fcn.0040c28b
mov eax, dword [eax]
push 1
push eax
push str.passport
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 1
call fcn.004d9ee0
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00509f90
lea ecx, [esp + 4]
push 0x5855b0
push ecx
mov ecx, esi
call fcn.0040c28b
mov eax, dword [eax]
push 1
push eax
push 0x5855b0
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 2
call fcn.004d9ee0
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00509f90
lea edx, [esp + 4]
lea ecx, [esp + 0xc]
push edx
call fcn.004da140
mov eax, dword [eax]
mov ecx, esi
push eax
push 0
push 0xffffffffffffffff
push 1
mov byte [esp + 0x64], 3
call fcn.004db410
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00509f90
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0xc], 0x54f8f8
call fcn.00509759
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
push ebx
push 0xa
lea ecx, [esp + 0x38]
call fcn.00509677
mov dword [esp + 0x30], 0x54f8f8
lea eax, [esp + 8]
mov ebx, 4
push str.uname
push eax
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0040c28b
mov eax, dword [eax]
push 1
push eax
push str.uname
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 5
call fcn.004d9ee0
lea ecx, [esp + 8]
mov byte [esp + 0x58], bl
call fcn.00509f90
lea ecx, [esp + 8]
push str.password
push ecx
mov ecx, esi
call fcn.0040c28b
mov eax, dword [eax]
push 1
push eax
push str.passwd
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 6
call fcn.004d9ee0
lea ecx, [esp + 8]
mov byte [esp + 0x58], bl
call fcn.00509f90
lea edx, [esp + 0xc]
lea ecx, [esp + 0x30]
push edx
call fcn.004da140
mov eax, dword [eax]
mov ecx, esi
push eax
push 0
push 0xffffffffffffffff
push 1
mov byte [esp + 0x68], 7
call fcn.004db410
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], bl
call fcn.00509f90
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x30], 0x54f8f8
call fcn.00509759
mov ecx, dword [esp + 0x50]
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x4da890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53fd18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x5927d4]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
xor esi, esi
push str._u:_u:_u____
push ecx
mov dword [esp + 0x34], esi
call fcn.00505f09
add esp, 0x14
lea edx, [edi + 0x99]
lea ecx, [esp + 0xc]
push esi
push edx
call fcn.004e74e1
push 0xc350
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.004e7508
test eax, eax
jne 0x4da937
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], al
call fcn.004e751d
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00509f90
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [0x5927d4]
push ebx
push ebp
mov dword [esp + 0x38], eax
mov ebp, dword [edi + 0x8d]
mov byte [esp + 0x28], 2
cmp ebp, esi
jle 0x4da98b
mov ecx, dword [edi + 0x89]
lea edx, [ecx + esi*4]
lea ecx, [esp + 0x38]
push edx
call fcn.0050a0c9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
call fcn.00505b83
test eax, eax
je 0x4da97d
inc esi
cmp esi, ebp
jl 0x4da951
jmp 0x4da98b
push 1
push esi
lea ecx, [edi + 0x85]
call fcn.0050893b
lea ecx, [esp + 0x14]
call fcn.004e751d
cmp esi, ebp
lea ecx, [esp + 0x38]
setl bl
mov byte [esp + 0x28], 1
call fcn.00509f90
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.004e751d
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00509f90
mov ecx, dword [esp + 0x20]
mov al, bl
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x4db940
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 1
push eax
call fcn.004dc0a0
push 0
mov ebx, eax
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004dc0a0
xor edx, edx
mov dl, byte [ebx + 0x1f]
mov esi, edx
test esi, esi
je 0x4dbaf3
cmp esi, 0x1f
jge 0x4dbaf3
cmp byte [esi + ebx], 0xe9
jne 0x4dbaf3
mov ecx, dword [esi + ebx + 1]
lea edi, [ecx + ebx + 5]
mov cl, byte [ecx + ebx + 5]
cmp cl, 0xe9
je 0x4db9a6
push 9
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov edx, dword [edi + 1]
lea ecx, [edx + edi + 5]
cmp ecx, eax
je 0x4db9c4
push 0xc
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x4dba0a
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4dba0a
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
test eax, eax
je 0x4dba0a
lea edx, [esp + 0x18]
push edx
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
xor ecx, ecx
mov eax, ebx
test esi, esi
mov edx, edi
jle 0x4dba28
push 0
push eax
push edx
call fcn.004dc0e0
mov ecx, eax
sub ecx, ebx
cmp ecx, esi
lea edx, [ecx + edi]
jl 0x4dba14
cmp ecx, esi
je 0x4dba9a
push 0xd
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4dbafb
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4dbafb
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4dbafb
push eax
mov eax, dword [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
test eax, eax
je 0x4dbafb
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4dbae5
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4dbae5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4dbae5
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
test eax, eax
je 0x4dbae5
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 8
push 6
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8