joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46489b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
mov bl, dl
mov esi, ecx
call fcn.004b8c50
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov eax, esi
or eax, 0x8000
test bl, bl
push edi
push edi
cmove eax, esi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
pop edi
pop esi
pop ebx
test eax, eax
je 0x4648f4
xor eax, eax
jmp 0x464902
or edx, 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.00462810
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7879
leave
ret

Function at 0x464e39
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x464ec9
cmp byte [edi], 0
je 0x464ec9
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004b8c50
mov ecx, dword [ebp + 8]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x400
call fcn.00462840
or edx, 0xffffffff
mov dword [ebp - 0x30], eax
mov ecx, edi
call fcn.00462840
or edx, 0xffffffff
mov dword [ebp - 0x2c], eax
mov ecx, ebx
call fcn.00462840
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x464ed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
push ebx
push edi
push str.LaunchFile:_ShellExecuteExW_path:__s_params:__s_verb:__s_n
call fcn.004620b3
add esp, 0x10
mov ecx, esi
call fcn.0046448c
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov al, 1
jmp 0x464ecb

Function at 0x464ed4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
push esi
push edi
push 0x44
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push 0
push eax
mov edi, edx
mov esi, ecx
movups xmmword [esp + 0x14], xmm0
call fcn.004b8c50
add esp, 0xc
mov dword [esp + 0x18], 0x44
or edx, 0xffffffff
mov ecx, esi
call fcn.00462840
or edx, 0xffffffff
mov ecx, edi
mov esi, eax
call fcn.00462840
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
xor eax, eax
push eax
push dword [ebp + 8]
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x464f48
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x464f97
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x464fdb
xor al, al
jmp 0x464ffb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], ebx
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret

Function at 0x46549f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
or edx, 0xffffffff
call fcn.00462840
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
sete cl
call fcn.00413f3a
test esi, esi
jne 0x4654c5
xor bl, bl
jmp 0x465527
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x465527
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, esi
call fcn.0045f463
lea edi, [eax + 1]
lea eax, [edi + edi]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x46551c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x46550c
push dword [ebp - 4]
mov edx, edi
mov ecx, eax
call fcn.00460d8d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
setne bl
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x46552e
Capabilities:
Write clipboard data

Disassembly:
push ebx
push esi
push edi
or edx, 0xffffffff
call fcn.00462840
mov edi, eax
test edi, edi
sete cl
call fcn.00413f3a
test edi, edi
jne 0x46554d
xor al, al
jmp 0x465594
mov ecx, edi
call fcn.0045f463
lea ebx, [eax + 1]
lea eax, [ebx + ebx]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x465591
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x46557f
push edi
mov edx, ebx
mov ecx, eax
call fcn.00460d8d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test esi, esi
setne al
pop edi
pop esi
pop ebx
ret
Function at 0x465598
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
test esi, esi
jne 0x4655a9
xor al, al
jmp 0x4655f5
push edi
lea eax, [ebp - 0x18]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp dword [ebp - 4], 0
je 0x4655e4
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push esi
call dword [sym.imp.USER32.dll_CopyImage]
mov esi, eax
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4655ef
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
test edi, edi
pop edi
setne al
pop esi
leave
ret

Function at 0x465fa2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push 0
mov edi, ecx
push 0xe
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
lea esi, [eax*2 + 4]
call fcn.0046265e
mov edx, esi
mov ecx, eax
call fcn.004621fe
mov esi, eax
test esi, esi
je 0x465fe6
mov eax, dword [ebp - 4]
push esi
inc eax
push eax
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x465fea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push 0
mov edi, ecx
push 0xe
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
lea esi, [eax*2 + 4]
call fcn.0046265e
mov edx, esi
mov ecx, eax
call fcn.004621fe
mov esi, eax
test esi, esi
je 0x466036
mov eax, dword [ebp - 4]
push esi
inc eax
push eax
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
or edx, 0xffffffff
mov ecx, esi
call fcn.00462810
pop edi
pop esi
leave
ret

Function at 0x4665fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
mov edi, ecx
call fcn.004b8c50
add esp, 0xc
lea eax, [ebp - 0x210]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x46668d
cmp eax, ebx
jae 0x46668d
or edx, 0xffffffff
lea ecx, [ebp - 0x210]
call fcn.00462810
push esi
mov edx, str.explorer.exe
mov ecx, eax
call fcn.00462922
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.0046330d
test al, al
je 0x46668d
push edi
push ebx
push str.__s____s_
call fcn.0045f9ea
add esp, 0xc
mov esi, eax
push 0
call fcn.004c5e5a
pop ecx
test esi, esi
je 0x46668d
mov edi, esi
push 0
xor edx, edx
mov ecx, edi
call fcn.00464ed4
pop ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], eax
call fcn.004665dd
push esi
call fcn.004c5e5a
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x4666c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xa
push 2
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
sete cl
call fcn.00413f3a
test edi, edi
je 0x466736
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
sete cl
call fcn.00413f3a
test ebx, ebx
je 0x466736
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
sete cl
call fcn.00413f3a
test edi, edi
je 0x466736
mov ebx, dword [ebp - 4]
mov edx, edi
push ebx
xor ecx, ecx
call fcn.0045f484
pop ecx
mov dword [esi], eax
mov dword [esi + 4], ebx
jmp 0x46673d
and dword [esi], 0
and dword [esi + 4], 0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4668b6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 2
push eax
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
cmp word [ebp - 4], 0x30
setne al
leave
ret

Function at 0x467cc5
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x467d94
push esi
push str._r_nThread:__x_r_n
push edi
call fcn.00460583
add esp, 0xc
push esi
push 0
push 0x4a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
jne 0x467d1c
push 0xffffffffffffffff
push str.Failed_to_OpenThread___r_n
mov ecx, edi
call fcn.00460443
jmp 0x467d94
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x467d37
push eax
push str.Failed_to_SuspendThread___r_n
mov ecx, edi
call fcn.00460443
jmp 0x467d8d
push 0x2c8
lea eax, [ebp - 0x2cc]
push 0
push eax
call fcn.004b8c50
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10007
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, edi
test eax, eax
je 0x467d7a
push esi
lea edx, [ebp - 0x2d0]
call fcn.00467b2c
pop ecx
jmp 0x467d86
push 0xffffffffffffffff
push str.Failed_to_GetThreadContext___r_n
call fcn.00460443
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b7879
leave
ret
Function at 0x467e8b
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x467eb0
jmp 0x467f04
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x467efb
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
jne 0x467ee9
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
call fcn.00467cc5
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov dword [ebp - 0x28], eax
jmp 0x467ed0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7879
leave
ret

Function at 0x46bb49
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x519afe], 0
push edi
mov edi, edx
mov dword [ebp - 4], edi
jne 0x46bbb4
push ebx
push esi
xor esi, esi
inc esi
and dword [0x51abd0], 0
lea ecx, [esi + 0x7f]
mov eax, esi
lea ebx, [ecx*4 + 0x51abd0]
and al, 1
mov edi, ecx
movzx eax, al
neg eax
sbb eax, eax
shr esi, 1
and eax, 0xedb88320
shl edi, 3
xor esi, eax
xor edx, edx
mov eax, dword [edx + 0x51abd0]
add edx, edi
xor eax, esi
mov dword [ebx], eax
add ebx, edi
cmp edx, 0x400
jb 0x46bb8e
shr ecx, 1
jne 0x46bb6c
mov edi, dword [ebp - 4]
pop esi
pop ebx
mov byte [0x519afe], 1
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
test edx, edx
je 0x46bbd6
movzx eax, byte [edi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x51abd0]
inc edi
sub edx, 1
jne 0x46bbbe
not ecx
mov eax, ecx
pop edi
leave
ret
Function at 0x46c05f
Capabilities:
Check http status code
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, edx
mov esi, ecx
push eax
push esi
push str.HttpGetToFile:_url:__s__file:__s_n
mov dword [ebp - 0x41c], eax
call fcn.004620b3
add esp, 0xc
mov dword [ebp - 0x424], 4
xor ebx, ebx
or edx, 0xffffffff
mov ecx, esi
mov dword [ebp - 0x40c], ebx
mov edi, ebx
mov dword [ebp - 0x414], ebx
call fcn.00462840
mov esi, dword [ebp - 0x41c]
or edx, 0xffffffff
mov ecx, esi
mov dword [ebp - 0x410], eax
call fcn.00462840
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x418], eax
cmp eax, 0xffffffff
jne 0x46c105
push esi
push str.HttpGetToFile:_CreateFileW__s__failed_n
call fcn.004620b3
pop ecx
pop ecx
xor ecx, ecx
call fcn.0046448c
mov esi, ebx
jmp 0x46c1c1
push ebx
push ebx
push ebx
push ebx
push str.SumatraPdfHTTP
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x46c1c1
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x410]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
test edi, edi
je 0x46c1c1
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x20000013
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x46c1c1
cmp dword [ebp - 0x414], 0xc8
jmp 0x46c19d
cmp dword [ebp - 0x40c], ebx
je 0x46c1bf
push ebx
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46c1c1
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x40c]
jne 0x46c1c1
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x46c164
jmp 0x46c1c1
mov bl, 1
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x46c1d8
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x46c1e3
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test bl, bl
jne 0x46c1f2
mov ecx, dword [ebp - 0x41c]
call fcn.00463427
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x46da95
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
mov dword [ebp - 0x260], edx
mov esi, ecx
call fcn.00462a91
push 0x250
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.004b8c50
add esp, 0xc
or edx, 0xffffffff
mov ecx, esi
push 0
call fcn.004692d1
pop ecx
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46db00
xor al, al
jmp 0x46db81
or edx, 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00462810
mov edx, dword [ebp - 0x25c]
mov edi, eax
mov ecx, edx
call fcn.0046d8b7
test al, al
je 0x46db25
test bl, bl
jmp 0x46db3a
shr edx, 4
test dl, 1
je 0x46db5b
test bl, bl
je 0x46db5b
mov ecx, edi
call fcn.0046d8d2
test al, al
jne 0x46db5b
mov ecx, dword [ebp - 0x264]
mov edx, edi
push 0
call fcn.00462922
mov edi, dword [ebp - 0x260]
mov ecx, edi
push eax
call fcn.00461461
jmp 0x46db61
mov edi, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46db00
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [edi + 0x38], 0
seta al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret

Function at 0x46db90
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x264], eax
mov edi, ecx
or edx, 0xffffffff
mov dword [ebp - 0x260], edi
call fcn.00462840
push ecx
mov edx, 0x503cb4
mov ecx, eax
call fcn.00462b02
pop ecx
lea ecx, [ebp - 0x25c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46dbe8
xor al, al
jmp 0x46dc62
mov ecx, dword [ebp - 0x25c]
call fcn.0046d8b7
test al, al
je 0x46dc47
or edx, 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00462810
push 0
mov edx, eax
mov ecx, edi
call fcn.00462922
mov edi, eax
mov eax, dword [ebp - 0x264]
pop ecx
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x46dc38
mov dword [ebp - 0x268], edi
lea eax, [ebp - 0x268]
mov edx, dword [ecx]
push eax
mov edx, dword [edx + 8]
call edx
test al, al
je 0x46dc41
push ecx
push edi
mov ecx, ebx
call fcn.00461461
mov edi, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46dbe8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x46dcb7
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xf0000000
push 1
xor ebx, ebx
lea eax, [ebp - 0xc]
push 0x503cd0
push ebx
push eax
mov esi, edx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
sete cl
call fcn.00413f3a
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
sete cl
call fcn.00413f3a
xor cl, cl
call fcn.00413f3a
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
sete cl
call fcn.00413f3a
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x10]
push 4
mov dword [ebp - 8], ebx
pop ebx
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x10], ebx
mov esi, eax
setne cl
call fcn.00413f3a
test esi, esi
sete cl
call fcn.00413f3a
cmp dword [ebp - 8], 0x10
setne cl
call fcn.00413f3a
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call edi
test eax, eax
sete cl
call fcn.00413f3a
cmp dword [ebp - 8], 0x10
setne cl
call fcn.00413f3a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46fe4d
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x28
mov esi, ecx
call fcn.004b7b0e
mov edi, eax
xor ebx, ebx
pop ecx
mov dword [edi + 0x24], ebx
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x46fe70
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
push ebx
push ebx
push edi
push 0x46fe17
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
test eax, eax
je 0x46fe93
cmp eax, 0xffffffff
je 0x46fe93
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x48cf1e
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [edx + 4]
push ebx
push esi
push edi
mov edi, dword [edx]
mov esi, ecx
push 1
lea ecx, [edi + eax]
imul eax, eax, 3
mov dword [ebp - 0xc], ecx
shr eax, 2
push eax
call fcn.004c7d3d
and dword [ebp - 4], 0
xor bh, bh
mov edx, eax
mov dword [ebp - 8], eax
pop ecx
pop ecx
cmp edi, dword [ebp - 0xc]
jae 0x48cf98
mov bl, byte [edi]
cmp bl, 0x3d
je 0x48cf95
lea ecx, [ebx - 0x41]
cmp cl, 0x19
jbe 0x48cf7b
mov al, bl
sub al, 0x61
cmp al, 0x19
ja 0x48cf70
lea ecx, [ebx - 0x47]
jmp 0x48cf7b
mov al, bl
sub al, 0x30
cmp al, 9
ja 0x48cfa6
lea ecx, [ebx + 4]
cmp cl, 0xff
jne 0x48cfb6
mov cl, bl
call fcn.0045f8d9
test al, al
je 0x48d01a
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x48cf54
mov eax, dword [ebp - 8]
sub edx, eax
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
cmp bl, 0x2b
jne 0x48cfaf
mov cl, 0x3e
jmp 0x48cfb6
cmp bl, 0x2f
jne 0x48cf80
mov cl, 0x3f
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x48cfc5
dec eax
or eax, 0xfffffffc
inc eax
inc dword [ebp - 4]
sub eax, 0
je 0x48d013
sub eax, 1
je 0x48cffc
sub eax, 1
je 0x48cfe8
sub eax, 1
jne 0x48cf8f
mov al, bh
shl al, 6
or al, cl
mov byte [edx], al
inc edx
jmp 0x48cf8f
shl bh, 4
mov al, cl
sar al, 2
or al, bh
mov bh, cl
mov byte [edx], al
inc edx
and bh, 3
jmp 0x48cf8f
shl bh, 2
mov al, cl
sar al, 4
or al, bh
mov bh, cl
mov byte [edx], al
inc edx
and bh, 0xf
jmp 0x48cf8f
mov bh, cl
jmp 0x48cf8f
push dword [ebp - 8]
call fcn.004c5e5a
and dword [esi], 0
and dword [esi + 4], 0
pop ecx
jmp 0x48cf9f

Function at 0x48fabc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + edx]
mov dword [ebp - 0x14], ecx
cmp esi, ecx
jae 0x48fb9b
mov edi, dword [ebp + 8]
mov bl, byte [esi]
inc esi
mov byte [ebp - 4], bl
lea eax, [ebx - 1]
cmp al, 7
ja 0x48fb03
movzx eax, bl
lea ebx, [eax + esi]
cmp ebx, ecx
ja 0x48fba2
push eax
push esi
mov ecx, edi
call fcn.00460443
mov esi, ebx
jmp 0x48fb90
cmp bl, 0x80
jae 0x48fb0d
push dword [ebp - 4]
jmp 0x48fb89
cmp bl, 0xc0
jae 0x48fb79
lea edx, [esi + 1]
cmp edx, ecx
ja 0x48fba2
movzx eax, byte [esi]
movzx ecx, bl
shl cx, 8
or cx, ax
mov dword [ebp - 0x10], edx
movzx ebx, cx
mov eax, ebx
shr eax, 3
and eax, 0x7ff
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, dword [edi + 8]
ja 0x48fba2
xor ecx, ecx
cmp cx, ax
je 0x48fba2
and bl, 7
mov esi, eax
add bl, 3
mov eax, dword [edi + 8]
mov ecx, edi
sub eax, esi
push eax
call fcn.004603fd
mov ecx, edi
mov al, byte [eax]
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
call fcn.0046041e
sub bl, 1
jne 0x48fb53
mov esi, dword [ebp - 0x10]
jmp 0x48fb90
push 0x20
mov ecx, edi
call fcn.0046041e
xor bl, 0x80
movzx eax, bl
push eax
mov ecx, edi
call fcn.0046041e
mov ecx, dword [ebp - 0x14]
cmp esi, ecx
jb 0x48fad8
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
xor al, al
jmp 0x48fb9d