joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432148
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x432179
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040bfb4
jmp 0x432185
mov eax, ebx
mov edx, 0x432194
call fcn.0040b7f8
add esp, 0x204
pop ebx
ret

Function at 0x432ea4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x432f54
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040bfb4
lea edx, [ebp - 0x20c]
mov eax, dword [ebx]
call fcn.00422284
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.0040b7f8
mov edx, dword [ebx]
mov eax, edx
test eax, eax
je 0x432f12
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
je 0x432f39
mov eax, edx
test eax, eax
je 0x432f23
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x432f39
mov eax, ebx
mov edx, 0x432f64
call fcn.0040c004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432f5b
lea eax, [ebp - 0x20c]
call fcn.0040b3dc
pop eax
jmp eax

Function at 0x433040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4330f0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040bfb4
lea edx, [ebp - 0x20c]
mov eax, dword [ebx]
call fcn.00422284
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.0040b7f8
mov edx, dword [ebx]
mov eax, edx
test eax, eax
je 0x4330ae
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
je 0x4330d5
mov eax, edx
test eax, eax
je 0x4330bf
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4330d5
mov eax, ebx
mov edx, 0x433100
call fcn.0040c004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4330f7
lea eax, [ebp - 0x20c]
call fcn.0040b3dc
pop eax
jmp eax

Function at 0x433b54
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00407ee4
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x43f618
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43f620
mov eax, edx
pop esi
pop ebx
ret
Function at 0x44226c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x442283
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x442273
mov eax, ecx
pop ebx
ret

Function at 0x452bcc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x452be0
add esp, 0xfffffff0
call fcn.00409bd4
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44cc68]
call fcn.004708cc
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x451c08]
call fcn.0047369c
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x451c08]
call fcn.0047369c
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x452c35
call fcn.00409c2c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bbfd8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4bc01b
cmp byte [ebx + 0x11], 0
jne 0x4bc01b
cmp byte [ebx + 0x24], 0
jne 0x4bc01b
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4bc032
mov ecx, dword [0x4f8e8c]
mov dl, 1
mov eax, dword [0x48c570]
call fcn.00428c28
call fcn.0040aa8c
pop ebx
ret
mov ecx, dword [0x4f8e8c]
mov dl, 1
mov eax, dword [0x48c570]
call fcn.00428c28
call fcn.0040aa8c
pop ebx
ret

Function at 0x4bc914
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4bc962
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004bbe84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bc97b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bc984
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004bbe84
dec esi
jne 0x4bc9a6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d7140
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d71cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4d71e4
call fcn.0040b784
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x4f8d38]
mov edx, dword [edx + 0x78]
movzx edx, word [edx]
call fcn.0040c280
lea eax, [ebp - 0x1c]
mov edx, 0x4d71fc
call fcn.0040c454
mov eax, dword [ebp - 0x1c]
call fcn.0040c25c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x4d71b4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, ebx
call fcn.00422ac4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d71d3
lea eax, [ebp - 0x1c]
call fcn.0040b394
pop eax
jmp eax

Function at 0x4d7204
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d7288
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.00422ac4
push dword [ebp - 0x28]
lea edx, [ebp - 0x2c]
movzx eax, word [ebp - 4]
call fcn.00422aa8
push dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 2]
call fcn.00422aa8
push dword [ebp - 0x30]
mov eax, ebx
mov edx, 3
call fcn.0040c534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d728f
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0040b3f4
pop eax
jmp eax

Function at 0x4d7294
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
xor edx, edx
mov dword [ebp - 0x420], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d733b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x420]
mov edx, dword [0x4f8d38]
mov edx, dword [edx + 0x78]
movzx edx, word [edx]
call fcn.0040c280
lea eax, [ebp - 0x420]
mov edx, 0x4d7354
call fcn.0040c454
mov eax, dword [ebp - 0x420]
call fcn.0040c25c
push eax
call sub.kernel32.dll_GetVolumeInformationW
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00422ac4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7342
lea eax, [ebp - 0x420]
call fcn.0040b394
pop eax
jmp eax

Function at 0x4d735c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.0040bfb4
add esp, 0x28
pop ebx
ret
Function at 0x4d76bc
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], eax
lea esi, [esp + 8]
lea ebp, [esp + 0x18]
mov eax, dword [esp]
mov byte [eax], 0
mov edi, 0x3e8
mov byte [ebp], 0
mov ebx, 8
shl byte [ebp], 1
push esi
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esi]
mov edx, dword [esi + 4]
sub eax, dword [esp + 0x10]
sbb edx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], edx
push 0
push 2
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.0040dfd8
cmp edx, 0
jne 0x4d772e
cmp eax, 0
jne 0x4d772e
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x4d773b
mov dword [esi], 1
mov dword [esi + 4], 0
movzx eax, byte [esi]
add byte [ebp], al
dec ebx
jne 0x4d76e2
mov eax, dword [esp]
movzx edx, byte [ebp]
xor byte [eax], dl
dec edi
jne 0x4d76d9
mov edi, 8
push esi
call sub.kernel32.dll_QueryPerformanceCounter
push 1
call sub.kernel32.dll_Sleep
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esi]
sbb edx, dword [esi + 4]
mov dword [esi], eax
mov dword [esi + 4], edx
movzx eax, byte [esi]
mov byte [ebp], al
mov eax, dword [esp]
movzx edx, byte [ebp]
xor byte [eax], dl
dec edi
jne 0x4d7755
mov dword [esi], 0
mov dword [esi + 4], 0
mov edx, ebp
mov eax, esi
mov ecx, 1
call fcn.0040714c
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d805c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, cl
dec ebx
test ebx, ebx
jb 0x4d80a6
inc ebx
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
movzx esi, byte [edx + ecx]
mov esi, dword [esi*4 + 0x4f7b6c]
movzx edi, byte [edx + ecx + 1]
xor esi, dword [edi*4 + 0x4f7f6c]
movzx edi, byte [edx + ecx + 2]
xor esi, dword [edi*4 + 0x4f836c]
movzx edi, byte [edx + ecx + 3]
xor esi, dword [edi*4 + 0x4f876c]
mov dword [edx + ecx], esi
inc eax
dec ebx
jne 0x4d806a
pop edi
pop esi
pop ebx
ret
Function at 0x4d8458
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4d8466
sub ecx, 4
mov ecx, dword [ecx]
mov edi, dword [edx]
mov esi, edi
test esi, esi
je 0x4d8473
sub esi, 4
mov esi, dword [esi]
cmp ecx, esi
jle 0x4d8482
mov ecx, edi
test ecx, ecx
je 0x4d8482
sub ecx, 4
mov ecx, dword [ecx]
mov esi, ecx
dec esi
test esi, esi
jl 0x4d849b
inc esi
xor ecx, ecx
mov ebx, dword [edx]
movzx ebx, byte [ebx + ecx]
mov edi, dword [eax]
xor byte [edi + ecx], bl
inc ecx
dec esi
jne 0x4d848c
pop edi
pop esi
pop ebx
ret

Function at 0x4d84a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebx]
push eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, pe_nt_image_headers32
call fcn.004d83c0
lea edx, [ebp - 0x18]
mov eax, dword [ebx]
mov ecx, 0x10
call fcn.0040714c
jmp 0x4d8517
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004d7db4
xor ebx, ebx
lea esi, [ebp - 0x18]
movzx eax, bl
add eax, edi
mov edx, dword [ebp - 4]
mov edx, dword [edx]
movzx eax, byte [edx + eax]
xor al, byte [esi]
movzx edx, bl
add edx, edi
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov byte [ecx + edx], al
inc ebx
inc esi
cmp bl, 0x10
jne 0x4d84f0
add edi, 0x10
lea eax, [edi + 0x10]
cmp eax, dword [ebp + 0xc]
jle 0x4d84db
cmp edi, dword [ebp + 0xc]
je 0x4d856d
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004d7db4
movzx edx, byte [ebp + 0xc]
mov eax, edi
sub dl, al
dec edx
test dl, dl
jb 0x4d856d
inc edx
mov bl, 0
lea eax, [ebp - 0x18]
movzx ecx, bl
add ecx, edi
mov esi, dword [ebp - 4]
mov esi, dword [esi]
movzx ecx, byte [esi + ecx]
xor cl, byte [eax]
push ecx
movzx ecx, bl
add ecx, edi
mov esi, dword [ebp + 0x10]
mov esi, dword [esi]
add esi, ecx
pop ecx
mov byte [esi], cl
inc ebx
inc eax
dec dl
jne 0x4d8547
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004d833c
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.00407ee4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4dcde8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040b4a8
xor eax, eax
push ebp
push 0x4dcebb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x4dcea3
lea eax, [ebp - 0x10]
push eax
push edi
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x4dce4b
push edi
call sub.kernel32.dll_CloseHandle
jmp 0x4dcea3
mov eax, esi
mov edx, dword [0x431758]
call fcn.0040e788
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
mov ecx, 1
mov edx, dword [0x431758]
call fcn.0040e664
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
push edi
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x4dce9b
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi]
push eax
push edi
call sub.kernel32.dll_ReadFile
push edi
call sub.kernel32.dll_CloseHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcec2
lea eax, [ebp - 4]
call fcn.0040b3dc
pop eax
jmp eax

Function at 0x4dd834
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, eax
jmp 0x4dd852
mov eax, dword [0x4f8cf0]
mov edx, 0x4dd878
call fcn.00408eec
call fcn.00408ff0
call fcn.004070fc
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4dd839
pop ebx
ret
Function at 0x4de7c8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, dword [0x4f8d38]
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x4de9d7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x3c]
mov edx, dword [0x431758]
call fcn.0040e788
cmp byte [esi + 0x90], 0
je 0x4de839
push 0x4de9ec
push dword [esi + 0x7c]
push 0x4dea20
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040c0f4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040c338
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.004dde34
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov edx, dword [esi + 0x7c]
lea eax, [ebp - 0x1c]
mov ecx, 0x4dea20
call fcn.0040c078
mov eax, dword [ebp - 0x1c]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4de895
cmp byte [esi + 0x90], 0
je 0x4de9b2
mov dl, 1
mov eax, 0x4dea54
call fcn.004dde34
xor eax, eax
call fcn.004de034
jmp 0x4de9b2
cmp byte [esi + 0x90], 0
je 0x4de8aa
mov dl, 1
mov eax, 0x4dea9c
call fcn.004dde34
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x4de8df
cmp byte [esi + 0x90], 0
je 0x4de8d4
mov dl, 1
mov eax, 0x4dead8
call fcn.004dde34
xor eax, eax
call fcn.004de034
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x4de9b2
mov eax, dword [ebp - 0x10]
push eax
lea eax, [esi + 0x3c]
mov ecx, 1
mov edx, dword [0x431758]
call fcn.0040e664
add esp, 4
xor eax, eax
mov dword [edi], eax
jmp 0x4de98c
xor eax, eax
mov dword [edi], eax
push 0
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x4de936
cmp byte [esi + 0x90], 0
je 0x4de98c
mov dl, 1
mov eax, 0x4deb28
call fcn.004dde34
xor eax, eax
call fcn.004de034
jmp 0x4de98c
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 0x3c]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x4de969
cmp byte [esi + 0x90], 0
je 0x4de98c
mov dl, 1
mov eax, 0x4deb94
call fcn.004dde34
xor eax, eax
call fcn.004de034
jmp 0x4de98c
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi]
je 0x4de98c
cmp byte [esi + 0x90], 0
je 0x4de98c
mov dl, 1
mov eax, 0x4debf0
call fcn.004dde34
xor eax, eax
call fcn.004de034
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi]
jne 0x4de902
push ebx
call sub.kernel32.dll_CloseHandle
cmp byte [esi + 0x90], 0
je 0x4de9b2
mov dl, 1
mov eax, 0x4dec5c
call fcn.004dde34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de9de
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040b464
lea eax, [ebp - 0x14]
call fcn.0040b394
pop eax
jmp eax
Function at 0x4df104
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040b4a8
xor eax, eax
push ebp
push 0x4df32c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4df173
push 0x4df340
mov eax, dword [0x4f8d38]
push dword [eax + 0x7c]
push 0x4df388
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040c0f4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040c338
mov eax, dword [ebp - 0x1c]
mov dl, 1
call fcn.004dde34
push 0
push 0x80
push 1
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x24]
mov ecx, 0x4df388
mov edx, dword [ebp - 4]
call fcn.0040c078
mov eax, dword [ebp - 0x24]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4df1d6
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4df2ff
mov dl, 1
mov eax, 0x4df3bc
call fcn.004dde34
xor eax, eax
call fcn.004de034
jmp 0x4df2ff
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4df2ba
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x4df224
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4df2ba
mov dl, 1
mov eax, 0x4df418
call fcn.004dde34
xor eax, eax
call fcn.004de034
jmp 0x4df2ba
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4df23b
sub esi, 4
mov esi, dword [esi]
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x3c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x4df27b
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4df2ba
mov dl, 1
mov eax, 0x4df484
call fcn.004dde34
xor eax, eax
call fcn.004de034
jmp 0x4df2ba
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x4df292
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x4df2ba
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4df2ba
mov dl, 1
mov eax, 0x4df4dc
call fcn.004dde34
xor eax, eax
call fcn.004de034
mov eax, dword [0x4f8d38]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4df2d1
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x4df1e0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4f8d38]
cmp byte [eax + 0x90], 0
je 0x4df2ff
mov dl, 1
mov eax, 0x4df548
call fcn.004dde34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df333
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040b464
lea eax, [ebp - 0x1c]
call fcn.0040b394
lea eax, [ebp - 4]
call fcn.0040b3dc
pop eax
jmp eax
Function at 0x4e0b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e0c31
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x431758]
call fcn.0040e788
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x431758]
call fcn.0040e664
add esp, 4
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x4e0c02
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WriteFile
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x431758]
call fcn.0040e788
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0c38
lea eax, [ebp - 4]
mov edx, dword [0x431758]
call fcn.0040e788
pop eax
jmp eax

Function at 0x4e1310
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.0040b4a8
xor eax, eax
push ebp
push 0x4e140d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x4e137c
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00431fc8
mov eax, dword [ebp - 0xc]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x4e13da
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x4e139e
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x4e13e8
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00431fc8
mov eax, dword [ebp - 0x10]
call fcn.0040bff0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x4e1341
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1414
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040b464
lea eax, [ebp - 4]
call fcn.0040b3dc
pop eax
jmp eax
Function at 0x4e14a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e158b
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [ebx]
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00432c98
mov eax, 1
mov edx, dword [esi]
movzx edx, byte [edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x4e14ca
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + eax]
shl edx, 4
movzx edx, dl
shr edx, 4
movzx ecx, dl
mov ebx, dword [esi]
movzx ecx, byte [ebx + ecx]
movzx edx, dl
mov ebx, dword [esi]
add ebx, edx
mov edx, dword [esi]
movzx edx, byte [edx + eax]
mov byte [ebx], dl
mov edx, dword [esi]
mov byte [edx + eax], cl
inc eax
cmp eax, 0x10
jne 0x4e14dc
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + 0xf]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0xf
jne 0x4e1510
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 3]
shl edx, 6
movzx eax, dl
shr eax, 6
mov edx, eax
xor eax, eax
movzx ecx, dl
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
mov ebx, dword [esi]
xor byte [ebx + eax], cl
inc eax
cmp eax, 0x10
jne 0x4e1535
xor eax, eax
mov edx, eax
and edx, 0x80000003
jns 0x4e155b
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x4e154c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1592
lea eax, [ebp - 4]
mov edx, dword [0x431758]
call fcn.0040e788
pop eax
jmp eax