joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446a38
Capabilities:
Terminate thread

Disassembly:
call fcn.0042ab24
test al, al
jne 0x446a91
cmp dword [0x4d59b0], 0
je 0x446a91
mov eax, dword [0x4d59b0]
call fcn.0042790c
mov eax, dword [0x4d4174]
cmp byte [eax], 0
jne 0x446a70
push 0xffffffffffffffff
mov eax, dword [0x4d59b0]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x446a80
push 1
mov eax, dword [0x4d59b0]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x4d59b0]
call fcn.00403ba8
xor eax, eax
mov dword [0x4d59b0], eax
ret

Function at 0x446d34
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
lea edi, [ebp - 8]
call fcn.00436450
mov edx, dword [eax]
mov dword [edi], edx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ebx, dword [edi]
dec ebx
jmp 0x446d55
dec ebx
test ebx, ebx
jl 0x446d62
mov eax, dword [edi + 4]
cmp dword [eax + ebx*8], 0
je 0x446d54
mov esi, dword [edi + 4]
mov eax, dword [esi + ebx*8]
test eax, eax
je 0x446da1
mov dword [0x4d5958], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [esi + ebx*8]
call fcn.00446bf0
push eax
call sub.kernel32.dll_VirtualProtect
lea eax, [esi + ebx*8]
call fcn.00446bf0
mov dword [0x4d5980], eax
mov eax, 0x446d08
mov edx, dword [0x4d5980]
mov dword [edx], eax
mov ebx, dword [edi]
dec ebx
jmp 0x446da7
dec ebx
test ebx, ebx
jl 0x446db5
mov eax, dword [edi + 4]
cmp dword [eax + ebx*8 + 4], 0
je 0x446da6
mov esi, dword [edi + 4]
mov eax, dword [esi + ebx*8 + 4]
test eax, eax
je 0x446de5
mov dword [0x4d595c], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
lea eax, [esi + ebx*8 + 4]
call fcn.00446bf0
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0x446d24
mov dword [esi + ebx*8 + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448ee4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x448eea
ret

Function at 0x44b438
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x44b489
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x44b470
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x44b460
jmp 0x44b489
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x44b471
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4545ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45479d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405188
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4547b4
call fcn.00404de4
mov eax, ebx
call fcn.00427fdc
mov edi, eax
dec edi
test edi, edi
jl 0x4546a4
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00427fb0
mov edx, dword [0x4662b4]
call fcn.00403d34
test al, al
je 0x4546a0
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00427fb0
lea edx, [ebp - 0x14]
call fcn.0046fba8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405188
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e58
inc esi
dec edi
jne 0x454652
mov al, byte [0x4547b8]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4547c4
mov eax, dword [ebp - 0xc]
call fcn.0040ecfc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404b54
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0046fba8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4547b4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0046fba8
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4547b4
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4547b4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4547d0
call fcn.0040a994
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4547a4
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404ae0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404ae0
lea eax, [ebp - 0x14]
call fcn.00404abc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404ae0
ret
Function at 0x457c30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403314
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4d4978]
cmp byte [edx + 0xc], 0
je 0x457c94
mov edx, dword [0x4d4960]
cmp dword [edx], 2
jne 0x457c94
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x457c98
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x457d50
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00457c30
test al, al
je 0x457d32
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404bac
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x457d32
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404f98
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404f98
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404cb4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x457ceb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457d57
lea eax, [ebp - 0x2c]
call fcn.00404abc
lea eax, [ebp - 0xc]
call fcn.00404abc
ret

Function at 0x457ec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004576e0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404f98
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x457f1e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4d45c8]
mov dl, 1
mov eax, dword [0x4575d8]
call fcn.0040d928
call fcn.00404438
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x457f28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404f98
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x457f80
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4d4988]
mov dl, 1
mov eax, dword [0x4575d8]
call fcn.0040d928
call fcn.00404438
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00457710
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46a2ac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x46a329
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00469d0c
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jbe 0x46a2d1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0046990c
cmp dword [ebp - 4], 0
je 0x46a313
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404f98
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call fcn.00407f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a330
lea eax, [ebp - 4]
call fcn.00404abc
ret
Function at 0x48d1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48d38b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x48d36c
mov dl, 1
mov eax, dword [0x41c0cc]
call fcn.00403b78
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404abc
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.00407bc4
dec eax
test eax, eax
jl 0x48d35b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0047b0cc
test al, al
je 0x48d34e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x48d39c
lea eax, [ebp - 0x254]
call fcn.0040a914
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48d34e
xor eax, eax
push ebp
push 0x48d347
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x48d3d4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x48d330
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d2c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x48d330
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d34e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x48d251
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004211f8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d392
lea eax, [ebp - 0x260]
call fcn.00404abc
ret
Function at 0x4a3220
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404f88
xor eax, eax
push ebp
push 0x4a329e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f98
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4a3269
mov eax, dword [ebx + 4]
call fcn.00404f98
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a32a5
lea eax, [ebp - 4]
call fcn.00404abc
ret

Function at 0x4a42b4
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a4451
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402c34
cmp word [ebx + 0xa2], 0
je 0x4a42fd
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4a4311
lea esi, [ebp - 8]
jmp 0x4a4313
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x4a4320
xor edi, edi
jmp 0x4a432d
mov eax, dword [ebx + 0x80]
call fcn.00404f98
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404f98
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004a39ec
mov eax, dword [ebp - 0x14]
call fcn.00404f98
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404f98
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404f98
push eax
mov eax, ebx
call fcn.004a3b20
push eax
mov eax, ebx
call fcn.004a3af4
push eax
mov eax, ebx
call fcn.004a3aa8
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004a38a4
mov eax, dword [ebp - 0x18]
call fcn.00404f98
push eax
mov eax, dword [ebx + 8]
call fcn.00404f98
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x4a43b6
call fcn.0040ef48
xor edx, edx
push ebp
push 0x4a442f
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4a43f4
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4a43ea
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4418
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4436
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4a4460
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4a448c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404f98
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a44b1
call fcn.0040ef48
xor eax, eax
push ebp
push 0x4a44e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4a44d1
call fcn.0040ef48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a44ef
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x4a5578
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407f78
ret

Function at 0x4a5b64
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a5c47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404abc
xor eax, eax
push ebp
push 0x4a5c22
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404ca4
lea eax, [ebp - 0x10]
mov edx, 0x4a5c60
call fcn.00404da0
mov eax, dword [ebp - 0x10]
call fcn.00404f98
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 4]
call fcn.00407f64
movzx eax, ax
lea ecx, [ebp - 0x14]
mov edx, 4
call fcn.00409930
push dword [ebp - 0x14]
push 0x4a5c6c
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.00409930
push dword [ebp - 0x18]
mov eax, esi
mov edx, 3
call fcn.00404e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5c4e
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404ae0
ret
Function at 0x4a5f88
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f88
xor eax, eax
push ebp
push 0x4a60c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00409d98
test al, al
je 0x4a60b1
xor eax, eax
push ebp
push 0x4a60aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a608a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41c2f0]
call fcn.004217c0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4a6006
cmp eax, 0x1000
jae 0x4a601a
jmp 0x4a6008
jge 0x4a601a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004044e4
jmp 0x4a60b1
lea edx, [ebp - 0x4c]
mov ecx, 0x40
mov eax, dword [ebp - 0xc]
call fcn.004214d4
cmp word [ebp - 0x4c], 0x5a4d
je 0x4a6041
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004044e4
jmp 0x4a60b1
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x144]
mov ecx, 0xf8
mov eax, dword [ebp - 0xc]
call fcn.004214d4
cmp dword [ebp - 0x144], 0x4550
je 0x4a607c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004044e4
jmp 0x4a60b1
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a6094
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a60b1
mov eax, dword [ebp - 0xc]
call fcn.00403ba8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a60ce
lea eax, [ebp - 4]
call fcn.00404abc
ret

Function at 0x4a60d8
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f88
mov eax, dword [ebp - 8]
call fcn.00404f88
xor eax, eax
push ebp
push 0x4a6166
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a613f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404f98
push eax
mov eax, dword [ebp - 4]
call fcn.00404f98
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a614b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a616d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ae0
ret

Function at 0x4a6624
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov eax, edi
call fcn.00404d98
mov edx, eax
mov eax, ebp
call fcn.00405124
mov eax, edi
call fcn.00404d98
mov esi, eax
test esi, esi
jle 0x4a6677
mov ebx, 1
mov eax, ebp
call fcn.00404ff0
lea eax, [eax + ebx - 1]
push eax
mov eax, ebx
mov ecx, 6
cdq
idiv ecx
mov al, byte [edx + 0x4d3940]
mov dl, byte [edi + ebx - 1]
xor al, dl
pop edx
mov byte [edx], al
inc ebx
dec esi
jne 0x4a664e
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a6704
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4a670c
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a686d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404abc
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404b54
lea eax, [ebp - 4]
call fcn.00404fe8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f98
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4a684a
mov eax, ebx
call fcn.00402828
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a6843
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f98
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4a682d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4a687c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4a682d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00409908
push dword [ebp - 0x18]
push 0x4a6888
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00409908
push dword [ebp - 0x1c]
push 0x4a6888
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409908
push dword [ebp - 0x20]
push 0x4a6888
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00409908
push dword [ebp - 0x24]
mov eax, esi
mov edx, 7
call fcn.00404e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a684a
mov eax, dword [ebp - 0xc]
call fcn.00402848
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6874
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404ae0
lea eax, [ebp - 4]
call fcn.00404abc
ret