joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a5f8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a7be8]
cmp dword [eax + 0x30], 0
je 0x46a6a2
cmp dword [ebx + 0x94], 0
jne 0x46a69c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46a588
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46a69c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46a662
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46a69c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417d1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46a671
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46b204
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46b239
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040c4
jmp 0x46b246
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404028
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46c340
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46c381
mov eax, esi
call fcn.004524dc
test al, al
je 0x46c381
mov eax, dword [ebx + 0x84]
call fcn.004521d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46c381
push 0
mov eax, dword [ebx + 0x84]
call fcn.004521d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x46fa48
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46fa76
mov eax, ebx
call fcn.004704fc
cmp dword [ebx + 0x40], 0
je 0x46fa6f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46fae7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46fad9
cmp dword [ebx + 8], 0
je 0x46fa98
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46faaa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46fad9
cmp dword [ebx + 8], 0
je 0x46fa8b
cmp eax, 3
je 0x46fabd
dec eax
jne 0x46fa8b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46fa8b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46fa8b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46fb05
cmp dword [ebx + 0x14], 0xcc
je 0x46fb05
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046fb10
pop ebx
ret
Function at 0x4813f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x48162d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403fd4
mov bl, 1
xor esi, esi
lea ecx, [ebp - 8]
mov edx, 0x104
mov al, 0x20
call fcn.00404684
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x104
call fcn.00402c7c
xor eax, eax
mov al, byte [ebp - 1]
cmp eax, 0x14
ja case.default.0x481453
jmp dword [eax*4 + 0x48145a]
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
xor ebx, ebx
mov eax, edi
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404244
jmp case.default.0x481453
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
xor ebx, ebx
mov eax, edi
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404244
jmp case.default.0x481453
lea eax, [ebp - 0x111]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
xor ebx, ebx
mov eax, edi
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404244
jmp case.default.0x481453
mov esi, 0x10
jmp case.default.0x481453
mov esi, 0x14
jmp case.default.0x481453
mov esi, 5
jmp case.default.0x481453
mov esi, 8
jmp case.default.0x481453
mov esi, 9
jmp case.default.0x481453
mov esi, 0xb
jmp case.default.0x481453
mov esi, 7
jmp case.default.0x481453
mov esi, 0x15
jmp case.default.0x481453
mov esi, 6
jmp case.default.0x481453
mov esi, 0x20
jmp case.default.0x481453
mov esi, 0x22
jmp case.default.0x481453
mov esi, 0x21
jmp case.default.0x481453
mov esi, 2
jmp case.default.0x481453
mov esi, 0x19
jmp case.default.0x481453
mov esi, 0x18
jmp case.default.0x481453
mov esi, 0x17
jmp case.default.0x481453
mov esi, 0x16
jmp case.default.0x481453
mov esi, 0x1a
test bl, bl
je 0x4815f6
lea eax, [ebp - 0xc]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4815ef
mov eax, dword [ebp - 8]
call fcn.00404494
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, dword [ebp - 8]
mov eax, 0x481644
call fcn.004045d8
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00404620
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404028
jmp 0x4815f6
mov eax, edi
call fcn.00403fd4
cmp dword [edi], 0
je 0x481617
mov eax, dword [edi]
call fcn.00404294
mov edx, dword [edi]
cmp byte [edx + eax - 1], 0x5c
je 0x481617
mov eax, edi
mov edx, 0x481650
call fcn.0040429c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481634
lea eax, [ebp - 8]
call fcn.00403fd4
ret
Function at 0x48157d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x48162d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403fd4
mov bl, 1
xor esi, esi
lea ecx, [ebp - 8]
mov edx, 0x104
mov al, 0x20
call fcn.00404684
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x104
call fcn.00402c7c
xor eax, eax
mov al, byte [ebp - 1]
cmp eax, 0x14
ja case.default.0x481453
jmp dword [eax*4 + 0x48145a]
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
xor ebx, ebx
mov eax, edi
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404244
jmp case.default.0x481453
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
xor ebx, ebx
mov eax, edi
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404244
jmp case.default.0x481453
lea eax, [ebp - 0x111]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
xor ebx, ebx
mov eax, edi
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404244
jmp case.default.0x481453
mov esi, 0x10
jmp case.default.0x481453
mov esi, 0x14
jmp case.default.0x481453
mov esi, 5
jmp case.default.0x481453
mov esi, 8
jmp case.default.0x481453
mov esi, 9
jmp case.default.0x481453
mov esi, 0xb
jmp case.default.0x481453
mov esi, 7
jmp case.default.0x481453
mov esi, 0x15
jmp case.default.0x481453
mov esi, 6
jmp case.default.0x481453
mov esi, 0x20
jmp case.default.0x481453
mov esi, 0x22
jmp case.default.0x481453
mov esi, 0x21
jmp case.default.0x481453
mov esi, 2
jmp case.default.0x481453
mov esi, 0x19
jmp case.default.0x481453
mov esi, 0x18
jmp case.default.0x481453
mov esi, 0x17
jmp case.default.0x481453
mov esi, 0x16
jmp case.default.0x481453
mov esi, 0x1a
test bl, bl
je 0x4815f6
lea eax, [ebp - 0xc]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4815ef
mov eax, dword [ebp - 8]
call fcn.00404494
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, dword [ebp - 8]
mov eax, 0x481644
call fcn.004045d8
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00404620
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404028
jmp 0x4815f6
mov eax, edi
call fcn.00403fd4
cmp dword [edi], 0
je 0x481617
mov eax, dword [edi]
call fcn.00404294
mov edx, dword [edi]
cmp byte [edx + eax - 1], 0x5c
je 0x481617
mov eax, edi
mov edx, 0x481650
call fcn.0040429c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481634
lea eax, [ebp - 8]
call fcn.00403fd4
ret
Function at 0x4819d8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404484
mov eax, dword [ebp - 8]
call fcn.00404484
mov eax, dword [ebp + 0xc]
call fcn.00404484
xor eax, eax
push ebp
push 0x481bc5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0x10], 0
je 0x481a27
mov esi, 0x80000002
jmp 0x481a2c
mov esi, 0x80000001
cmp byte [ebp + 8], 0
je 0x481a41
lea eax, [ebp - 0x18]
mov edx, 0x481be0
call fcn.0040406c
jmp 0x481a4e
lea eax, [ebp - 0x18]
mov edx, 0x481c20
call fcn.0040406c
mov ecx, 0x2001f
mov dl, 1
mov eax, dword [0x4337e0]
call fcn.00433924
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x415dd0]
call fcn.00403254
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x481b8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004339bc
test bl, bl
jne 0x481b0f
mov cl, 1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00433a20
test al, al
je 0x481b70
mov edx, dword [ebp - 8]
mov eax, 0x481c58
call fcn.004045d8
test eax, eax
jle 0x481ad1
push 0x481c64
push dword [ebp - 8]
push 0x481c64
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404354
cmp dword [ebp + 0xc], 0
je 0x481aff
push dword [ebp - 8]
push 0x481c58
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404354
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00433d0c
jmp 0x481b70
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00433d0c
jmp 0x481b70
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00433a20
test al, al
je 0x481b70
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00433bcc
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x481b5f
inc ebx
xor esi, esi
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.004043e0
jne 0x481b5b
mov byte [ebp - 0xd], 1
inc esi
dec ebx
jne 0x481b3d
cmp byte [ebp - 0xd], 0
je 0x481b70
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00433b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481b95
mov eax, dword [ebp - 0xc]
call fcn.00403284
mov eax, dword [ebp - 0x14]
call fcn.00403284
ret
Function at 0x481d8c
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x481dd0
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x481dd0
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x481e67
mov eax, 0x400
call fcn.00402738
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x481e60
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4a2840
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x481e56
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x481e52
mov byte [esp], 1
jmp 0x481e56
inc edi
dec ebx
jne 0x481e39
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402758
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4827a0
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.004029ac
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.004029ac
add esp, 0x58
pop ebx
ret
Function at 0x484f9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x484fc9
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x485048
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00483d08
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x485016
mov cx, word [esp]
sub cx, si
jmp 0x485018
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x484fff
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48503e
mov cx, word [esp]
sub cx, si
jmp 0x485040
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x485027
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4850a5
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.00484c74
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x485090
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4850a5
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x484fa6
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48af60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, 8
mov edx, 0x3020100
mov dword [eax], edx
add edx, 0x4040404
mov dword [eax + 4], edx
add edx, 0x4040404
mov dword [eax + 8], edx
add edx, 0x4040404
mov dword [eax + 0xc], edx
add edx, 0x4040404
mov dword [eax + 0x10], edx
add edx, 0x4040404
mov dword [eax + 0x14], edx
add edx, 0x4040404
mov dword [eax + 0x18], edx
add edx, 0x4040404
mov dword [eax + 0x1c], edx
add edx, 0x4040404
add eax, 0x20
dec ecx
jne 0x48af6a
ret

Function at 0x48cf00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48cf64
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408dc0
mov eax, dword [ebp - 4]
call fcn.0048ce60
test al, al
je 0x48cf39
mov byte [ebp - 5], 1
jmp 0x48cf4e
mov eax, dword [ebp - 0xc]
call fcn.00404494
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cf6b
lea eax, [ebp - 0xc]
call fcn.00403fd4
ret

Function at 0x48d1b4
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x48d1d7
and ecx, ecx
jle 0x48d1d7
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x48d1dd]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x48d1c7
pop edi
pop ebx
ret

Function at 0x48d7b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x48d815
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.0048d708
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.0048d670
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x48d7da
mov esp, ebp
pop ebp
ret
Function at 0x48d870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
call fcn.00404294
dec eax
test eax, eax
jl 0x48d8e6
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.00404494
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.0048d670
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x48d8c9
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.0048d708
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.0048d670
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x48d8eb
mov esp, ebp
pop ebp
ret
Function at 0x49782c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x113]
mov edx, 0x4978b4
call fcn.0040933c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x497867
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
call fcn.0040933c
jmp 0x497878
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00404244
mov esp, ebp
pop ebp
ret
Function at 0x49e158
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404484
mov eax, dword [ebp - 8]
call fcn.00404484
xor eax, eax
push ebp
push 0x49e296
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00402c7c
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.00402c7c
mov dword [ebp - 0x50], 0x44
mov word [ebp - 0x20], 1
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
push dword [ebp - 4]
push 0x49e2b0
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00404354
mov eax, dword [ebp - 0x64]
call fcn.00404494
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
push ebp
push 0x49e267
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x49e226
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x49e247
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x68]
call fcn.0040bb38
mov ecx, dword [ebp - 0x68]
mov dl, 1
mov eax, dword [0x407444]
call fcn.0040c340
call fcn.00403a10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e26e
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
ret
Function at 0x49f6b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x49f875
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x3c4], 3
jne 0x49f7b6
xor ecx, ecx
mov edx, 0x49f88c
mov eax, ebx
call fcn.0049e648
cmp dword [ebx + 0x3d4], 0
je 0x49f720
push 0x49f8a4
call dword [ebx + 0x3d4]
test eax, eax
je 0x49f712
xor ecx, ecx
mov edx, 0x49f8b8
mov eax, ebx
call fcn.0049e648
jmp 0x49f720
mov cl, 1
mov edx, 0x49f8d0
mov eax, ebx
call fcn.0049e648
xor ecx, ecx
mov edx, 0x49f8f4
mov eax, ebx
call fcn.0049e648
push 1
push 0
push 0x49f910
lea eax, [ebp - 4]
mov ecx, 0x49f924
mov edx, dword [ebx + 0x3b4]
call fcn.004042e0
mov eax, dword [ebp - 4]
call fcn.00404494
push eax
push 0x49f930
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x49f777
xor ecx, ecx
mov edx, 0x49f940
mov eax, ebx
call fcn.0049e648
jmp 0x49f841
call sub.kernel32.dll_GetLastError
mov esi, eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.0040bb38
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x49f960
call fcn.00409994
mov edx, dword [ebp - 8]
mov cl, 1
mov eax, ebx
call fcn.0049e648
jmp 0x49f841
xor ecx, ecx
mov edx, 0x49f990
mov eax, ebx
call fcn.0049e648
push 1
push 0
push 0
lea eax, [ebp - 0x18]
mov ecx, 0x49f9b4
mov edx, dword [ebx + 0x3b4]
call fcn.004042e0
mov eax, dword [ebp - 0x18]
call fcn.00404494
push eax
push 0x49f930
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x49f807
xor ecx, ecx
mov edx, 0x49f9c8
mov eax, ebx
call fcn.0049e648
jmp 0x49f841
call sub.kernel32.dll_GetLastError
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0040bb38
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x49f9e4
call fcn.00409994
mov edx, dword [ebp - 0x1c]
mov cl, 1
mov eax, ebx
call fcn.0049e648
mov eax, dword [0x4a6cbc]
mov eax, dword [eax]
call fcn.0046b544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f87c
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00403ff8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ff8
ret
Function at 0x4a00d0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4a01c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403fd4
mov ecx, 0x20019
mov dl, 1
mov eax, dword [0x4337e0]
call fcn.00433924
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a01ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.004339bc
xor ecx, ecx
mov edx, 0x4a01e0
mov eax, dword [ebp - 4]
call fcn.00433a20
lea ecx, [ebp - 8]
mov edx, 0x4a022c
mov eax, dword [ebp - 4]
call fcn.00433d38
mov eax, dword [ebp - 4]
call fcn.0043398c
cmp dword [ebp - 8], 0
jne 0x4a017f
mov edx, 0x80000003
mov eax, dword [ebp - 4]
call fcn.004339bc
xor ecx, ecx
mov edx, 0x4a0244
mov eax, dword [ebp - 4]
call fcn.00433a20
test al, al
je 0x4a017f
lea ecx, [ebp - 8]
mov edx, 0x4a0298
mov eax, dword [ebp - 4]
call fcn.00433d38
cmp dword [ebp - 8], 0
jne 0x4a018c
call fcn.00403abc
jmp 0x4a01b3
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a01b3
mov eax, dword [ebp - 4]
call fcn.00403284
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a01d0
lea eax, [ebp - 8]
call fcn.00403fd4
ret