joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454cf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
mov ebx, esp
call fcn.00496f50
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x14]
push 3
push 0
push 0
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [ebp - 0x14]
mov dword [ebx], 0
je 0x454d76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jb 0x454d60
call fcn.004835e0
push dword [ebx]
call fcn.00498c60
add esp, 4
mov dword [ebx], 0
lea eax, [esi + 1]
cmp eax, 2
jb 0x454d6f
mov dword [ebx], esi
call fcn.004835e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004be7a6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x455530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x6411c4]
cmp esi, 1
ja 0x455596
push 0x6411c4
call fcn.00483240
add esp, 4
test al, al
je 0x455590
mov dword [0x6411cc], 0
mov dword [0x6411c8], 0
mov esi, 0x6411c8
mov ecx, 0x6411c8
push 0
call fcn.0048e750
push 0x6411c4
push 0
push 0x6411c8
push 0x6411c4
call fcn.004832f0
add esp, 0x10
jmp 0x455596
mov esi, dword [0x6411c4]
mov ecx, esi
pop esi
pop ebp
jmp fcn.0048e6e0

Function at 0x455c00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x455c52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x455c3c
call fcn.004835e0
push dword [esi]
call fcn.00498c60
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x455c4b
mov dword [esi], ebx
call fcn.004835e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x455d20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jae 0x455d42
cmp dword [esi], ebx
jne 0x455d4b
jmp 0x455d67
call fcn.004835e0
cmp dword [esi], ebx
je 0x455d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x455d73
cmp edi, 2
jae 0x455d93
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004835e0
push dword [esi]
call fcn.00498c60
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp edi, 2
jb 0x455d60
mov dword [esi], ebx
mov edi, eax
call fcn.004835e0
mov eax, edi
jmp 0x455d60
Function at 0x4578a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
lea ebx, [ebp + 8]
push 0x5c9884
call fcn.004cd070
mov dword [esi], 0x5c9888
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], 0
mov dword [esi + 0x18], eax
mov word [esi + 0x1c], 0x101
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
movups xmm0, xmmword [0x5d4230]
movups xmmword [esi + 0x40], xmm0
mov eax, dword [0x6411e8]
mov ecx, dword [0x644310]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x45796d
lock add dword [0x6411e0], 1
mov edi, dword [ebx + 4]
mov dword [ebx + 4], 0
test edi, edi
je 0x457964
mov ecx, edi
call fcn.0043d850
push edi
call fcn.00596316
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
push 0x6411e8
call fcn.00596397
add esp, 4
cmp dword [0x6411e8], 0xffffffff
jne 0x45793e
call fcn.004580b0
push 0x6411e8
call fcn.0059640d
add esp, 4
jmp 0x45793e
Function at 0x45ce0e
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [0x6401e4]
xor edi, ebp
mov dword [ebp - 0x10], edi
xor edi, edi
lea ebx, [ebp + 0x10]
push edi
push ebx
push eax
push edi
push edx
push dword [ecx + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x45ce47
mov byte [esi], 1
jmp 0x45ce57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x45ce70
mov byte [esi], 0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x45cece
lea esi, [ebp - 0xb8]
mov ecx, esi
push 2
push 0x1ea
push str..._.._chrome_chrome_cleaner_http_http_agent_impl.cc
call fcn.00483ab0
lea eax, [ebp - 0xb0]
push 0x1b
push str.WinHttpQueryHeaders_failed:
push eax
call fcn.00401baa
add esp, 0xc
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0xbc]
mov dword [ecx], eax
push ecx
push edi
call fcn.0045b970
add esp, 8
mov ecx, esi
call fcn.00483e50
xor ebx, ebx
jmp 0x45ce59
Function at 0x464f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov ebx, eax
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.005af3d4
add esp, 0x10
cmp eax, esi
jne 0x464f70
cmp ebx, 1
je 0x464f19
cmp ebx, 2
mov esi, 0xffffffff
je 0x464f73
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.005ae3fb
add esp, 4
neg eax
sbb esi, esi
jmp 0x464f73
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x464f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x464fb4
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.005af3d4
add esp, 0x14
jmp 0x464fe3
test esi, esi
jle 0x464fdc
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, byte [eax + edi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x464fde
inc edi
cmp esi, edi
mov eax, ebx
jne 0x464fbd
mov edi, esi
jmp 0x464fde
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x464ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0xffffffff
je 0x465033
mov esi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x46504b
xor edi, edi
inc edi
lea eax, [ebp - 0x19]
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.005af3d4
add esp, 0x10
cmp eax, edi
je 0x465035
xor ebx, ebx
dec ebx
jmp 0x465035
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea ebx, [ebp - 0x19]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x46502e
mov edi, eax
cmp eax, 3
je 0x4650ac
cmp edi, 1
ja 0x46502e
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.005af3d4
add esp, 0x10
cmp eax, ebx
jne 0x46502e
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x465056
jmp 0x4650c5
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.005af3d4
add esp, 0x10
cmp eax, edi
jne 0x46502e
mov ebx, dword [ebp + 8]
jmp 0x465035
Function at 0x465100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x465124
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.005af3d4
add esp, 0x14
jmp 0x465154
test esi, esi
jle 0x46514d
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x46514f
inc edi
cmp esi, edi
mov eax, ebx
jne 0x46512d
mov edi, esi
jmp 0x46514f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x465160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp si, 0xffff
je 0x4651a6
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x4651be
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.005af3d4
add esp, 0x10
cmp eax, 1
je 0x4651a8
xor esi, esi
dec esi
jmp 0x4651a8
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x4651a1
mov ebx, eax
cmp eax, 3
je 0x46521f
cmp ebx, 1
ja 0x4651a1
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.005af3d4
add esp, 0x10
cmp eax, esi
jne 0x4651a1
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x4651c9
jmp 0x465238
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.005af3d4
add esp, 0x10
cmp eax, ebx
jne 0x4651a1
movzx esi, word [ebp + 8]
jmp 0x4651a8

Function at 0x4653d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x4653ff
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x4653e1
pop esi
pop edi
pop ebp
ret 8

Function at 0x465510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x465541
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x465521
pop esi
pop edi
pop ebp
ret 8
Function at 0x46ea94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00477644
mov ebx, eax
test esi, esi
je 0x46eacd
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x46eaba
movzx eax, word [eax]
jmp 0x46eac1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x46eacd
test bl, bl
jne 0x46ead3
jmp 0x46eb30
xor esi, esi
test bl, bl
jne 0x46eb21
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x46eae2
movzx eax, word [eax]
jmp 0x46eae7
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x46eb12
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x46eb0b
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x46eaa0
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x46eaa0
mov ecx, edi
call fcn.00477644
mov ebx, eax
test esi, esi
jne 0x46eb39
jmp 0x46eb2a
mov ecx, edi
call fcn.00477644
mov ebx, eax
test bl, bl
jne 0x46eb58
jmp 0x46eb5e
mov ecx, edi
call fcn.00477644
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x46eb46
movzx eax, word [eax]
jmp 0x46eb4d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x46eb5e
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x47b900
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [0x641d90]
test edi, edi
jne 0x47b9a6
push 0x24
call fcn.00596296
add esp, 4
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
push 0xc
call fcn.00596296
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x641d90], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
test eax, eax
je 0x47b99d
cmp word [eax], 0
je 0x47b99d
xor ecx, ecx
nop dword [eax + eax]
lea edx, [ecx + 1]
cmp word [eax + ecx*2 + 2], 0
mov ecx, edx
jne 0x47b990
mov ecx, esi
push edx
push eax
call fcn.0047b9b0
test edi, edi
sete al
pop esi
pop edi
pop ebp
ret
Function at 0x47b9b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x6401e4]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.0048a720
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47bbab
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x47ba2a
push 0x5cd1d6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47ba39
mov ecx, eax
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x47ba35
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
jmp 0x47ba3b
xor esi, esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test eax, eax
je 0x47bb41
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
cmp eax, 0x15555556
jae 0x47bbcb
shl eax, 2
mov dword [ebp - 0x30], eax
lea esi, [eax + eax*2]
push esi
call fcn.00596296
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
add eax, esi
mov dword [ebp - 0x18], eax
xor eax, eax
mov esi, dword [ebp - 0x24]
jmp 0x47bad5
mov byte [edi + 0xb], bl
mov eax, edi
test ebx, ebx
je 0x47bac1
mov ecx, ebx
add ecx, ebx
push ecx
push dword [ebp - 0x34]
push eax
mov esi, eax
call fcn.00599c40
mov eax, esi
mov esi, dword [ebp - 0x24]
add esp, 0xc
mov word [eax + ebx*2], 0
add edi, 0xc
mov eax, dword [ebp - 0x38]
add eax, 4
cmp dword [ebp - 0x30], eax
je 0x47bb38
mov dword [ebp - 0x38], eax
mov eax, dword [esi + eax]
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
mov dword [ebp - 0x34], eax
push eax
call fcn.005b0e94
add esp, 4
cmp eax, 0x7ffffff0
jae 0x47bbbf
mov ebx, eax
cmp eax, 5
jb 0x47baa0
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x47bbc6
lea eax, [esi + esi]
push eax
call fcn.00596296
add esp, 4
mov dword [edi], eax
or esi, 0x80000000
mov dword [edi + 8], esi
mov dword [edi + 4], ebx
jmp 0x47baa9
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x28]
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.0047b620
mov dword [edi], 0
mov dword [edi + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x47bb6b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x47bbab
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jne 0x47bb86
mov eax, esi
jmp 0x47bb9f
mov eax, edi
cmp esi, edi
je 0x47bb9c
lea edi, [eax - 0xc]
cmp byte [eax - 1], 0
jns 0x47bb80
push dword [eax - 0xc]
call fcn.00596316
add esp, 4
jmp 0x47bb80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
push eax
call fcn.00596316
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, edi
call fcn.00478354
call fcn.005aa3fa
lea ecx, [ebp - 0x20]
call fcn.0047a3cc
int3
Function at 0x47cf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, ecx
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x1c], edx
movzx ecx, byte [0x641d94]
xor ecx, 3
xor eax, eax
mov dword [esp + 0x10], ecx
mov ebx, dword [eax*8 + 0x5cd168]
mov dword [esp + 0x14], eax
mov eax, dword [eax*8 + 0x5cd164]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x2b], bl
lea ecx, [ebx + ebx]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00599c40
add esp, 0xc
mov word [esp + ebx*2 + 0x20], 0
movzx eax, byte [esp + 0x2b]
test al, al
mov ecx, dword [esp + 0x24]
mov edx, eax
mov dword [esp + 0xc], ecx
cmovs edx, ecx
cmp edx, dword [esp + 8]
jbe 0x47cfa0
test al, al
js 0x47cfe0
mov ecx, dword [esp + 0x10]
jmp 0x47cff6
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
test edx, edx
je 0x47d00a
test al, al
lea esi, [esp + 0x20]
cmovs esi, dword [esp + 4]
xor ebx, ebx
nop dword [eax]
movzx ecx, word [edi + ebx*2]
cmp cx, word [esi + ebx*2]
jne 0x47cf96
add ebx, 1
cmp edx, ebx
jne 0x47cfc0
jmp 0x47d00a
push dword [esp + 0x20]
call fcn.00596316
add esp, 4
movzx ecx, byte [0x641d94]
xor ecx, 3
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, ecx
jb 0x47cf31
jmp 0x47d096
test al, al
js 0x47d018
mov ecx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x47d02e
push dword [esp + 4]
call fcn.00596316
add esp, 4
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
xor ebx, ebx
test ecx, ecx
je 0x47d09c
cmp ecx, dword [esp + 8]
je 0x47d09c
lea eax, [esp + 0x18]
push 0
push 0x5cd210
push eax
mov ebx, ecx
call fcn.00488550
mov edx, ebx
add esp, 0xc
sub eax, ebx
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
cmovb edx, ecx
sub ecx, edx
cmp ecx, eax
cmovae ecx, eax
cmp ecx, esi
jne 0x47d096
test esi, esi
je 0x47d09a
add edx, edx
add edx, dword [esp + 0x18]
xor eax, eax
nop word cs:[eax + eax]
nop
movzx ecx, word [edx + eax*2]
cmp cx, word [edi + eax*2]
sete bl
jne 0x47d09c
add eax, 1
cmp esi, eax
jne 0x47d080
jmp 0x47d09c
xor ebx, ebx
jmp 0x47d09c
mov bl, 1
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4806b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x480702
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x4806ec
call fcn.004835e0
push dword [esi]
call fcn.00498c60
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4806fb
mov dword [esi], ebx
call fcn.004835e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
call fcn.00480860
lea ecx, [esi + 0x10]
call fcn.004d4780
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
mov al, byte [ebp + 0xc]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x480730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00455db0
mov dword [esi], 0
test eax, eax
je 0x480794
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jb 0x48077a
mov dword [ebp - 0x10], eax
call fcn.004835e0
push dword [esi]
call fcn.00498c60
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x48078d
mov dword [esi], ebx
mov ebx, eax
call fcn.004835e0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.00430bd0
lea ecx, [esi + 0x10]
call fcn.004d4780
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4835f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.0047bbe0
mov esi, eax
mov ecx, eax
push 0x5d068b
call fcn.0047c090
test al, al
jne 0x48362e
mov ecx, esi
push str.vmodule
call fcn.0047c090
test al, al
je 0x4836c0
cmp dword [0x641da4], 0
jne 0x48378b
mov eax, dword [0x641da8]
mov dword [0x641da4], eax
push 0x10
call fcn.00596296
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], str.vmodule
push str.vmodule
call fcn.005b0c60
add esp, 4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push edx
call fcn.0047c100
mov dword [ebp - 0x38], 0x5d068b
push 0x5d068b
call fcn.005b0c60
add esp, 4
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
lea ebx, [ebp - 0x30]
mov ecx, esi
push eax
push ebx
call fcn.0047c100
mov ecx, edi
push 0x641dac
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.004d51a0
mov dword [0x641da8], edi
cmp byte [ebp - 0x25], 0
js 0x483701
cmp byte [ebp - 0x11], 0
js 0x483712
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x63f220], eax
mov bl, 1
test al, 1
je 0x483777
mov eax, dword [0x641dc0]
test eax, eax
je 0x48371f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x641dc0], 0
mov ecx, dword [0x641db0]
test ecx, ecx
jne 0x48374e
and byte [0x63f220], 0xfe
jmp 0x483729
push dword [ebp - 0x30]
call fcn.00596316
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x4836c0
push dword [ebp - 0x1c]
call fcn.00596316
add esp, 4
jmp 0x4836c0
mov ecx, dword [0x641db0]
test ecx, ecx
jne 0x48374e
push 0xc
call fcn.00596296
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x641db0], eax
push dword [esi + 4]
call fcn.0047966c
cmp dword [esi + 0xc], 0
jne 0x483770
mov eax, dword [0x641db0]
cmp byte [eax + 0xb], 0
jns 0x483769
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00483790
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
int3