joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x238
mov eax, dword [ebp + 8]
mov ecx, eax
lea edx, [ebp - 0x108]
mov dword [ebp - 0x210], 0x104
mov esi, dword [ebp - 0x210]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
xor ecx, ecx
lea edx, [ebp - 0x108]
lea esi, [ebp - 0x20c]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], esi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
lea ecx, [ebp - 0x20c]
mov edx, dword [ebp - 0x214]
mov dword [ebp - 0x224], ecx
mov ecx, edx
mov esi, dword [ebp - 0x224]
mov dword [esp], esi
mov dword [ebp - 0x228], eax
call fcn.00a80ff0
sub esp, 4
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x22c], eax
mov eax, ecx
add esp, 0x238
pop esi
pop ebp
ret
Function at 0xa81590
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, esp
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], 0xffffffff
lea ebx, [esi + 0x48]
mov dword [esi + 0x4c], 0xa8b310
mov dword [esi + 0x24], eax
mov eax, dword fs:[0]
mov dword [esi + 0x48], eax
mov dword fs:[0], ebx
mov dword [esi + 0x3c], edx
mov eax, dword [esi + 0x24]
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], ecx
mov ecx, dword [esi + 0x34]
mov dword [esi + 0x30], 0
lea edx, [esi + 0x28]
mov dword [esi + 0x20], ecx
mov ecx, edx
mov edx, dword [esi + 0x20]
mov dword [esp], edx
mov dword [esi + 0x1c], edi
call fcn.00a8a7f0
sub esp, 4
lea ecx, [esi + 0x28]
mov dword [esi + 0x18], eax
call fcn.00a8a910
test al, 1
jne 0xa81623
mov eax, dword [esi + 0x30]
or eax, 4
mov dword [esi + 0x30], eax
jmp 0xa816c1
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
sub eax, 1
sbb ecx, 0
jl 0xa816ba
jmp 0xa8163a
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add eax, ecx
mov ecx, eax
call fcn.00a8a930
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
mov edi, dword [ebp + 8]
mov dword [esi + 0x50], 1
mov ebx, esp
mov dword [ebx + 8], edx
mov dword [ebx + 4], ecx
mov dword [ebx], edi
mov ecx, eax
call fcn.00a8a950
sub esp, 0xc
mov dword [esi + 0x14], edx
mov dword [esi + 0x10], eax
jmp 0xa8168f
jmp 0xa816ba
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x10]
xor edx, eax
mov eax, dword [esi + 0x14]
xor eax, ecx
or edx, eax
je 0xa816b5
jmp 0xa816ac
mov eax, dword [esi + 0x30]
or eax, 4
mov dword [esi + 0x30], eax
jmp 0xa8168a
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add eax, ecx
mov ecx, dword [esi + 0x30]
mov dword [esi + 0x50], 0
mov edx, esp
mov dword [edx], ecx
mov dword [edx + 4], 0
mov ecx, eax
call fcn.00a88870
sub esp, 8
jmp 0xa816ef
lea ecx, [esi + 0x28]
call fcn.00a8a9b0
mov eax, dword [esi + 0x48]
mov dword fs:[0], eax
mov eax, dword [esi + 0x20]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0xa82900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
cmp dword [eax + 0x38], 0
mov dword [esp + 0x1c], eax
je 0xa82960
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [ebp + 8]
mov esi, esp
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], edx
mov ecx, dword [esp + 0x1c]
call fcn.00a83720
sub esp, 0xc
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], eax
jmp 0xa82ac0
movsd xmm0, qword [esp + 0x38]
movsd qword [esp + 0x28], xmm0
mov ecx, dword [esp + 0x1c]
call fcn.00a83b60
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
sub eax, 1
sbb ecx, 0
jl 0xa82a4a
jmp 0xa82996
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub eax, 1
sbb ecx, 0
jl 0xa82a4a
jmp 0xa829af
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
sub eax, edx
sbb ecx, esi
jge 0xa829da
jmp 0xa829ce
movsd xmm0, qword [esp + 0x38]
movsd qword [esp + 0x20], xmm0
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, edx
mov dword [esp + 0x14], eax
call fcn.00a83bb0
mov ecx, esp
mov edx, dword [esp + 0x14]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], edx
mov dword [ecx], eax
call fcn.00a83aa0
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp + 8]
add edx, ecx
mov dword [ebp + 8], edx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
sub esi, ecx
sbb edi, edx
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edi
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp], edx
mov dword [esp + 0x10], eax
call fcn.00a83bd0
sub esp, 4
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
sub eax, 1
sbb ecx, 0
jl 0xa82aa4
jmp 0xa82a63
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x4c], 0
je 0xa82aa4
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x4c]
mov edx, dword [esp + 0x38]
mov esi, dword [ebp + 8]
mov edi, esp
mov dword [edi + 0xc], ecx
mov dword [edi + 8], edx
mov dword [edi], esi
mov dword [edi + 4], 1
call fcn.00a96e0a
mov ecx, dword [esp + 0x38]
sub ecx, eax
sbb dword [esp + 0x3c], 0
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
sub eax, edx
sbb ecx, esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 0xc
Function at 0xa82fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x58
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
mov dword [ebp - 0x48], eax
je 0xa82ff8
mov eax, dword [ebp - 0x48]
test byte [eax + 0x3d], 1
jne 0xa83001
mov byte [ebp - 9], 1
jmp 0xa8312c
call fcn.00a83260
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 4
mov dword [ebp - 0x14], eax
call fcn.00a83260
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.00a83230
test al, 1
jne 0xa8303e
jmp 0xa83047
mov byte [ebp - 9], 0
jmp 0xa8312c
mov dword [ebp - 0x1c], 0x20
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax + 0x38]
lea edx, [ebp - 0x1c]
add eax, 0x40
mov esi, esp
lea edi, [ebp - 0x40]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edx
lea edx, [ebp - 0x3c]
mov dword [esi + 4], edx
mov dword [esi], eax
call fcn.00a83270
sub esp, 0x10
mov ecx, eax
test eax, eax
mov dword [ebp - 0x4c], ecx
je 0xa830a9
jmp 0xa83087
mov eax, dword [ebp - 0x4c]
sub eax, 1
je 0xa830b0
jmp 0xa83098
mov eax, dword [ebp - 0x4c]
sub eax, 3
je 0xa83118
jmp 0xa83128
mov eax, dword [ebp - 0x48]
mov byte [eax + 0x3d], 0
xor eax, eax
lea ecx, [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
sub edx, ecx
mov dword [ebp - 0x44], edx
cmp eax, dword [ebp - 0x44]
jae 0xa83104
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov esi, dword [edx + 0x4c]
mov edi, dword [ebp - 0x44]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
mov dword [ebp - 0x50], ecx
call fcn.00a96e0a
mov ecx, dword [ebp - 0x50]
cmp ecx, eax
je 0xa83104
mov byte [ebp - 9], 0
jmp 0xa8312c
mov eax, dword [ebp - 0x48]
mov cl, byte [eax + 0x3d]
xor cl, 0xff
and cl, 1
mov byte [ebp - 9], cl
jmp 0xa8312c
mov eax, dword [ebp - 0x48]
mov byte [eax + 0x3d], 0
mov byte [ebp - 9], 1
jmp 0xa8312c
mov byte [ebp - 9], 0
mov al, byte [ebp - 9]
and al, 1
movzx eax, al
add esp, 0x58
pop esi
pop edi
pop ebp
ret
Function at 0xa8e230
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xffffffffffffffff
push 0xaae09d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0xac1534]
xor eax, ebp
mov dword [ebp + 0x410], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp + 0x208]
push 0
push eax
call fcn.00a93010
push 0x208
lea eax, [ebp]
push 0
push eax
call fcn.00a93010
push 0x104
lea eax, [ebp]
push eax
lea eax, [edi + 8]
push eax
call fcn.00a8e4e0
add esp, 0x24
lea eax, [ebp + 0x208]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0xab04d0
push 1
push 0
push 0xab0808
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0xa8e410
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 0x208]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov esi, eax
test esi, esi
js 0xa8e410
mov eax, dword [ebp - 0x10]
push 0xab02c4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
js 0xa8e410
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 0x208]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
js 0xa8e410
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push 0xab0668
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 1
call dword [ecx]
mov esi, eax
test esi, esi
js 0xa8e3f8
cmp dword [edi + 0x34], 8
lea eax, [edi + 0x20]
jb 0xa8e369
mov eax, dword [eax]
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.00a8caf0
mov esi, eax
add esp, 8
test esi, esi
js 0xa8e3f8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
push edx
push 0xab0818
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
test esi, esi
js 0xa8e3ee
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
js 0xa8e3ee
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push 0xab0658
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 2
call dword [ecx]
mov esi, eax
test esi, esi
js 0xa8e3d6
mov eax, dword [ebp - 0x18]
lea edx, [ebp]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 1
test ecx, ecx
je 0xa8e3ee
mov dword [ebp - 0x18], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ole32.dll_PropVariantClear]
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0xa8e410
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0xa8e42b
mov dword [ebp - 0x10], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.00a916ca
lea esp, [ebp + 0x414]
pop ebp
ret
Function at 0xa8e4e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x20
mov eax, dword [0xac1534]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x34]
push ebp
push ebx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
test eax, eax
je 0xa8e53c
push str.MicrosoftWindowsStart_MenuPrograms_
push ebp
push ebx
call fcn.00a9840f
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80070057
test esi, esi
js 0xa8e59c
mov ecx, dword [edi + 0x10]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 4
jb 0xa8e5b1
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0xa8e559
mov eax, dword [edi]
push 4
push str..lnk
push ecx
push eax
push edi
push dword [esp + 0x24]
lea ecx, [esp + 0x2c]
call fcn.00a8c0d0
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
push ebp
push ebx
call fcn.00a9840f
add esp, 0xc
lea ecx, [esp + 0x14]
neg eax
sbb esi, esi
and esi, 0x80070057
call fcn.00a80e20
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a916ca
add esp, 0x20
ret
call fcn.00a84580
int3
Function at 0xa9fbc1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a9fa37
Function at 0x4273ff
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push OleUIBusyA
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x42741d
mov eax, 0x4b837b
push eax
push 1
mov ebx, 0x194
call fcn.004878a0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x427447
mov eax, 0
jmp 0x4274bb
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x4274a8
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x427491
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x427480
xor ecx, eax
xor edx, ebx
dec edi
jne 0x427471
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x441ec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x441f73
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x48b2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x48b2c1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x48b31b
inc edi
cmp edi, esi
jl 0x48b2b5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x48b350
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x48b30a
cmp byte [eax], bl
je 0x48b325
cmp byte [eax + 1], bl
je 0x48b32e
cmp byte [eax + 2], bl
je 0x48b338
cmp byte [eax + 3], bl
je 0x48b344
add eax, 4
cmp eax, edi
jb 0x48b2e1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x48b930
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x48b962
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x48b9c2
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x48b999
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x48ba70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x48bb0c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x48ba9b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0x48f570
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0990
push 0x4998b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00499a40
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492470
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x8fac9c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x492483
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4924c4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x8fad44]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4924f6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4924fa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4924eb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x492518
mov bl, byte [esp + ecx + 0x4c]
jmp 0x49251c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x49250d
xor ecx, ecx
mov eax, 0x8facac
xor ebx, ebx
mov bl, byte [ecx + 0x8fad54]
cmp byte [esp + ebx + 0x14], 0
je 0x492547
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x8fad6c]
cmp byte [esp + ebx + 0x14], 0
je 0x49255e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x49252e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4924b7
lea edx, [esp + 0x84]
push edx
call fcn.004925a0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x495e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aeaa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00495a20
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00495aa0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00495aa0
lea ecx, [esi + 0xc]
call fcn.004a68ac
lea ecx, [esi + 0x10]
call fcn.004a68ac
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00497030
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00497030
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00497030
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004a6921
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a6921
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x938c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x938d1c
test eax, eax
je 0x938d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x953fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x938d03
lea edi, [eax + 4]
jmp 0x938c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x938c7c
mov dword [ebp - 4], 2
jmp 0x938c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x938c93
mov dword [ebp - 4], 1
jmp 0x938c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x938d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x938cd6
mov byte [ecx], 0x3d
jmp 0x938ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x938ced
mov byte [ecx], 0x3d
jmp 0x938cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x938c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401464
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401476
mov eax, dword [0x49807f]
shl eax, 2
mov dword [0x498083], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00488d74
pop edx
call fcn.00488c9c
call fcn.00488db4
push 0
call fcn.00489e90
pop ecx
push 0x498028
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x498087], eax
push 0
jmp fcn.004924c4