joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f044
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45f05b
add esp, 0xfffffff0
call fcn.00403b4c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420208
mov eax, dword [0x4b3960]
cmp word [eax + 2], 0
jne 0x45f083
mov eax, dword [0x4b3960]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00460690
mov eax, dword [0x4b3a5c]
cmp word [eax + 2], 0
jne 0x45f09d
mov eax, dword [0x4b3a5c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00460888
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415898]
call fcn.004037b8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415898]
call fcn.004037b8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x422770]
call fcn.0042a44c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45f224
mov eax, dword [0x4b3828]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042a81c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x460e08
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4b3828]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d148
test eax, eax
je 0x45f192
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040939c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d170
test eax, eax
je 0x45f1a6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404860
mov eax, dword [0x4b3668]
cmp byte [eax], 0
jne 0x45f1da
mov eax, ebx
call fcn.0045f34c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00460fe4
mov eax, ebx
call fcn.00461924
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45f21a
call fcn.00403ba4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f5c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b4c30]
cmp dword [eax + 0x30], 0
je 0x45f66a
cmp dword [ebx + 0x94], 0
jne 0x45f664
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45f550
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f664
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f62a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f664
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041804c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f639
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460148
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46017d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046e8
jmp 0x46018a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040464c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4611c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461201
mov eax, esi
call fcn.004471a4
test al, al
je 0x461201
mov eax, dword [ebx + 0x84]
call fcn.00446ea0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461201
push 0
mov eax, dword [ebx + 0x84]
call fcn.00446ea0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x464a44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00464730
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404aa8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x464aa2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b398c]
mov dl, 1
mov eax, dword [0x464628]
call fcn.0040c4a8
call fcn.00403fb4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x464aac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404aa8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x464b04
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b3c78]
mov dl, 1
mov eax, dword [0x464628]
call fcn.0040c4a8
call fcn.00403fb4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00464760
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x468184
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x468304
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 8]
call fcn.004048b0
mov dword [ebp - 0x10], eax
call fcn.0043a2f4
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4682fd
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
mov esi, dword [ebp - 0x10]
inc esi
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46823d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x468236
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x46821f
mov eax, dword [ebp - 8]
call fcn.00404aa8
mov ecx, esi
mov edx, ebx
call fcn.004029b0
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46823d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
cmp byte [ebp - 0x11], 0
jne 0x4682c9
mov esi, dword [ebp - 0x10]
inc esi
mov eax, esi
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4682c2
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4682ab
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x328]
mov byte [ebx], al
inc ebx
mov eax, dword [ebp - 8]
call fcn.00404aa8
mov ecx, esi
mov edx, ebx
call fcn.004029b0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4b4e98]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4682c9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468304
call fcn.0043a2f4
mov edx, dword [eax]
call dword [edx + 0x14]
cmp byte [ebp - 0x11], 0
je 0x4682fc
mov ecx, 0x468314
mov dl, 1
mov eax, dword [0x466980]
call fcn.0040c3b0
call fcn.00403fb4
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473f54
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x474030
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
test eax, eax
jl 0x474030
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x474024
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.0042907c
mov ecx, esi
mov edx, dword [ebp - 0x10]
call fcn.004245e4
mov edi, eax
mov eax, edi
call fcn.004077cc
xor ebx, ebx
mov bl, al
imul ebx, dword [ebp - 8]
mov eax, edi
call fcn.004077d0
and eax, 0xff
imul dword [ebp - 0xc]
add ebx, eax
mov eax, edi
call fcn.004077d4
and eax, 0xff
imul dword [ebp + 8]
add ebx, eax
mov eax, ebx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
add edx, dword [ebp + 8]
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov ebx, edi
mov ecx, ebx
mov edx, ebx
mov eax, ebx
call fcn.004077b0
push eax
mov eax, dword [ebp - 4]
call fcn.0042907c
mov ecx, esi
mov edx, dword [ebp - 0x10]
call fcn.00424610
inc esi
dec dword [ebp - 0x18]
jne 0x473fa7
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x473f91
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x475dbc
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc0
mov edi, eax
push 0x14
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x475bb8]
call fcn.00405cdc
add esp, 4
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x475e1f
push 0
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x475bb8]
call fcn.00405cdc
add esp, 4
cmp word [edi + 0x42], 0
je 0x475e5f
mov edx, 0x475e70
mov eax, dword [edi + 0x44]
call dword [edi + 0x40]
jmp 0x475e5f
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x475e3c
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [edi + 0x4c]
lea eax, [eax + ebx*4]
call fcn.004047e8
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
je 0x475e48
cmp ebx, 0x14
jl 0x475e26
push ebx
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x475bb8]
call fcn.00405cdc
add esp, 4
add esp, 0x40
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x475e84
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, eax
lea ebp, [esp + 8]
mov eax, dword [ebx + 0x4c]
call fcn.00405b28
inc eax
je 0x475f88
mov eax, dword [ebx + 0x4c]
call fcn.00405b28
inc eax
push eax
lea eax, [ebx + 0x48]
mov ecx, 1
mov edx, dword [0x475b98]
call fcn.00405cdc
add esp, 4
mov eax, dword [ebx + 0x4c]
call fcn.00405b28
mov edi, eax
test edi, edi
jl 0x475f88
inc edi
xor esi, esi
push 0
push 3
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebx + 0x48]
mov dword [edx + esi*4], eax
mov word [ebp], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + esi*4]
call fcn.00404aa8
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp + 4], eax
push 0x10
push ebp
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_bind
mov edx, eax
mov eax, ebx
call fcn.0047646c
mov dword [esp], 1
xor eax, eax
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x2c
lea eax, [esp + 0x28]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x98000001
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call dword [ebx + 0x6c]
mov edx, eax
mov eax, ebx
call fcn.0047646c
push 0x21
lea eax, [esi + 0x4c8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov edx, eax
mov eax, ebx
call fcn.0047646c
inc esi
dec edi
jne 0x475ed5
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x476e54
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414eec]
call fcn.00405020
xor eax, eax
push ebp
push 0x476f98
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b10e8], 0
jne 0x476ea7
mov ecx, dword [0x4b3690]
mov dl, 1
mov eax, dword [0x407cb8]
call fcn.0040c46c
call fcn.00403fb4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403054
mov eax, ebx
call fcn.00404e70
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x476fa8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004064b4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404e80
test eax, eax
jle 0x476f3f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x476f38
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404878
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404860
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b64
test eax, eax
jne 0x476f38
mov ebx, 0x15
jmp 0x476f44
mov ebx, 0x10
jmp 0x476f44
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4b10e8]
call fcn.00476d50
mov eax, dword [ebp - 8]
call fcn.00476d50
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004064cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476f9f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040461c
lea eax, [ebp - 0x10]
mov edx, dword [0x414eec]
call fcn.004050f0
ret

Function at 0x48b49c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x4b3a30]
mov eax, dword [eax]
call fcn.004603e4
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x48b4c4
cmp ebx, eax
jle 0x48b4a7
pop esi
pop ebx
ret
Function at 0x48b4c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x48b6d9
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 1
jb 0x48b519
je 0x48b562
dec eax
je 0x48b5d5
dec eax
je 0x48b645
jmp 0x48b6b3
lea edx, [ebp - 0x108]
mov eax, dword [0x4b3a30]
mov eax, dword [eax]
call fcn.00460b68
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 4]
call fcn.00409238
mov eax, dword [ebp - 4]
call fcn.00409124
cmp byte [eax], 0x5c
je 0x48b553
lea eax, [ebp - 4]
mov edx, 0x48b6f0
call fcn.004048b8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040464c
jmp 0x48b6b3
lea eax, [ebp - 0x104]
mov ecx, 0x20
mov edx, pe_nt_image_headers32
call fcn.00403054
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404860
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 4]
call fcn.00408bd4
mov eax, dword [ebp - 4]
call fcn.00409124
cmp byte [eax], 0x5c
je 0x48b5c6
lea eax, [ebp - 4]
mov edx, 0x48b6f0
call fcn.004048b8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040464c
jmp 0x48b6b3
lea eax, [ebp - 0x104]
mov ecx, 0x20
mov edx, pe_nt_image_headers32
call fcn.00403054
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404860
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 4]
call fcn.00408bd4
mov eax, dword [ebp - 4]
call fcn.00409124
cmp byte [eax], 0x5c
je 0x48b639
lea eax, [ebp - 4]
mov edx, 0x48b6f0
call fcn.004048b8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040464c
jmp 0x48b6b3
lea eax, [ebp - 0x104]
mov ecx, 0x20
mov edx, pe_nt_image_headers32
call fcn.00403054
lea eax, [ebp - 0x104]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404860
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 4]
call fcn.00408bd4
mov eax, dword [ebp - 4]
call fcn.00409124
cmp byte [eax], 0x5c
je 0x48b6a9
lea eax, [ebp - 4]
mov edx, 0x48b6f0
call fcn.004048b8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040464c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b6e0
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.0040461c
lea eax, [ebp - 4]
call fcn.004045f8
ret
Function at 0x48bbc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x48bdd9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov edx, ecx
mov cl, byte [eax + edx]
mov byte [ebp - 0xd], cl
xor cl, byte [0x4b6fc0]
and cl, 0xff
mov byte [eax + edx], cl
inc edx
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jle 0x48bc36
mov ecx, 1
mov bl, byte [eax + edx]
mov byte [ebp - 0xe], bl
mov bl, byte [eax + edx]
mov edi, ecx
and edi, 0x3f
xor bl, byte [edi + 0x4b3148]
mov edi, ecx
and edi, 7
xor bl, byte [edi + 0x4b6fc0]
and bl, 0xff
xor bl, byte [ebp - 0xd]
mov byte [eax + edx], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xd], bl
inc edx
inc ecx
dec esi
jne 0x48bc03
mov al, byte [0x4b6fc0]
and al, 0xff
and eax, 0xff
xor edx, edx
shld edx, eax, 0
push edx
push eax
mov al, byte [0x4b6fc1]
and al, 0xff
and eax, 0xff
xor edx, edx
shld edx, eax, 8
shl eax, 8
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov al, byte [0x4b6fc2]
and al, 0xff
and eax, 0xff
xor edx, edx
shld edx, eax, 0x10
shl eax, 0x10
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov al, byte [0x4b6fc3]
and al, 0xff
and eax, 0xff
xor edx, edx
shld edx, eax, 0x18
shl eax, 0x18
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov al, byte [0x4b6fc4]
and al, 0xff
and eax, 0xff
xor edx, edx
mov edx, eax
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov al, byte [0x4b6fc5]
and al, 0xff
and eax, 0xff
xor edx, edx
mov edx, eax
shl edx, 8
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov al, byte [0x4b6fc6]
and al, 0xff
and eax, 0xff
xor edx, edx
mov edx, eax
shl edx, 0x10
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov al, byte [0x4b6fc7]
and al, 0xff
and eax, 0xff
xor edx, edx
mov edx, eax
shl edx, 0x18
xor eax, eax
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [ebp - 8]
adc edx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
shrd eax, edx, 0
shr edx, 0
and al, 0xff
mov byte [0x4b6fc0], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
shrd eax, edx, 8
shr edx, 8
and al, 0xff
mov byte [0x4b6fc1], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
shrd eax, edx, 0x10
shr edx, 0x10
and al, 0xff
mov byte [0x4b6fc2], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
shrd eax, edx, 0x18
shr edx, 0x18
and al, 0xff
mov byte [0x4b6fc3], al
mov eax, dword [ebp - 4]
xor edx, edx
and al, 0xff
mov byte [0x4b6fc4], al
mov eax, dword [ebp - 4]
shr eax, 8
xor edx, edx
and al, 0xff
mov byte [0x4b6fc5], al
mov eax, dword [ebp - 4]
shr eax, 0x10
xor edx, edx
and al, 0xff
mov byte [0x4b6fc6], al
mov eax, dword [ebp - 4]
shr eax, 0x18
xor edx, edx
and al, 0xff
mov byte [0x4b6fc7], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bde0
ret
Function at 0x48c050
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor edx, edx
mov ecx, eax
lea ebx, [edx + 0x40]
lea esi, [eax + ebx]
mov bl, byte [ecx]
xor byte [esi], bl
inc edx
inc ecx
cmp edx, 0x40
jne 0x48c057
xor edx, edx
lea ecx, [edx + 0x34]
mov cl, byte [eax + ecx]
lea ebx, [edx + 0xd]
xor byte [eax + ebx], cl
inc edx
cmp edx, 4
jne 0x48c06a
xor edx, edx
mov ecx, eax
lea ebx, [edx + 0x40]
mov bl, byte [eax + ebx]
xor byte [ecx], bl
inc edx
inc ecx
cmp edx, 0x40
jne 0x48c080
xor edx, edx
mov esi, eax
mov cl, byte [esi]
lea edi, [edx + 0x4d]
mov bl, byte [eax + edi]
mov byte [esi], bl
mov byte [eax + edi], cl
inc edx
inc esi
cmp edx, 4
jne 0x48c093
pop edi
pop esi
pop ebx
ret

Function at 0x48c0ac
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ecx, edx
test ecx, ecx
js 0x48c0c5
shr ecx, 2
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x48c0be
mov eax, esp
mov dword [ebp - 4], 4
mov dword [ebp - 8], 0x4b2148
mov dword [ebp - 0xc], 0x4b5f70
mov esi, pe_nt_image_headers32
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ecx]
mov dword [ebx], edi
add ebx, 4
add ecx, 4
dec esi
jne 0x48c0e7
add dword [ebp - 0xc], 0x400
add dword [ebp - 8], 0x400
dec dword [ebp - 4]
jne 0x48c0dc
call fcn.0048c11c
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x48c11c
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ecx, edx
test ecx, ecx
js 0x48c134
shr ecx, 2
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x48c12d
mov eax, esp
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
mov ebx, 0x12
mov dword [ebp - 0x14], 0x4b2100
mov dword [ebp - 0x18], 0x4b6f70
xor eax, eax
mov esi, 4
mov edx, dword [ebp - 4]
mov dl, byte [edx + ecx]
and dl, 0xff
and edx, 0xff
shl eax, 8
and eax, 0xffffffff
add edx, eax
mov eax, edx
inc ecx
cmp ecx, dword [ebp - 8]
jle 0x48c179
xor ecx, ecx
dec esi
jne 0x48c158
mov edx, dword [ebp - 0x14]
xor eax, dword [edx]
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
add dword [ebp - 0x18], 4
add dword [ebp - 0x14], 4
dec ebx
jne 0x48c151
mov ebx, 8
lea eax, [ebp - 0x10]
mov byte [eax], 0
inc eax
dec ebx
jne 0x48c199
mov ebx, 9
mov esi, 0x4b6f70
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.0048c268
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 7
call fcn.0048c46c
mov dword [esi], eax
lea eax, [ebp - 0x10]
mov ecx, 4
mov edx, 7
call fcn.0048c46c
mov dword [esi + 4], eax
add esi, 8
dec ebx
jne 0x48c1aa
mov ebx, 4
mov esi, 0x4b5f70
push 0xff
mov ecx, esi
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.0048c214
add esi, 0x400
dec ebx
jne 0x48c1ed
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret