joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00489540
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x4cb788]
add esp, 8
test ebx, ebx
je 0x4864b4
test eax, eax
je 0x4864b4
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4863e2
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4864a1
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x48646a
cmp eax, 0xea
jne 0x48648d
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x486435
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x486478
cmp eax, 2
jne 0x48648d
push esi
call dword [0x4cb788]
push eax
push esi
call fcn.00489500
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x4864dd
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4864e9
mov esi, dword [esp + 0x40]
test esi, esi
je 0x4864e9
push esi
call dword [0x4cb788]
push eax
push esi
call fcn.00489500
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x486b20
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x486ba1
je 0x486b92
cmp eax, 0x80000101
ja 0x486b8b
je 0x486b92
cmp eax, 0x80000004
je 0x486b6c
cmp eax, 0x80000005
jne 0x486bb6
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x486c03
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x486c03
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call dword [0x4cb788]
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x486c03
cmp eax, 0x80000201
jne 0x486bb6
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x486c03
cmp eax, 0x80000401
je 0x486bee
cmp eax, 0x80000501
je 0x486bd6
cmp eax, 0x80000601
je 0x486bbe
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call sub.MSVCRT.dll__ftol
mov dword [esp + 0xc], eax
jmp 0x486bff
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call sub.MSVCRT.dll__ftol
mov dword [esp + 0xc], eax
jmp 0x486bff
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.00489540
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call dword [0x4cb788]
add esp, 8
test esi, esi
je 0x486cdc
test eax, eax
je 0x486cdc
inc eax
push edi
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x486c7e
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x486cd2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x486cc7
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x486f50
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x486f5d
xor eax, eax
pop esi
ret
push esi
call dword [0x4cb788]
add esp, 4
test eax, eax
jne 0x486f6d
pop esi
ret
cmp eax, 1
jne 0x486f7b
cmp byte [esi], 0x5c
jne 0x486f7b
xor eax, eax
pop esi
ret
push esi
call fcn.00486d00
add esp, 4
test eax, eax
je 0x486f8f
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop esi
ret

Function at 0x486fa0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x486fd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x487062
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x487054
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x48704c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x487015
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x487180
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
ret
Function at 0x4871a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x4871e1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x4871e1.2
jmp dword [eax*4 + 0x48726c]
mov word [esp + 0x48], di
jmp 0x48721a
mov word [esp + 0x48], 2
jmp 0x48721a
mov word [esp + 0x48], 3
jmp 0x48721a
mov word [esp + 0x48], 4
jmp 0x48721a
mov word [esp + 0x48], 7
jmp 0x48721a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x487264
cmp dword [esp + 0x70], edi
je 0x487250
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x487730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
call fcn.00489540
mov edi, dword [esp + 0x38]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
call dword [0x4cb788]
add esp, 8
cmp ebp, esi
je 0x487810
cmp eax, esi
je 0x487810
inc eax
push ebx
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4877a6
mov byte [esi], 0
inc esi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4877fe
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov edi, 4
push esi
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4877f3
cmp dword [esp + 0x14], edi
jne 0x4877f3
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
pop ebx
jne 0x48781c
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, dword [esp + 0x40]
jne 0x487820
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x487830
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.00489540
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call dword [0x4cb788]
add esp, 8
test ebp, ebp
je 0x4878fa
test eax, eax
je 0x4878fa
inc eax
push ebx
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x48789c
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4878d6
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4878e9
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x4898e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x4898ec
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x48997f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x489949
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.00489990
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x48991e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x4899b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x489aad
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x489a02
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x489a2e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.00489990
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x489a6f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x4899f1
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x48b110
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4cb8dc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x48b123
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x48b164
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x4cb984]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x48b196
mov bl, byte [esp + ecx + 0x4c]
jmp 0x48b19a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x48b18b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x48b1b8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x48b1bc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x48b1ad
xor ecx, ecx
mov eax, 0x4cb8ec
xor ebx, ebx
mov bl, byte [ecx + 0x4cb994]
cmp byte [esp + ebx + 0x14], 0
je 0x48b1e7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x4cb9ac]
cmp byte [esp + ebx + 0x14], 0
je 0x48b1fe
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x48b1ce
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x48b157
lea edx, [esp + 0x84]
push edx
call fcn.0048b240
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x48f8a0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
push esi
test edx, edx
push edi
je 0x48f93b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x48f93b
push 0x4cd90c
push edx
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
je 0x48f93b
push ebx
push ebp
push 2
push 0
push esi
mov bl, 1
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
mov ebp, dword [esp + 0x24]
mov edi, eax
push 0
push edi
push ebp
call fcn.0048f580
add esp, 0x1c
test al, al
je 0x48f929
push esi
call sub.MSVCRT.dll_rewind
mov eax, dword [ebp]
push esi
push edi
push 1
push eax
call sub.MSVCRT.dll_fread
add esp, 0x14
cmp eax, edi
je 0x48f916
xor bl, bl
push esi
mov dword [ebp + 4], eax
call sub.MSVCRT.dll_fclose
add esp, 4
mov al, bl
pop ebp
pop ebx
pop edi
pop esi
ret
push esi
xor bl, bl
call sub.MSVCRT.dll_fclose
add esp, 4
mov al, bl
pop ebp
pop ebx
pop edi
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x48f940
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
push ebp
test edx, edx
push edi
je 0x48f9b3
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x48f9b3
push 0x4cd910
push edx
call sub.MSVCRT.dll_fopen
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x48f9b3
mov edi, dword [esp + 0xc]
push ebx
push esi
push edi
mov bl, 1
call fcn.0048fc20
mov esi, eax
add esp, 4
test esi, esi
jle 0x48f9a3
push ebp
push esi
push 1
push 0
push 0
push edi
call fcn.0048f6f0
add esp, 0xc
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp eax, esi
je 0x48f9a3
xor bl, bl
push ebp
call sub.MSVCRT.dll_fclose
add esp, 4
mov al, bl
pop esi
pop ebx
pop edi
pop ebp
ret
pop edi
xor al, al
pop ebp
ret
Function at 0x418100
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x74
push ebx
push ebp
mov ebp, dword [esp + 0x80]
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 0x3c]
add edi, ebp
cmp word [edi + 6], bx
lea esi, [edi + 0xf8]
mov dword [esp + 0x10], esi
jbe 0x418166
push 0
push 0x63
push 0x72
push 0x73
push 0x72
lea eax, [esp + 0x34]
push 0x2e
push eax
call fcn.00408c90
mov edx, dword [0x4353d0]
lea ecx, [esp + 0x3c]
push ecx
push esi
call dword [edx + 0x1e0]
add esp, 0x24
test eax, eax
je 0x418172
xor eax, eax
inc ebx
mov ax, word [edi + 6]
add esi, 0x28
cmp ebx, eax
jl 0x418125
mov dword [esp + 0x10], esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x74
ret 0xc
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x10], esi
add ecx, ebp
xor eax, eax
xor esi, esi
xor edi, edi
mov ax, word [ecx + 0xe]
mov si, word [ecx + 0xc]
add eax, esi
lea edx, [ecx + 0x10]
test eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], 0
jle 0x418215
mov dword [esp + 0x18], eax
cmp dword [edx], 3
jne 0x4181ff
mov eax, dword [edx + 4]
xor ebx, ebx
and eax, 0x7fffffff
xor ebp, ebp
add eax, ecx
xor esi, esi
mov bx, word [eax + 0xe]
mov bp, word [eax + 0xc]
lea edx, [eax + 0x10]
lea eax, [ebx + ebp]
test eax, eax
jle 0x4181ff
mov ebx, 0x80000000
test dword [edx + 4], ebx
ja 0x4181dd
inc esi
add edx, 8
cmp esi, eax
jl 0x4181ce
jmp 0x4181ff
mov edx, dword [edx + 4]
and edx, 0x7fffffff
mov eax, dword [edx + ecx + 0x14]
mov edx, dword [eax + ecx + 4]
add eax, ecx
mov dword [esp + 0x1c], edx
mov edi, dword [eax]
mov eax, dword [esp + 0x10]
sub edi, dword [eax + 0xc]
add edi, ecx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add edx, 8
dec eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
jne 0x4181a2
mov ecx, dword [esp + 0x90]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
ja 0x418166
mov esi, dword [esp + 0x8c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret 0xc

Function at 0x4182b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x419270
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea edi, [ecx + 4]
mov dword [esp + 0x1c], ecx
mov dword [ecx], 0x42f0c0
xor edx, edx
xor eax, eax
mov ecx, edi
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x41928a
mov byte [edi + 0x100], dl
mov byte [edi + 0x101], dl
mov byte [esp + 0x10], dl
xor esi, esi
mov ebx, edi
mov dword [esp + 0x14], 0x100
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x24]
mov cl, byte [ebx]
and eax, 0xff
xor edx, edx
mov dl, byte [eax + ebp]
mov ebp, ecx
and ebp, 0xff
add esi, edx
add ebp, esi
mov edx, ebp
and edx, 0x800000ff
jns 0x4192e2
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x18], dl
mov esi, dword [esp + 0x18]
and esi, 0xff
inc eax
mov dl, byte [esi + edi]
mov byte [ebx], dl
mov byte [esi + edi], cl
cdq
idiv dword [esp + 0x28]
mov eax, dword [esp + 0x14]
inc ebx
dec eax
mov dword [esp + 0x14], eax
mov byte [esp + 0x10], dl
jne 0x4192b0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x419350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov al, byte [ecx + 0x105]
mov dl, byte [ecx + 0x104]
mov byte [esp], al
mov eax, dword [esp + 0x18]
push edi
xor edi, edi
test eax, eax
mov byte [esp + 8], dl
jbe 0x419435
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
and eax, 0xff
and esi, 0xff
lea edx, [eax + 1]
and edx, 0x800000ff
jns 0x41939f
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov eax, dword [esp + 0x14]
and eax, 0xff
mov bl, byte [eax + ecx + 4]
mov byte [esp + 0x1c], bl
and ebx, 0xff
add ebx, esi
and ebx, 0x800000ff
jns 0x4193cc
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x10], bl
mov bl, byte [esp + 0x1c]
mov esi, dword [esp + 0x10]
mov byte [esp + 0x18], bl
and esi, 0xff
mov ebp, dword [esp + 0x18]
and ebp, 0xff
mov bl, byte [esi + ecx + 4]
mov byte [eax + ecx + 4], bl
mov bl, byte [esp + 0x18]
mov byte [esi + ecx + 4], bl
xor ebx, ebx
mov bl, byte [eax + ecx + 4]
add ebx, ebp
and ebx, 0x800000ff
jns 0x419414
dec ebx
or ebx, 0xffffff00
inc ebx
mov ebp, dword [esp + 0x24]
and ebx, 0xff
mov bl, byte [ebx + ecx + 4]
xor byte [edi + ebp], bl
mov ebx, dword [esp + 0x28]
inc edi
cmp edi, ebx
jb 0x41938c
pop esi
pop ebp
pop ebx
mov byte [ecx + 0x104], dl
mov dl, byte [esp + 4]
mov byte [ecx + 0x105], dl
mov eax, 1
pop edi
add esp, 0x10
ret 8
Function at 0x41b17e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x42dbb3
call fcn.0042cf34
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0041c342
xor edi, edi
mov dword [esi + 0x1c], 0xa
mov dword [ebp - 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edi
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [esi], 0x42f0d4
mov dword [esi + 0x30], ebx
call fcn.00423340
push edi
mov dword [esi + 4], eax
push dword [ebp + 0xc]
push ebx
push eax
call fcn.00423367
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 0x24], eax
mov ecx, dword [0x43541c]
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov dword [eax + 4], esi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8