joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4727e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x472a44
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x472847
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004722ac
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040f08c
cmp al, 1
jne 0x472847
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004725c4
test al, al
je 0x4729d3
cmp dword [ebp - 8], 0
jge 0x472865
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004722ac
mov eax, dword [ebp - 0x210]
call fcn.00404d5c
cmp ebx, eax
jge 0x4728af
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004722ac
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x545dcc]
and eax, 0xff
bt dword [edx], eax
jae 0x4728af
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4728c3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004727c0
cmp ebx, dword [ebp - 8]
je 0x4729c5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4728ef
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403e0c
and eax, 0x7f
movzx eax, word [eax*2 + 0x53a0f8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4729b2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403e0c
and eax, 0x7f
movzx eax, word [eax*2 + 0x53a0f8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00456830
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403e0c
and eax, 0x7f
movzx eax, word [eax*2 + 0x53a0f8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00456830
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4729b9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x472a26
cmp dword [ebp - 8], 0
jge 0x4729de
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004722ac
mov eax, dword [ebp - 0x218]
call fcn.00404d5c
cmp eax, dword [ebp - 8]
jg 0x472a18
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004722ac
mov eax, dword [ebp - 0x21c]
call fcn.00404d5c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004727c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472a4b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404ab0
ret
Function at 0x4822c8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41b570]
call fcn.00405754
xor eax, eax
push ebp
push 0x48240c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x53a1a0], 0
jne 0x48231b
mov ecx, dword [0x54568c]
mov dl, 1
mov eax, dword [0x4087f4]
call fcn.0040e744
call fcn.004044a0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403270
mov eax, ebx
call fcn.00405418
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48241c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406ad4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405428
test eax, eax
jle 0x4823b3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4823ac
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404d24
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404d0c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004097e4
test eax, eax
jne 0x4823ac
mov ebx, 0x15
jmp 0x4823b8
mov ebx, 0x10
jmp 0x4823b8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x53a1a0]
call fcn.00482220
mov eax, dword [ebp - 8]
call fcn.00482220
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406aec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482413
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404ab0
lea eax, [ebp - 0x10]
mov edx, dword [0x41b570]
call fcn.00405824
ret
Function at 0x4a95b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9735
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x53a520], 0
jne 0x4a9712
push 0x546c7c
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x4a970b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x53a520], 0
jne 0x4a96f3
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004050ec
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404f5c
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00409548
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4a974c
call fcn.0040b0c4
mov eax, dword [ebp - 0xc]
call fcn.00404f5c
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4a9674
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004050ec
jmp 0x4a96ab
lea eax, [ebp - 8]
mov edx, 0x4a976c
call fcn.00404b24
xor eax, eax
push ebp
push 0x4a96a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0048242c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a96ab
mov eax, dword [ebp - 8]
call fcn.00404f5c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x53a520], eax
cmp dword [0x53a520], 0
jne 0x4a96de
mov ecx, dword [0x545a28]
mov dl, 1
mov eax, dword [0x4087f4]
call fcn.0040e744
call fcn.004044a0
push 0x4a9778
mov eax, dword [0x53a520]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546c94], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9712
push 0x546c7c
call sub.kernel32.dll_LeaveCriticalSection_1
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a973c
lea eax, [ebp - 0x18]
call fcn.00404a8c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ab0
ret
Function at 0x4b4cac
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x4b4ce7
cmp dword [ebx + 0x5c], 0
je 0x4b4ce7
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.004ad32c
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x4b4e32
cmp dword [ebx + 0x7c], 0
jne 0x4b4d0d
mov dl, 1
mov eax, dword [0x41bef0]
call fcn.00403be0
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x4b4e0b
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x4b4e38]
push eax
mov al, byte [0x4b4e3c]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x545a54]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x4a5648]
call fcn.004a74b4
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4b4e04
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004ad32c
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.004ad32c
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x4aabe8]
call fcn.004062fc
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x4b4dd7
mov edx, dword [0x545cd8]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x4b4de8
cmp eax, 0x1007
jne 0x4b4de4
mov byte [ebx + 0x74], 0x18
jmp 0x4b4de8
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4e32
mov eax, dword [ebp - 4]
call fcn.00403c10
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004ad32c
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b5464
Capabilities:
Write file on windows

Disassembly:
add esp, 0xffffffb8
mov dword [esp], eax
mov eax, dword [0x545c40]
cmp byte [eax], 0
je 0x4b54c3
mov eax, dword [0x545858]
call fcn.0040307c
call fcn.00402978
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
call fcn.0040a980
push eax
lea eax, [esp + 0xc]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 8]
push eax
push 2
push 0x4b5508
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4b54f9
push 0x40
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x5457e0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x546668]
call fcn.00406504
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x48
ret
Function at 0x4b7a2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x53ad03
lea ecx, [ebp - 0x200]
push ecx
call fcn.004b5614
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004b55d4
pop ecx
mov edx, 0x200
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004b55d4
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x53ad05
lea ecx, [ebp - 0x200]
push ecx
call fcn.004b5614
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004b55d4
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004b9544
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4b7b3d
push esi
call fcn.004b55d4
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004b55d4
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004b550c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4b7b14
xor eax, eax
jmp 0x4b7bc4
push esi
call fcn.004b55d4
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004b55d4
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004b55a0
add esp, 0xc
jmp 0x4b7b7d
mov edi, dword [ebx + 0x24]
push edi
call fcn.004b55d4
pop ecx
push eax
push esi
call fcn.004b55d4
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004b55d4
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004b5548
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4b7b7d
xor eax, eax
jmp 0x4b7bc4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004b5614
add esp, 8
push 0x53ad07
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004b5614
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004b5614
add esp, 8
push 0x53ad09
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004b5614
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ba622
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4001f
push 0
push 0
push 0
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4ba676
push esi
call fcn.004b55d4
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4e8a80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x158
call fcn.00403270
cmp dword [ebp - 4], 0
je 0x4e8b34
mov eax, dword [ebp - 4]
mov dword [ebx + 0x154], eax
mov ax, word [ebp + 8]
mov edx, dword [ebp - 4]
mov dx, word [edx + 8]
mov word [ebp - 6], dx
cmp ax, word [ebp - 6]
jbe 0x4e8af0
movzx eax, ax
push eax
lea edx, [ebp - 0x46]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.004e89ec
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xa]
movzx ecx, ax
lea edx, [ebx + 0xd4]
lea eax, [ebp - 0x46]
call fcn.00402abc
jmp 0x4e8b00
movzx ecx, ax
lea edx, [ebx + 0xd4]
mov eax, esi
call fcn.00402abc
mov dx, word [ebp - 6]
dec edx
test dx, dx
jb 0x4e8b1a
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x36
inc eax
dec dx
jne 0x4e8b11
mov eax, ebx
mov esi, dword [ebp - 4]
call dword [esi + 0xc]
movzx ecx, word [ebp - 6]
lea edx, [ebx + 0xd4]
mov eax, ebx
mov ebx, dword [ebp - 4]
call dword [ebx + 0x14]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e8b4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x4e8bce
mov dx, word [eax + 8]
mov word [esp + 4], dx
mov esi, eax
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
movzx edx, word [esp + 4]
dec edx
test edx, edx
jl 0x4e8b8b
inc edx
lea eax, [ebx + 0xd4]
xor byte [eax], 0x6a
inc eax
dec edx
jne 0x4e8b84
mov esi, dword [ebx + 0x154]
mov eax, ebx
call dword [esi + 0xc]
mov esi, dword [ebx + 0x154]
movzx ecx, word [esp + 4]
lea edx, [ebx + 0xd4]
mov eax, ebx
call dword [esi + 0x14]
mov eax, dword [ebx + 0x154]
mov esi, eax
movzx ecx, word [eax + 0xa]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x14]
mov esi, dword [ebx + 0x154]
mov edx, dword [esp]
mov eax, ebx
call dword [esi + 0x10]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4e8c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e8c46
mov dword [ebp - 0x10], 1
jmp 0x4e8d94
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xa]
test ax, ax
jne 0x4e8c5e
mov dword [ebp - 0x10], 2
jmp 0x4e8d94
xor edx, edx
mov dword [ebp - 0x10], edx
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 4
call fcn.00403270
movzx eax, word [ebp + 8]
dec eax
movzx edx, word [ebp - 0x14]
mov ecx, edx
cdq
idiv ecx
inc eax
test ax, ax
jbe 0x4e8d94
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x20]
call fcn.004e8c0c
lea eax, [ebp - 0xa8]
xor ecx, ecx
mov edx, 0x40
call fcn.00403270
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4e8d5b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 1
mov ax, word [ebp - 0xa]
push eax
lea eax, [ebp - 0x200]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004e8a80
cmp dword [ebp - 0x18], 1
jne 0x4e8d10
movzx ecx, word [ebp + 0x14]
lea eax, [ebp - 0x200]
mov edx, dword [ebp + 0x18]
call fcn.004e8b3c
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x200]
mov ecx, 4
call fcn.004e8b3c
jmp 0x4e8d22
movzx ecx, word [ebp - 0x14]
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.004e8b3c
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x200]
call fcn.004e8b4c
mov cx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x4e8d4f
inc ecx
lea eax, [ebp - 0x68]
lea edx, [ebp - 0xa8]
mov bl, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec cx
jne 0x4e8d44
inc dword [ebp - 0x18]
dec dword [ebp - 0x28]
jne 0x4e8ccd
mov cx, word [ebp - 0x14]
dec ecx
test cx, cx
jb 0x4e8d8a
inc ecx
lea eax, [ebp - 0xa8]
mov dx, word [ebp - 0x12]
cmp dx, word [ebp + 8]
jae 0x4e8d84
mov dl, byte [eax]
mov ebx, dword [ebp - 0x1c]
mov byte [ebx], dl
inc word [ebp - 0x12]
inc dword [ebp - 0x1c]
inc eax
dec cx
jne 0x4e8d6c
dec word [ebp - 0x22]
jne 0x4e8c9e
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4e8e04
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
add edx, 4
dec ecx
jne 0x4e8e0c
mov ecx, 0x40
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x4e8e25
pop ebx
ret
Function at 0x4f0fcc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x53f7fc
test edx, edx
jne 0x4f0feb
xor eax, eax
jmp 0x4f1109
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4f1008
push esi
push edx
push eax
call fcn.004f112c
add esp, 0xc
jmp 0x4f1109
push esi
push edx
push eax
call fcn.004f13ec
add esp, 0xc
jmp 0x4f1109
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f348c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4f34d1
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4f34ae
mov esp, ebp
pop ebp
ret 4
Function at 0x4f5d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00402abc
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x4f5e0f
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x543a1c]
mov edx, 8
call fcn.004f32f0
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x543a1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x543a1c]
mov edx, 0x10
call fcn.004f32f0
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x543a1c]
mov edx, 0x18
call fcn.004f32f0
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x4f5d92
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f8fc8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f9022
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x545758]
cmp byte [eax], 0
je 0x4f8ff2
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x4f900c
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404cc4
mov eax, dword [ebp - 4]
call fcn.00404f5c
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9029
lea eax, [ebp - 4]
call fcn.00404a8c
ret

Function at 0x4f9030
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f908f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x545758]
cmp byte [eax], 0
je 0x4f905e
push esi
push ebx
call sub.kernel32.dll_SetFileAttributesW
mov ebx, eax
jmp 0x4f9079
push esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404cc4
mov eax, dword [ebp - 4]
call fcn.00404f5c
push eax
call sub.kernel32.dll_SetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9096
lea eax, [ebp - 4]
call fcn.00404a8c
ret
Function at 0x4f9110
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f9188
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x545758]
cmp byte [eax], 0
je 0x4f9140
push esi
push ebx
call sub.kernel32.dll_MoveFileW
mov ebx, eax
jmp 0x4f916d
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404cc4
mov eax, dword [ebp - 4]
call fcn.00404f5c
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404cc4
mov eax, dword [ebp - 8]
call fcn.00404f5c
push eax
call sub.kernel32.dll_MoveFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f918f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ab0
ret

Function at 0x4f9438
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.0040814c
cmp ax, 0xffff
jne 0x4f9459
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4f94da
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4f94da
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4f94a0
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x4f9493
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4f94da
cmp dword [ebp + 8], 0
jle 0x4f94da
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00431964
mov esi, eax
test esi, esi
jle 0x4f94d1
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408160
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4f9fdc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4fa040
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404d0c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040a0d8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa047
lea eax, [ebp - 0xc]
call fcn.00404a8c
ret