joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495371
Capabilities:
Get geographical location

Disassembly:
push 0x68
mov eax, 0x4ad5e7
call fcn.004a7f93
mov esi, ecx
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
fld qword [ebp + 0xc]
mov dword [ebp - 0x6c], edi
and dword [ebp - 0x64], 0
fmul qword [0x435aa0]
call fcn.0049406c
test al, al
jne 0x4953b0
fadd qword [0x435a00]
call sub.msvcrt.dll__ftol2_sse
mov dword [ebp - 0x60], eax
fild dword [ebp - 0x60]
fld st(0)
call sub.msvcrt.dll__ftol2_sse
mov dword [ebp - 0x60], eax
fild dword [ebp - 0x60]
fstp qword [ebp - 0x74]
fld qword [ebp - 0x74]
fucomp st(1)
fnstsw ax
test ah, 0x44
jnp 0x4953d0
mov bl, 1
jmp 0x4953d2
xor bl, bl
push ecx
push ecx
fstp qword [esp]
movzx eax, bl
push eax
push 0x431014
lea eax, [ebp - 0x5c]
push 0x14
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x18
lea ecx, [ebp - 0x60]
call dword [0x4bb398]
push 0x18
push 0x18
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 1
call dword [sym.imp.MFC42u.dll_CString::GetBufferSetLength]
push eax
xor ecx, ecx
lea eax, [ebp - 0x5c]
push ecx
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
test eax, eax
jg 0x49542d
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x60]
call dword [0x4bb3a0]
test bl, bl
jne 0x49545d
push 8
lea eax, [ebp - 0x24]
push eax
push 0xe
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x60]
call dword [sym.imp.MFC42u.dll_CString::ReverseFind]
test eax, eax
jle 0x49545d
push 0
push eax
lea ecx, [ebp - 0x60]
call dword [sym.imp.MFC42u.dll_CString::SetAt]
mov ecx, edi
call dword [0x4bb398]
mov ebx, dword [esi + 0x27c]
mov dword [ebp - 0x64], 1
test ebx, ebx
je 0x4954ab
mov eax, dword [ebx]
lea ecx, [ebp - 0x68]
push 2
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4bc1e4]
mov ecx, ebx
call esi
mov byte [ebp - 4], 2
push dword [ebp - 0x60]
push dword [eax]
push edi
call dword [sym.imp.MFC42u.dll_CString::Format]
add esp, 0xc
lea ecx, [ebp - 0x68]
call dword [sym.imp.MFC42u.dll_CString::CString]
jmp 0x4954fa
push 8
lea eax, [ebp - 0x34]
push eax
push 0x75
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 0x34]
push dword [ebp - 0x60]
sub eax, 0x30
je 0x4954eb
sub eax, 1
je 0x4954d6
sub eax, 1
je 0x4954e4
sub eax, 1
je 0x4954dd
push 0x43102c
jmp 0x4954f0
push 0x431044
jmp 0x4954f0
push 0x431038
jmp 0x4954f0
push 0x431020
push edi
call dword [sym.imp.MFC42u.dll_CString::Format]
add esp, 0xc
lea ecx, [ebp - 0x60]
call dword [sym.imp.MFC42u.dll_CString::CString]
mov eax, edi
call fcn.004a7f42
ret 0xc
Function at 0x49833b
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x46c
mov eax, 0x4adba4
call fcn.004a7f93
mov edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x418]
push 0x208
xor esi, esi
mov dword [ebp - 0x470], ebx
push esi
push eax
call sub.msvcrt.dll_memset
push 0x60
mov dword [ebp - 0x468], 0x104
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x450], esi
call dword [sym.imp.MFC42u.dll_operatornew]
add esp, 0x10
mov dword [ebp - 0x438], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x4983c4
lea ecx, [edi + 0x1c]
push ecx
mov ecx, eax
call fcn.00498188
mov edi, eax
jmp 0x4983c6
mov edi, esi
lea eax, [ebp - 0x478]
or dword [ebp - 4], 0xffffffff
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x43c]
push eax
push esi
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x498599
cmp dword [ebp - 0x43c], eax
je 0x498596
call fcn.004488da
mov dword [ebp - 0x444], eax
mov byte [eax + 0x2d], 1
mov eax, dword [ebp - 0x444]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x444]
mov dword [eax], eax
mov eax, dword [ebp - 0x444]
mov dword [eax + 8], eax
mov dword [ebp - 0x440], esi
mov eax, esi
mov dword [ebp - 4], 1
mov ebx, esi
mov dword [ebp - 0x44c], esi
cmp dword [ebp - 0x43c], eax
jbe 0x498537
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x46c], 0xff
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x49851e
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x434]
call fcn.00446442
lea eax, [ebp - 0x434]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.004988b9
push esi
push 1
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.004400ed
mov ecx, edi
call fcn.00498dc6
test eax, eax
je 0x4984f7
mov ecx, edi
call fcn.0049823b
test eax, eax
je 0x49851e
lea eax, [ebp - 0x210]
mov dword [ebp - 0x438], ebx
push eax
lea eax, [ebp - 0x438]
inc ebx
push eax
lea ecx, [ebp - 0x448]
call fcn.00499207
mov ecx, eax
call fcn.0043fd52
mov eax, dword [ebp - 0x44c]
inc eax
mov dword [ebp - 0x44c], eax
cmp eax, dword [ebp - 0x43c]
jb 0x498478
test ebx, ebx
je 0x498567
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], esi
push eax
lea ecx, [ebp - 0x448]
call fcn.00499207
push eax
mov ecx, edi
call fcn.004988b9
mov ecx, edi
call fcn.004990a8
inc esi
cmp esi, ebx
jb 0x49853b
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x448]
mov eax, dword [ebp - 0x444]
push eax
push dword [eax]
lea eax, [ebp - 0x438]
push eax
call fcn.0049995d
push dword [ebp - 0x444]
call dword [sym.imp.MFC42u.dll_operatordelete]
pop ecx
xor esi, esi
inc esi
test edi, edi
je 0x4985a5
push ecx
mov ecx, edi
call fcn.00495a80
mov eax, esi
call fcn.004a7f42
ret 4
Function at 0x498be8
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0x438
mov eax, 0x4adca5
call fcn.004a7f93
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
xor edi, edi
push 0x208
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x444], esi
push eax
mov dword [ebp - 0x440], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, esi
push 0x415fa8
call fcn.00446442
push edi
push 0x1a
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
push edi
mov dword [ebp - 0x440], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x498d3b
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0043fd52
push 0x4311e8
mov ecx, esi
call fcn.00499419
push 0xffffffffffffffff
push edi
lea eax, [ebx + 0x1c]
mov ecx, esi
push eax
call fcn.00497b1d
push 0x419cc4
mov ecx, esi
call fcn.00499419
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x498c95
mov eax, dword [edi]
jmp 0x498c97
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x498cfd
cmp dword [esi + 0x18], 8
jb 0x498cad
mov eax, dword [edi]
jmp 0x498caf
mov eax, edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x498cfd
xor ebx, ebx
mov dword [ebp - 0x424], 7
xor eax, eax
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
push 0xffffffffffffffff
xor edi, edi
lea eax, [ebp - 0x43c]
push ebx
inc edi
mov ecx, esi
push eax
mov dword [ebp - 4], edi
call fcn.004401ac
push ebx
push edi
lea ecx, [ebp - 0x43c]
call fcn.004400ed
jmp 0x498d3b
cmp dword [ebx + 0x34], 8
lea eax, [ebx + 0x20]
jb 0x498d08
mov eax, dword [eax]
cmp dword [esi + 0x18], 8
jb 0x498d10
mov edi, dword [edi]
lea ecx, [ebp - 0x420]
push ecx
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x415fa8
mov ecx, esi
call fcn.0043fd52
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
call fcn.00499419
mov eax, esi
call fcn.004a7f42
ret 4
Function at 0x4990a8
Capabilities:
Delete file
Delete registry key

Disassembly:
push 0x5c
mov eax, 0x4addad
call fcn.004a7f93
mov edi, ecx
lea eax, [edi + 0x1c]
mov edx, 0x431180
push eax
lea ecx, [ebp - 0x64]
call fcn.00497e98
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
mov edx, eax
call fcn.00499ff2
pop ecx
push 0
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.004400ed
push 0x415fa8
mov ecx, edi
call fcn.0043fd25
test eax, eax
jne 0x4990fd
xor esi, esi
jmp 0x49919c
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.00497b1d
push 0x4310a4
lea ecx, [ebp - 0x48]
call fcn.00446442
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [edi + 0x48]
call fcn.0049934a
push 0
push 1
lea ecx, [ebp - 0x48]
mov esi, dword [eax]
mov byte [ebp - 4], 2
call fcn.004400ed
cmp esi, dword [edi + 0x4c]
je 0x49917d
push 0x4310a4
lea ecx, [ebp - 0x48]
call fcn.00446442
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x48]
call fcn.00499386
cmp dword [eax + 0x18], 8
lea ecx, [eax + 4]
jb 0x49916a
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004400ed
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x499189
lea eax, [ebp - 0x28]
push eax
push SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x49919c
inc esi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004400ed
mov eax, esi
call fcn.004a7f42
ret
Function at 0x49d060
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 8], ebx
lea esi, [ebx - 0xc]
neg esi
lea eax, [ebx + 4]
sbb esi, esi
and esi, eax
je 0x49d08a
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x8c], 0
je 0x49d213
and dword [ebx + 0x8c], 0
push edi
push dword [ebx + 0x5c]
call sub.msvcrt.dll_free
pop ecx
mov ecx, dword [ebx + 0x6c]
test ecx, ecx
je 0x49d0c3
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebx + 0x6c], 0
mov ecx, dword [ebx + 0x70]
test ecx, ecx
je 0x49d0de
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebx + 0x70], 0
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x49d131
mov edi, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 0x43129c
push eax
mov ecx, dword [edi]
call dword [0x4bc1e4]
call dword [edi]
test eax, eax
js 0x49d131
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x4bc1e4]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x49d12e
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
and dword [ebx + 0x74], 0
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x49d188
mov edi, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 0x43129c
push eax
mov ecx, dword [edi]
call dword [0x4bc1e4]
call dword [edi]
test eax, eax
js 0x49d188
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x4bc1e4]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x49d185
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
and dword [ebx + 0x7c], 0
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x49d1df
mov edi, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 0x43129c
push eax
mov ecx, dword [edi]
call dword [0x4bc1e4]
call dword [edi]
test eax, eax
js 0x49d1df
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x4bc1e4]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x49d1dc
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 0x78]
test ecx, ecx
je 0x49d1fa
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebx + 0x78], 0
cmp dword [ebx + 0x64], 0
pop edi
je 0x49d213
push dword [ebx + 0x64]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebx + 0x64]
call sub.msvcrt.dll_free
pop ecx
test esi, esi
je 0x49d221
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
xor eax, eax
pop ebx
leave
Function at 0x49f8e0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebx
mov ebx, ecx
push esi
lea esi, [ebx - 4]
neg esi
lea eax, [ebx + 4]
sbb esi, esi
and esi, eax
je 0x49f8fe
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x94], 0
je 0x49f9c1
and dword [ebx + 0x94], 0
cmp dword [ebx + 0x9c], 0
je 0x49f925
push 0
lea ecx, [ebx - 4]
call fcn.004a038f
mov ecx, dword [ebx + 0x8c]
push edi
test ecx, ecx
je 0x49f947
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebx + 0x8c], 0
cmp dword [ebx + 0x98], 0
je 0x49f95c
push dword [ebx + 0x90]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebx + 0x90]
call sub.msvcrt.dll_free
push dword [ebx + 0x6c]
call sub.msvcrt.dll_free
push dword [ebx + 0x74]
call sub.msvcrt.dll_free
mov ecx, dword [ebx + 0x84]
add esp, 0xc
test ecx, ecx
je 0x49f99b
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebx + 0x84], 0
mov ecx, dword [ebx + 0x88]
test ecx, ecx
je 0x49f9bc
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x4bc1e4]
call edi
and dword [ebx + 0x88], 0
and dword [ebx + 0x20], 0
pop edi
test esi, esi
je 0x49f9cf
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
xor eax, eax
pop ebx
ret
Function at 0x49fc1d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 8], 0xffffffff
push ebx
push esi
mov ebx, ecx
xor ecx, ecx
mov esi, ebx
mov dword [ebp - 4], ecx
neg esi
mov dword [ebp - 0x10], ecx
push edi
lea eax, [ebx + 8]
mov dword [ebp - 0xc], ecx
sbb esi, esi
mov edi, ecx
and esi, eax
je 0x49fc54
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
cmp dword [ebx + 0x98], ecx
jne 0x49fc66
mov edi, 0x802a0035
jmp 0x49fdeb
mov eax, dword [ebx + 0x94]
test eax, eax
jne 0x49fc7a
mov edi, 0x80004005
jmp 0x49fdf4
cmp dword [ebx + 0x9c], ecx
jne 0x49fdeb
push ecx
push 0x80
push 2
push ecx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x49fcd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x49fccd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x49fdeb
movzx edi, di
or edi, 0x80070000
jmp 0x49fdeb
mov edi, 0x8000ffff
jmp 0x49fdeb
mov eax, dword [ebx]
lea ecx, [ebp - 0xc]
push ecx
push ebx
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x4bc1e4]
call edi
push 1
mov ecx, ebx
call fcn.004a038f
mov edi, eax
test edi, edi
js 0x49fdeb
jmp 0x49fd4d
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x80]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49fd3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x49fd35
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x49fdeb
mov eax, dword [ebp - 4]
add dword [ebx + 0x84], eax
mov eax, dword [ebp - 0x10]
add dword [ebx + 0x80], eax
lea eax, [ebp - 4]
mov ecx, ebx
push eax
call fcn.004a029f
mov eax, dword [ebp - 4]
test eax, eax
jne 0x49fd00
mov eax, dword [ebx + 0x84]
mov edi, eax
sub edi, dword [ebx + 0x30]
neg edi
sbb edi, edi
and edi, 0x802a0021
cmp eax, dword [ebx + 0x30]
jne 0x49fdeb
push 0
mov ecx, ebx
call fcn.004a038f
mov edi, eax
test edi, edi
js 0x49fdeb
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
lea edx, [ebx + 0x90]
mov ecx, dword [ebx + 0x94]
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], eax
call fcn.0049bfda
mov edi, eax
test edi, edi
js 0x49fdeb
mov eax, dword [ebx + 0x90]
lea edx, [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
mov edi, dword [ecx + 0x10]
mov ecx, edi
call dword [0x4bc1e4]
call edi
mov edi, eax
test edi, edi
js 0x49fdeb
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x49fde1
mov edi, 0x80004005
jmp 0x49fdeb
mov dword [ebx + 0x9c], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x49fe02
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a0eba
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4a0f7b
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
sub edi, 1
jne 0x4a0ed4
pop edi
test esi, esi
je 0x4a0f97
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431338]
inc edx
sub esi, 1
jne 0x4a0f7f
not ecx
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x4a1b94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov ebx, dword [edi + 0x24]
mov ecx, dword [edi + 0x6c]
mov esi, dword [edi + 0x34]
mov edx, dword [edi + 0x64]
sub esi, edx
sub esi, ecx
jne 0x4a1bc5
test edx, edx
jne 0x4a1bd2
test ecx, ecx
jne 0x4a1bd2
mov esi, ebx
jmp 0x4a1c54
cmp esi, 0xffffffff
jne 0x4a1bd2
push 0xfffffffffffffffe
pop esi
jmp 0x4a1c54
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, ebx
cmp edx, eax
jb 0x4a1c54
mov ecx, dword [edi + 0x30]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
sub dword [edi + 0x54], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea edx, [eax + ecx*2]
lea edx, [edx - 2]
movzx eax, bx
movzx ecx, word [edx]
mov dword [ebp - 8], eax
mov eax, ecx
sub ecx, dword [ebp - 8]
cmp eax, ebx
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub edi, 1
jne 0x4a1c08
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x38]
mov edi, ebx
lea edx, [eax + ebx*2]
lea edx, [edx - 2]
movzx ecx, word [edx]
mov eax, ecx
sub ecx, dword [ebp - 8]
cmp eax, ebx
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub edi, 1
jne 0x4a1c34
mov edi, dword [ebp - 0xc]
add esi, ebx
mov ecx, dword [edi]
mov dword [ebp - 8], ecx
mov edx, dword [ecx + 4]
test edx, edx
je 0x4a1d13
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x30]
add ecx, eax
mov dword [ebp - 0x14], eax
mov eax, ecx
mov dword [ebp - 4], ecx
add eax, dword [edi + 0x64]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x10], eax
cmp eax, esi
ja 0x4a1c88
mov esi, edx
test esi, esi
jne 0x4a1c91
mov eax, dword [ebp - 0x14]
jmp 0x4a1ccf
mov eax, dword [ecx + 0x1c]
sub edx, esi
mov dword [ecx + 4], edx
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
cmp dword [eax + 0x18], 0
jne 0x4a1cb7
push esi
push edx
push dword [ecx + 0x30]
call fcn.004a3040
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x30], eax
push esi
push edx
push dword [ebp - 4]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [eax], esi
add dword [eax + 8], esi
mov eax, dword [edi + 0x6c]
lea ecx, [eax + esi]
mov dword [ebp - 0x14], ecx
mov dword [edi + 0x6c], ecx
cmp ecx, 3
jb 0x4a1cff
mov edx, dword [edi + 0x30]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx esi, byte [edx + eax]
mov dword [edi + 0x40], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
mov ecx, dword [ebp - 0x14]
xor esi, eax
and esi, dword [edi + 0x4c]
mov dword [edi + 0x40], esi
cmp ecx, 0x106
jae 0x4a1d13
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4a1baa
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a5e5f
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4a5e83
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x4a5ecc
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
mov esi, ebx
neg esi
and esi, edi
lea ecx, [ebx - 1]
mov eax, ecx
and ecx, dword [ebp - 4]
and eax, edi
dec ecx
add eax, ebx
add eax, ecx
div ebx
xor edx, edx
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x4a5eca
xor eax, eax
lock or dword [esi], eax
add esi, ebx
sub ecx, 1
jne 0x4a5ebe
pop esi
pop ebx
pop edi
leave
ret
Function at 0x4a79b0
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x4b4878
call fcn.004a8358
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x4bab78
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4a7785
cmp eax, esi
jne 0x4a7778
xor esi, esi
inc esi
mov edi, esi
jmp 0x4a7788
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a775c
xor esi, esi
inc esi
cmp dword [0x4bab7c], esi
jne 0x4a779a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4a77d4
cmp dword [0x4bab7c], ebx
jne 0x4a77ce
mov dword [0x4bab7c], esi
push 0x4135dc
push 0x4135d0
call fcn.004a790e
pop ecx
pop ecx
test eax, eax
je 0x4a77d4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4a78fe
mov dword [0x4b9c08], esi
cmp dword [0x4bab7c], esi
jne 0x4a77f7
push 0x4135cc
push 0x413528
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4bab7c], 2
test edi, edi
jne 0x4a7804
xor eax, eax
mov ecx, 0x4bab78
xchg dword [ecx], eax
cmp dword [0x4bab88], 0
je 0x4a7830
push 0x4bab88
call fcn.004a81b0
pop ecx
test eax, eax
je 0x4a7830
push ebx
push 2
push ebx
mov esi, dword [0x4bab88]
mov ecx, esi
call dword [0x4bc1e4]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x4a77bd
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x4a789b
test ax, ax
je 0x4a786a
test edx, edx
jne 0x4a789b
test ax, ax
je 0x4a786a
cmp ax, si
ja 0x4a786a
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x4a7855
test byte [ebp - 0x3c], 1
je 0x4a7876
movzx eax, word [ebp - 0x38]
jmp 0x4a7879
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x4b9c04], eax
cmp dword [0x4b9c1c], 0
jne 0x4a78e3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x4a78ac
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x4a7844
cmp dword [0x4b9c08], 0
jne 0x4a78f7
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x4b9c04]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.004a82a5
jmp 0x4a7733

Function at 0x4a80a4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4b4918
call fcn.004a8358
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a8104
cmp eax, 0xffffffff
je 0x4a8104
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4a80fd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4a80fd
cmp edx, 0x10000000
jae 0x4a80fd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4a80fa
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4