joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020850
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x105645d8
mov esi, ecx
call fcn.10029de0
movaps xmm1, xmmword [str.eeeeeeeeeeeeeeeewwwwwwwwwwwwwwww]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
xor eax, eax
shl esi, 8
lea ecx, [esi + 0x1004bb10]
pop esi
movups xmm0, xmmword [ecx + eax - 0x10]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x105645d8], xmm0
movups xmm0, xmmword [ecx + eax]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x105645e8], xmm0
add eax, 0x20
cmp eax, 0x100
jb 0x10020881
mov eax, 0x105645d8
ret

Function at 0x10020a70
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov edx, 0xd6
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2f4], eax
xor eax, eax
nop dword [eax]
mov cl, byte [eax + 0x100511c8]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x12
jb 0x10020aa0
lea eax, [ebp - 0x18]
mov byte [ebp - 6], 0
push eax
push 0x3f69966f
lea ecx, [ebp - 0x24]
call fcn.100215c0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x2f8]
mov word [ebp - 8], 0
push eax
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 6], 0
push 0x100
push esi
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x2f4]
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x240], edi
push eax
push esi
mov dword [ebp - 0x2f0], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026898
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10020b90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1016383c]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10020be2
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020be6
cmp edx, esi
jne 0x10020bcb
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10020c06
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020c0a
cmp edx, esi
jne 0x10020bef
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10020c2a
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020c2e
cmp edx, esi
jne 0x10020c13
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021c90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10157cec]
sub esp, 8
push esi
mov esi, dword [0x10157ce8]
cmp esi, eax
je 0x10021d75
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
cmp byte [esi], 2
jne 0x10021cd9
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [esi + 1]
push eax
push connect
call ebx
mov edi, dword [ebp - 8]
test edi, edi
jne 0x10021cea
mov eax, dword [0x10157cec]
add esi, 0x105
cmp esi, eax
jne 0x10021cb2
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x10157cec]
xor ecx, ecx
mov esi, dword [0x10157ce8]
mov eax, 0x7d8c42b3
mov dword [ebp - 4], ecx
mov ecx, ebx
sub ecx, esi
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10021d5d
xor edi, edi
cmp byte [edi + esi], 2
jne 0x10021d37
lea eax, [esi + 1]
add eax, edi
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ebx, dword [0x10157cec]
mov esi, dword [0x10157ce8]
inc dword [ebp - 4]
mov ecx, ebx
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
add edi, 0x105
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 4], eax
jb 0x10021d14
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
push 0
lea ecx, [edx + 6]
call fcn.10004e30
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100334b8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10033337
Function at 0x405784
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4060b8
push 0x4058c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4090cc], 0xffffffff
or dword [0x4090d0], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4090c8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4090c4]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4090d4], eax
call fcn.004058b5
cmp dword [0x408f14], 0
jne 0x405807
push 0x4058b2
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.004058a0
push 0x40700c
push 0x407008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4090c0]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4090bc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x407004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x402928
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404140
test esi, esi
jne 0x40295e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404230
jmp 0x40297c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040283c
mov edi, eax
test esi, esi
je 0x40297c
cmp dword [ebx], 0
je 0x40297c
dec esi
jmp 0x402965
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40352c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x414020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035a4
xor eax, eax
push ebp
push 0x40359d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x414020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x414020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403fc4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x415044], 0
je 0x404025
cmp word [0x415218], 0xd7b2
jne 0x403fed
cmp dword [0x415220], 0
jbe 0x403fed
mov eax, 0x415214
call dword [0x415230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41408c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40404c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41402c], 0
jne 0x404041
push 0
push 0x414084
push 0x41408c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405b38
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b9e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004043b0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402fc4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b88
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ba5
lea eax, [ebp - 0x10]
call fcn.00404140
ret

Function at 0x409d6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409da5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404230
jmp 0x409dae
mov eax, ebx
mov edx, esi
call fcn.00404194
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409db8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409dd9
mov al, byte [esp]
jmp 0x409ddb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a460
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a2d8
mov eax, dword [0x4145a4]
cmp byte [eax], 0
je 0x40a4dc
mov eax, dword [0x4144c0]
call fcn.00402d10
call fcn.0040275c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407720
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a524
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a512
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41449c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415660]
call fcn.00405088
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b1c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b224
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004043b0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407268
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b22b
lea eax, [ebp - 0xc]
call fcn.00404140
ret

Function at 0x412d14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004045dc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x412d6c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x414620]
mov dl, 1
mov eax, dword [0x412838]
call fcn.0040a620
call fcn.00403ba0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00412940
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a60274f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
push ebx
push ebp
mov ecx, dword [ecx + 0x3c]
push esi
push edi
lea eax, [ecx + eax*8]
mov ecx, dword [esp + 0x20]
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov ebx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
add ebx, ecx
mov dword [esp + 0x18], ebx
add edx, ecx
mov ebx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ebx, ecx
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x2c], eax
test eax, eax
je 0x4a6027e2
mov ebp, dword [esp + 0x28]
nop dword [eax + eax]
mov edx, dword [edx + ebx*4]
xor eax, eax
add edx, ecx
xor edi, edi
cmp byte [edx], al
je 0x4a6027b6
nop dword [eax]
inc eax
cmp byte [eax + edx], 0
jne 0x4a6027af
xor esi, esi
test eax, eax
je 0x4a6027d1
nop dword [eax]
movzx ecx, byte [esi + edx]
inc esi
imul edi, ebp
add edi, ecx
cmp esi, eax
jb 0x4a6027bf
mov ecx, dword [esp + 0x20]
cmp edi, dword [esp + 0x24]
je 0x4a6027ec
mov edx, dword [esp + 0x10]
inc ebx
cmp ebx, dword [esp + 0x2c]
jb 0x4a60279f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop edi
pop esi
movzx eax, word [eax + ebx*2]
pop ebp
pop ebx
mov eax, dword [edx + eax*4]
add eax, ecx
add esp, 0xc
ret
Function at 0x4a60289f
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x24
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push edi
mov dword [esp + 0x1c], ecx
mov ebp, dword [ecx]
mov dword [esp + 0x10], ebp
cmp ebp, ecx
je 0x4a602928
mov eax, dword [ebp + 0x30]
xor ebx, ebx
mov dword [esp + 0x20], eax
xor edi, edi
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x4a60290f
mov ebp, dword [esp + 0x20]
mov esi, edx
nop dword [eax]
movzx eax, si
lea edi, [edi + 1]
lea ecx, [eax - 0x41]
add eax, 0x20
movzx edx, ax
cmp cx, 0x19
movzx eax, si
movzx esi, word [ebp + edi*2]
cmova edx, eax
movzx eax, dx
add ebx, eax
test si, si
jne 0x4a6028df
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
lea eax, [ebx + ebx]
cmp eax, 0x8a0
je 0x4a602cb5
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp ebp, ecx
jne 0x4a6028c0
xor ebp, ebp
mov eax, dword [0x4a6c9e84]
push eax
mov eax, dword [0x4a6c9ea4]
push eax
mov eax, dword [0x4a6c9ea8]
push eax
push ebp
call fcn.4a60274f
mov ecx, dword [0x4a6c9ebc]
add esp, 0x10
mov ebx, eax
mov dword [esp + 0x10], ebx
push ecx
push 0
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov ecx, dword [0x4a6c9ebc]
mov esi, eax
push ecx
push esi
call fcn.4a60285f
mov ecx, dword [0x4a6c9e84]
push ecx
mov ecx, dword [0x4a6c9ea4]
mov eax, dword [0x4a6c9ecc]
push ecx
push eax
push ebp
call fcn.4a60274f
add esp, 0x18
push 0x104
push esi
push 0
call eax
mov edi, dword [0x4a6c9eb4]
xor ecx, ecx
cmp word [esi], cx
je 0x4a6029a7
nop
inc ecx
cmp word [esi + ecx*2], 0
jne 0x4a60299f
movzx eax, word [esi + ecx*2 - 2]
lea edx, [esi + ecx*2]
cmp ax, word [0x4a6c9ec8]
je 0x4a6029d5
nop dword [eax]
dec ecx
xor eax, eax
mov word [edx], ax
lea edx, [esi + ecx*2]
movzx eax, word [edx - 2]
cmp ax, word [0x4a6c9ec8]
jne 0x4a6029bf
mov al, byte [edi]
test al, al
je 0x4a6029f1
lea ecx, [esi + ecx*2]
nop
cbw
lea edi, [edi + 1]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [edi]
test al, al
jne 0x4a6029df
mov eax, dword [0x4a6c9e84]
push eax
mov eax, dword [0x4a6c9ea4]
push eax
mov eax, dword [0x4a6c9eb0]
push eax
push ebp
call fcn.4a60274f
add esp, 0x10
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
push esi
call eax
mov ecx, dword [0x4a6c9e84]
mov esi, eax
push ecx
mov ecx, dword [0x4a6c9ea4]
push ecx
mov ecx, dword [0x4a6c9eac]
push ecx
push ebp
call fcn.4a60274f
add esp, 0x10
push 0
push esi
call eax
mov edi, eax
cmp edi, dword [0x4a6c9e84]
jne 0x4a602a54
push 1
call ebx
mov eax, dword [0x4a6c9e98]
push 4
push 0x1000
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov ecx, dword [0x4a6c9e84]
mov ebx, eax
push ecx
mov ecx, dword [0x4a6c9ea4]
push ecx
mov ecx, dword [0x4a6c9ec0]
push ecx
push ebp
call fcn.4a60274f
add esp, 0x10
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x18]
push 0
push ecx
push edi
push ebx
push esi
call eax
test eax, eax
jne 0x4a602aa7
push es
mov ebp, dword [ebp + 0x18]
jmp 0x4a60292a
Function at 0x4a6100b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x4a610154
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.4a60801c
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.4a607b28
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x4a6100de
cmp byte [esp], 0
je 0x4a610123
mov eax, edi
call fcn.4a607b28
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x4a610160
mov eax, edi
call fcn.4a607b28
push eax
mov eax, edi
call fcn.4a607b28
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.4a604a4c
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.4a60801c
jmp 0x4a610160
mov eax, edi
mov edx, 0x4a610174
call fcn.4a6079e4
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a610178
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x4a61021b
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.4a608364
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.4a607b20
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x4a6101a0
cmp byte [esp], 0
je 0x4a6101e9
mov eax, edi
call fcn.4a607b20
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x4a610227
mov eax, edi
call fcn.4a607b20
push eax
mov eax, edi
call fcn.4a607b20
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call fcn.4a604a4c
mov edx, ebx
mov eax, edi
call fcn.4a608364
jmp 0x4a610227
mov eax, edi
mov edx, 0x4a61023c
call fcn.4a607948
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a6113ec
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x4a6c7f64], 0
jne 0x4a611424
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4a61141b
movzx eax, word [esp]
mov word [0x4a6c7f64], ax
jmp 0x4a611424
mov word [0x4a6c7f64], 0x2c
movzx eax, word [0x4a6c7f64]
pop edx
ret
Function at 0x4a6119f8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4a611a00
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a611c12
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x4a611a43
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x4a6c7cf0]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.4a608314
jmp 0x4a611bdf
test ebx, 0xc0000000
je 0x4a611a8b
lea edx, [ebp - 0x10]
mov eax, dword [0x4a6c7f7c]
call fcn.4a611c30
mov eax, dword [ebp - 0x10]
call fcn.4a607ee8
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x4a6c7d60]
call fcn.4a611c30
mov eax, dword [ebp - 0x14]
call fcn.4a607ee8
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_2
test eax, eax
je 0x4a611a8b
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x4a611ad0
cmp ebx, 0xbb7
ja 0x4a611ad0
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x4a6c7f78]
call fcn.4a611c30
mov eax, dword [ebp - 0x18]
call fcn.4a607ee8
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a611ad5
or edi, 0x800
jmp 0x4a611ad5
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a611bd8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x4a611b78
xor eax, eax
push ebp
push 0x4a611b71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.4a6082a4
mov eax, dword [esi]
call fcn.4a607a58
mov ebx, eax
test ebx, ebx
jbe 0x4a611b5a
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x4a611b41
mov eax, esi
call fcn.4a607b20
mov word [eax + ebx*2 - 2], 0x20
jmp 0x4a611b55
cmp di, 0xa
jne 0x4a611b55
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.4a6085f4
dec ebx
test ebx, ebx
ja 0x4a611b24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a611bbb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree_1
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x4a6c7f80]
call fcn.4a611c30
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.4a608314
push dword [ebp - 0x1c]
push 0x4a611c2c
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.4a610b90
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.4a6084c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a611bdf
cmp dword [ebp - 8], 0
je 0x4a611bd7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a611c19
lea eax, [ebp - 0x24]
call fcn.4a607588
lea eax, [ebp - 0x20]
call fcn.4a6075ac
lea eax, [ebp - 0x1c]
call fcn.4a607588
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.4a607618
ret