joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422dcc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422ed0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409a98
lea eax, [ebp - 4]
call fcn.00409c00
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a110
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x422eb8
mov eax, ebx
call fcn.00406f40
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x422eb1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a110
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x422e99
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x422ee4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x422e99
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422eb8
mov eax, dword [ebp - 0x10]
call fcn.00406f5c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422ed7
lea eax, [ebp - 4]
call fcn.00409660
pop eax
jmp eax

Function at 0x423720
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00409b40
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f204
mov edi, eax
cmp edi, 0x104
jbe 0x4236cb
mov eax, edi
add eax, eax
call fcn.00406f40
mov esi, eax
jmp 0x4236cd
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f204
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x423706
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4236f0
mov eax, esp
cmp esi, eax
je 0x423713
mov eax, esi
call fcn.00406f5c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42374c
cmp bl, 0
je 0x423748
cmp bl, 0x41
jl 0x423743
cmp bl, 0x5a
jg 0x423743
or bl, 0x20
xor al, bl
inc esi
jmp 0x423727
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42368c

Function at 0x43080c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x430814
mov eax, edx
pop esi
pop ebx
ret
Function at 0x4332e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4332ff
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4332ef
mov eax, ecx
pop ebx
ret
Function at 0x441b17
Capabilities:
Get system information on windows

Disassembly:
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
add al, byte [eax]
inc eax
add byte [ebx + ebp*8], bl
inc ebp
add byte [0x6f727245], al
jb 0x441b31
add byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [ebx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + edx*2], al
add byte [eax], al
or byte [eax], al
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0x53
insb byte es:[edi], dx
add al, byte [eax]
add bh, byte [eax + 0x1004012]
add byte [ebx], al
dec ebp
jae 0x441bb6
add al, byte [eax]
add byte [ecx + edx + 0x40], dl
add byte [edx], al
add byte [esp + eax*2], al
popal
je 0x441bbe
add al, byte [eax]
add al, byte [eax]
inc eax
add byte [eax], ah
mov word [edx], cs
add eax, 0x6f727245
jb 0x441b71
add byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [ebx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + edx*2], al
add byte [eax], al
or byte [eax], al
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0x53
insb byte es:[edi], dx
add al, byte [eax]
add byte [esi + ecx*2 + 0x40], ch
add byte [ecx], al
add byte [ebx], al
dec ebp
jae 0x441bf6
add al, byte [eax]
add byte [ecx + edx + 0x40], dl
add byte [edx], al
add byte [esp + eax*2], al
popal
je 0x441bfe
add al, byte [eax]
add al, byte [eax]
xor al, byte [eax]
and byte [edx + ecx*2 + 0x64410300], cl
add eax, dword fs:[eax]
pushfd
adc byte [eax], al
or byte [eax], al
add cl, byte [eax]
and byte [0x44], 4
push ebx
and eax, 0x44
add al, 0x53
insb byte es:[edi], dx
insb byte es:[edi], dx
add al, byte [eax]
adc bh, ah
or al, 0x44
add byte [ecx], al
add byte [0x756c6156], al
add al, byte gs:[eax]
add al, byte [eax]
cmp byte [eax], al
and byte [edx + ecx*2 + 0x64410800], cl
push edx
popal
outsb dx, byte [esi]
add eax, dword gs:[bx + si]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
and byte [0x44], 4
push ebx
insb byte es:[edi], dx
add al, byte [eax]
push ss
cld
or al, 0x44
add byte [ecx], al
add byte [esi], al
add dword [eax], eax
push es
push esi
popal
insb byte es:[edi], dx
jne 0x441c6b
jae 0x441c0a
add byte [edx], al
add byte [eax + eax], bh
and byte [edx + ecx*2 + 0x64410800], cl
push edx
popal
outsb dx, byte [esi]
add eax, dword gs:[bx + si]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
and byte [0x44], 4
push ebx
insb byte es:[edi], dx
add al, byte [eax]
or bh, byte [esp + edx + 0x10044]
or al, byte [ebx + 0x6f]
insb byte es:[edi], dx
insb byte es:[edi], dx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add al, byte [eax]
add al, byte [eax]
cmp al, 0
and byte [edx + ecx*2 + 0x64410800], cl
push edx
popal
outsb dx, byte [esi]
add eax, dword gs:[bx + si]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
and byte [0x44], 4
push ebx
insb byte es:[edi], dx
add al, byte [eax]
add al, byte [eax]
Function at 0x49053c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x49057f
cmp byte [ebx + 0x11], 0
jne 0x49057f
cmp byte [ebx + 0x24], 0
jne 0x49057f
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x490596
mov ecx, dword [0x4ab804]
mov dl, 1
mov eax, dword [0x46b53c]
call fcn.004220b0
call fcn.00408d58
pop ebx
ret
mov ecx, dword [0x4ab804]
mov dl, 1
mov eax, dword [0x46b53c]
call fcn.004220b0
call fcn.00408d58
pop ebx
ret

Function at 0x490a44
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x490a92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004904b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x490aab
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x490ab4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004904b4
dec esi
jne 0x490ad6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x49af00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x49af48
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0049ae94
mov eax, dword [ebp - 4]
call fcn.0040a110
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49af4f
lea eax, [ebp - 4]
call fcn.00409660
pop eax
jmp eax

Function at 0x49b168
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49b1ff
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x49b1b3
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.004097f8
jmp 0x49b1e7
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x49b1ca
lea eax, [ebp - 4]
call fcn.00409660
jmp 0x49b1dd
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0049b020
mov ebx, eax
test esi, esi
je 0x49b1dd
dec esi
jmp 0x49b1ba
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00409a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b206
lea eax, [ebp - 4]
call fcn.00409660
pop eax
jmp eax

Function at 0x49b210
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041cee0
add esp, 0x208
pop ebx
ret
Function at 0x49b270
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041cee0
add esp, 0x208
pop ebx
ret

Function at 0x49b3c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x49b4fc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x49b4e4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x49b421
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x49b4e4
cmp dword [ebp - 0x14], 0
jne 0x49b436
mov eax, dword [ebp - 0xc]
call fcn.00409660
mov bl, 1
jmp 0x49b4e4
cmp dword [ebp - 0x14], 0x70000000
jb 0x49b444
call fcn.00421fe4
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.004097f8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00409bf0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x49b3ea
test eax, eax
jne 0x49b4e4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x49b492
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x49b4e4
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x49b49a
dec esi
test esi, esi
je 0x49b4a9
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x49b499
cmp dword [ebp - 0x10], 7
jne 0x49b4b4
test esi, esi
je 0x49b4b4
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040a288
cmp dword [ebp - 0x10], 7
jne 0x49b4d7
test esi, esi
je 0x49b4d7
lea eax, [ebp - 4]
call fcn.00409bf0
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00409a50
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b503
lea eax, [ebp - 4]
call fcn.00409660
pop eax
jmp eax
Function at 0x49b630
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov byte [ebp - 1], 0
mov edx, 0x4ab4b8
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x49b802
xor eax, eax
push ebp
push 0x49b7fb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49b80c
push 0x49b838
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.004109d4
mov ebx, eax
test ebx, ebx
je 0x49b6b6
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x49b7e2
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x49b7e2
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x49b707
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x49b6e8
call fcn.00408e4c
jmp 0x49b802
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x49b707
call fcn.00408e4c
jmp 0x49b802
xor eax, eax
push ebp
push 0x49b7db
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x49b74a
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x49b74a
call fcn.00408e4c
call fcn.00408e4c
jmp 0x49b802
mov eax, dword [ebp - 0x14]
call fcn.00406f40
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x49b77f
call fcn.00408e4c
call fcn.00408e4c
jmp 0x49b802
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x49b7ba
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x49b7b6
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x49b7b6
mov byte [ebp - 1], 1
jmp 0x49b7ba
inc ebx
dec esi
jne 0x49b78c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b7e2
mov eax, dword [ebp - 0x18]
call fcn.00406f5c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b802
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49cd54
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4b2884
mov eax, esi
mov edx, 8
test al, 1
je 0x49cd70
shr eax, 1
xor eax, 0xedb88320
jmp 0x49cd72
shr eax, 1
dec edx
jne 0x49cd63
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49cd5c
pop esi
ret

Function at 0x49cd88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4b2880], 0
jne 0x49cdb2
call fcn.0049cd54
mov dword [esp], 0x4b2880
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x49cddc
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4b2884]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x49cdb8
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x49f89c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0049f850
test al, al
jne 0x49f8bd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x49f90b
xor eax, eax
push ebp
push 0x49f8fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a110
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f902
lea eax, [ebp - 0xc]
call fcn.0049f88c
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a012c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4a0145
xor eax, eax
jmp 0x4a0199
lea eax, [esp + 8]
push eax
push 0x4a01a0
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4a018a
xor eax, eax
jmp 0x4a0199
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4a01c8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4a0222
inc esi
xor edi, edi
cmp edi, 1
jne 0x4a01ee
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4a01fc
cmp edi, 1
jle 0x4a01fc
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0049f89c
test eax, eax
jne 0x4a0222
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4a0222
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4a0222
inc edi
dec esi
jne 0x4a01de
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x4a022c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4a0250
mov eax, dword [ebp - 4]
jmp 0x4a0253
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x4a0258
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4a02a5
xor ebx, ebx
jmp 0x4a029a
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041c100
test eax, eax
jne 0x4a0299
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4a0350
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a027b
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4a02b1
je 0x4a02ba
jmp 0x4a02c3
call fcn.0049b860
mov esi, eax
jmp 0x4a02c5
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4a02c5
xor esi, esi
test si, si
je 0x4a0350
xor ebx, ebx
jmp 0x4a02eb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x4a02ea
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a0350
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a02d2
xor ebx, ebx
jmp 0x4a0345
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x4a0344
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x4a0339
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004a022c
push eax
mov eax, esi
call fcn.004a022c
pop edx
cmp edx, eax
jne 0x4a0344
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a0350
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a02fa
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4a073c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0815
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a0830
push ebx
push 0x4a0840
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a3e8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040741c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a110
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a07be
mov ax, 0x83
call fcn.004a0360
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a0710
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a07c7
call fcn.004a0710
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a081c
lea eax, [ebp - 4]
call fcn.00409660
pop eax
jmp eax

Function at 0x4a0930
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a09f9
jmp 0x4a09ed
cmp dword [esi + 0x10], 0x1000
jne 0x4a09db
test byte [esi + 0x15], 1
jne 0x4a09db
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a098c
cmp ebp, 2
je 0x4a098c
cmp ebp, 0x10
je 0x4a098c
cmp ebp, 0x20
jne 0x4a09a8
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a09a8
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a09b9
mov eax, dword [esi]
add eax, ebx
call fcn.004a0928
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a09ac
cmp byte [esp + 4], 0
je 0x4a09db
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a09f9
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a0961
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x20001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 0x2c]
mov esi, 0x20005040
push eax
push esi
mov dword [ebp - 0x2c], 0x3641377b
mov dword [ebp - 0x28], 0x30334644
mov dword [ebp - 0x24], 0x30442d45
mov dword [ebp - 0x20], 0x342d3246
mov dword [ebp - 0x1c], 0x2d663634
mov dword [ebp - 0x18], 0x30463442
mov dword [ebp - 0x14], 0x3446422d
mov dword [ebp - 0x10], 0x44323332
mov dword [ebp - 0xc], 0x30453036
mov dword [ebp - 8], 0x7d37
call sub.MSVCRT.dll_strcpy
pop ecx
mov eax, esi
pop ecx
pop esi
leave
ret