joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481e50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405de8
lea eax, [ebp - 0x168]
mov edx, dword [0x4093d4]
call fcn.00406418
xor eax, eax
push ebp
push 0x481ff6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040ade4
test al, al
je 0x481fbf
lea eax, [ebp - 0x16c]
mov ecx, 0x48200c
mov edx, dword [ebp - 4]
call fcn.00405c44
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
mov edx, 0x10
call fcn.0040af98
test eax, eax
jne 0x481fb7
push dword [ebp - 4]
push 0x48201c
push dword [ebp - 0x154]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00405cb8
mov eax, dword [ebp - 0x170]
call fcn.0040ade4
test al, al
je 0x481f5a
mov eax, dword [ebp - 0x154]
mov edx, 0x482028
call fcn.00405d44
je 0x481f99
mov eax, dword [ebp - 0x154]
mov edx, 0x482034
call fcn.00405d44
je 0x481f99
push dword [ebp - 4]
push 0x48201c
push dword [ebp - 0x154]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00405cb8
mov eax, dword [ebp - 0x174]
call fcn.00481e50
jmp 0x481f99
mov edx, dword [ebp - 4]
mov eax, dword [0x593814]
call fcn.00405f3c
dec eax
jne 0x481f99
push dword [ebp - 4]
push 0x48201c
push dword [ebp - 0x154]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00405cb8
mov eax, dword [ebp - 0x178]
call fcn.00405df8
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040afe8
test eax, eax
je 0x481ede
lea eax, [ebp - 0x168]
call fcn.0040b00c
mov eax, dword [ebp - 4]
call fcn.0040b48c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481ffd
lea eax, [ebp - 0x178]
mov edx, 4
call fcn.00405958
lea eax, [ebp - 0x168]
mov edx, dword [0x4093d4]
call fcn.004064e8
lea eax, [ebp - 4]
call fcn.00405934
ret

Function at 0x487bc8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, eax
or ebx, 0xffffffff
mov esi, dword [edi + 4]
mov eax, edi
mov edx, dword [eax]
call dword [edx]
dec eax
test eax, eax
jl 0x487bfe
inc eax
movzx edx, byte [esi]
mov ecx, ebx
and ecx, 0xff
xor edx, ecx
mov edx, dword [edx*4 + 0x58cdf0]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
dec eax
jne 0x487bdf
not ebx
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x48ca1c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x48ca6d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x48ca54
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x48ca44
jmp 0x48ca6d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x48ca55
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499f60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0041b628
mov esi, eax
xor eax, eax
push ebp
push 0x499fda
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x499fbe
mov edx, ebx
mov eax, esi
call fcn.0041b260
test byte [eax + 0x58], 1
je 0x499fb8
push 0
mov edx, ebx
mov eax, esi
call fcn.0041b260
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.0041b14c
dec ebx
cmp ebx, 0xffffffff
jne 0x499f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499fe1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0041b68c
ret

Function at 0x4a360c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407684
mov ebx, 0x6c7324
xor eax, eax
push ebp
push 0x4a375d
push dword fs:[eax]
mov dword fs:[eax], esp
fld qword [ebp + 0x40]
fstp dword [ebx]
wait
fld qword [ebp + 0x38]
fstp dword [ebx + 4]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 8]
wait
mov dword [ebx + 0xc], esi
fld qword [ebp + 0x20]
fstp dword [ebx + 0x10]
wait
fld qword [ebp + 0x18]
fstp dword [ebx + 0x14]
wait
fld qword [ebp + 0x30]
fstp dword [ebx + 0x18]
wait
fld qword [ebp + 0x38]
fstp dword [ebx + 0x1c]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x20]
wait
mov dword [ebx + 0x24], esi
fld qword [ebp + 0x10]
fstp dword [ebx + 0x28]
wait
fld qword [ebp + 0x18]
fstp dword [ebx + 0x2c]
wait
fld qword [ebp + 0x30]
fstp dword [ebx + 0x30]
wait
fld qword [ebp + 0x28]
fstp dword [ebx + 0x34]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x38]
wait
mov dword [ebx + 0x3c], esi
fld qword [ebp + 0x10]
fstp dword [ebx + 0x40]
wait
fld qword [ebp + 8]
fstp dword [ebx + 0x44]
wait
fld qword [ebp + 0x40]
fstp dword [ebx + 0x48]
wait
fld qword [ebp + 0x28]
fstp dword [ebx + 0x4c]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x50]
wait
mov dword [ebx + 0x54], esi
fld qword [ebp + 0x20]
fstp dword [ebx + 0x58]
wait
fld qword [ebp + 8]
fstp dword [ebx + 0x5c]
wait
push 3
push 0xd
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xfc]
push 3
push 0xe
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xfc]
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xf4]
push 0x142
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x130]
push 0x18
push ebx
push 2
push 6
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x120]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3764
lea eax, [ebp - 4]
call fcn.00407610
ret
Function at 0x4a376c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407684
mov ebx, 0x6c7324
xor eax, eax
push ebp
push 0x4a38bd
push dword fs:[eax]
mov dword fs:[eax], esp
fld qword [ebp + 0x60]
fstp dword [ebx]
wait
fld qword [ebp + 0x58]
fstp dword [ebx + 4]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 8]
wait
mov dword [ebx + 0xc], esi
fld qword [ebp + 0x20]
fstp dword [ebx + 0x10]
wait
fld qword [ebp + 0x18]
fstp dword [ebx + 0x14]
wait
fld qword [ebp + 0x50]
fstp dword [ebx + 0x18]
wait
fld qword [ebp + 0x48]
fstp dword [ebx + 0x1c]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x20]
wait
mov dword [ebx + 0x24], esi
fld qword [ebp + 0x10]
fstp dword [ebx + 0x28]
wait
fld qword [ebp + 0x18]
fstp dword [ebx + 0x2c]
wait
fld qword [ebp + 0x40]
fstp dword [ebx + 0x30]
wait
fld qword [ebp + 0x38]
fstp dword [ebx + 0x34]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x38]
wait
mov dword [ebx + 0x3c], esi
fld qword [ebp + 0x10]
fstp dword [ebx + 0x40]
wait
fld qword [ebp + 8]
fstp dword [ebx + 0x44]
wait
fld qword [ebp + 0x30]
fstp dword [ebx + 0x48]
wait
fld qword [ebp + 0x28]
fstp dword [ebx + 0x4c]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x50]
wait
mov dword [ebx + 0x54], esi
fld qword [ebp + 0x20]
fstp dword [ebx + 0x58]
wait
fld qword [ebp + 8]
fstp dword [ebx + 0x5c]
wait
push 3
push 0xd
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xfc]
push 3
push 0xe
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xfc]
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xf4]
push 0x142
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x130]
push 0x18
push ebx
push 2
push 6
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x120]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a38c4
lea eax, [ebp - 4]
call fcn.00407610
ret
Function at 0x4a38cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407684
mov ebx, 0x6c7324
xor eax, eax
push ebp
push 0x4a3a26
push dword fs:[eax]
mov dword fs:[eax], esp
fld qword [ebp + 0x68]
fstp dword [ebx]
wait
fld qword [ebp + 0x60]
fstp dword [ebx + 4]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 8]
wait
mov dword [ebx + 0xc], esi
fld qword [ebp + 0x28]
fstp dword [ebx + 0x10]
wait
fld qword [ebp + 0x20]
fstp dword [ebx + 0x14]
wait
fld qword [ebp + 0x58]
fstp dword [ebx + 0x18]
wait
fld qword [ebp + 0x50]
fstp dword [ebx + 0x1c]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x20]
wait
mov dword [ebx + 0x24], edi
fld qword [ebp + 0x18]
fstp dword [ebx + 0x28]
wait
fld qword [ebp + 0x20]
fstp dword [ebx + 0x2c]
wait
fld qword [ebp + 0x48]
fstp dword [ebx + 0x30]
wait
fld qword [ebp + 0x40]
fstp dword [ebx + 0x34]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x38]
wait
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x3c], eax
fld qword [ebp + 0x18]
fstp dword [ebx + 0x40]
wait
fld qword [ebp + 0x10]
fstp dword [ebx + 0x44]
wait
fld qword [ebp + 0x38]
fstp dword [ebx + 0x48]
wait
fld qword [ebp + 0x30]
fstp dword [ebx + 0x4c]
wait
mov eax, dword [0x58f904]
fld qword [eax]
fstp dword [ebx + 0x50]
wait
mov eax, dword [ebp + 8]
mov dword [ebx + 0x54], eax
fld qword [ebp + 0x28]
fstp dword [ebx + 0x58]
wait
fld qword [ebp + 0x10]
fstp dword [ebx + 0x5c]
wait
push 3
push 0xd
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xfc]
push 3
push 0xe
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xfc]
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xf4]
push 0x142
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x130]
push 0x18
push ebx
push 2
push 6
mov eax, dword [0x58fbe4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0x120]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3a2d
lea eax, [ebp - 4]
call fcn.00407610
ret
Function at 0x4b231c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00405bf4
mov edx, eax
mov eax, ebp
call fcn.00406080
mov eax, dword [esp]
call fcn.00405bf4
mov edi, eax
test edi, edi
jle 0x4b2381
mov ebx, 1
mov eax, ebp
call fcn.00405e50
mov edx, dword [esp]
movzx edx, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x4b234c
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b2388
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.00405bf4
mov edx, eax
mov eax, dword [esp]
call fcn.00406080
mov eax, edi
call fcn.00405bf4
mov ebp, eax
test ebp, ebp
jle 0x4b23e7
mov ebx, 1
mov eax, dword [esp]
call fcn.00405e50
movzx edx, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
movzx eax, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x4b23b7
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b6148
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x58fc90]
cmp dword [eax], 1
sete byte [0x58d558]
cmp byte [0x58d558], 0
je 0x4b61ae
call fcn.004b60bc
cmp ax, 0xa
setae byte [0x58d55c]
call fcn.004b609c
cmp ax, 4
jb 0x4b6186
call fcn.004b60bc
cmp ax, 0x5a
jae 0x4b618a
xor eax, eax
jmp 0x4b618c
mov al, 1
mov byte [0x58d56c], al
push 0
push 0
push 1
push 0x5c
call sub.user32.dll_SystemParametersInfoA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [0x58d580], al
jmp 0x4b62d5
mov byte [0x58d580], 1
mov eax, dword [0x58fc90]
cmp dword [eax], 2
sete byte [0x58d560]
call sub.kernel32.dll_GetVersion
cmp al, 5
jne 0x4b6269
call fcn.004b60bc
test ax, ax
jne 0x4b61f4
mov byte [0x58d564], 1
call fcn.004b60e4
cmp ax, 2
sete byte [0x58d568]
jmp 0x4b6269
mov byte [0x58d570], 1
call fcn.004b60dc
cmp ax, 1
seta byte [0x58d584]
cmp byte [0x58d584], 0
je 0x4b6226
call fcn.004b60e4
cmp ax, 2
sete byte [0x58d57c]
jmp 0x4b6269
call fcn.004b60e4
cmp ax, 3
jne 0x4b623a
mov byte [0x58d574], 1
jmp 0x4b6269
push 0x57
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x4b624e
mov byte [0x58d590], 1
jmp 0x4b6269
push 0x56
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x4b6262
mov byte [0x58d58c], 1
jmp 0x4b6269
mov byte [0x58d578], 1
call sub.kernel32.dll_GetVersion
cmp al, 6
jb 0x4b62d5
mov byte [0x58d588], 1
push 0x4b62d8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x6c7410], eax
cmp dword [0x6c7410], 0
je 0x4b62d5
push 0x4b62e4
mov eax, dword [0x6c7410]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58d594], eax
push 0x4b62fc
mov eax, dword [0x6c7410]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58d598], eax
push 0x4b6314
mov eax, dword [0x6c7410]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58d59c], eax
call fcn.004b6130
ret
Function at 0x4be088
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff6c
imul eax, eax, 0xb
mov edx, dword [0x58d5ac]
lea ebx, [edx + eax*8]
mov eax, dword [ebx + 0x30]
dec eax
test eax, eax
jl 0x4be380
inc eax
mov dword [esp + 0x18], eax
xor esi, esi
Function at 0x4ccdac
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x6c74b4], 0
jne 0x4ccdcf
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4ccd20
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x6c74b4], eax
ret

Function at 0x4d20ac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d20da
mov eax, ebx
call fcn.004d2b60
cmp dword [ebx + 0x40], 0
je 0x4d20d3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d214b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d213d
cmp dword [ebx + 8], 0
je 0x4d20fc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d210e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d213d
cmp dword [ebx + 8], 0
je 0x4d20ef
cmp eax, 3
je 0x4d2121
dec eax
jne 0x4d20ef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d20ef
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d20ef
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d2169
cmp dword [ebx + 0x14], 0xcc
je 0x4d2169
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d2174
pop ebx
ret
Function at 0x4e772c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4e775a
mov eax, ebx
call fcn.004e81d0
cmp dword [ebx + 0x3c], 0
je 0x4e7753
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4e77cb
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4e77bd
cmp dword [ebx + 8], 0
je 0x4e777c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4e778e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4e77bd
cmp dword [ebx + 8], 0
je 0x4e776f
cmp eax, 3
je 0x4e77a1
dec eax
jne 0x4e776f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4e776f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4e776f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4e77e9
cmp dword [ebx + 0x10], 0xcc
je 0x4e77e9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004e77f4
pop ebx
ret

Function at 0x4f1bc8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x6c74f0
test esi, esi
jne 0x4f1be2
xor eax, eax
jmp 0x4f1cd3
cmp dword [ebp], 0
jne 0x4f1bed
call fcn.004f1b58
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4f1cad
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4f1bf9
test edi, edi
jbe 0x4f1cce
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4f1cb1
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50b204
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408d48]
call fcn.00406418
xor eax, eax
push ebp
push 0x50b3a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x58ef68], 0
jne 0x50b25f
mov ecx, dword [0x58f3a4]
mov dl, 1
mov eax, dword [0x4093f4]
call fcn.0040ef9c
call fcn.004052a4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b50
mov eax, ebx
call fcn.004062c8
mov dword [ebp - 0x24], eax
mov esi, 0x50b3b4
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407610
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004062d8
test eax, eax
jle 0x50b348
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x50b334
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405ba4
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x50b2da
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405bbc
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x50b2f0
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405bbc
mov eax, dword [ebp - 0x54]
call fcn.00405df8
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405ba4
mov eax, dword [ebp - 0x58]
call fcn.00405df8
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x50b336
xor eax, eax
test al, al
je 0x50b341
mov ebx, 0x15
jmp 0x50b34d
mov ebx, 0x10
jmp 0x50b34d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x58ef68]
call fcn.0050b088
mov eax, dword [ebp - 4]
call fcn.0050b088
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407628
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b3ac
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405958
lea eax, [ebp - 0xc]
mov edx, dword [0x408d48]
call fcn.004064e8
ret
Function at 0x5437ec
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
mov ecx, eax
mov eax, ecx
mov ebx, 0xfa
cdq
idiv ebx
mov esi, edx
add esi, 6
test esi, esi
jge 0x54380a
add esi, 0x100
mov eax, ecx
mov ecx, 0xfa
cdq
idiv ecx
mov edi, eax
test edi, edi
jge 0x543820
add edi, 0x100
xor ecx, ecx
mov eax, 0x6dce28
mov byte [eax], cl
inc ecx
inc eax
cmp ecx, 0x100
jne 0x543827
xor ecx, ecx
mov eax, 0x6dcf28
mov byte [eax], cl
inc ecx
inc eax
cmp ecx, 0x100
jne 0x54383a
mov ecx, 1
mov eax, ecx
imul esi
add eax, edi
mov ebx, 0xfe
cdq
idiv ebx
mov eax, edx
inc eax
movzx edx, byte [eax + 0x6dce28]
movzx ebx, byte [eax + 0x6dce29]
mov byte [eax + 0x6dce28], bl
mov byte [eax + 0x6dce29], dl
inc ecx
cmp ecx, 0x2711
jne 0x54384b
mov ecx, 1
mov eax, 0x6dce29
movzx edx, byte [eax]
mov byte [edx + 0x6dcf28], cl
inc ecx
inc eax
cmp ecx, 0x100
jne 0x543889
pop edi
pop esi
pop ebx
ret

Function at 0x5449a8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x544acf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [esi + 0x26], 0
jne 0x5449d2
mov bl, 1
jmp 0x544aac
mov eax, dword [0x58f8a4]
cmp byte [eax], 0
je 0x544a06
mov edx, dword [esi + 4]
mov eax, 0x544ae8
call fcn.00405f3c
test eax, eax
jne 0x544aac
mov edx, dword [esi + 4]
mov eax, 0x544af4
call fcn.00405f3c
test eax, eax
jne 0x544aac
mov eax, dword [esi + 0x1c]
sub eax, 1
jb 0x544a1b
je 0x544a22
dec eax
je 0x544a60
dec eax
je 0x544a76
jmp 0x544aac
mov bl, 1
jmp 0x544aac
lea eax, [ebp - 8]
call fcn.00482044
push dword [ebp - 8]
push 0x544ae8
push dword [esi + 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405cb8
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
call fcn.00405df8
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
jmp 0x544aac
mov eax, dword [esi + 4]
call fcn.00405df8
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x544aac
mov eax, dword [0x58f8a4]
cmp byte [eax], 0
jne 0x544aac
push dword [esi + 0x20]
push 0x544ae8
push dword [esi + 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405cb8
mov eax, dword [ebp - 0x10]
call fcn.00405df8
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544ad6
lea eax, [ebp - 0x10]
call fcn.00405934
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405958
ret