joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd324
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 0x188], edx
mov dword [ebp - 0x184], eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, dword [ebp - 0x184]
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor ecx, ecx
mov cl, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, dword [ebp - 0x184]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4cd379
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x100]
call fcn.004486f8
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x180]
call fcn.004486f8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cdbe0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 5], 1
je 0x4cdbfb
add dword [ebp - 0xc], 0x20
test byte [ebp - 5], 2
je 0x4cdc05
add dword [ebp - 0xc], 2
test byte [ebp - 5], 4
je 0x4cdc0e
inc dword [ebp - 0xc]
test byte [ebp - 5], 8
je 0x4cdc18
add dword [ebp - 0xc], 4
test byte [ebp - 5], 0x10
je 0x4cdc25
add dword [ebp - 0xc], 0x100
test byte [ebp - 5], 0x20
je 0x4cdc32
add dword [ebp - 0xc], 0x1000
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00448974
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret
Function at 0x4cdc54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dl, byte [0x4cdd40]
mov byte [eax], dl
mov eax, dword [ebp - 4]
call fcn.00448974
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4cdd34
mov eax, dword [ebp - 0x10]
and eax, 0x20
cmp eax, 0x20
jne 0x4cdca1
mov eax, dword [ebp - 8]
mov al, byte [eax]
or al, byte [0x4cdd44]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
and eax, 2
cmp eax, 2
jne 0x4cdcbc
mov eax, dword [ebp - 8]
mov al, byte [eax]
or al, byte [0x4cdd48]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
and eax, 1
dec eax
jne 0x4cdcd5
mov eax, dword [ebp - 8]
mov al, byte [eax]
or al, byte [0x4cdd4c]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
and eax, 4
cmp eax, 4
jne 0x4cdcf0
mov eax, dword [ebp - 8]
mov al, byte [eax]
or al, byte [0x4cdd50]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
and eax, 0x100
cmp eax, 0x100
jne 0x4cdd0f
mov eax, dword [ebp - 8]
mov al, byte [eax]
or al, byte [0x4cdd54]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
and eax, 0x1000
cmp eax, 0x1000
jne 0x4cdd2e
mov eax, dword [ebp - 8]
mov al, byte [eax]
or al, byte [0x4cdd58]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov byte [ebp - 9], 1
jmp 0x4cdd38
mov byte [ebp - 9], 0
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4cf194
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4cf2ba
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
xor eax, eax
call fcn.004cf038
pop ecx
test al, al
je 0x4cf295
mov eax, dword [ebp + 8]
push eax
call fcn.004cee58
pop ecx
test al, al
jne 0x4cf295
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x148]
push eax
call sub.WININET.DLL_HttpSendRequestA
test eax, eax
je 0x4cf295
mov eax, dword [ebp + 8]
push eax
mov eax, 0x13
call fcn.004cee9c
pop ecx
test al, al
je 0x4cf295
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00448704
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00434554
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x190], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x190], 0xc8
je 0x4cf25f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x190], 0xce
jne 0x4cf295
mov eax, dword [ebp + 8]
push eax
mov eax, 5
call fcn.004cee9c
pop ecx
test al, al
je 0x4cf295
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00448704
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00434554
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004cee58
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf2c1
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004484b8
ret
Function at 0x4d1630
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
call fcn.00447a48
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x14], 0
jne 0x4d166b
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
je 0x4d1673
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jne 0x4d1673
mov eax, dword [ebp - 4]
call sym.tripyupdate.exe__Winthread_TEventWinThread_WaitFor_qqrv
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4d1688
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov dl, byte [ebp - 5]
and dl, 0xfc
mov eax, dword [ebp - 4]
call fcn.0044762c
call fcn.004d1464
cmp byte [ebp - 5], 0
jle 0x4d16a9
mov eax, dword [ebp - 4]
call fcn.004479f0
pop ecx
pop ecx
pop ebp
ret

Function at 0x4d17dc
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
pop ecx
pop ebp
ret

Function at 0x4d17fc
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jne 0x4d181b
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 0
pop ecx
pop ebp
ret

Function at 0x4d1944
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x14], 0
je 0x4d1964
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_TerminateThread
mov eax, dword [ebp - 4]
call sym.tripyupdate.exe__Winthread_TEventWinThread_CreateThread_qqrv
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0044763c
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d27cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
mov dword [ebp - 4], eax
mov eax, 0x512a98
call fcn.004f505c
mov dword [ebp - 0x10], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00503970
inc dword [ebp - 0x10]
xor edx, edx
mov word [ebp - 0x1c], 0xc
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x70], edx
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
xor eax, eax
mov dword [ebp - 0x68], eax
xor edx, edx
mov dword [ebp - 0x48], 0x40
mov word [ebp - 0x42], 0
mov dword [ebp - 0x40], edx
lea ecx, [ebp - 0x84]
push ecx
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
cmp dword [ebp - 4], 0
je 0x4d2847
mov edx, dword [ebp - 4]
jmp 0x4d284c
mov edx, 0x512a18
push edx
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4d2881
mov eax, dword [ebp - 0x84]
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x10]
call fcn.005039ac
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x4d28df
call sub.KERNEL32.DLL_GetLastError
push eax
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x18
mov edx, str.Error_executing_command
call fcn.00503938
inc dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [0x519ca8]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x30]
mov ecx, dword [ebp - 4]
call fcn.004d28e4
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005039ac
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x10]
call fcn.005039ac
pop eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x4d4008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, edx
lea edx, [ebp - 4]
push edx
push eax
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.004358e4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d43b0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 3
push 0
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4d441c
push 0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x2d1080
mov edx, dword [ebp - 0xc]
push edx
call sub.KERNEL32.DLL_DeviceIoControl
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d4413
mov ecx, dword [ebp - 0x18]
shl ecx, 8
add ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4d8cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x21c]
push edx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4d8d1e
mov eax, 0xffffff3b
jmp 0x4d8d3f
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x10]
je 0x4d8d35
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
mov eax, 0xffffff3b
jmp 0x4d8d3f
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [edx], ecx
xor eax, eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x4e8284
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jge 0x4e82ce
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, eax
shl eax, 5
add eax, edx
xor edx, edx
mov dl, byte [ecx]
xor eax, edx
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x4e82aa
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4ec374
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x5141a4
call fcn.004f505c
mov word [ebp - 0x18], 0xc
mov edx, 0x514664
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004f0cfc
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4ec3c1
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004ef528
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4ec3c4
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f17f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x515464
call fcn.004f505c
mov word [ebp - 0x18], 0xc
mov edx, 0x5157d4
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004f0cfc
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4f183d
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004ef528
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4f1840
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f5eb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4f5ed0
call fcn.004f7578
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4f5eef
test bl, 1
je 0x4f5eef
call fcn.004fe3a8
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4f60d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004f70f4
test byte [ebp + 0xd], 0xc0
jne 0x4f60f4
mov eax, dword [0x516970]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4f6101
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4f612e
je 0x4f6140
sub ecx, 0x100
je 0x4f614e
sub ecx, 0x100
je 0x4f6155
sub ecx, 0x100
je 0x4f6147
jmp 0x4f615c
sub ecx, 0x600
je 0x4f6155
sub ecx, 0x100
je 0x4f6140
jmp 0x4f615c
mov edi, 1
jmp 0x4f6161
mov edi, 2
jmp 0x4f6161
mov edi, 4
jmp 0x4f6161
mov edi, 5
jmp 0x4f6161
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4f6188
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5163e8]
test al, 0x80
je 0x4f6181
mov ebx, 0x80
jmp 0x4f619a
mov ebx, 1
jmp 0x4f619a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4f619a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4f61ac
je 0x4f61b5
dec eax
je 0x4f61be
jmp 0x4f61c7
mov dword [ebp - 4], SysStringLen
jmp 0x4f61d6
mov dword [ebp - 4], 0x40000000
jmp 0x4f61d6
mov dword [ebp - 4], 0xc0000000
jmp 0x4f61d6
push 1
call fcn.004f750c
pop ecx
mov ebx, eax
jmp 0x4f62c6
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4f61f2
sub eax, 0x10
je 0x4f61f9
sub eax, 0x10
je 0x4f6202
sub eax, 0x10
je 0x4f620b
jmp 0x4f620b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4f6212
mov dword [ebp - 8], 1
jmp 0x4f6212
mov dword [ebp - 8], 2
jmp 0x4f6212
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4f627f
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4f6274
test byte [ebp + 0xd], 1
je 0x4f626f
mov ebx, 0x50
jmp 0x4f6274
mov ebx, 2
push ebx
call fcn.004f750c
pop ecx
mov ebx, eax
jmp 0x4f62c6
mov edi, esi
push edi
call fcn.004f6034
pop ecx
test eax, eax
je 0x4f6293
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4f629f
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004f7234
add esp, 8
mov ebx, eax
inc eax
jne 0x4f62c6
push 4
call fcn.004f750c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004f7128
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fae30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004f4c3c
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004f4d04
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004f4d04
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5176a9
lea ecx, [ebp - 0x200]
push ecx
call fcn.004f4c3c
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004f4d04
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004fc098
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4faf41
push esi
call fcn.004f4d04
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004f4d04
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004f4874
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4faf18
xor eax, eax
jmp 0x4fafc8
push esi
call fcn.004f4d04
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004f4d04
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004f4b94
add esp, 0xc
jmp 0x4faf81
mov edi, dword [ebx + 0x24]
push edi
call fcn.004f4d04
pop ecx
push eax
push esi
call fcn.004f4d04
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004f4d04
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004f4894
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4faf81
xor eax, eax
jmp 0x4fafc8
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004f4c3c
add esp, 8
push 0x5176ab
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004f4c3c
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004f4c3c
add esp, 8
push 0x5176ad
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004f4c3c
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fe33c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x4fe369
jmp 0x4fe3a0
call fcn.004fe2ec
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004f4d04
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004f4d04
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4fe420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x517d84], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4fe4fa
cmp dword [0x517d80], 0
jne 0x4fe4fa
cmp dword [0x517f64], 0
je 0x4fe4b4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004fe198
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4fe49a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004fe198
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4fe49a
lea ebx, [ebp - 0x84]
jmp 0x4fe49b
inc ebx
call fcn.004fe3dc
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4fe535
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x517d88
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004f4d04
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x517d8b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4fe535
cmp dword [0x517d80], 0
je 0x4fe514
cmp dword [0x517d80], 0xffffffff
je 0x4fe535
push esi
call dword [0x517d80]
pop ecx
mov eax, dword [0x517d84]
test eax, eax
je 0x4fe535
cmp dword [0x517d84], 0xffffffff
je 0x4fe535
cmp byte [eax], 0
je 0x4fe535
push esi
push eax
call fcn.004fe33c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1d810c3a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x69a22d1d
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219