joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov byte [ebp - 0xc], cl
mov edx, dword [ebp + 0x10]
sar edx, 8
and edx, 0xff
mov byte [ebp - 0xb], dl
mov eax, dword [ebp + 0x10]
sar eax, 0x10
and eax, 0xff
mov byte [ebp - 0xa], al
mov ecx, dword [ebp + 0x10]
sar ecx, 0x18
and ecx, 0xff
mov byte [ebp - 9], cl
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x471fcd
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov al, byte [ecx]
xor al, byte [ebp + edx - 0xc]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jle 0x471fc2
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x471f8b
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x485083
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
pop dword [esp - 4]
jno 0x4a9324
shl cl, 0x20
jo 0x485095
invalid
jo 0x4a9324
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x4850a3
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x4b72c5
ret
push esi
ja 0x48ef57
xchg bl, ch
xchg ch, bl
jbe 0x4a9333
jecxz 0x4a939a
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.0049d4e5
add byte [eax - 0x627df0fe], ch
retf 0

Function at 0x485145
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
pop dword [esp - 4]
mov edx, dword [ebp + 0x38]
lea esi, [esi + 8]
mul dword [ebp + ebx]
mov dword [ebp + 0x30], eax
xchg esi, edi
xchg edi, esi
mov dword [ebp + 0x38], edx
mov bl, bl
ja 0x4a38c4
jbe 0x48513d
nop
cpuid
ret 0x860f
jbe 0x4a38c4
and byte [eax - 0x73], 0x64
and al, 4
mov cl, byte [ebp + 0xc]
mov dx, word [ebp + 0x10]
push eax
ja 0x49924a
jbe 0x48515c
cli
into
jbe 0x49924a
invalid
mov bx, bx
push esi
mov esi, esi
mov byte [esi + 0xba], cl
shr edi, 0x40
shr esi, 0x40
mov bx, bx
mov byte [esi + 0xbb], 0
shr bp, 0x40
xchg bl, ah
mov bh, bh
xchg ah, bl
mov word [esi + 0xbc], dx
call fcn.004b8275
jmp dword [esi]
Function at 0x48d7cf
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
js 0x492e59
jns 0x48d7db
invalid
jns 0x492e59
sub dl, 0xff
mov ebx, 0x66c98845
xchg esi, edx
xchg dx, si
mov ecx, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
rol byte [ebx], cl
jmp dword [esi]
mov ax, ax
jno 0x49bdf3
jo 0x492e68
cpuid
ret
jo 0x49bdf3
xor al, 0x77
call fcn.0048448c
add esp, 0x24
test ax, ax
jb 0x4a5683
je 0x492eae
jne 0x492e8e
cmp ax, 0x1a
je 0x492eae
jne 0x492e9e
cmp ax, 0xa
jne 0x4a0555
push ebp
jmp fcn.004a0556

Function at 0x48e111
Capabilities:
Check os version

Disassembly:
mov ch, ch
mov eax, dword [esi + 4]
movzx eax, word [ebp + eax]
cmp dx, dx
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x4a7112
jne 0x4a330a
je 0x485193
scasb al, byte es:[edi]
fisubr word [edi + 0xfdb881e]
mov byte [eax], ah
stosd dword es:[edi], eax
add eax, dword [eax]
mov bl, bl
js 0x4bfcbb
mov bp, bp
jns 0x4851a4
stc
insd dword es:[edi], dx
or ah, bl
jns 0x4bfcbb
lea esp, [esp + 4]
jne 0x4af6b8
je 0x48e121
mov word [eax - 0x51], ds
ja 0x49d62c
jbe 0x48e12b
test ecx, 0x1000
jb 0x4c26bd
push ebx
pop ebx
jne 0x492b6e
push eax
pop eax
je 0x49554d
cpuid
nop
ret
popfd
mov ebx, ebx
jmp dword [esi - 4]
jmp 0x485164
shr si, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
cmc
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x4c26b2
jne 0x4a330a
je 0x4af6e7
nop
cpuid
ret
xchg ebx, edi
xchg edi, ebx
mov ecx, dword [esi]
sub cx, 0
add esi, 8
jne 0x495531
je 0x4af704
cpuid
nop
ret
je 0x495531
in al, dx
sub eax, dword [ebx]
pop ds
popfd
shl al, 0x20
jmp dword [esi - 4]
pushal
pop esp
shl esi, 0x20
movzx eax, byte [edi]
popfd
jmp dword [esi - 4]
Function at 0x49035a
Capabilities:
Encode data using xor

Disassembly:
push edi
call esi
pop dword [esp - 4]
shr ah, 0x40
call esi
test eax, eax
jb 0x4b4663
mov dword [0x555fcd], eax
lea edi, [edi]
je 0x4acd0d
shl ch, 0x20
jne 0x49037f
jg 0x4903a7
call fcn.0048bf59
test eax, eax
jb 0x4c1df0
shr edx, 0x40
je 0x496342
jne 0x49039b
nop
cpuid
ret
call fcn.004a4aa5
xor al, 0xa7
mov eax, dword [esi + 4]
mov ah, ah
mov ebx, dword [esi + 8]
mov al, byte [ebp + eax]
js 0x4b4941
jns 0x4903b9
add al, 0x27
jns 0x49493f
jns 0x4b4941
add al, byte [eax]
add byte [eax], al
add ah, ch
sub eax, 0x400049
add byte [eax], al
xor al, 0
add byte [eax], al
lodsd eax, dword [esi]
cli
dec eax
add byte [eax + eax], al
add byte [0x3c004b45], dh
add byte [eax], al
add byte [eax + eax], al
add byte [0x44004b45], dh
add byte [eax], al
add byte [eax + eax], bh
add byte [eax], al
add al, 0x3e
dec ecx
add byte [edx], ch
pop edi
mov dh, 0xbc
dec edx
add byte [eax + eax], al
add byte [eax + eax], al
add byte [edi + edi + 0x49], dl
add byte [esi + 0x70], ah
dec eax
add byte [edx + 0x73], bl
dec edx
add byte [ecx + ecx*2 + 0x633f0049], dl
js 0x4949b2
pop edx
jae 0x4949e1
add byte [esi + 0x70], ah
dec eax
add byte [edx + edi*2], dh
shl bp, 0x20
pop esi
pop ebx
mov word [edx], ax
pop ebp
ret
ret
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
add ebp, 0
test edi, edi
jb 0x4c2707
je 0x4be57b
jne 0x496367
adc eax, 0x5e8768c8
push ebp
add bl, ch
push str.WTSQuerySessionInformationA
jmp 0x49636d
push edi
call esi
mov ebx, eax
test ebx, ebx
jb 0x4c270f
je 0x4be57b
jne 0x496387
nop
cpuid
ret
push str.WTSFreeMemory
js 0x48e973
jns 0x496397
inc esp
jns 0x48e973
jns 0x48e973
invalid
xchg bx, cx
xchg cx, bx
jle 0x4b7c74
jg 0x4b22c4
cpuid
mov ebx, 0x4526ffc3
jmp dword [esi]
xlatb
add byte [eax], al
or byte [eax], 0x63
mov al, 0x4a
add bh, bh
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebp + ecx*2 + 0x26810049], dl
dec edx
add byte [ebx], bl
sti
dec eax
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
imul esp, dword [edx + 0x4000004a], 0
add byte [eax + eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], ah
or byte [eax], 0
add byte [ecx], al
popal
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
push cs
add byte [eax], al
add al, ch
and cl, byte [ebx]
je 0x4b4660
dec edx
add al, al
test byte [eax], cl
xor al, 0xa3
lea esi, [esi + 0xc]
and byte [ebx], al
jb 0x4a204e
mov ch, ch
jmp dword [esi]
cwde
adc cl, byte [edi]
test dword [esi - 0x48], ecx
invalid
xchg ecx, eax
out dx, al
jbe 0x4b22b2
and eax, 0x313e897
std
inc dword [esi - 0x760c7922]
mov dword [ecx + 0x8c4], 0xff816600
invalid
Function at 0x492575
Capabilities:
Check os version

Disassembly:
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x4a75f1
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x4925cb
jbe 0x4925a1
nop
cpuid
ret
xor ecx, ecx
jb 0x4b4108
shr ecx, 0x40
mov cl, byte [eax + 0x4c2e74]
jmp dword [ecx*4 + 0x4c2e6c]
xor eax, eax
jb 0x4b4121
pop ebp
jne 0x494227
mov dx, dx
je 0x4925e3
cpuid
ret
je 0x494227
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
mov cx, cx
jl 0x4a5014
jge 0x492604
nop
cpuid
ret
jmp fcn.004941e8
ret
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x4bf9fc
je 0x4b413a
sub dword [ebx], ecx
inc ecx
je 0x4bf9fc
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x4a11fa
je 0x4b4158
cpuid
ret
je 0x4a11fa
fidiv dword [edx + 0x6b]
mov byte [0x6100004a], al
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
mov cl, 0x8a
dec eax
add byte [edi + 0x38], bl
dec eax
add byte [ebp + ecx*2 + 0x41940049], dl
dec ebx
add byte [eax - 0x6b3c5df1], dl
dec ebp
dec ecx
add byte [esi], cl
sbb ecx, dword [eax + eax - 0x26]
xchg ecx, eax
pop esi
pop ebp
ret
Function at 0x49f9de
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x4a1ebf
je 0x49f9f9
and al, 0xc5
je 0x4a1ebf
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x4a1ec7
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.00492322
shl eax, 0x20
call fcn.004b9c9d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret

Function at 0x49fa70
Capabilities:
Check os version

Disassembly:
sub esp, 0x10
push ebx
push edi
pop edi
push esi
push edi
js 0x49fa45
jns 0x483947
pop ecx
pop edi
jae 0x483957
jns 0x49fa45
mov eax, edi
rol byte [ecx], 0
add eax, 0x2c26ff20
cli
xchg ebx, ebp
shl bh, 0x20
push ebp
mov ebp, esp
jno 0x48392e
jo 0x485abe
nop
cpuid
ret 0x800f
jo 0x48392e
invalid
mov edi, dword [ebp + 0x10]
shl cl, 0x20
mov eax, dword [edi]
ja 0x4a28bb
shr ax, 0x40
jbe 0x49fa5b
push 0xffffffffffffffce
jbe 0x4a28bb
and eax, 0xd289664c
mov edx, dword [ebp + 0x38]
call fcn.004a8906
and eax, 0x24448f81
cld
js 0x4afbcb
xchg ecx, ebp
mov di, di
xchg ebp, ecx
jns 0x49fa87
cpuid
nop
ret
jns 0x4afbcb
invalid
push eax
ja 0x492e45
jbe 0x4a28c7
or dword [edx], 0x78860fe6
add eax, 0x3835ffff
push esp
aas
dec ecx
jbe 0x492e45
xor eax, 0x493f5438
add dh, cl
jbe 0x4a291f
dec ecx
add byte [edx + 0x73], bl
dec edx
add dl, ah
sub byte [edx], cl
mov ebx, 0x735af254
dec edx
add dh, cl
jbe 0x4a2932
add bh, al
jae 0x4a28d5
cmc
jne 0x4a28f1
add byte [ebx - 0x531617bb], cl
aaa
add byte [eax], al
cmp byte [eax], 0xc0
loopne 0x4a291e
add byte [edi], cl
adc byte [edx + 0x38], 0
add byte [ebp + 0x40fd04], cl
add byte [eax], al
xchg ebp, eax
outsb dx, byte [esi]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0x48ca0b
ret
mov al, byte [ebp + 0xb]
mov bl, bl
shl cl, 0x20

Function at 0x49fe77
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
push ebp
ja 0x4abb86
jbe 0x48a062
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x4abb86
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x48a055
jo 0x49fe82
dec edi
xor edi, ecx
jo 0x48a055
xor eax, 0xfbe1e8e0
invalid

Function at 0x4a131f
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
pop dword [esp - 4]
jmp fcn.0048ce43

Function at 0x4a38d0
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.00494e40
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid

Function at 0x4a8906
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
lea esi, [esi + 4]
push 0xd30569ff
mov dword [esp], ebx
pushfd
mov ebx, 0xf597a04e
sub ebx, 0x800edc60
popfd
push eax
pop eax
call fcn.0049a35a
xor eax, 0xee850f71
mov al, 0xfd
push dword [edx + eax - 0x68]
Function at 0x4aadaf
Capabilities:
Check os version

Disassembly:
aad 0x7b
xchg si, dx
xchg dx, si
jne 0x49afb1
je 0x48e644
cpuid
out 0xc3, al
je 0x49afb1
xor al, 0x32
not byte [edi]
mov dl, dl
jmp dword [esi]
pop dword [esp - 4]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ecx, dword [ebp + 0xc]
and bx, bx
cmp ax, ax
xor edx, edx
jb 0x48e630
cmp eax, 0xffffffff
setne dl
mov dword [ecx], eax
mov eax, edx
pop ebp
ret

Function at 0x4abaa6
Capabilities:
Check os version
Encode data using base64
Parse pe header

Disassembly:
je 0x483c97
jne 0x483c91
inc esp
cdq
mov dword [eax], 0x48c
pop edi
pop esi
mov ax, 0x18
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
pop ecx
mov eax, dword [esi + 2]
xor edx, edx
jb 0x4b8f0a
mov dword [ebx], eax
mov cx, word [esi]
mov word [ebx + 8], cx
mov dword [ebx + 4], 0x60
lea edi, [ebx + 0x14]
jmp 0x483cd1
pop dword [esp - 4]
cmp edi, 0x48c
mov dword [ebp + 0x14], 0x48c
jae 0x483ca4
jb 0x49d490
lodsd eax, dword [esi]
sub cl, ch
in eax, 0
add dl, bl
into
jmp 0x4aba88
rcr byte [edx - 2], 1
jmp [edx + 8]
mov eax, dword [ebp + 0x18]
test eax, eax
jb 0x4b8f02
ja 0x483c87
jbe 0x4aba9e
push edx
popal
lea ecx, [edi]
xchg bl, ah
cmp ebp, 0x8f5a05ff
pop dword [esp - 4]
jbe 0x483c87
add eax, 0x24448f5a
cld
lea ecx, [ebp - 0x10]
mov cl, cl
push ecx
lea esi, [esi]
push 0x4b9a10
push 0
push 0x556319
js 0x4c236f
jns 0x4abac9
jl 0x4aba64
dec edi
jns 0x4c236f
add eax, 0x3026fff7
test al, 0x88
in al, 0x8b
jbe 0x4abade
call fcn.004b285d
and eax, 0x86e286df
add byte [0x86e286df], ah
aam 0x8d
jbe 0x4abaec
clc
shr si, 0x40
inc eax
jmp dword [esi]
push esi
call fcn.004cef90
ja 0x498a56
jbe 0x4c2382
sal dword [eax + 0x26], cl
arpl word [edi], cx
xchg dh, cl
std
inc edi
mov al, byte [0x858dc389]
hlt
jbe 0x498a56
invalid
Function at 0x4b0da0
Capabilities:
Check os version

Disassembly:
jle 0x49bf24
xchg bp, ax
xchg bp, ax
jg 0x49bf19
retf 0xa8e8
lea esi, [esi + 8]
shl di, 0x20
jmp dword [esi]
mov esi, dword [esi + 4]
mov esi, dword [ebp + esi]
mov esi, dword [esi]
jmp dword [esi]
ret
push eax
shr ecx, 0x40
push esi
push ebx
movsx ebx, word [0x4baa7f]
pop ebx
push 0x49c677
ret
xor eax, 0x850f5fe6
xchg edx, eax
scasb al, byte es:[edi]
std
push dword [esp + eax + 0x7f]
add esp, eax
je 0x48a851
fmul dword [ebx - 0x683a08c0]
adc ch, byte [eax + edi*2 + 0x38c3f766]
xlatb
jne 0x49da41
je 0x4af9e5
fmul qword [edi]
mov byte [0x56840fc3], al
je 0x49da41
loopne 0x4af9e8
invalid
fnstenv [ebp - 0x71]
inc esp
and al, 0xfc
stosw word es:[edi], ax
lea esi, [esi + 4]
lea ebx, [ebx]
push edi
pop edi
mov dword [ebp + 0x4c], edi
jmp dword [esi]
pop dword [esp - 4]
mov esp, ebp
pop ebp
mov al, al
jne 0x49ddf6
je 0x4b0db4
outsb dx, byte [esi]
pop es
xchg esi, eax
je 0x49ddf6
xor al, 0x6a
ja 0x49bf09
jbe 0x4b0dc8
sbb al, 0x3e
insb byte es:[edi], dx
ja 0x4b0dd8
jbe 0x49bf09
xchg byte [ebx], bh
mov cl, 0xfe
invalid
fnstcw word [ebx + 0x4c481]
add byte [eax], al
xor word [ebp + ebx], ax
jb 0x4b66d2
inc esp
sbb eax, 0xf1820f00
pop eax
add byte [eax], al
jmp dword [esi]
mov ch, 0x25
je 0x4b704f
and eax, 0x4abcb62e
add byte [eax], bh
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebx], cl
push esi
dec eax
add byte [eax], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ebp + ecx*2 + 0x1db40049], dl
dec ecx
add byte [ecx], al
dec ecx
add cl, ah
mov ecx, dword [eax]
xor eax, 0x30004b45
add byte [eax], al
add byte [eax + eax], cl
add byte [0x4c004b45], dh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [edx + 0x26004bb0], dl
dec ebx
add byte [eax + 0x12], al
xchg edx, eax
mov al, 0x4b
add cl, ah
mov ecx, dword [eax]
and eax, 0xe8c68050
sub dh, 0xe8
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x4c2cbc
jne 0x4aab96
je 0x4b6758
and byte [edx], 0x1c
imul esp, dword [esi - 0x77], 0xffffffdb
mov bx, bx
call fcn.004a6e2f
xor al, 0
mov di, di
push 0x4a0709
ret
and eax, 0x24448f97
cld
jmp 0x492adf
add edi, dword [ecx + 0x6870fb5]
popfd
cld
push dword [esi + 4]
jae 0x4c2cdd
leave
pop ebx
jbe 0x48c9cb
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax]
add esi, 8
shr dx, 0x40
shr ax, 0x40
shl eax, cl
add edx, 0xdfcce240
sub edx, 0xdfcce240
add edi, eax
test ecx, 0x80000000
jb 0x4af9b6
add byte [esi - 0x3f], ah
ljmp 0xd340
shl cl, 0x20
jne 0x4aab96
je 0x4c2d11
movsb byte es:[edi], byte [esi]
sahf
and eax, 0x40e9c0ed
shr cl, 0x40
mov ecx, dword [esi]
add esi, 4
test ecx, 0x1000
jb 0x4c05ac
jne 0x49f67d
je 0x4c2d33
or ch, al
sbb cl, byte [edi]
test byte [ecx + ecx*8 - 3], al
invalid
je 0x49f67d
invalid

Function at 0x4b3a71
Capabilities:
Check os version
Parse pe header

Disassembly:
add esp, 4
xor eax, eax
jb 0x4aedb1
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x4a38e6
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x4b3a85
jge 0x4b3ab4
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp fcn.004b332c
Function at 0x4bd45d
Capabilities:
Query environment variable

Disassembly:
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
jb 0x491fdb
xchg bh, dl
xchg dl, bh
js 0x4a5eee
jns 0x48e467
fiadd dword [edi + 0x6a]
sbb cl, ch
xor eax, 0xf70001a7
test al, 0x68
pop ds
or dword [ebx], 0x1910d9c3
rcr byte [esi + 0x25], 2
add byte [eax], al
add byte [edi], cl
sub byte [edx + 0x25], 2
add byte [esi - 0x77], ah
in eax, dx
pop ebx
dec eax
pop ebp
ret
mov bp, bp
mov eax, dword [0x556241]
test eax, eax
jb 0x490820
jne 0x4bd481
je 0x4bd479
dec esp
push ecx
jecxz 0x4bd4b2
mov eax, dword [0x556050]
ret
push 0x58
push 0x555ff8
push 0x556235
shr ah, 0x40
mov dword [0x556241], 0
shl si, 0x20
ja 0x48e449
jbe 0x4bd4aa
nop
cpuid
ret
jbe 0x48e449
mov dword [esi - 0x7f], 0x5176f1
add byte [edi], cl
or byte [esi], 0x9e
cld
dec dword [edi]
test dword [eax], esp
adc ch, bh
jmp dword [esi - 0x77]
Function at 0x4c0050
Capabilities:
Get file size

Disassembly:
add esp, 4
push ebp
mov ebp, esp
js 0x48a826
jns 0x4c005f
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x48a826
fisubr dword [edi - 0x75]
push es
jmp 0x4c006a
push eax
call fcn.004ab70e
jno 0x4bfa0e
jo 0x4c007d
cpuid
test ebx, 0xf98b800f
invalid
jo 0x4bfa0e
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x4c00af

Function at 0x4c2cac
Capabilities:
Check os version
Encode data using base64
Encode data using xor
Parse pe header

Disassembly:
pop dword [esp - 4]
jne 0x4a330a
shl ax, 0x20
je 0x4c2cbf
ja 0x48c9cb
jbe 0x4c2ccb

Function at 0x4c2fac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0x40], 0x6c
mov byte [ebp - 0x3f], 0xb0
mov byte [ebp - 0x3e], 0x4b
mov byte [ebp - 0x3d], 0xa0
mov byte [ebp - 0x3c], 0xad
mov byte [ebp - 0x3b], 0xef
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x38], 0xa3
mov byte [ebp - 0x37], 0x2f
mov byte [ebp - 0x36], 0x90
mov byte [ebp - 0x35], 0xd2
mov byte [ebp - 0x34], 0xb0
mov byte [ebp - 0x33], 0x45
mov byte [ebp - 0x32], 0xa2
mov byte [ebp - 0x31], 0x75
mov byte [ebp - 0x30], 0x85
mov byte [ebp - 0x2f], 0xe8
mov byte [ebp - 0x2e], 0xa3
mov byte [ebp - 0x2d], 0xfb
mov byte [ebp - 0x2c], 0x7b
mov byte [ebp - 0x2b], 0xd4
mov byte [ebp - 0x2a], 0x81
mov byte [ebp - 0x29], 0x38
mov byte [ebp - 0x28], 0xd6
mov byte [ebp - 0x27], 0xf5
mov byte [ebp - 0x26], 0xdc
mov byte [ebp - 0x25], 0xa4
mov byte [ebp - 0x24], 0xba
mov byte [ebp - 0x23], 0x4c
mov byte [ebp - 0x22], pe_nt_image_headers32
mov byte [ebp - 0x21], 0xb9
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x83
mov byte [ebp - 0x1e], 0x8a
mov byte [ebp - 0x1d], 0x7f
mov byte [ebp - 0x1c], 0xa6
mov byte [ebp - 0x1b], 0x18
mov byte [ebp - 0x1a], 0xac
mov byte [ebp - 0x19], 0x17
mov byte [ebp - 0x18], 0xb9
mov byte [ebp - 0x17], 0x88
mov byte [ebp - 0x16], 0x11
mov byte [ebp - 0x15], 0xaa
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x13], 0x47
mov byte [ebp - 0x12], 0xf3
mov byte [ebp - 0x11], 0x76
mov byte [ebp - 0x10], 0x37
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 2
mov byte [ebp - 0xd], 0xa
mov byte [ebp - 0xc], 0x1d
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x9c
mov byte [ebp - 9], 0x69
mov dword [ebp - 8], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
ja 0x4c30c3
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004fb090
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4c3a50
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x4c3a74
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x4c3a8e
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.004d3370
add esp, 0xc
cmp si, 0xfc
jbe 0x4c3ad9
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.004d0160
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x4c3b87
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4c3b09
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4c3b25
jmp 0x4c3c4a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.004d3370
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.004d3370
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x4c3bc1
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x4c3be0
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.004d3350
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.004d01b0
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret