joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421f6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
xor edx, edx
mov eax, 6
call fcn.0042b68c
test al, al
je 0x422036
xor edx, edx
mov eax, ebx
call fcn.004236ac
test al, al
je 0x422036
mov eax, ebx
call fcn.00423460
test al, 0x20
je 0x422036
mov eax, ebx
call fcn.0040b390
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x422036
test ah, 4
je 0x422036
test al, 0x10
je 0x421fd3
mov edi, 0x2000000
jmp 0x421fd5
xor edi, edi
push 0
push edi
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.0040b390
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x422036
xor eax, eax
push ebp
push 0x42202f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov ecx, edi
mov eax, dword [ebp - 8]
call fcn.00421cb4
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422036
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42212c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x422185
test eax, edx
je 0x422188
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x422143
movzx eax, word [eax]
sub eax, ecx
jmp 0x42216a
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x42216b
add ecx, 4
js 0x42215b
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x422168
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42216a
xor eax, eax
ret
test eax, eax
je 0x422194
test edx, edx
jne 0x422134
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x42330c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4233ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x4233d0
test edi, edi
je 0x4233d0
xor edx, edx
mov eax, 6
call fcn.0042b68c
test al, al
je 0x4233d0
lea edx, [ebp - 4]
mov eax, edi
call fcn.00423d6c
mov eax, dword [ebp - 4]
call fcn.00423460
test al, 0x20
je 0x4233d0
mov eax, esi
call fcn.00423fbc
test al, al
je 0x423396
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0042bacc
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040b584
mov eax, dword [ebp - 8]
call fcn.0040b390
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x4233a5
mov eax, esi
call fcn.0040b390
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4233b6
test bl, 0x10
je 0x4233b6
mov ebx, 1
jmp 0x4233b8
xor ebx, ebx
push ebx
mov eax, esi
call fcn.0040b390
push eax
mov eax, edi
call fcn.0040b390
push eax
call sub.kernel32.dll_CreateSymbolicLinkW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4233f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a98c
pop eax
jmp eax

Function at 0x423460
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4235b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x423400]
call fcn.0040d524
add esp, 4
push 0x104
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x423430]
call fcn.0040d524
add esp, 4
mov bl, 0
mov dl, 1
mov eax, esi
call fcn.00423744
test al, al
jne 0x4234d6
mov dl, 1
mov eax, esi
call fcn.004236ac
test al, al
je 0x423560
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.00423eac
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.0042bacc
push 0x104
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b390
mov edi, eax
push edi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x42355b
test byte [ebp - 0x14], 1
je 0x423526
or bl, 1
test byte [ebp - 0x14], 2
je 0x42352f
or bl, 2
test byte [ebp - 0x14], 0x80
je 0x423538
or bl, 0x20
push edi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x42354c
dec eax
je 0x423551
dec eax
je 0x423556
dec eax
jne 0x423578
or bl, 0x10
jmp 0x423578
or bl, 4
jmp 0x423578
or bl, 8
jmp 0x423578
call fcn.0042c928
push esi
mov ecx, dword [0x508e64]
mov dl, 1
mov eax, dword [0x41bd04]
call fcn.0042a890
call fcn.00409fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4235bb
lea eax, [ebp - 0x1c]
call fcn.0040a92c
lea eax, [ebp - 0xc]
mov edx, dword [0x423430]
call fcn.0040d648
lea eax, [ebp - 8]
mov edx, dword [0x423400]
call fcn.0040d648
lea eax, [ebp - 4]
call fcn.0040a92c
pop eax
jmp eax
Function at 0x4236ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040b390
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x423716
test ah, 4
je 0x42370f
test bl, bl
jne 0x4236d4
mov al, 1
jmp 0x42373d
test al, 0x10
je 0x4236dc
xor eax, eax
jmp 0x42373d
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x423700
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x42373d
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x42373d
test al, 0x10
sete al
jmp 0x42373d
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x423737
cmp ebx, 3
je 0x423737
cmp ebx, 0x7b
je 0x423737
mov eax, esi
call fcn.0042366c
test al, al
jne 0x42373b
xor eax, eax
jmp 0x42373d
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x423744
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040b390
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4237e2
test esi, 0x400
jne 0x423779
test esi, 0x10
setne bl
jmp 0x4237e2
cmp byte [esp], 0
je 0x4237ad
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x4237e2
push eax
call sub.kernel32.dll_CloseHandle
test esi, 0x10
setne bl
jmp 0x4237e2
test esi, 0x10
je 0x4237b9
mov bl, 1
jmp 0x4237e2
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x4237e0
push eax
call sub.kernel32.dll_CloseHandle
xor ebx, ebx
jmp 0x4237e2
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4239a4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x423a4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b390
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
test edi, 0x400
setne al
test al, bl
je 0x423a2e
or edi, 0xffffffff
lea edx, [ebp - 4]
mov eax, esi
call fcn.00421f6c
test al, al
je 0x423a2e
mov eax, dword [ebp - 4]
call fcn.00423fbc
test al, al
je 0x423a1e
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00423d6c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042bacc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.0040b5dc
mov eax, dword [ebp - 4]
call fcn.0040b390
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423a52
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a98c
pop eax
jmp eax
Function at 0x423a5c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x423b31
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040ad64
cmp byte [ebp - 9], 0
je 0x423aed
mov eax, ebx
call fcn.0040b390
push eax
call sub.kernel32.dll_GetFileAttributesW
test ah, 4
je 0x423aed
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00421f6c
test al, al
je 0x423aed
mov eax, dword [ebp - 8]
call fcn.00423fbc
test al, al
je 0x423ae2
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00423d6c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042bacc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.0040b5dc
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040ad64
push edi
mov eax, dword [ebp - 4]
call fcn.0040b390
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x423b07
call sub.kernel32.dll_GetLastError
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423b38
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a98c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a98c
pop eax
jmp eax

Function at 0x423c70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040b390
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x423cc5
call sub.kernel32.dll_GetLastError
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x423cbf
test ah, 4
je 0x423cbf
test al, 0x10
je 0x423cbf
mov eax, esi
call fcn.0040b390
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x423cc5
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42868c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4286c5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040aac4
jmp 0x4286ce
mov eax, ebx
mov edx, esi
call fcn.0040ad1c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4286d8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4286fc
movzx eax, word [esp]
jmp 0x4286fe
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x429e1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x429f43
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00429c24
mov esi, eax
mov eax, dword [0x508dd4]
cmp byte [eax], 0
je 0x429ee9
mov eax, dword [0x508be0]
call fcn.004080f4
call fcn.0040711c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x429dec]
call fcn.0040d524
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x429f5c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x429f25
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x508b94]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x50c634]
call fcn.0040dab8
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429f4a
lea eax, [ebp - 4]
mov edx, dword [0x429dec]
call fcn.0040d648
pop eax
jmp eax
Function at 0x42b3dc
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x42b41f
mov eax, dword [ebp - 0x10c]
mov dword [0x50c950], eax
mov eax, 0x50c954
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.0040b42c
mov eax, 0x50c958
call fcn.0040a92c
xor eax, eax
mov dword [0x50c95c], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x50c814], 0xa
jl 0x42b575
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x42b580
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x42b575
xor eax, eax
push ebp
push 0x42b56e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42b5dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42b4ce
cmp dword [ebp - 8], 2
jle 0x42b4ce
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42b4a1
adc edx, 0
mov eax, 0x50c958
call fcn.0040b504
lea eax, [ebp - 8]
push eax
mov eax, dword [0x50c958]
call fcn.0040b390
push eax
push 0
push 0
push 0x42b5dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x42b528
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42b5fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42b528
cmp dword [ebp - 8], 2
jle 0x42b528
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42b4fd
adc edx, 0
mov eax, 0x50c958
call fcn.0040b504
lea eax, [ebp - 8]
push eax
mov eax, dword [0x50c958]
call fcn.0040b390
push eax
push 0
push 0
push 0x42b5fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x50c95c
push 0
push 0
push 0x42b610
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x42b555
xor eax, eax
mov dword [0x50c95c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b575
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x503730], 1
mov esp, ebp
pop ebp
ret
Function at 0x42c770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040ae10
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.004106b0
mov edi, eax
cmp edi, 0x104
jbe 0x42c71b
mov eax, edi
add eax, eax
call fcn.00406fa8
mov esi, eax
jmp 0x42c71d
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.004106b0
push esi
call fcn.004134bc
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42c756
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42c740
mov eax, esp
cmp esi, eax
je 0x42c763
mov eax, esi
call fcn.00406fc4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42c79c
cmp bl, 0
je 0x42c798
cmp bl, 0x41
jl 0x42c793
cmp bl, 0x5a
jg 0x42c793
or bl, 0x20
xor al, bl
inc esi
jmp 0x42c777
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42c6dc

Function at 0x42d094
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040b42c
add esp, 0x800
pop ebx
ret
Function at 0x42f8c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42f8e4
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42f8fe
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42f8f9
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42f903
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42f971
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42f9ba
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42f92f
inc dword [ebp - 0xc]
jmp 0x42f947
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42f947
cmp dword [ebp - 0xc], 0
jle 0x42f947
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42f969
xor eax, eax
jmp 0x42f965
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42f964
mov eax, esi
jmp 0x42f9bd
inc eax
cmp eax, ecx
jle 0x42f951
inc esi
cmp esi, dword [ebp - 8]
jl 0x42f91b
jmp 0x42f9ba
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42f9ba
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42f992
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42f9b4
xor eax, eax
jmp 0x42f9b0
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42f9af
mov eax, esi
jmp 0x42f9bd
inc eax
cmp eax, ecx
jle 0x42f99c
inc esi
cmp esi, dword [ebp - 8]
jl 0x42f97a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42fbac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42fbcb
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42fbdb
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42fcfd
test ebx, ebx
jl 0x42fcfd
test esi, esi
jle 0x42fcfd
mov eax, dword [ebp - 8]
call fcn.0040b390
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b390
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42fc9a
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42fcfd
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42fc7f
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42fc4e
inc dword [ebp - 0x14]
jmp 0x42fc5e
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42fc5e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42fc69
or eax, 0xffffffff
jmp 0x42fc7f
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42fc7c
inc eax
jmp 0x42fc7f
or eax, 0xffffffff
test eax, eax
jl 0x42fc87
cmp esi, eax
jg 0x42fc3c
cmp esi, eax
jg 0x42fc92
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42fd00
inc edx
dec dword [ebp - 0x1c]
jne 0x42fc38
jmp 0x42fcfd
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42fcfd
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42fce4
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42fcc3
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42fcce
or eax, 0xffffffff
jmp 0x42fce4
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42fce1
inc eax
jmp 0x42fce4
or eax, 0xffffffff
test eax, eax
jl 0x42fcec
cmp esi, eax
jg 0x42fcac
cmp esi, eax
jg 0x42fcf7
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42fd00
inc edx
dec dword [ebp - 0x1c]
jne 0x42fca8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ed58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43ed60
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4419a4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4419bb
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4419ab
mov eax, ecx
pop ebx
ret
Function at 0x452b24
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x452b38
add esp, 0xfffffff0
call fcn.004090f0
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44cbc0]
call fcn.00470604
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x451b60]
call fcn.004733d4

Function at 0x4bcaa0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4bcae3
cmp byte [ebx + 0x11], 0
jne 0x4bcae3
cmp byte [ebx + 0x24], 0
jne 0x4bcae3
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4bcafa
mov ecx, dword [0x508d88]
mov dl, 1
mov eax, dword [0x48c70c]
call fcn.0042a0a8
call fcn.00409fa4
pop ebx
ret
mov ecx, dword [0x508d88]
mov dl, 1
mov eax, dword [0x48c70c]
call fcn.0042a0a8
call fcn.00409fa4
pop ebx
ret

Function at 0x4bd468
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4bd4b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004bc94c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bd4cf
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bd4d8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004bc94c
dec esi
jne 0x4bd4fa
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4dd918
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x4dd97d
mov eax, dword [esp]
call fcn.004ddc1c
test al, al
je 0x4dd97d
mov eax, dword [esp]
call fcn.004dda28
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x4dd960
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x4dd97d
cmp ax, 0x5a
ja 0x4dd97d
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4e70dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
and eax, 0xff
shr ecx, 8
inc edx
xor ecx, dword [eax*4 + 0x50615c]
cmp edx, 4
mov eax, ecx
jl 0x4e70e4
pop ebp
ret

Function at 0x4e7100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
inc edx
shr eax, 0x18
and eax, 0xff
shl ecx, 8
xor ecx, dword [eax*4 + 0x50655c]
cmp edx, 4
mov eax, ecx
jl 0x4e7108
pop ebp
ret