joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0958
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004a090c
test al, al
jne 0x4a0979
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4a09c7
xor eax, eax
push ebp
push 0x4a09b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a494
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a09be
lea eax, [ebp - 0xc]
call fcn.004a0948
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a11e8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4a1201
xor eax, eax
jmp 0x4a1255
lea eax, [esp + 8]
push eax
push 0x4a125c
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4a1246
xor eax, eax
jmp 0x4a1255
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4a1284
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4a12de
inc esi
xor edi, edi
cmp edi, 1
jne 0x4a12aa
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4a12b8
cmp edi, 1
jle 0x4a12b8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a0958
test eax, eax
jne 0x4a12de
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4a12de
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4a12de
inc edi
dec esi
jne 0x4a129a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4a12e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4a130c
mov eax, dword [ebp - 4]
jmp 0x4a130f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a1314
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4a1361
xor ebx, ebx
jmp 0x4a1356
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041c520
test eax, eax
jne 0x4a1355
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4a140c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a1337
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4a136d
je 0x4a1376
jmp 0x4a137f
call fcn.0049c514
mov esi, eax
jmp 0x4a1381
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4a1381
xor esi, esi
test si, si
je 0x4a140c
xor ebx, ebx
jmp 0x4a13a7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x4a13a6
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a140c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a138e
xor ebx, ebx
jmp 0x4a1401
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x4a1400
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x4a13f5
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004a12e8
push eax
mov eax, esi
call fcn.004a12e8
pop edx
cmp edx, eax
jne 0x4a1400
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a140c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a13b6
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4a17f8
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a18d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a18ec
push ebx
push 0x4a18fc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004077c0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a494
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a187a
mov ax, 0x83
call fcn.004a141c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a17cc
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a1883
call fcn.004a17cc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a18d8
lea eax, [ebp - 4]
call fcn.00409a3c
pop eax
jmp eax
Function at 0x4a19ec
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a1ab5
jmp 0x4a1aa9
cmp dword [esi + 0x10], 0x1000
jne 0x4a1a97
test byte [esi + 0x15], 1
jne 0x4a1a97
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1a48
cmp ebp, 2
je 0x4a1a48
cmp ebp, 0x10
je 0x4a1a48
cmp ebp, 0x20
jne 0x4a1a64
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1a64
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1a75
mov eax, dword [esi]
add eax, ebx
call fcn.004a19e4
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1a68
cmp byte [esp + 4], 0
je 0x4a1a97
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a1ab5
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1a1d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x104f69e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 0xf07
xor edi, edi
mov dword [0x1050d9d0], 0
mov byte [0x1050d9d4], 0
mov dword [0x1050d9c4], 0xf07
mov dword [0x1050d9cc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x104f6a41
mov dword [0x1050d9c8], 0x121b
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
mov bl, dl
add ecx, 0xfffffdcf
mov dword [0x1050d9c8], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x1050d9c4]
mov edx, eax
add edx, 0x256e
mov dword [0x1050d9c4], edx
mov esi, dword [0x1050d9cc]
add esi, 1
mov dword [0x1050d9cc], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], eax
jl 0x104f6a41
jmp 0x104f6b60
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, 0xfffff8dd
mov esi, 0x100
mov dword [0x1050d9d8], 0
mov dword [ebp - 0x30], eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x34], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov ebx, dword [0x1050d9d0]
mov edi, dword [ebp - 0x18]
movzx edi, byte [edi + ecx]
add edi, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x1050d9d8], edi
mov edx, dword [ebp - 0x30]
mov dword [0x1050d9c4], edx
mov eax, edi
cdq
idiv esi
mov dword [0x1050d9d0], edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x1050d9d4], bl
mov dword [0x1050d9c8], 0x18c7
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov dword [0x1050d9c8], 0x1c65
mov bl, byte [0x1050d9d4]
mov ecx, dword [0x1050d9d0]
mov byte [esi + ecx], bl
mov dword [0x1050d9c4], 0xf5e
mov ecx, dword [0x1050d9cc]
add ecx, 1
mov dword [0x1050d9cc], ecx
cmp ecx, 0x100
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
jl 0x104f6a98
jmp 0x104f6a2f
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [0x1050d9cc], 0
add eax, 0xeed
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jmp 0x104f6a98
Function at 0x104f6ce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov dword [0x1050d9c4], 0x2481
call fcn.104f6820
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x104f6d76
jmp 0x104f6e83
mov eax, dword [esp + 0x28]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [esp + 0x24]
add ecx, 0xfffff007
mov dword [0x1050d9c4], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
jne 0x104f6d0e
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
je 0x104f6e21
jmp 0x104f6d0e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
jmp 0x104f6e83
lea eax, [esp + 0x40]
mov dword [0x1050d9c4], 0x1834
mov dword [esp + 0xc], eax
call fcn.104f7160
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x104f6d69
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.104f7840
mov ecx, 0x232c
lea edx, [0x104f8380]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x84], 0x2e2e00
mov esi, dword [0x1050d9b0]
mov dword [esp + 0x88], esi
mov esi, dword [0x1050d9b4]
mov dword [esp + 0x60], esi
mov esi, dword [0x1050d9b8]
mov dword [esp + 0x94], esi
mov esi, dword [0x1050d9bc]
mov dword [esp + 0x44], esi
mov esi, dword [0x1050d9c0]
mov dword [esp + 0x70], esi
mov dword [0x1050d9c4], 0x232c
mov dword [0x1050d9c8], 0x140c
mov dword [esp + 8], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
jmp 0x104f6d34
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x40]
mov dword [esp + 0x80], ecx
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x5c], eax
mov dword [0x1050d9c4], 0xffffede2
mov eax, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.104f7cb0
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x1050d9c4]
add ecx, 0x139d
mov dword [0x1050d9c4], ecx
mov dword [esp + 0x10], eax
jmp 0x104f6d69
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x104f7160
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [0x1050d9c8], 0x1407
mov dword [ebp - 8], 0
mov dword [0x1050d9c4], 0x120f
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x1050d9c4]
add esi, 0xf36
mov dword [0x1050d9c4], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x104f7206
mov eax, dword [ebp - 0x18]
mov dword [0x1050d9c4], 0x1eba
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x104f7267
jmp 0x104f72b8
mov eax, 0xfffffb1d
mov ecx, 1
mov dword [0x1050d9c8], 0xf74
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
je 0x104f721e
jmp 0x104f72b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
je 0x104f71b3
jmp 0x104f7230
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x1050d9c4], ecx
add esp, 0x28
pop esi
pop ebp
ret
mov dword [0x1050d9c8], 0xb1
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jl 0x104f7206
jmp 0x104f71b3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x104f7291
jmp 0x104f72b8
mov dword [0x1050d9c4], 0xbc6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x104f72b8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x104f72ca
jmp 0x104f72b8
mov dword [0x1050d9c4], 0x1b7c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0x10]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x6c
je 0x104f71d8
mov eax, 0x2249
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x104f721e
mov dword [0x1050d9c8], 0x515
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x104f7256
jmp 0x104f72b8
Function at 0x104f7cb0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dl, 0x6b
xor esi, esi
lea edi, [ebp - 0x6c]
lea ebx, [ebp - 0x8c]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], 0x56
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x41
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x63
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0xfb
mov dword [0x1050d9c8], 0x151b
mov byte [ebp - 0x8c], 0x6b
mov byte [ebp - 0x8b], 0x65
mov byte [ebp - 0x8a], 0x72
mov byte [ebp - 0x89], 0x6e
mov byte [ebp - 0x88], 0x65
mov byte [ebp - 0x87], 0x6c
mov byte [ebp - 0x86], 0x33
mov byte [ebp - 0x85], 0x32
mov byte [ebp - 0x84], 0x2e
mov byte [ebp - 0x83], 0x64
mov byte [ebp - 0x82], 0x6c
mov byte [ebp - 0x81], 0x6c
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0xfb
mov dword [0x1050d9c4], 0x2729
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0x9d], dl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], esi
mov eax, dword [ebp - 0xa8]
mov cl, byte [ebp - 0x9d]
movsx edx, cl
mov si, dx
mov word [ebp + eax*2 - 0x6c], si
mov edx, eax
add edx, 1
mov cl, byte [ebp + eax - 0x8b]
cmp cl, 0
mov byte [ebp - 0x9d], cl
mov dword [ebp - 0xa8], edx
je 0x104f7ea0
jmp 0x104f7da4
mov eax, dword [ebp - 0xac]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1050d9c4], 0xd74
mov dword [esp], eax
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [ebp - 0xb0], eax
call fcn.104f72f0
xor eax, eax
mov ecx, dword [ebp - 0xb0]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x98]
mov dword [edx + 0x4c], ecx
mov dword [0x1050d9c4], 0x1249
mov ecx, dword [ebp - 0xb0]
mov dword [edx + 0x28], ecx
mov dword [0x1050d9c8], 0x1711
cmp ecx, 0
mov dword [ebp - 0xb4], eax
je 0x104f7ef8
mov eax, dword [ebp - 0xb0]
add eax, 0x204c
mov dword [0x1050d9c4], 0xffffe59f
mov dword [ebp - 0xb4], eax
jmp 0x104f7ef8
xor eax, eax
lea ecx, [ebp - 0x6c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0xb8], eax
call fcn.104f6570
mov dword [esp], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
call fcn.104f6e90
xor ecx, ecx
mov edx, dword [0x1050d9c8]
add edx, 0x614
mov dword [0x1050d9c8], edx
cmp eax, 0
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], ecx
jne 0x104f7de1
mov eax, dword [ebp - 0xb4]
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x104f7f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1050d9cc], 0
mov dword [0x1050d9d0], 0
mov dword [0x1050d9dc], 0
mov edi, dword [0x1050d9c8]
add edi, 0xfffffa66
mov dword [0x1050d9c4], edi
mov dword [0x1050d9c8], 0x1866
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x104f7fd8
jmp 0x104f7fed
mov eax, dword [0x1050d9cc]
mov ecx, dword [0x1050d9d0]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
jmp 0x104f7ffe
mov eax, dword [0x1050d9c4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffff7c7
mov dword [0x1050d9c8], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], eax
jmp 0x104f7ffe
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x1050d9c8], 0xdea
add ecx, 1
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1050d9cc], edx
mov dword [0x1050d9c4], 0xfffff4c5
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x38]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x1050d9d0], edx
mov dword [0x1050d9c4], 0x1112
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x1050d9d4], cl
mov dword [0x1050d9c4], 0x1f28
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1050d9c8], 0x102d
mov cl, byte [0x1050d9d4]
mov edx, dword [0x1050d9d0]
mov byte [edi + edx], cl
mov dword [0x1050d9c4], 0xd4a
mov edx, dword [0x1050d9cc]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1050d9d0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1050d9dc], ebx
mov dword [0x1050d9c8], 0xfae
mov dword [0x1050d9c4], 0xffffdb4f
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x34]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x24], edx
je 0x104f7fd0
jmp 0x104f7fb7
Function at 0x4045a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040458c
add esp, 0x104
pop ebx
ret

Function at 0x40565c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405695
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
invalid

Function at 0x4056a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4056c9
mov al, byte [esp]
jmp 0x4056cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406a88
Capabilities:
Encode data using xor

Disassembly:
dec eax
and eax, 0x5d509c9b
and dword [0x40c81b], 0x86054dc6
inc edi
call fcn.00405b19
dec edx
add esi, 0xdbc98381
ror edx, 0x12
inc edx
or esi, dword [0x40c271]
rol ebx, 0xe
ror ebx, 0x16
shl esi, 0x11
dec ecx
jne 0x406a66
call fcn.00409db6
mov esi, edi
or esi, dword [0x40c383]
mov ecx, 0x5527f003
add dword [0x40c47c], esi
shl edi, 0x1d
or ebx, ecx
shr edi, 2
dec esi
not esi
sub dword [0x40c7dd], 0xd2514c8c
or edx, dword [0x40c3ca]
dec eax
xchg edi, edx
and edx, eax
shl ebx, 9
xor ebx, dword [0x40c1ce]
xor eax, 0x1be4316d
sub edx, 0x492f2260
inc edx
dec ecx
jne 0x406aad
sub ebx, 0x4590ffda
mov eax, 0x405cb747
sub esi, 0x666f4fbf
xor esi, 0xadaf37ce
and eax, edi
call fcn.004012a9
mov ebx, 0x6d8e08cb

Function at 0x409438
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004093ec
test al, al
jne 0x409459
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4094a5
xor eax, eax
push ebp
push 0x409495
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40949c
lea eax, [ebp - 0xc]
call fcn.00409428
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409978
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4099d2
inc esi
xor edi, edi
cmp edi, 1
jne 0x40999e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4099ac
cmp edi, 1
jle 0x4099ac
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409438
test eax, eax
jne 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4099d2
inc edi
dec esi
jne 0x40998e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8