joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451080
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.004821a0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4511ba
mov eax, dword [ebp - 0x114]
cmp eax, 5
jne 0x4510f0
cmp dword [ebp - 0x110], 1
jne 0x4511ba
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x4511ba
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x451116
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x45112e
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x4511ba
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4511a7
lea ecx, [ebp - 0x118]
push ecx
call eax
test eax, eax
jne 0x4511a7
mov eax, dword [ebp - 0x114]
cmp eax, 6
jne 0x451186
cmp dword [ebp - 0x110], 3
jne 0x4511a7
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x4511a7
cmp dword [ebp - 0x110], 0
jne 0x4511a7
mov eax, 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
or eax, 0xffffffff
call fcn.0047cf45
mov esp, ebp
pop ebp
ret

Function at 0x451460
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 0
mov edi, edx
jne 0x45147b
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004821a0
add esp, 0xc
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x440
jb 0x4514a1
mov esi, dword [esi]
mov dword [ebp - 0x30], esi
call fcn.00451080
test eax, eax
jne 0x4514b1
xor cl, cl
jmp 0x4514b3
mov cl, 1
test cl, cl
mov eax, str.runas
mov edx, 0x4b2b54
cmove eax, edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
jb 0x4514d4
mov edi, dword [edi]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4514f0
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], 0x103
jne 0x451525
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4525d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a7d06
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x4c9860]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
push edi
mov eax, dword [0x4c9860]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.0042bae0
mov dword [esp + 0xc0], 0
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4526b3
lea ecx, [esp + 0x24]
call fcn.00452220
mov byte [esp + 0xc0], 1
lea ecx, [esp + 0xc]
cmp ecx, eax
je 0x45267f
push 0xffffffffffffffff
push 0
push eax
call fcn.0042bae0
mov byte [esp + 0xc0], 0
cmp dword [esp + 0x38], 0x10
jb 0x45269a
push dword [esp + 0x24]
call fcn.0047cf40
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
test esi, esi
je 0x45273e
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push ecx
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xac], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x44], 0x67452301
mov dword [esp + 0x48], 0xefcdab89
mov dword [esp + 0x4c], 0x98badcfe
mov dword [esp + 0x50], 0x10325476
call fcn.00453200
cmp byte [esp + 0xa4], 0
jne 0x452727
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa4], 1
call fcn.004532b0
push ecx
lea eax, [esp + 0x98]
push eax
mov edx, esi
mov ecx, edi
call fcn.004523c0
add esp, 8
mov esi, eax
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x20], 0x10
jb 0x45275c
push dword [esp + 0xc]
call fcn.0047cf40
add esp, 4
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov eax, esi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
Function at 0x452ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4c5908
push 0x486f60
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4c9860]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edx, ecx
mov dword [ebp - 0x20], edx
mov edi, dword [ebp + 8]
mov dword [edi], 0
xor esi, esi
cmp ebx, 4
jl 0x452d25
mov eax, ebx
and eax, 0x80000003
jns 0x452bfc
dec eax
or eax, 0xfffffffc
inc eax
jne 0x452d25
mov dword [ebp - 4], esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
jge 0x452c2c
mov al, byte [ecx + edx]
cmp al, 0x80
jae 0x452d1e
movzx eax, al
cmp byte [eax + 0x4cc020], 0xff
je 0x452d1e
inc ecx
jmp 0x452c07
push ebx
call fcn.0047923b
mov dword [ebp - 0x1c], eax
push ebx
push 0
push eax
call fcn.004821a0
add esp, 0x10
mov edx, dword [ebp - 0x1c]
cmp esi, ebx
jge 0x452cf1
mov ecx, dword [ebp - 0x20]
movzx eax, byte [esi + ecx]
mov dl, byte [eax + 0x4cc020]
inc esi
mov dword [ebp - 0x24], esi
movzx eax, byte [esi + ecx]
mov al, byte [eax + 0x4cc020]
inc esi
mov dword [ebp - 0x24], esi
movzx ecx, al
mov dword [ebp - 0x2c], ecx
shr ecx, 4
and ecx, 3
movzx eax, dl
shl eax, 2
or ecx, eax
mov eax, dword [edi]
mov edx, dword [ebp - 0x1c]
mov byte [edx + eax], cl
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x452cf1
movzx eax, al
mov al, byte [eax + 0x4cc020]
movzx ecx, al
mov eax, ecx
shr eax, 2
and eax, 0xf
mov edx, dword [ebp - 0x2c]
and edx, 0xf
shl edx, 4
or eax, edx
mov edx, dword [ebp - 0x1c]
mov edi, dword [edi]
mov byte [edi + edx], al
mov edi, dword [ebp + 8]
inc dword [edi]
mov eax, dword [ebp - 0x20]
mov al, byte [esi + eax]
inc esi
mov dword [ebp - 0x24], esi
cmp al, 0x3d
je 0x452cf1
movzx eax, al
mov al, byte [eax + 0x4cc020]
and ecx, 3
shl ecx, 6
movzx eax, al
or ecx, eax
mov eax, dword [edi]
mov byte [eax + edx], cl
inc dword [edi]
jmp 0x452c44
mov dword [ebp - 4], 0xfffffffe
mov eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4531a0
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov eax, ecx
ret

Function at 0x4531d0
Capabilities:
Hash data with md5

Disassembly:
mov byte [ecx + 0x68], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x45bb30
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a86b1
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x16c], esi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x170], 0
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x170], 1
mov dword [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x60]
call fcn.004029f0
mov byte [ebp - 4], 2
lea edx, [esi + 0x18]
lea ecx, [ebp - 0x48]
call fcn.0042c070
mov edi, eax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0xf0]
call fcn.0042c070
mov esi, eax
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x16c]
lea ecx, [ebp - 0xd8]
call fcn.0042c070
mov byte [ebp - 4], 5
push eax
push 0x4b7f08
lea eax, [ebp - 0x90]
push eax
call fcn.00422060
add esp, 0xc
mov byte [ebp - 4], 6
push 0x4b7f04
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.00422100
add esp, 0xc
mov byte [ebp - 4], 7
push esi
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.00422390
add esp, 4
mov byte [ebp - 4], 8
push 0x4b7f00
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00422100
add esp, 0xc
mov byte [ebp - 4], 9
push edi
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00422390
add esp, 4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xc0]
call fcn.0040c3a0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x78]
call fcn.0040c3a0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa8]
call fcn.0040c3a0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x90]
call fcn.0040c3a0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xd8]
call fcn.0040c3a0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xf0]
call fcn.0040c3a0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x48]
call fcn.0040c3a0
lea ecx, [ebp - 0x164]
call fcn.004531a0
call fcn.004531d0
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
cmovae eax, dword [ebp - 0x30]
push dword [ebp - 0x20]
push eax
call fcn.00453200
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x164]
call fcn.00453c90
mov byte [ebp - 4], 0x12
push eax
mov ecx, ebx
call fcn.0041cda0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x48]
call fcn.0040c3a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.0040c3a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.0040c340
mov dword [ebp - 4], 0
mov eax, ebx
jmp 0x45bd55
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret 4
Function at 0x45fc00
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8d30
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [0x4cdec4], 0
mov dword [0x4cdec0], 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 0x4cdec4
push 0x4b2968
push 1
push 0
push 0x4b2a38
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0x4cdec4], 0
jne 0x45fc88
mov eax, 0xfffffffd
jmp 0x45fd4d
lea ecx, [ebp - 0x28]
call fcn.0045cff0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x45fc9f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00451360
mov byte [ebp - 4], 1
mov edx, dword [eax]
test edx, edx
je 0x45fcb6
mov edx, dword [edx]
jmp 0x45fcb8
xor edx, edx
mov eax, dword [0x4cdec4]
push 0x4cdec0
mov ecx, dword [eax]
push 0
push 0
push 0x80
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00451400
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x45fcfc
push dword [ebp - 0x28]
call fcn.0047cf40
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp dword [0x4cdec4], eax
jne 0x45fd1f
mov eax, 0xfffffffc
jmp 0x45fd4d
call fcn.0045f790
test eax, eax
jne 0x45fd2f
mov eax, 0xfffffffb
jmp 0x45fd4d
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [0x4cdec0]
call eax
neg eax
sbb eax, eax
and eax, 0xfffffffa
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
Function at 0x461da0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8f0b
mov eax, dword fs:[0]
push eax
mov eax, 0x37e4
call fcn.00490ab0
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
mov dword [ebp - 0x37e8], eax
xor edi, edi
lea ecx, [ebp - 0x37e4]
call fcn.004610c0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x461dfc
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00462690
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x37d0], 0x10
jb 0x461e2b
push dword [ebp - 0x37e4]
call fcn.0047cf40
add esp, 4
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x37d0], 0xf
mov dword [ebp - 0x37d4], 0
mov byte [ebp - 0x37e4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x462009
push 0x2710
xorps xmm0, xmm0
lea eax, [ebp - 0x2ff0]
movq qword [ebp - 0x37cc], xmm0
push 0
push eax
mov dword [ebp - 0x37ec], 0
mov dword [ebp - 0x37c4], 0
mov dword [ebp - 0x37cc], 0
mov dword [ebp - 0x37c8], 0
call fcn.004821a0
add esp, 0xc
lea eax, [ebp - 0x37ec]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2ff0]
push eax
push 0xc
lea eax, [ebp - 0x37cc]
push eax
push 0x2d1400
push esi
call ebx
test eax, eax
je 0x461ffc
mov edx, dword [ebp - 0x2fe4]
lea eax, [ebp - 0x37c0]
push eax
push 0
lea ecx, [ebp - 0x2ff0]
call fcn.00461c40
mov edx, dword [ebp - 0x2fe0]
lea eax, [ebp - 0x8e0]
push eax
push 0
lea ecx, [ebp - 0x2ff0]
call fcn.00461c40
mov edx, dword [ebp - 0x2fdc]
lea eax, [ebp - 0x33d8]
push eax
push 0
lea ecx, [ebp - 0x2ff0]
call fcn.00461c40
mov edx, dword [ebp - 0x2fd8]
lea eax, [ebp - 0x4f8]
push eax
push 1
lea ecx, [ebp - 0x2ff0]
call fcn.00461c40
add esp, 0x20
cmp byte [0x4ce4d8], 0
jne 0x461fc3
mov al, byte [ebp - 0x4f8]
test al, al
je 0x461fc3
cmp al, 0xa
je 0x461fc3
movsx eax, al
push eax
call fcn.0047e179
add esp, 4
test eax, eax
jne 0x461f87
movsx eax, byte [ebp - 0x4e5]
push eax
call fcn.0047e179
add esp, 4
test eax, eax
je 0x461fc3
lea eax, [ebp - 0x4f8]
push eax
push 0x400
push 0x4ce4d8
call fcn.004801a0
add esp, 0xc
lea eax, [ebp - 0x8e0]
push eax
push 0x400
push 0x4ce0d8
call fcn.004801a0
add esp, 0xc
mov dword [ebp - 0x37e8], 1
push 0x2710
lea eax, [ebp - 0x2ff0]
push 0
push eax
call fcn.004821a0
add esp, 0xc
lea eax, [ebp - 0x37ec]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2ff0]
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
jmp 0x462002
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x461de2
mov eax, dword [ebp - 0x37e8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
Function at 0x4623f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x4ab815
push 0x400
push 0x4ce4d8
xor edi, edi
call fcn.004801a0
add esp, 0xc
lea eax, [ebp - 0x120]
push 0x114
push edi
push eax
call fcn.004821a0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x462475
call fcn.00461850
test eax, eax
jne 0x462491
call fcn.00462230
test eax, eax
jne 0x462491
call fcn.00461da0
test eax, eax
jne 0x462491
call fcn.00461a80
jmp 0x462491
xor esi, esi
test edi, edi
jne 0x462491
cmp byte [0x4ce4d8], 0
jne 0x462491
call fcn.00462040
inc esi
mov edi, eax
cmp esi, 0xa
jl 0x462477
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x4ce4d8
pop esi
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
Function at 0x4639f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov edi, edi
mov edx, dword [edi + 0x3c]
sub edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
sub edx, dword [edi + 0x6c]
add eax, 0xfffffefa
add eax, esi
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x463a7c
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00481880
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
add esp, 0xc
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x463a4f
sub eax, esi
jmp 0x463a51
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x463a40
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x463a6f
sub eax, esi
jmp 0x463a71
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x463a60
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x463bb0
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x463aa9
xor eax, eax
jmp 0x463afc
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x463ac6
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00464540
jmp 0x463ade
cmp eax, 2
jne 0x463ae4
mov edx, dword [ebx]
test edx, edx
jne 0x463ad5
xor eax, eax
jmp 0x463ae1
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00463560
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.00481880
mov eax, dword [ebp - 4]
add dword [ebx], eax
add esp, 0xc
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x463b24
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x463b38
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x463a00
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x463bb0
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x463b80
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
push 0
push eax
mov dword [ebp - 8], ecx
call fcn.004821a0
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x463bb0
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
push esi
add eax, edx
push 0
push eax
call fcn.004821a0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f0e9
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004848f1
mov dword [ebp - 0x14], eax
cmp dword [0x4cdc74], edi
jne 0x48f1da
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x48f167
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x48f2ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x48f2ba
push 0x4b0ef8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f2ba
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4cdc74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4cdc78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4cdc7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cdc84], eax
test eax, eax
je 0x48f1d7
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cdc80], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x48f1ff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x48f1f2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x48f214
push 4
pop eax
jmp 0x48f2bc
cmp dword [ebp - 0x14], edi
je 0x48f214
push dword [0x4cdc74]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x48f1f9
mov eax, dword [0x4cdc80]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x48f272
cmp dword [0x4cdc84], esi
je 0x48f272
push eax
call ebx
push dword [0x4cdc84]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x48f272
test eax, eax
je 0x48f272
call ecx
test eax, eax
je 0x48f267
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x48f267
test byte [ebp - 8], 1
jne 0x48f272
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x48f2a2
mov eax, dword [0x4cdc78]
cmp eax, esi
je 0x48f29f
push eax
call ebx
test eax, eax
je 0x48f29f
call eax
mov edi, eax
test edi, edi
je 0x48f29f
mov eax, dword [0x4cdc7c]
cmp eax, esi
je 0x48f29f
push eax
call ebx
test eax, eax
je 0x48f29f
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4cdc74]
call ebx
test eax, eax
je 0x48f2ba
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x48f2bc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047cf45
leave
ret
Function at 0x499ad2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004868c3
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x499b0a
xor eax, eax
jmp 0x499b36
cmp esi, dword [ebp - 4]
je 0x499b33
cmp dword [ebp + 0xc], 0
je 0x499b33
push dword [edi + 0x9c]
call fcn.004996e0
push dword [edi + 0x9c]
mov esi, eax
call fcn.00484cfa
pop ecx
pop ecx
cmp esi, eax
je 0x499b06
xor eax, eax
inc eax
pop edi
pop esi
leave
ret