joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fb66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x41fb75
pop dword [ebp - 0x1c]
mov eax, 0x41fb75
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4fc43
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x46aa
mov esi, eax
mov edx, 0x475e00
add edx, dword [ebp - 0x1c]
mov ebx, 0xfc862c7a
add ebx, 0xe614783f
add dword [ebp - 8], 0x1ba5e0bb
mov edi, dword [edx]
add dword [ebp - 0x18], esi
xor edi, ebx
add dword [ebp - 0xc], edx
mov dword [esi], edi
xor dword [ebp - 0x10], esi
add esi, 0xc486982b
sub esi, 0xc4869827
add edx, 0xa92cad72
add edx, 0x56d35292
loop 0x41fbbe
add eax, 0x6dc5bec5
sub eax, 0x6dc4b14a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x404f26
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x404f35
pop dword [ebp - 8]
mov eax, 0x93c151
sub eax, 0x53721c
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x11f5c785
add dword [ebp - 0x18], 0x3c5c7dc6
mov dword [ebp - 0x14], 0x65921f31
sub dword [ebp - 0x14], 0x335ed2ec
mov dword [ebp - 0x10], 0xedd0d209
sub dword [ebp - 0x10], 0xa1848ddb
mov dword [ebp - 0xc], 0x91c529a6
add dword [ebp - 0xc], 0x6e3ad65a
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x7f497aa9
add dword [ebp - 0x18], 0xf528eead
mov dword [ebp - 0x14], 0x6ae2569
sub dword [ebp - 0x14], 0xc541c3f4
mov dword [ebp - 0x10], 0x98014ad
add dword [ebp - 0x10], 0x59ef57bf
mov dword [ebp - 0xc], 0x92285145
add dword [ebp - 0xc], 0x6dd7aebb
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x84f67bc
add eax, 0xf7f16874
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a341
push 0
call eax
mov ecx, 0x92e01cd7
add ecx, 0x6d2030b5
mov edx, eax
mov esi, 0xab5f39c7
sub esi, 0xab1d29c7
add esi, dword [ebp - 8]
mov ebx, 0x2af418a3
sub dword [ebp - 4], 0x1e57ebf2
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
sub dword [ebp - 4], 0xae77118e
add edx, 4
add esi, 0x3e83d9d2
add esi, 0xc17c2632
loop 0x40504c
add eax, 0xd7301a18
add eax, 0x28d10eeb
mov ebx, eax
add eax, 5
mov ecx, 0x1a7e1b8b
add ecx, 0xe5c1e475
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x40d3d8
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409648
xor eax, eax
push ebp
push 0x40d49a
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a04c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a1fc
mov eax, dword [ebx]
call fcn.0040d280
test al, al
jne 0x40d475
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040a04c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a1fc
mov eax, dword [ebx]
call fcn.0040d280
test al, al
jne 0x40d475
mov eax, ebx
call fcn.00409564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d4a1
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004095c4
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax

Function at 0x40ed54
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x410824
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00410810
add esp, 0x208
pop ebx
ret

Function at 0x41ba5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41bab5
test eax, edx
je 0x41bab8
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41ba73
movzx eax, word [eax]
sub eax, ecx
jmp 0x41ba9a
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41ba9b
add ecx, 4
js 0x41ba8b
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41ba98
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41ba9a
xor eax, eax
ret
test eax, eax
je 0x41bac4
test edx, edx
jne 0x41ba64
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4202bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4202f5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004096ec
jmp 0x4202fe
mov eax, ebx
mov edx, esi
call fcn.00409944
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x420308
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x42032a
movzx eax, word [esp]
jmp 0x42032c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x421340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x421467
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00421148
mov esi, eax
mov eax, dword [0x4c1744]
cmp byte [eax], 0
je 0x42140d
mov eax, dword [0x4c15a4]
call fcn.00407270
call fcn.00406f90
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x421310]
call fcn.0040bf78
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x421480
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x421449
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4c1578]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c5634]
call fcn.0040c368
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42146e
lea eax, [ebp - 4]
mov edx, dword [0x421310]
call fcn.0040c09c
pop eax
jmp eax
Function at 0x4222a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4223a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040998c
lea eax, [ebp - 4]
call fcn.00409af4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x42238c
mov eax, ebx
call fcn.00406e1c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x422385
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42236d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4223b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42236d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42238c
mov eax, dword [ebp - 0x10]
call fcn.00406e38
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4223ab
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax

Function at 0x42508c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4250d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00425020
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4250db
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax

Function at 0x4252f4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42538b
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x42533f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.004096ec
jmp 0x425373
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x425356
lea eax, [ebp - 4]
call fcn.00409564
jmp 0x425369
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004251ac
mov ebx, eax
test esi, esi
je 0x425369
dec esi
jmp 0x425346
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00409944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425392
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax
Function at 0x42539c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041caf4
add esp, 0x208
pop ebx
ret

Function at 0x4253c8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041caf4
add esp, 0x208
pop ebx
ret

Function at 0x425528
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x425660
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x425648
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x425585
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x425648
cmp dword [ebp - 0x14], 0
jne 0x42559a
mov eax, dword [ebp - 0xc]
call fcn.00409564
mov bl, 1
jmp 0x425648
cmp dword [ebp - 0x14], 0x70000000
jb 0x4255a8
call fcn.004214a4
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.004096ec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00409ae4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x42554e
test eax, eax
jne 0x425648
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4255f6
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x425648
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x4255fe
dec esi
test esi, esi
je 0x42560d
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x4255fd
cmp dword [ebp - 0x10], 7
jne 0x425618
test esi, esi
je 0x425618
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040a124
cmp dword [ebp - 0x10], 7
jne 0x42563b
test esi, esi
je 0x42563b
lea eax, [ebp - 4]
call fcn.00409ae4
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00409944
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425667
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax

Function at 0x426c30
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c7d1c
mov eax, esi
mov edx, 8
test al, 1
je 0x426c4c
shr eax, 1
xor eax, 0xedb88320
jmp 0x426c4e
shr eax, 1
dec edx
jne 0x426c3f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x426c38
pop esi
ret
Function at 0x426c64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c7d18], 0
jne 0x426c8e
call fcn.00426c30
mov dword [esp], 0x4c7d18
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x426cb8
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c7d1c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x426c94
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4298b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 9]
mov eax, ebx
call fcn.00429864
test al, al
jne 0x4298d1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x42991f
xor eax, eax
push ebp
push 0x42990f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409fac
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429916
lea eax, [ebp - 9]
call fcn.004298a0
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d1a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46d1b0
mov eax, edx
pop esi
pop ebx
ret

Function at 0x49e00c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x49e05a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0049dad4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e073
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b6120
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b6128
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4b621b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004253f4
mov edx, dword [ebp - 8]
mov ecx, 0x4b6234
xor eax, eax
call fcn.004b6000
push 0
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4b61e7
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x4b6142
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ax, 0x3d
call fcn.00429664
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0041c20c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0042597c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov ax, 0x81
call fcn.00429634
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x417194]
call fcn.004214b0
call fcn.00408c5c
jmp 0x4b6142
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00409944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6222
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004095c4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004095c4
pop eax
jmp eax

Function at 0x4b6248
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
call fcn.00422238
cmp eax, 2
jne 0x4b62b0
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b626b
xor eax, eax
jmp 0x4b62bf
lea eax, [esp + 8]
push eax
push 0x4b62c4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4b62b0
xor eax, eax
jmp 0x4b62bf
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x4b62ec
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4b6346
inc esi
xor edi, edi
cmp edi, 1
jne 0x4b6312
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4b6320
cmp edi, 1
jle 0x4b6320
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004298b0
test eax, eax
jne 0x4b6346
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4b6346
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4b6346
inc edi
dec esi
jne 0x4b6302
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4b6350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4b6374
mov eax, dword [ebp - 4]
jmp 0x4b6377
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b637c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4b63c9
xor ebx, ebx
jmp 0x4b63be
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041bb5c
test eax, eax
jne 0x4b63bd
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4b6474
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b639f
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4b63d5
je 0x4b63de
jmp 0x4b63e7
call fcn.004256a8
mov esi, eax
jmp 0x4b63e9
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4b63e9
xor esi, esi
test si, si
je 0x4b6474
xor ebx, ebx
jmp 0x4b640f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x4b640e
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4b6474
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b63f6
xor ebx, ebx
jmp 0x4b6469
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x4b6468
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x4b645d
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004b6350
push eax
mov eax, esi
call fcn.004b6350
pop edx
cmp edx, eax
jne 0x4b6468
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4b6474
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b641e
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4