joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48add4
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.0048ab88
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x48adf0
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.0048ab88
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.0048ab88
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x48ae0c
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.0048ad68
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x48ae36
mov bl, 1
mov eax, 0x4f12c0
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x48ae6f
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x48ae7c
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x48ae5b
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x48aea6
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.0048abf0
jmp 0x48aecd
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.0048abf0
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x48aed5
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x48ae8e
mov bl, 0x40
mov esi, 0x4f1300
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x48af3b
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x48af48
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x48af24
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0048abb0
inc ebx
inc esi
cmp bl, 0x41
jne 0x48af56
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48bab4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x48bb65
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x48bb60
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.00405838
push 1
mov eax, edi
call fcn.004057cc
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.0048add4
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x492f24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x492f45
inc edi
mov eax, esi
call fcn.00405358
cmp edi, eax
jg 0x492f57
cmp byte [esi + edi - 1], 0x20
je 0x492f44
mov eax, esi
test eax, eax
je 0x492f62
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x493024
cmp byte [esi + edi - 1], 0x2e
je 0x493048
jmp 0x493024
cmp byte [esi + edi - 1], 0x2e
jne 0x492fcc
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x493048
cmp dword [esp + 8], 0xff
jg 0x493048
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x492fb0
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x492fb8
mov bl, 1
jmp 0x492fc6
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x493048
jmp 0x493023
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x492ff1
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x493023
inc edi
mov eax, esi
call fcn.00405358
cmp edi, eax
jg 0x493003
cmp byte [esi + edi - 1], 0x20
je 0x492ff0
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x49301b
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x493048
jmp 0x493033
inc edi
mov eax, esi
call fcn.00405358
cmp edi, eax
jle 0x492f7a
cmp dword [esp + 4], 3
jne 0x493048
cmp dword [esp + 8], 0xff
jg 0x493048
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ad898
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ad9a3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x69c], 0
je 0x4ad8eb
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4ad8eb
inc eax
xor edx, edx
mov ecx, dword [ebp - 0xc]
lea esi, [ecx + edx]
movzx ecx, byte [ebx + 0x69c]
xor byte [esi], cl
inc edx
dec eax
jne 0x4ad8d8
lea edx, [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xd8]
mov esi, eax
mov dl, 9
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x94]
test al, al
je 0x4ad985
inc dword [0x4f17ec]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x44]
mov edx, 8
mov eax, ebx
call fcn.0040c598
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0x11
mov eax, dword [ebx + 0x4b4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x1c], 0
mov eax, dword [0x4f17ec]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x40]
mov ecx, 5
mov eax, 0x4ad9c0
call fcn.0040db14
mov ecx, dword [ebp - 0x10]
mov dl, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x90]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad9aa
lea eax, [ebp - 0x44]
call fcn.00405bd4
lea eax, [ebp - 0x10]
call fcn.00405bd4
ret
Function at 0x4c4488
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.004058d0
cmp byte [ebp - 1], 0
jne 0x4c44e8
mov eax, esi
call fcn.004057cc
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4c4502
sub al, 2
jb 0x4c4509
jmp 0x4c450e
mov ebx, 2
jmp 0x4c450e
mov ebx, 1
mov eax, esi
call fcn.004057cc
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4c45f2
test edi, edi
jle 0x4c456a
mov eax, esi
call fcn.004057cc
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.004057cc
mov byte [eax + ebx - 1], 0
jmp 0x4c45e6
test edi, edi
jge 0x4c45b0
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.004057cc
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4c45e6
mov eax, esi
call fcn.004057cc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.004057cc
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4c4526
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4c4603
sub al, 2
jb 0x4c463d
jmp 0x4c4685
cmp edi, 2
jne 0x4c4609
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4c4685
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.004057cc
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x4f181c]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4c4619
jmp 0x4c4685
cmp edi, 2
jne 0x4c4643
dec ebx
test ebx, ebx
jle 0x4c4680
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.004057cc
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x4f1820]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4c464f
jmp 0x4c4680
inc ebx
mov eax, esi
call fcn.004057cc
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4c4673
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.00405838
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c5d44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bcc
mov eax, dword [ebp + 0x10]
call fcn.00405bcc
mov eax, dword [ebp + 0xc]
call fcn.00405bcc
xor eax, eax
push ebp
push 0x4c5fc6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0040b914
mov edx, dword [ebp - 0x50]
mov eax, 0x4c5fe4
call fcn.00406690
dec eax
jne 0x4c5ddd
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4bb7dc]
call fcn.004bbd0c
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x490220]
call fcn.004a27ac
mov edx, eax
mov esi, dword [ebp - 0xc]
mov eax, esi
call fcn.004c4c70
mov eax, esi
call fcn.004c4c64
call fcn.004a6b9c
jmp 0x4c5dee
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ba8ec]
call fcn.004bbd0c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c5f8a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f1830], 0
je 0x4c5e5b
mov eax, dword [ebp - 0xc]
add eax, 0x90
mov edx, dword [0x4f1830]
call fcn.00405be4
lea edx, [ebp - 0x54]
mov eax, dword [0x4f1834]
call fcn.0040c364
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0xc]
add eax, 0x94
call fcn.00405be4
mov eax, dword [ebp - 0xc]
add eax, 0xa8
mov edx, dword [0x4f1838]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
add eax, 0xac
mov edx, dword [0x4f183c]
call fcn.00405be4
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.004035d8
push 0x20
lea eax, [ebp - 0x4c]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 8]
lea edx, [ebp - 0x4c]
mov ecx, 0x20
call fcn.00405dcc
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.004035d8
push 0x20
lea eax, [ebp - 0x4c]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
push dword [ebp - 8]
push 0x4c6004
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x4c]
mov ecx, 0x20
call fcn.00405dcc
push dword [ebp - 0x58]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406184
push 0
push 0
mov eax, ebx
call fcn.00425484
cmp dword [ebp + 0xc], 0
je 0x4c5ef6
mov eax, dword [ebp - 0xc]
add eax, 0xfc
mov edx, dword [ebp + 0xc]
call fcn.00405be4
cmp dword [ebp + 0x10], 0
je 0x4c5f0c
mov eax, dword [ebp - 0xc]
add eax, 0x16c
mov edx, dword [ebp + 0x10]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 0x37c], edx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1a0], ebx
mov eax, dword [ebp - 0xc]
add eax, 0x118
mov edx, dword [ebp - 8]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
add eax, 0xec
mov edx, dword [ebp - 4]
call fcn.00405be4
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x188], edi
xor eax, eax
push ebp
push 0x4c5f6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004c4364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5f74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5f91
mov eax, dword [ebp - 0xc]
call fcn.00403d10
ret
Function at 0x4e13bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4e13c4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bcc
xor eax, eax
push ebp
push 0x4e16d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405be4
xor eax, eax
push ebp
push 0x4e1433
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x4e16ec
call fcn.004060a0
mov eax, dword [ebp - 0x14]
mov ecx, 0x4e171c
mov edx, 6
call fcn.004c6008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e146f
cmp dword [ebp - 8], 0
je 0x4e14e4
mov edx, dword [ebp - 8]
mov eax, dword [0x4c7628]
call fcn.004c8db8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e14e4
xor eax, eax
push ebp
push 0x4e14dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4e17c4
mov eax, dword [ebp - 0x10]
call fcn.004c8000
test eax, eax
jl 0x4e14c7
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4e17c4
mov eax, dword [ebp - 0x10]
call fcn.004c8518
call fcn.004047e0
jmp 0x4e16aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e14e4
mov eax, dword [ebp - 0x10]
call fcn.00403d10
ret
xor eax, eax
push ebp
push 0x4e1522
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x4e17e0
call fcn.004060a0
mov eax, dword [ebp - 0x1c]
mov ecx, 0x4e171c
mov edx, 6
call fcn.004c6008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e155e
cmp dword [ebp - 8], 0
je 0x4e15d3
mov edx, dword [ebp - 8]
mov eax, dword [0x4c7628]
call fcn.004c8db8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e15d3
xor eax, eax
push ebp
push 0x4e15cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4e1898
mov eax, dword [ebp - 0x10]
call fcn.004c8000
test eax, eax
jl 0x4e15b6
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4e1898
mov eax, dword [ebp - 0x10]
call fcn.004c8518
call fcn.004047e0
jmp 0x4e16aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e15d3
mov eax, dword [ebp - 0x10]
call fcn.00403d10
ret
cmp dword [ebp - 4], 0
jne 0x4e16aa
xor eax, eax
push ebp
push 0x4e160d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov ecx, 0x4e171c
mov edx, 6
mov eax, 0x4e18bc
call fcn.004c6008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e1649
cmp dword [ebp - 8], 0
je 0x4e16aa
mov edx, dword [ebp - 8]
mov eax, dword [0x4c7628]
call fcn.004c8db8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e16aa
xor eax, eax
push ebp
push 0x4e16a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4e19bc
mov eax, dword [ebp - 0x10]
call fcn.004c8518
call fcn.004047e0
jmp 0x4e16aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e16d9
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00405bdc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405bdc
ret
Function at 0x4e2aa4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bcc
mov eax, dword [ebp - 8]
call fcn.00405bcc
mov eax, dword [ebp - 0xc]
call fcn.00405bcc
xor eax, eax
push ebp
push 0x4e2bf6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.004cb550
xor edx, edx
push ebp
push 0x4e2bd4
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x4e2aff
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4e2b06
mov dword [ebp - 0x10], 1
xor edx, edx
push ebp
push 0x4e2b67
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405c70
mov edi, eax
push edi
mov eax, dword [ebp - 8]
call fcn.00405c70
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405c70
mov ebx, eax
push ebx
push 0x4e2c08
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4e2b5d
mov eax, dword [ebp - 0x10]
push eax
push edi
push esi
push ebx
push 0x4e2c08
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2bbe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2bdb
mov eax, dword [ebp - 0x14]
call fcn.004cb580
ret

Function at 0x4e4b3c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e4bc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004035d8
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00414ee8
lea eax, [ebp - 0x24]
mov edx, 0x4e4be4
call fcn.00405fe0
mov eax, dword [ebp - 0x24]
call fcn.00405c70
mov dword [ebp - 0x16], eax
mov eax, 0x4e4be8
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4bce
lea eax, [ebp - 0x24]
call fcn.00405bd4
ret
Function at 0x4e80d4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e81ca
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx esi, ax
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e81e4
mov edx, 0x59
mov eax, esi
call fcn.00412e34
push dword [ebp - 4]
push 0x4e81f8
lea eax, [ebp - 8]
push eax
mov ecx, 0x4e8208
mov edx, 0x5a
mov eax, esi
call fcn.00412e34
push dword [ebp - 8]
lea eax, [ebx + 0x18]
mov edx, 3
call fcn.00406184
call fcn.00444f14
test al, al
je 0x4e8152
lea eax, [ebx + 0x1c]
mov edx, 0x4e821c
call fcn.00405be4
jmp 0x4e8179
mov eax, dword [0x4f2c3c]
mov eax, dword [eax]
add eax, eax
lea eax, [eax + eax*4]
mov edx, dword [0x4f3074]
add eax, dword [edx]
lea edx, [ebp - 0xc]
call fcn.0040c364
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x1c]
call fcn.00405be4
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, dword [ebx + 0xc]
call fcn.004e4a34
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
call fcn.00405be4
lea ecx, [ebp - 0x14]
mov edx, 1
mov eax, dword [ebx + 0xc]
call fcn.004e4a34
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x3c]
call fcn.00405be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e81d1
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405bdc
ret
Function at 0x43daf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x7dce60]
xor edx, edx
cmp eax, edx
jne 0x43db16
xor eax, eax
mov byte [eax + 0x7dcd60], al
inc eax
cmp eax, 0x100
jl 0x43dafe
mov dword [0x7dce60], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x7dcd60
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x43dba7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x43db7a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x43db48
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x43dc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x43dc73
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x43dc5a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret