joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41010c
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040bb28
xor eax, eax
push ebp
push 0x4101ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040c7d8
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c988
mov eax, dword [ebx]
call fcn.0040ffb4
test al, al
jne 0x4101a9
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040c7d8
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040c988
mov eax, dword [ebx]
call fcn.0040ffb4
test al, al
jne 0x4101a9
mov eax, ebx
call fcn.0040ba34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4101d5
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040ba94
lea eax, [ebp - 4]
call fcn.0040ba34
pop eax
jmp eax

Function at 0x411d04
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x422a8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x422ae5
test eax, edx
je 0x422ae8
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x422aa3
movzx eax, word [eax]
sub eax, ecx
jmp 0x422aca
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x422acb
add ecx, 4
js 0x422abb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x422ac8
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x422aca
xor eax, eax
ret
test eax, eax
je 0x422af4
test edx, edx
jne 0x422a94
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x423d88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040c724
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x423df2
test ah, 4
je 0x423deb
test bl, bl
jne 0x423db0
mov al, 1
jmp 0x423e19
test al, 0x10
je 0x423db8
xor eax, eax
jmp 0x423e19
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x423ddc
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x423e19
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x423e19
test al, 0x10
sete al
jmp 0x423e19
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x423e13
cmp ebx, 3
je 0x423e13
cmp ebx, 0x7b
je 0x423e13
mov eax, esi
call fcn.00423d48
test al, al
jne 0x423e17
xor eax, eax
jmp 0x423e19
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x423e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040c724
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x423ebe
test esi, 0x400
jne 0x423e55
test esi, 0x10
setne bl
jmp 0x423ebe
cmp byte [esp], 0
je 0x423e89
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x423ebe
push eax
call sub.kernel32.dll_CloseHandle
test esi, 0x10
setne bl
jmp 0x423ebe
test esi, 0x10
je 0x423e95
mov bl, 1
jmp 0x423ebe
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x423ebc
push eax
call sub.kernel32.dll_CloseHandle
xor ebx, ebx
jmp 0x423ebe
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x423ec8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040c724
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x423f1d
call sub.kernel32.dll_GetLastError
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x423f17
test ah, 4
je 0x423f17
test al, 0x10
je 0x423f17
mov eax, esi
call fcn.0040c724
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x423f1d
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42895c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x428995
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040bbcc
jmp 0x42899e
mov eax, ebx
mov edx, esi
call fcn.0040be24
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4289a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4289cc
movzx eax, word [esp]
jmp 0x4289ce
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42a0ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x42a213
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00429ef4
mov esi, eax
mov eax, dword [0x7f5314]
cmp byte [eax], 0
je 0x42a1b9
mov eax, dword [0x7f5080]
call fcn.0040824c
call fcn.00407140
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x42a0bc]
call fcn.0040eaf8
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x42a22c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x42a1f5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x7f5024]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x7f9634]
call fcn.0040f08c
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a21a
lea eax, [ebp - 4]
mov edx, dword [0x42a0bc]
call fcn.0040ec1c
pop eax
jmp eax
Function at 0x42b6ac
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x42b6ef
mov eax, dword [ebp - 0x10c]
mov dword [0x7f98f0], eax
mov eax, 0x7f98f4
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.0040c7d8
mov eax, 0x7f98f8
call fcn.0040ba34
xor eax, eax
mov dword [0x7f98fc], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x7f97b4], 0xa
jl 0x42b845
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x42b850
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x42b845
xor eax, eax
push ebp
push 0x42b83e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42b8ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42b79e
cmp dword [ebp - 8], 2
jle 0x42b79e
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42b771
adc edx, 0
mov eax, 0x7f98f8
call fcn.0040c8b0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x7f98f8]
call fcn.0040c724
push eax
push 0
push 0
push 0x42b8ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x42b7f8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42b8cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42b7f8
cmp dword [ebp - 8], 2
jle 0x42b7f8
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42b7cd
adc edx, 0
mov eax, 0x7f98f8
call fcn.0040c8b0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x7f98f8]
call fcn.0040c724
push eax
push 0
push 0
push 0x42b8cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x7f98fc
push 0
push 0
push 0x42b8e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x42b825
xor eax, eax
mov dword [0x7f98fc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b845
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x7f3720], 1
mov esp, ebp
pop ebp
ret
Function at 0x42ca00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040bf50
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00411ce4
mov edi, eax
cmp edi, 0x104
jbe 0x42c9ab
mov eax, edi
add eax, eax
call fcn.00406fcc
mov esi, eax
jmp 0x42c9ad
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00411ce4
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42c9e6
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42c9d0
mov eax, esp
cmp esi, eax
je 0x42c9f3
mov eax, esi
call fcn.00406fe8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42ca2c
cmp bl, 0
je 0x42ca28
cmp bl, 0x41
jl 0x42ca23
cmp bl, 0x5a
jg 0x42ca23
or bl, 0x20
xor al, bl
inc esi
jmp 0x42ca07
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42c96c

Function at 0x42d324
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040c7d8
add esp, 0x800
pop ebx
ret
Function at 0x42fbdc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42fbfc
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42fc16
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42fc11
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42fc1b
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42fc89
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42fcd2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42fc47
inc dword [ebp - 0xc]
jmp 0x42fc5f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42fc5f
cmp dword [ebp - 0xc], 0
jle 0x42fc5f
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42fc81
xor eax, eax
jmp 0x42fc7d
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42fc7c
mov eax, esi
jmp 0x42fcd5
inc eax
cmp eax, ecx
jle 0x42fc69
inc esi
cmp esi, dword [ebp - 8]
jl 0x42fc33
jmp 0x42fcd2
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42fcd2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42fcaa
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42fccc
xor eax, eax
jmp 0x42fcc8
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42fcc7
mov eax, esi
jmp 0x42fcd5
inc eax
cmp eax, ecx
jle 0x42fcb4
inc esi
cmp esi, dword [ebp - 8]
jl 0x42fc92
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42fec4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42fee3
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42fef3
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x430015
test ebx, ebx
jl 0x430015
test esi, esi
jle 0x430015
mov eax, dword [ebp - 8]
call fcn.0040c724
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c724
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42ffb2
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x430015
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42ff97
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42ff66
inc dword [ebp - 0x14]
jmp 0x42ff76
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42ff76
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42ff81
or eax, 0xffffffff
jmp 0x42ff97
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42ff94
inc eax
jmp 0x42ff97
or eax, 0xffffffff
test eax, eax
jl 0x42ff9f
cmp esi, eax
jg 0x42ff54
cmp esi, eax
jg 0x42ffaa
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x430018
inc edx
dec dword [ebp - 0x1c]
jne 0x42ff50
jmp 0x430015
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x430015
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42fffc
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42ffdb
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42ffe6
or eax, 0xffffffff
jmp 0x42fffc
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42fff9
inc eax
jmp 0x42fffc
or eax, 0xffffffff
test eax, eax
jl 0x430004
cmp esi, eax
jg 0x42ffc4
cmp esi, eax
jg 0x43000f
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x430018
inc edx
dec dword [ebp - 0x1c]
jne 0x42ffc0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43f0ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43f0b4
mov eax, edx
pop esi
pop ebx
ret

Function at 0x441cf8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x441d0f
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x441cff
mov eax, ecx
pop ebx
ret
Function at 0x4525ec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x452600
add esp, 0xfffffff0
call fcn.0040a278
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44c688]
call fcn.004700cc
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x451628]
call fcn.00472e9c
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x451628]
call fcn.00472e9c
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x452655
call fcn.0040a2d0
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bc4d0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4bc513
cmp byte [ebx + 0x11], 0
jne 0x4bc513
cmp byte [ebx + 0x24], 0
jne 0x4bc513
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4bc52a
mov ecx, dword [0x7f52c4]
mov dl, 1
mov eax, dword [0x48c4c4]
call fcn.0042a378
call fcn.0040b12c
pop ebx
ret
mov ecx, dword [0x7f52c4]
mov dl, 1
mov eax, dword [0x48c4c4]
call fcn.0042a378
call fcn.0040b12c
pop ebx
ret

Function at 0x4bce98
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4bcee6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004bc37c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bceff
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bcf08
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004bc37c
dec esi
jne 0x4bcf2a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x526270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x526282
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x5262d0
movzx edx, word [ebp + 0xc]
and edx, 0x80
je 0x5262a4
movzx eax, word [ebp + 0xc]
xor eax, 0x658e
mov word [ebp + 0xc], ax
movzx ecx, word [ebp + 0xc]
shl ecx, 1
mov word [ebp + 0xc], cx
movzx edx, byte [ebp + 8]
and edx, 0x80
je 0x5262c6
mov ax, word [ebp + 0xc]
add ax, 1
mov word [ebp + 0xc], ax
mov cl, byte [ebp + 8]
shl cl, 1
mov byte [ebp + 8], cl
jmp 0x52627a
mov ax, word [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x526330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp 0x52633f
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jbe 0x5263b5
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [ebp - 2], dl
mov byte [ebp - 1], 0
jmp 0x52635b
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x5263aa
movzx edx, word [ebp + 0x10]
and edx, 0x8000
je 0x52637d
movzx eax, word [ebp + 0x10]
xor eax, 0x8411
mov word [ebp + 0x10], ax
mov cx, word [ebp + 0x10]
shl cx, 1
mov word [ebp + 0x10], cx
movzx edx, byte [ebp - 2]
and edx, 0x80
je 0x5263a0
mov ax, word [ebp + 0x10]
add ax, 1
mov word [ebp + 0x10], ax
mov cl, byte [ebp - 2]
shl cl, 1
mov byte [ebp - 2], cl
jmp 0x526353
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x526336
mov ax, word [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x59df20
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x104], ecx
mov dword [eax + 0x100], ecx
mov dword [eax + 0x108], 0x6a09e667
mov dword [eax + 0x10c], 0xbb67ae85
mov dword [eax + 0x110], 0x3c6ef372
mov dword [eax + 0x114], 0xa54ff53a
mov dword [eax + 0x118], 0x510e527f
mov dword [eax + 0x11c], 0x9b05688c
mov dword [eax + 0x120], 0x1f83d9ab
mov dword [eax + 0x124], 0x5be0cd19
mov dword [eax], 0x428a2f98
mov dword [eax + 4], 0x71374491
mov dword [eax + 8], 0xb5c0fbcf
mov dword [eax + 0xc], 0xe9b5dba5
mov dword [eax + 0x10], 0x3956c25b
mov dword [eax + 0x14], 0x59f111f1
mov dword [eax + 0x18], 0x923f82a4
mov dword [eax + 0x1c], 0xab1c5ed5
mov dword [eax + 0x20], 0xd807aa98
mov dword [eax + 0x24], 0x12835b01
mov dword [eax + 0x28], 0x243185be
mov dword [eax + 0x2c], 0x550c7dc3
mov dword [eax + 0x30], 0x72be5d74
mov dword [eax + 0x34], 0x80deb1fe
mov dword [eax + 0x38], 0x9bdc06a7
mov dword [eax + 0x3c], 0xc19bf174
mov dword [eax + 0x40], 0xe49b69c1
mov dword [eax + 0x44], 0xefbe4786
mov dword [eax + 0x48], 0xfc19dc6
mov dword [eax + 0x4c], 0x240ca1cc
mov dword [eax + 0x50], 0x2de92c6f
mov dword [eax + 0x54], 0x4a7484aa
mov dword [eax + 0x58], 0x5cb0a9dc
mov dword [eax + 0x5c], 0x76f988da
mov dword [eax + 0x60], 0x983e5152
mov dword [eax + 0x64], 0xa831c66d
mov dword [eax + 0x68], 0xb00327c8
mov dword [eax + 0x6c], 0xbf597fc7
mov dword [eax + 0x70], 0xc6e00bf3
mov dword [eax + 0x74], 0xd5a79147
mov dword [eax + 0x78], 0x6ca6351
mov dword [eax + 0x7c], 0x14292967
mov dword [eax + 0x80], 0x27b70a85
mov dword [eax + 0x84], 0x2e1b2138
mov dword [eax + 0x88], 0x4d2c6dfc
mov dword [eax + 0x8c], 0x53380d13
mov dword [eax + 0x90], 0x650a7354
mov dword [eax + 0x94], 0x766a0abb
mov dword [eax + 0x98], 0x81c2c92e
mov dword [eax + 0x9c], 0x92722c85
mov dword [eax + 0xa0], 0xa2bfe8a1
mov dword [eax + 0xa4], 0xa81a664b
mov dword [eax + 0xa8], 0xc24b8b70
mov dword [eax + 0xac], 0xc76c51a3
mov dword [eax + 0xb0], 0xd192e819
mov dword [eax + 0xb4], 0xd6990624
mov dword [eax + 0xb8], 0xf40e3585
mov dword [eax + 0xbc], 0x106aa070
mov dword [eax + 0xc0], 0x19a4c116
mov dword [eax + 0xc4], 0x1e376c08
mov dword [eax + 0xc8], 0x2748774c
mov dword [eax + 0xcc], 0x34b0bcb5
mov dword [eax + 0xd0], 0x391c0cb3
mov dword [eax + 0xd4], 0x4ed8aa4a
mov dword [eax + 0xd8], 0x5b9cca4f
mov dword [eax + 0xdc], 0x682e6ff3
mov dword [eax + 0xe0], 0x748f82ee
mov dword [eax + 0xe4], 0x78a5636f
mov dword [eax + 0xe8], 0x84c87814
mov dword [eax + 0xec], 0x8cc70208
mov dword [eax + 0xf0], 0x90befffa
mov dword [eax + 0xf4], 0xa4506ceb
mov dword [eax + 0xf8], 0xbef9a3f7
mov dword [eax + 0xfc], 0xc67178f2
pop ebp
ret