joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420320
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x420342
movzx eax, word [esp]
jmp 0x420344
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x421358
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x42147f
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00421160
mov esi, eax
mov eax, dword [0x4c172c]
cmp byte [eax], 0
je 0x421425
mov eax, dword [0x4c158c]
call fcn.00407270
call fcn.00406f90
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x421328]
call fcn.0040bf78
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x421498
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x421461
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4c1560]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4c5634]
call fcn.0040c368
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421486
lea eax, [ebp - 4]
mov edx, dword [0x421328]
call fcn.0040c09c
pop eax
jmp eax
Function at 0x4222b8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4223bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040998c
lea eax, [ebp - 4]
call fcn.00409af4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4223a4
mov eax, ebx
call fcn.00406e1c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x42239d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x422385
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4223d0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x422385
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4223a4
mov eax, dword [ebp - 0x10]
call fcn.00406e38
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4223c3
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax

Function at 0x4250b8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x425100
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042504c
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425107
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax

Function at 0x425320
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4253b7
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x42536b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.004096ec
jmp 0x42539f
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x425382
lea eax, [ebp - 4]
call fcn.00409564
jmp 0x425395
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004251d8
mov ebx, eax
test esi, esi
je 0x425395
dec esi
jmp 0x425372
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00409944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4253be
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax
Function at 0x4253c8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041cb0c
add esp, 0x208
pop ebx
ret

Function at 0x425428
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041cb0c
add esp, 0x208
pop ebx
ret

Function at 0x425588
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4256c0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4256a8
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4255e5
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4256a8
cmp dword [ebp - 0x14], 0
jne 0x4255fa
mov eax, dword [ebp - 0xc]
call fcn.00409564
mov bl, 1
jmp 0x4256a8
cmp dword [ebp - 0x14], 0x70000000
jb 0x425608
call fcn.004214bc
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.004096ec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00409ae4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x4255ae
test eax, eax
jne 0x4256a8
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x425656
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x4256a8
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x42565e
dec esi
test esi, esi
je 0x42566d
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x42565d
cmp dword [ebp - 0x10], 7
jne 0x425678
test esi, esi
je 0x425678
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040a124
cmp dword [ebp - 0x10], 7
jne 0x42569b
test esi, esi
je 0x42569b
lea eax, [ebp - 4]
call fcn.00409ae4
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00409944
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4256c7
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax

Function at 0x426d7c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c7d1c
mov eax, esi
mov edx, 8
test al, 1
je 0x426d98
shr eax, 1
xor eax, 0xedb88320
jmp 0x426d9a
shr eax, 1
dec edx
jne 0x426d8b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x426d84
pop esi
ret
Function at 0x426db0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c7d18], 0
jne 0x426dda
call fcn.00426d7c
mov dword [esp], 0x4c7d18
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x426e04
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c7d1c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x426de0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42993c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004298f0
test al, al
jne 0x42995d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4299ab
xor eax, eax
push ebp
push 0x42999b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409fac
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4299a2
lea eax, [ebp - 0xc]
call fcn.0042992c
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d234
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46d23c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x49e098
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x49e0e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0049db60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e0ff
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b601c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4b6024
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6189
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.0040a010
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00424f38
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0042502c
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
call fcn.004253fc
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00424cf4
lea eax, [ebp - 0x2c]
mov edx, 0x4b61a4
call fcn.0040a1a4
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0042502c
mov eax, dword [ebp - 0x28]
mov ecx, 1
pop edx
call fcn.0040a4c8
dec eax
je 0x4b60c3
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
jne 0x4b615f
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
jmp 0x4b615f
lea eax, [ebp - 4]
call fcn.00425708
cmp dword [ebp - 4], 0
jne 0x4b60de
lea eax, [ebp - 4]
mov edx, 0x4b61bc
call fcn.0040998c
push 0x4b61d0
push dword [ebp - 4]
push 0x4b6210
push 0x4b6220
push 0x4b6260
lea eax, [ebp - 8]
mov edx, 5
call fcn.0040a284
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 8]
call fcn.00409fac
push eax
call sub.advapi32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x4b6127
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
xor ebx, ebx
jmp 0x4b615f
mov dword [ebp - 0x18], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
jne 0x4b6156
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6190
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.004095c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004095c4
pop eax
jmp eax
Function at 0x4b6558
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
call fcn.00422250
cmp eax, 2
jne 0x4b65c0
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b657b
xor eax, eax
jmp 0x4b65cf
lea eax, [esp + 8]
push eax
push 0x4b65d4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4b65c0
xor eax, eax
jmp 0x4b65cf
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4b65fc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4b6656
inc esi
xor edi, edi
cmp edi, 1
jne 0x4b6622
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4b6630
cmp edi, 1
jle 0x4b6630
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042993c
test eax, eax
jne 0x4b6656
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4b6656
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4b6656
inc edi
dec esi
jne 0x4b6612
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4b6660
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4b6684
mov eax, dword [ebp - 4]
jmp 0x4b6687
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b668c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4b66d9
xor ebx, ebx
jmp 0x4b66ce
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041bb74
test eax, eax
jne 0x4b66cd
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4b6784
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b66af
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4b66e5
je 0x4b66ee
jmp 0x4b66f7
call fcn.004257f4
mov esi, eax
jmp 0x4b66f9
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4b66f9
xor esi, esi
test si, si
je 0x4b6784
xor ebx, ebx
jmp 0x4b671f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x4b671e
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4b6784
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b6706
xor ebx, ebx
jmp 0x4b6779
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x4b6778
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x4b676d
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004b6660
push eax
mov eax, esi
call fcn.004b6660
pop edx
cmp edx, eax
jne 0x4b6778
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4b6784
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b672e
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4b6b70
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6c49
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b6c64
push ebx
push 0x4b6c74
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a284
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004072d4
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00409fac
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4b6bf2
mov ax, 0x83
call fcn.004b6794
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004b6b44
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4b6bfb
call fcn.004b6b44
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6c50
lea eax, [ebp - 4]
call fcn.00409564
pop eax
jmp eax
Function at 0x4b6d64
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b6e2d
jmp 0x4b6e21
cmp dword [esi + 0x10], 0x1000
jne 0x4b6e0f
test byte [esi + 0x15], 1
jne 0x4b6e0f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4b6dc0
cmp ebp, 2
je 0x4b6dc0
cmp ebp, 0x10
je 0x4b6dc0
cmp ebp, 0x20
jne 0x4b6ddc
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4b6ddc
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4b6ded
mov eax, dword [esi]
add eax, ebx
call fcn.004b6d5c
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4b6de0
cmp byte [esp + 4], 0
je 0x4b6e0f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b6e2d
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4b6d95
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x710c80
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7109ec
dec eax
sub eax, eax
sub eax, 1
call fcn.00710cc1
add eax, 0xd34b8b4d
sub ecx, ecx
xor dword [ebx], edi
sub eax, ecx
and eax, ecx
and ecx, eax
inc ebx
and ecx, ecx
mov eax, eax
sub esp, 4
mov dword [esp], 0x46cf7e06
pop eax
cmp ebx, edx
jne fcn.00710c80
inc ecx
add ecx, ecx
ret

Function at 0x42b4c6
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0042b545
jae 0x42b4d2
xor ecx, ecx
call fcn.0042b545
jae 0x42b4fc
xor eax, eax
call fcn.0042b545
jae 0x42b50d
mov al, 0x10
call fcn.0042b545
adc al, al
jae 0x42b4ee
jne 0x42b53a
stosb byte es:[edi], al
jmp 0x42b4d3
call fcn.0042b551
dec ecx
loop 0x42b519
mov eax, ebp
call fcn.0042b54f
jmp 0x42b53b
lodsb al, byte [esi]
shr eax, 1
je 0x42b561
adc ecx, 2
mov ebp, eax
jmp 0x42b53b
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0042b54f
cmp eax, 0x7d00
jae 0x42b539
cmp eax, 0x500
jae 0x42b53a
cmp eax, 0x7f
ja 0x42b53b
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x42b4d3
pop ebp
ret 8
Function at 0x44b6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov cl, byte [0x65f042]
invalid

Function at 0x4ed05e
Capabilities:
Encode data using xor

Disassembly:
xchg ah, bl
cmp bl, al
xor dword [esi - 0x631ca1da], ebx
pop esi
or dword [eax - 0x443bdaf0], esi
sub bh, byte [edi - 0x52600ee6]
sub esi, dword [edx]
jmp 0x9c4b7957
or al, 0xd4
loope 0x4ed0c7
shl dword [edi - 0x74c2f814], 0x90
jge 0x4ed006
jl 0x4ed053
or eax, 0x2b129406
mov dword [edx + 0x76], esp
push ds
sbb eax, 0x441bdae5
out 3, al
pmaddwd mm6, mm4
sbb byte [ecx - 0x34ddaa62], bh
xchg esi, eax
inc edi
and cl, byte [ecx - 0x3ad77b2b]
sub al, 0xab
pop es
push ds
push es
cmp dword [ecx + edi*4 + 0x16cb5559], edi
int3
sub byte [ebx - 8], ah
pushfd
daa
mov eax, eax
pop ebp
dec eax
or ecx, dword [esi]
mov esp, 0xb5ca8b2d
fadd st(6)
inc esp
cdq
lcall 0x4fad, 0xdcfa68a2
ljmp 0x538e
cmp byte [ebx + 0x26], 0x6a
mov ss, word [ebx - 0x37]
invalid
cmp eax, 0x732d3f66
shr byte [esi], 1
adc eax, 0xc328a0a1
jg 0x4ed0a0
wait
lahf
mov ebx, 0x593ab0e5
pop ecx
bound edi, qword [ecx]
sbb al, 0x64
xor esi, dword [esp + edi - 0x41]
pop edi
jp 0x4ed0dc
cmp eax, 0x2d116f36
pop esp
and al, 0x31
or byte [ebx + ecx*2 - 0x53628a7f], 0x8a
loopne 0x4ed095
xor eax, 0x744b2d7f
pop eax
jnp 0x4ed0b1
inc edx
mov ch, 0xd9
pushfd
test eax, 0x2a941d2c
test dword [eax + 0x1c0ded7d], ecx
pop ecx
out dx, eax
pop ebx
cld
mov ch, 0x7c
wait
mov ecx, 0x9e756bdf
sal ch, 1
xlatb
inc esi
push edx
pushfd
mov cl, 0x48
sbb eax, 0xba39f835
sub dh, cl
retf 0x4b7d
Function at 0x5d3fb2
Capabilities:
Encode data using xor

Disassembly:
push ss
sbb edx, esp
mov ecx, 0x68625465
sal dh, 1
sub byte [ebx - 7], ch
xor dword [ebx], esi
inc ecx
leave
pop ecx
mov ecx, 0xfafded3a
or eax, dword [edx - 0x33f1d9e4]
cmp eax, 0x6ab627b9
add eax, esi
invalid
std
or dl, byte [edx + 0xc]
add byte [edx + 0x3f8eae7], ch
xlatb
push edx
or al, 0
stosb byte es:[edi], al
out 0xea, eax
clc
add edx, edi
push esi
popfd
loop 0x5d3f0e
retf
inc edi
mov ecx, 0xc8f5444b
jg 0x5d3ee7
and dl, al
wait
jae 0x5d3f47
inc edi
wait
cmpsd dword [esi], dword es:[edi]
shl byte [eax + 0x40a23dd0], 0x15
jp 0x5d3f8f
sub dh, bh
jl 0x5d3f10
fidiv word [ebp + 0x65]
pushfd
pop esi
dec ebx
scasd eax, dword es:[edi]
mov edx, 0xab624bdf
push ebx
lodsd eax, dword [esi]
mov eax, 0xc82bdb3b
test ebx, ebp
pop ebx
sub eax, dword [ebx]
imul esi, esi, 0xf3a2035b
add al, 0x2a
or dword [eax], edi
fisttp word [edi]
lodsb al, byte [esi]
push eax
cmp ebx, dword [ecx]
bound ecx, qword [eax]
les esi, [edi + 0x57ab9cea]
and edi, dword [ebx]
sub al, 0xca
ror byte ds:[ebx + 0x7b5c7b69], 1
xor eax, 0x22741698
int3
pop edx
cmp dword [edx + ebx*8 + 0x7248e89c], 0x37662198
jb 0x5d3f30
and dword [esi + 0x37], esp
mov ebx, 0x3a838e5a
mov bl, 0x7c
mov ebx, 0x57187316
aaa
shr dword [ebx], cl
xchg edx, eax
add eax, 0x5bb49625
jne 0x5d3fc6
sub byte [ecx - 0x3573bfe6], ah
loop 0x5d3f96
cmp dword [eax - 0x68c0483b], ebx
lcall 0xff0b, 0x9772dc5a
or edi, edi
lodsd eax, dword [esi]
mov dword [0x4345d954], eax
and esi, dword [edx - 0x18738b7a]
std
out 0xfd, eax
stosd dword es:[edi], eax
push 0xffffffffffffffc7
dec ebx
xor esp, edi
mov bl, byte [esi + 0x78]
movsb byte es:[edi], byte [esi]
push es
mov dword [0xb02a1e1a], eax
popfd
js 0x5d3fd3
jecxz 0x5d400d
dec ecx
add eax, 0x712b937c
call 0xf964bacf
ljmp 0xf49b
salc
cmp dl, byte [esi - 0x49]
into
lcall 0xc42e, 0x5219ea90
mov ebp, 0x173b4e2e
and dh, byte [edx + 0x3e]
ret 0x9189