joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 7
push 0
push 0
dec ecx
jne 0x494159
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404da8
xor eax, eax
push ebp
push 0x494352
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00493f50
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00493f50
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00404990
mov eax, dword [ebp - 0x10]
call fcn.00404bb8
sar eax, 1
jns 0x4941b3
adc eax, 0
test eax, eax
jle 0x49430f
mov dword [ebp - 0x20], eax
mov esi, 1
cmp esi, 1
je 0x4941d3
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404990
lea eax, [ebp - 0x18]
call fcn.004048f8
mov eax, dword [ebp - 0x14]
call fcn.00404bb8
mov edi, eax
sar edi, 1
jns 0x4941ec
adc edi, 0
test edi, edi
jle 0x494305
mov ebx, 1
mov edx, 0x494360
lea eax, [ebp - 0x28]
call fcn.00403110
lea eax, [ebp - 0x2c]
mov edx, ebx
add edx, edx
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx + edx - 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.004030e0
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x30]
call fcn.00403110
lea eax, [ebp - 0x2c]
mov edx, ebx
add edx, edx
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx + edx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x30]
mov cl, 3
call fcn.004030e0
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x24]
call fcn.00404b5c
mov eax, dword [ebp - 0x24]
call fcn.00409308
mov byte [ebp - 0x19], al
mov edx, 0x494360
lea eax, [ebp - 0x28]
call fcn.00403110
lea eax, [ebp - 0x2c]
mov edx, esi
add edx, edx
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + edx - 2]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.004030e0
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x30]
call fcn.00403110
lea eax, [ebp - 0x2c]
mov edx, esi
add edx, edx
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + edx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x30]
mov cl, 3
call fcn.004030e0
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x34]
call fcn.00404b5c
mov eax, dword [ebp - 0x34]
call fcn.00409308
xor al, byte [ebp - 0x19]
mov byte [ebp - 0x1a], al
lea eax, [ebp - 0x3c]
mov dl, byte [ebp - 0x1a]
call fcn.00404ae0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00493f50
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x18]
call fcn.00404bc0
inc ebx
dec edi
jne 0x4941f9
inc esi
dec dword [ebp - 0x20]
jne 0x4941c3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494359
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.0040491c
lea eax, [ebp - 0x24]
call fcn.004048f8
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040491c
lea eax, [ebp - 4]
call fcn.004048f8
ret
Function at 0x4945a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da8
xor eax, eax
push ebp
push 0x49462f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404bb8
mov esi, eax
test esi, esi
jle 0x494614
mov ebx, 1
mov eax, dword [ebp - 4]
call fcn.00404bb8
mov edx, eax
imul edx, ebx
imul edx, ebx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
xor edx, eax
lea eax, [ebp - 8]
call fcn.00404ae0
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00404bc0
inc ebx
dec esi
jne 0x4945e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494636
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040491c
ret

Function at 0x494640
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4946bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404ae0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4946d4
call fcn.00404c04
mov eax, dword [ebp - 4]
call fcn.00404db8
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
je 0x49469e
cmp eax, 1
je 0x49469e
cmp eax, 3
jne 0x49469e
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x5b
jne 0x49465e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4946c6
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040491c
ret
Function at 0x498528
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x498788
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49858b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004981d0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d72c
cmp al, 1
jne 0x49858b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00498498
test al, al
je 0x498717
cmp dword [ebp - 8], 0
jge 0x4985a9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004981d0
mov eax, dword [ebp - 0x210]
call fcn.00404bb8
cmp ebx, eax
jge 0x4985f3
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004981d0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4f71fc]
and eax, 0xff
bt dword [edx], eax
jae 0x4985f3
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x498607
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00498504
cmp ebx, dword [ebp - 8]
je 0x498709
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x498633
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d20
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f4ad8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4986f6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d20
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f4ad8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00451b60
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d20
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f4ad8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00451b60
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4986fd
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49876a
cmp dword [ebp - 8], 0
jge 0x498722
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004981d0
mov eax, dword [ebp - 0x218]
call fcn.00404bb8
cmp eax, dword [ebp - 8]
jg 0x49875c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004981d0
mov eax, dword [ebp - 0x21c]
call fcn.00404bb8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00498504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49878f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040491c
ret
Function at 0x4aa3e0
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x4aa3f0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4aa405
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4aa508
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004aa474
mov esi, eax
mov eax, ebx
call fcn.00403b24
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4ac4e0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da8
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x4ac667
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4ac684
call fcn.00404efc
test eax, eax
jne 0x4ac52b
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4ac690
call fcn.00404c04
mov eax, esi
mov edx, 0x3c
call fcn.004ac000
mov dword [esi + 8], 0x21
mov dword [esi + 0x14], 0x101
mov dword [esi + 0x20], 0x81
mov dword [esi + 0x28], 0x81
mov dword [esi + 0x30], 0x801
mov dword [esi + 0x38], 0x801
mov eax, 0x21
call fcn.00402814
mov dword [esi + 4], eax
mov eax, 0x101
call fcn.00402814
mov dword [esi + 0x10], eax
mov eax, 0x81
call fcn.00402814
mov dword [esi + 0x1c], eax
mov eax, 0x81
call fcn.00402814
mov dword [esi + 0x24], eax
mov eax, 0x801
call fcn.00402814
mov dword [esi + 0x2c], eax
mov eax, 0x801
call fcn.00402814
mov dword [esi + 0x34], eax
push esi
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404bb8
push eax
mov eax, dword [ebp - 4]
call fcn.00404db8
push eax
call sub.wininet.dll_InternetCrackUrlA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4ac621
mov eax, edi
mov edx, dword [esi + 4]
call fcn.00404af0
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x10]
call fcn.00404af0
mov eax, dword [ebp + 0x18]
mov edx, dword [esi + 0x2c]
call fcn.00404af0
mov eax, dword [ebp + 0x14]
mov edx, dword [esi + 0x1c]
call fcn.00404af0
mov eax, dword [ebp + 0x10]
mov edx, dword [esi + 0x24]
call fcn.00404af0
mov eax, dword [ebp + 0xc]
mov edx, dword [esi + 0x34]
call fcn.00404af0
mov eax, dword [ebp + 8]
mov dx, word [esi + 0x18]
mov word [eax], dx
mov eax, dword [esi + 0x34]
call fcn.00402834
mov eax, dword [esi + 0x2c]
call fcn.00402834
mov eax, dword [esi + 0x24]
call fcn.00402834
mov eax, dword [esi + 0x1c]
call fcn.00402834
mov eax, dword [esi + 0x10]
call fcn.00402834
mov eax, dword [esi + 4]
call fcn.00402834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac66e
lea eax, [ebp - 4]
call fcn.004048f8
ret
Function at 0x4ac698
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x4ac6b1
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x4ac6be
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4ac6dc
cld
pop edi
pop esi
xor ecx, ecx
mov cl, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ada80
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4adb9d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
xor eax, eax
call fcn.004ad948
pop ecx
test al, al
je 0x4adb78
mov eax, dword [ebp + 8]
push eax
call fcn.004ad78c
pop ecx
test al, al
jne 0x4adb78
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x13c]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x4adb78
mov eax, dword [ebp + 8]
push eax
mov eax, 0x13
call fcn.004ad7cc
pop ecx
test al, al
je 0x4adb78
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00404b68
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00409344
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x178], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x178]
cmp esi, 0xc8
je 0x4adb43
mov eax, dword [ebp + 8]
cmp esi, 0xce
jne 0x4adb78
mov eax, dword [ebp + 8]
push eax
mov eax, 5
call fcn.004ad7cc
pop ecx
test al, al
je 0x4adb78
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00404b68
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00409344
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
call fcn.004ad78c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adba4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040491c
ret

Function at 0x4af340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
call fcn.004af2cc
mov ebx, eax
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4af39f
mov eax, esi
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404b68
push ebx
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4af3ac
mov eax, esi
call fcn.004048f8
push ebx
call sub.advapi32.dll_RegCloseKey_1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b223c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b226a
mov eax, ebx
call fcn.004b2cf0
cmp dword [ebx + 0x40], 0
je 0x4b2263
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b22db
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b22cd
cmp dword [ebx + 8], 0
je 0x4b228c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b229e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b22cd
cmp dword [ebx + 8], 0
je 0x4b227f
cmp eax, 3
je 0x4b22b1
dec eax
jne 0x4b227f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b227f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b227f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b22f9
cmp dword [ebx + 0x14], 0xcc
je 0x4b22f9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b2304
pop ebx
ret
Function at 0x4cd964
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x4cd996
cmp dword [ebx + 0x64], 0
jne 0x4cd996
cmp dword [ebx + 0x6c], 0
jne 0x4cd996
mov esi, dword [ebp - 8]
jmp 0x4cda3f
cmp esi, 0xffffffff
jne 0x4cd9a1
dec esi
jmp 0x4cda3f
mov eax, dword [ebx + 0x64]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 8]
sub edx, 0x106
cmp eax, edx
jb 0x4cda3f
mov eax, dword [ebx + 0x30]
mov edx, dword [ebp - 8]
lea edx, [eax + edx]
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.004ccf88
mov eax, dword [ebp - 8]
sub dword [ebx + 0x68], eax
mov eax, dword [ebp - 8]
sub dword [ebx + 0x64], eax
sub dword [ebx + 0x54], edi
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x4cda01
mov cx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x4cda06
mov word [edx], 0
dec eax
test eax, eax
jne 0x4cd9e3
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jb 0x4cda32
mov cx, word [ebp - 4]
sub cx, word [ebp - 8]
mov word [edx], cx
jmp 0x4cda37
mov word [edx], 0
dec eax
test eax, eax
jne 0x4cda14
add esi, dword [ebp - 8]
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x4cda9d
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.004cd6e4
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4cda88
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4cda9d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4cd975
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d8c68
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4d8c7d
add esp, 0xfffffff0
call fcn.00403e48
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404da8
xor eax, eax
push ebp
push 0x4d8d40
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004d48c4
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a8a0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x28], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a8a0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a8a0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x38], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a8a0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041a8c8
push esi
lea edi, [esi + 0x44]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8d47
lea eax, [ebp - 4]
call fcn.004048f8
ret

Function at 0x4ec6dc
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov byte [ebp - 1], al
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4ec757
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x18]
push eax
push 0x4ec760
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp byte [ebp - 1], 0
je 0x4ec723
mov dword [ebp - 0x10], 2
jmp 0x4ec728
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ecd34
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da8
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ece97
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004e834c
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.004e836c
jmp 0x4ece69
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404b68
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409a40
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408d14
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408d14
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404d04
je 0x4ece4b
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404b68
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408d14
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408d14
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404d04
jne 0x4ece60
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.004e838c
test eax, eax
jne 0x4ecdac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ece9e
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040491c
lea eax, [ebp - 4]
call fcn.004048f8
ret