joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2530
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.004b20d8
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.004b213c
mov word [ebp - 0x22], 0
mov dx, 4
mov eax, dword [ebp - 0x1c]
call fcn.004b2068
movzx edx, word [ebp - 0x22]
shl edx, 2
mov ecx, dword [ebp - 0x20]
xor eax, dword [ecx + edx*4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0x3f
mov eax, dword [eax*4 + 0x4eddb8]
xor eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
shr edx, 8
and edx, 0x3f
xor eax, dword [edx*4 + 0x4edbb8]
mov edx, dword [ebp - 0x28]
shr edx, 0x10
and edx, 0x3f
xor eax, dword [edx*4 + 0x4ed9b8]
mov edx, dword [ebp - 0x28]
shr edx, 0x18
and edx, 0x3f
xor eax, dword [edx*4 + 0x4ed7b8]
mov dword [ebp - 0x18], eax
movzx eax, word [ebp - 0x22]
shl eax, 2
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4 + 4]
xor eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0x3f
mov eax, dword [eax*4 + 0x4edeb8]
xor eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
shr edx, 8
and edx, 0x3f
xor eax, dword [edx*4 + 0x4edcb8]
mov edx, dword [ebp - 0x28]
shr edx, 0x10
and edx, 0x3f
xor eax, dword [edx*4 + 0x4edab8]
mov edx, dword [ebp - 0x28]
shr edx, 0x18
and edx, 0x3f
xor eax, dword [edx*4 + 0x4ed8b8]
mov dword [ebp - 0x18], eax
mov dx, 4
mov eax, dword [ebp - 0x18]
call fcn.004b2068
movzx edx, word [ebp - 0x22]
shl edx, 2
mov ecx, dword [ebp - 0x20]
xor eax, dword [ecx + edx*4 + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0x3f
mov eax, dword [eax*4 + 0x4eddb8]
xor eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
shr edx, 8
and edx, 0x3f
xor eax, dword [edx*4 + 0x4edbb8]
mov edx, dword [ebp - 0x28]
shr edx, 0x10
and edx, 0x3f
xor eax, dword [edx*4 + 0x4ed9b8]
mov edx, dword [ebp - 0x28]
shr edx, 0x18
and edx, 0x3f
xor eax, dword [edx*4 + 0x4ed7b8]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp - 0x22]
shl eax, 2
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4 + 0xc]
xor eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0x3f
mov eax, dword [eax*4 + 0x4edeb8]
xor eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
shr edx, 8
and edx, 0x3f
xor eax, dword [edx*4 + 0x4edcb8]
mov edx, dword [ebp - 0x28]
shr edx, 0x10
and edx, 0x3f
xor eax, dword [edx*4 + 0x4edab8]
mov edx, dword [ebp - 0x28]
shr edx, 0x18
and edx, 0x3f
xor eax, dword [edx*4 + 0x4ed8b8]
mov dword [ebp - 0x1c], eax
inc word [ebp - 0x22]
cmp word [ebp - 0x22], 8
jne 0x4b2570
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.004b2250
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
call fcn.004b210c
mov esp, ebp
pop ebp
ret
Function at 0x4bfc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
add eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
add eax, 8
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xc
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 0xc]
shl eax, 0x18
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*4 + 0xc]
shr edx, 8
or eax, edx
mov dword [ebp - 0x14], eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov eax, dword [eax*4 + 0x4ee538]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x4ee538]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4ee538]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0xff
mov eax, dword [eax*4 + 0x4ee538]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
shl eax, 8
mov edx, dword [ebp - 0x1c]
shr edx, 0x18
or eax, edx
xor eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
shl edx, 0x10
mov ecx, dword [ebp - 0x20]
shr ecx, 0x10
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 0x24]
shl edx, 0x18
mov ecx, dword [ebp - 0x24]
shr ecx, 8
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov edx, dword [ebp - 0x10]
xor eax, dword [edx*4 + 0x4ee0bc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x10], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x14]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x18]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x1c], eax
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], 0x28
jl 0x4bfc8c
mov esp, ebp
pop ebp
ret
Function at 0x4cb24c
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 1
mov byte [ebp - 0xa], 0
xor eax, eax
mov al, byte [ebp - 0xa]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xa]
cmp al, byte [edx + 0x4ef144]
je 0x4cb27e
mov byte [ebp - 9], 0
jmp 0x4cb287
inc byte [ebp - 0xa]
cmp byte [ebp - 0xa], 9
jne 0x4cb260
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4cb290
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 1
mov byte [ebp - 0xa], 0
xor eax, eax
mov al, byte [ebp - 0xa]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xa]
cmp al, byte [edx + 0x4ef150]
je 0x4cb2c2
mov byte [ebp - 9], 0
jmp 0x4cb2cb
inc byte [ebp - 0xa]
cmp byte [ebp - 0xa], 9
jne 0x4cb2a4
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4cb2d4
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 1
mov byte [ebp - 0xa], 0
xor eax, eax
mov al, byte [ebp - 0xa]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xa]
cmp al, byte [edx + 0x4ef15c]
je 0x4cb306
mov byte [ebp - 9], 0
jmp 0x4cb30f
inc byte [ebp - 0xa]
cmp byte [ebp - 0xa], 9
jne 0x4cb2e8
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4cb318
Capabilities:
Encrypt data using openssl dsa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 1
mov byte [ebp - 0xa], 0
xor eax, eax
mov al, byte [ebp - 0xa]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xa]
cmp al, byte [edx + 0x4ef170]
je 0x4cb34a
mov byte [ebp - 9], 0
jmp 0x4cb353
inc byte [ebp - 0xa]
cmp byte [ebp - 0xa], 7
jne 0x4cb32c
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4cb3a0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 1
mov byte [ebp - 0xa], 0
xor eax, eax
mov al, byte [ebp - 0xa]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
xor edx, edx
mov dl, byte [ebp - 0xa]
cmp al, byte [edx + 0x4ef138]
je 0x4cb3d2
mov byte [ebp - 9], 0
jmp 0x4cb3db
inc byte [ebp - 0xa]
cmp byte [ebp - 0xa], 9
jne 0x4cb3b4
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4cc84c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404ab0
xor eax, eax
push ebp
push 0x4cc95a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4cc970
mov eax, dword [ebp - 8]
call fcn.00408a1c
test eax, eax
jne 0x4cc894
mov eax, dword [ebp - 0xc]
mov edx, 0x4cc97c
call fcn.00404654
jmp 0x4cc944
mov edx, 0x4cc990
mov eax, dword [ebp - 8]
call fcn.00408a1c
test eax, eax
jne 0x4cc8b7
mov eax, dword [ebp - 0xc]
mov edx, 0x4cc99c
call fcn.00404654
jmp 0x4cc944
mov edx, 0x4cc9ac
mov eax, dword [ebp - 8]
call fcn.00408a1c
test eax, eax
jne 0x4cc8d7
mov eax, dword [ebp - 0xc]
mov edx, 0x4cc9b8
call fcn.00404654
jmp 0x4cc944
mov edx, 0x4cc9cc
mov eax, dword [ebp - 8]
call fcn.00408a1c
test eax, eax
jne 0x4cc8f7
mov eax, dword [ebp - 0xc]
mov edx, 0x4cc9d8
call fcn.00404654
jmp 0x4cc944
mov edx, 0x4cc9f0
mov eax, dword [ebp - 8]
call fcn.00408a1c
test eax, eax
jne 0x4cc917
mov eax, dword [ebp - 0xc]
mov edx, 0x4cc9fc
call fcn.00404654
jmp 0x4cc944
mov edx, 0x4cca14
mov eax, dword [ebp - 8]
call fcn.00408a1c
test eax, eax
jne 0x4cc937
mov eax, dword [ebp - 0xc]
mov edx, 0x4cca20
call fcn.00404654
jmp 0x4cc944
mov eax, dword [ebp - 0xc]
mov edx, 0x4cca3c
call fcn.00404654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc961
lea eax, [ebp - 8]
call fcn.00404600
ret
Function at 0x4dfe20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404ab0
mov eax, dword [ebp - 0xc]
call fcn.00404ab0
mov eax, dword [ebp + 0x10]
call fcn.00404ab0
xor eax, eax
push ebp
push 0x4dff85
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004048c0
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
fdiv dword [0x4dff94]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0042ac10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404b20
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.004048c0
mov edx, eax
sub edx, dword [ebp - 0x24]
inc edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00404b20
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040490c
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004dfbb4
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x38]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0040490c
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004dfce8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00404c4c
mov eax, dword [ebp + 8]
call fcn.00404b18
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4dff55
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dl, byte [edx + ecx - 1]
xor al, dl
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx - 1], al
inc dword [ebp - 0x20]
dec dword [ebp - 0x2c]
jne 0x4dff2d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dff8c
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00404624
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404624
lea eax, [ebp + 0x10]
call fcn.00404600
ret
Function at 0x4e22e8
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4e22f0
push ebx
push esi
mov esi, edx
lea ebx, [ebp - 8]
xor eax, eax
push ebp
push 0x4e245f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x2800
mov eax, dword [ebp - 0x10]
call fcn.00402b14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4e243c
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4e2358
mov eax, dword [ebx]
cmp byte [eax + 0x1b0], 0
jne 0x4e2358
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x4e2342
lea eax, [ebp - 4]
call fcn.00404600
cmp dword [ebx], 0
je 0x4e2416
lea ecx, [ebp - 0x14]
mov eax, dword [ebx]
movzx eax, byte [eax + 0x194]
mov edx, 2
call fcn.0040912c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov eax, dword [ebx]
movzx eax, byte [eax + 0x195]
mov edx, 2
call fcn.0040912c
push dword [ebp - 0x18]
push 0x4e2474
lea ecx, [ebp - 0x1c]
mov eax, dword [ebx]
movzx eax, byte [eax + 0x196]
mov edx, 2
call fcn.0040912c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebx]
movzx eax, byte [eax + 0x197]
mov edx, 2
call fcn.0040912c
push dword [ebp - 0x20]
push 0x4e2474
lea ecx, [ebp - 0x24]
mov eax, dword [ebx]
movzx eax, byte [eax + 0x198]
mov edx, 2
call fcn.0040912c
push dword [ebp - 0x24]
lea ecx, [ebp - 0x28]
mov eax, dword [ebx]
movzx eax, byte [eax + 0x199]
mov edx, 2
call fcn.0040912c
push dword [ebp - 0x28]
lea eax, [ebp - 4]
mov edx, 8
call fcn.00404980
cmp dword [ebp - 4], 0
jne 0x4e242a
mov eax, esi
mov edx, 0x4e2480
call fcn.00404654
jmp 0x4e2434
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404654
mov eax, dword [ebp - 0xc]
call fcn.00402b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2466
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404624
lea eax, [ebp - 4]
call fcn.00404600
ret
Function at 0x4e24c8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404ab0
mov eax, dword [ebp - 8]
call fcn.00404ab0
xor eax, eax
push ebp
push 0x4e2586
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00404ac0
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e251f
xor ebx, ebx
jmp 0x4e256b
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov edx, 0x4e25a0
call fcn.004048c8
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048c0
push eax
mov eax, dword [ebp - 8]
call fcn.00404ac0
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x4e2563
mov bl, 1
jmp 0x4e2565
xor ebx, ebx
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e258d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404624
ret

Function at 0x4e3d10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4e3d48]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4e3d26
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4e3d35
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4e3d44
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4e5058
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4efd04]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4e507e
push 0
mov eax, dword [0x4efd04]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4e5778
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404600
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
call fcn.00404ac0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4e57e3
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
push eax
push 0x4e57e8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4e57e3
mov eax, dword [ebp + 8]
push eax
mov edx, ebx
mov eax, esi
call fcn.004e5680
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x65341d50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x65341dab
cmp byte [esi + ebx - 1], 0xa
je 0x65341d7f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x65342118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x1c07179
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
shr cx, cl
bt cx, 0xb5
sub esp, 4
mov cl, 0x97
mov dword [ebp - 4], 0
cld
sub edx, edx
movzx esi, ax
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov ecx, ebp
cmovns ecx, ecx
btc cx, 0x19
mov edx, dword [edx + 0x14]
cmc
bts esi, ebx
sub esi, 0x690d1295
mov esi, dword [edx + 0x28]
neg ecx
shr ch, cl
push 0x18
and cl, 0x7c
pop ecx
stc
test ecx, ebx
xor edi, edi
cmp bp, 0x37f9
xor eax, eax
lodsb al, byte [esi]
stc
cmp al, 0x61
jmp 0x1c0d1d6
jl 0x1c0d1de
sub al, 0x20
ror edi, 0xd
test edi, 0x1df4e79
test esi, ebx
add edi, eax
jmp 0x1c677a7
cmp edi, 0x6a4abc5b
jmp 0x1c8a914
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x1c756ed
loop 0x1c1bf65
jmp 0x1c14eb3
jmp 0x1c071cb
jne 0x1c071b4
mov eax, ebx
jmp 0x1c18a7e
mov edx, dword [edx]
jmp 0x1c3ac96
jmp 0x1c1bf5e
jmp 0x1c0665f
mov ebx, dword [edx + 0x10]
jmp 0x1c5e333

Function at 0x1c0beb7
Capabilities:
Hash data with crc32

Disassembly:
push ebp
not ebp
clc
mov ebp, esp
or al, 0x3c
inc ax
lea esp, [esp - 4]
rcl ax, 0xbc
sal ah, cl
seto al
mov dword [ebp - 4], 0
and eax, 0x6e191398
cmp esi, 0x4546807
test esp, 0x697d68fa
lea esp, [esp - 0x14]
clc
sal eax, cl
xadd al, ah
push esi
shr ax, cl
ror esi, 0xa0
push ebx
sbb al, 0x73
setae bl
push edi
sar di, 0xa0
shrd eax, eax, 0xfb
push edx
add ax, 0x7ccb
sbb bx, dx
push ecx
clc
bsr esi, ebp
mov eax, dword [ebp + 0x10]
xchg di, bx
sar bh, 0xf1
xor edx, edx
xchg edx, eax
mov esi, 0x3c
cwde
cmp dl, 0xa1
not bh
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xadd ebx, esi
mov esi, dword [eax + 0x78]
and bx, sp
lea esi, [esi + 0x18]
add esi, dword [ebp + 0xc]
cwde
mov eax, dword [esi]
neg ebx
bswap ebx
mov dword [ebp - 0x14], eax
setnp bl
add esi, 4
not bh
mov bx, sp
xchg edi, eax
lea edi, [ebp - 8]
movzx ebx, ax
lodsd eax, dword [esi]
sar bl, cl
bsf bx, cx
add eax, dword [ebp + 0xc]
xchg ebx, ebx
jmp 0x1c47da8
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
movzx ax, dl
xchg al, al
lodsd eax, dword [esi]
sal ebx, 0xcd
clc
cmp sp, ax
add eax, dword [ebp + 0xc]
bswap bx
push eax
stosd dword es:[edi], eax
xor bl, bl
mov dword [ebp - 0xc], eax
sar eax, cl
shrd ebx, ebp, 0x99
bt bx, 0x79
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
bsr ebx, ecx
xor si, bx
mov dword [ebp - 0x10], eax
rcr bl, 0xcb
pop esi
xor bx, bx
or ah, cl
mov dword [ebp - 4], 0
rcr ebx, 0xfc
cbw
or bx, bp
push esi
mov eax, dword [esi]
bt ebx, esi
bt ebx, 0xe7
sal bx, cl
add eax, dword [ebp + 0xc]
cmc
xchg edi, eax
and ebx, ebp
bsr bx, dx
mov ebx, edi
push edi
test ebx, 0x4cc2556e
jmp 0x1c7e831
sub al, al
test ebp, edi
scasb al, byte es:[edi]
jmp loc.01c061fb
Function at 0x1c4a411
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp - 0xc]
bsr ax, dx
and al, 8
bts ax, dx
wait
fnstcw word [ebp - 2]
mov ax, word [ebp - 2]
or ah, 0xc
movsx edx, bx
not dh
mov word [ebp - 4], ax
cwd
rdtsc
fldcw word [ebp - 4]
movsx dx, dl
rdtsc
fistp qword [ebp - 0xc]
fldcw word [ebp - 2]
cwd
movzx edx, ax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x1c5a8f4
push ebp
inc ax
bt bp, bx
mov ebp, esp
add dx, dx
sar dl, 0xb9
jmp 0x1c224a3
ret
Function at 0x422200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5d39f0]
xor edx, edx
cmp eax, edx
jne 0x422226
xor eax, eax
mov byte [eax + 0x5d38f0], al
inc eax
cmp eax, 0x100
jl 0x42220e
mov dword [0x5d39f0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5d38f0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4222b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42228a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x422258
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x422330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x422383
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42236a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret