joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cda64
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004cd3b8
xor eax, eax
push ebp
push 0x4cdbd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4cdbbf
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4cdaaf
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4cdab9
call fcn.00403e70
jmp 0x4cdbdc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420bb4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4cdbb4
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4cdb67
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4cdb54
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403730
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004cda1c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4cdbe8]
cmp dl, byte [eax + 0x28]
je 0x4cdbbb
call fcn.0040d2f8
jmp 0x4cdbbb
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420bd4
jmp 0x4cdbbb
cmp ecx, ebx
jge 0x4cdb83
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420bd4
jmp 0x4cdab9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00420bb4
cmp edx, dword [esp + 4]
jne 0x4cdba3
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4cdab9
push ebp
call fcn.004cda1c
pop ecx
jmp 0x4cdbbb
push ebp
call fcn.004cda1c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdbdc
mov eax, dword [ebp - 4]
call fcn.004cd3c4
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cdbec
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cdd0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004cd3b8
xor eax, eax
push ebp
push 0x4cdcf1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4cdc3c
call fcn.00403e70
jmp 0x4cdcf8
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4cdcdb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4cdcdb
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403730
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4cdcdb
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040caec
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4cdd28
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x559420]
mov dl, 1
mov eax, dword [0x4ccc90]
call fcn.0040d41c
call fcn.00403dc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdcf8
mov eax, dword [ebp - 4]
call fcn.004cd3c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdd15
lea eax, [ebp - 0x28]
call fcn.00404448
ret
Function at 0x4cdd74
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cdebe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004cd3b8
xor eax, eax
push ebp
push 0x4cdea1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4cddd9
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4cddd9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4cde8b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4cddec
call fcn.00403e70
jmp 0x4cdea8
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4cde8b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4cde8b
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403730
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4cde8b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040caec
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4cded8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x559420]
mov dl, 1
mov eax, dword [0x4ccc90]
call fcn.0040d41c
call fcn.00403dc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdea8
mov eax, dword [ebp - 4]
call fcn.004cd3c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdec5
lea eax, [ebp - 0x28]
call fcn.00404448
ret

Function at 0x4ce580
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404448
push 0
push 0
push 0x4ce5d4
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4ce5cd
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00404a94
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404908
push eax
push 0x4ce5d4
call sub.kernel32.dll_GetEnvironmentVariableA
pop ecx
pop ecx
pop ebp
ret
Function at 0x4ce5dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048f8
xor eax, eax
push ebp
push 0x4ce776
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404448
mov word [0x55b360], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404908
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4aa7d0]
call fcn.00405b18
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404908
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ce745
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4ce784
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ce6ed
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, 4
call fcn.00402a3c
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.004094b8
lea eax, [ebp - 0x24]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.00404968
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 4
mov edx, 5
mov eax, dword [ebp - 0x20]
call fcn.00404968
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
pop ecx
call fcn.00404754
jmp 0x4ce6fa
lea eax, [ebp - 0x20]
mov edx, 0x4ce7a8
call fcn.004044e0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4ce7bc
push dword [ebp - 0x20]
push 0x4ce7d8
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004047c8
mov eax, dword [ebp - 0x2c]
call fcn.00404908
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ce745
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4aa854]
call fcn.004aace0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce77d
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.0040446c
lea eax, [ebp - 0xc]
mov edx, dword [0x4aa7d0]
call fcn.00405c38
lea eax, [ebp - 4]
call fcn.00404448
ret
Function at 0x4ce7e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
xor edx, edx
mov dword [ebp - 0x184], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048f8
xor eax, eax
push ebp
push 0x4ce971
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x55b380], 0xa
jge 0x4ce950
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 4]
mov edx, 0x4ce984
call fcn.00404754
mov eax, dword [ebp - 0x184]
call fcn.00404908
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ce950
mov dword [ebp - 0xc], 0x64
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x7d]
push eax
push 0
push 0
push 0x4ce998
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ce947
mov dword [ebp - 0xc], 0xff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x17d]
push eax
push 0
push 0
push 0x4ce9ac
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ce947
mov byte [ebp - 0x11], 0
mov eax, dword [0x55b380]
dec eax
test eax, eax
jl 0x4ce8f2
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x55b3d8]
call fcn.00404908
lea edx, [ebp - 0x7d]
call fcn.00408eb4
test eax, eax
jne 0x4ce8ea
mov byte [ebp - 0x11], 1
jmp 0x4ce8f2
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4ce8c9
cmp byte [ebp - 0x11], 0
jne 0x4ce947
inc dword [0x55b380]
mov eax, dword [0x55b380]
lea eax, [eax*4 + 0x55b384]
lea edx, [ebp - 0x17d]
mov ecx, pe_nt_image_headers32
call fcn.004046b8
mov eax, dword [0x55b380]
lea eax, [eax*4 + 0x55b3ac]
mov edx, dword [ebp - 4]
call fcn.0040449c
mov eax, dword [0x55b380]
lea eax, [eax*4 + 0x55b3d4]
lea edx, [ebp - 0x7d]
mov ecx, 0x65
call fcn.004046b8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce978
lea eax, [ebp - 0x184]
call fcn.00404448
lea eax, [ebp - 4]
call fcn.00404448
ret
Function at 0x4d190c
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4d1a9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x558a3c]
cmp byte [eax], 0
jne 0x4d1935
call fcn.004d1d4c
mov byte [0x55b36a], 0
cmp dword [0x55b380], 1
jle 0x4d19fa
cmp dword [0x55b378], 0
je 0x4d19fa
lea eax, [ebp - 4]
call fcn.004ce580
lea edx, [ebp - 0x10]
mov eax, dword [0x55b354]
call fcn.00409b3c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4d1ab0
call fcn.00404754
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00404a4c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4d19fa
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404708
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00404708
sub ebx, eax
sub ebx, dword [ebp - 0xc]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.00404708
mov edx, eax
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
pop ecx
call fcn.00404968
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404968
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call fcn.00404754
mov eax, dword [ebp - 4]
call fcn.00404908
push eax
push 0x4d1ab4
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [0x55b408], 0
jbe 0x4d1a15
mov eax, dword [0x55b408]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x55b408], eax
cmp dword [0x55b40c], 0
jbe 0x4d1a30
mov eax, dword [0x55b40c]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [0x55b40c], eax
mov eax, 0x55b354
call fcn.00404448
mov eax, 0x55b358
call fcn.00404448
mov eax, 0x55b35c
call fcn.00404448
mov word [0x55b360], 0
mov byte [0x55b362], 0
mov al, byte [0x4d1abc]
mov byte [0x55b363], al
mov eax, 0x55b378
call fcn.00404448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1aa1
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040446c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040446c
ret
Function at 0x4d2d24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c9c
xor eax, eax
push ebp
push 0x4d2e46
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4aa7d0]
call fcn.00405b18
add esp, 4
mov eax, dword [ebp - 4]
call fcn.0040595c
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x4aa7d0]
call fcn.00405b18
add esp, 4
mov eax, dword [ebp - 4]
call fcn.0040595c
mov esi, eax
test esi, esi
jns 0x4d2d9b
add esi, 7
sar esi, 3
dec esi
test esi, esi
jl 0x4d2ded
inc esi
xor ebx, ebx
xor eax, eax
mov edx, ebx
shl edx, 3
add edx, eax
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
mov ecx, dword [ebp - 0x10]
xor byte [ecx + eax], dl
inc eax
cmp eax, 8
jne 0x4d2da8
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004d2e54
cmp byte [ebp - 5], 0
jne 0x4d2de9
mov eax, ebx
shl eax, 3
push eax
push 8
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004d2c64
inc ebx
dec esi
jne 0x4d2da6
cmp byte [ebp - 5], 0
je 0x4d2e06
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [0x4aa7d0]
call fcn.00405c74
jmp 0x4d2e17
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x4aa7d0]
call fcn.00405c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2e4d
lea eax, [ebp - 0x14]
mov edx, dword [0x4aa7d0]
mov ecx, 2
call fcn.0040504c
lea eax, [ebp - 4]
mov edx, dword [0x4aa7d0]
call fcn.00405c38
ret
Function at 0x4f2998
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f29a0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f2ba3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x559450]
cmp byte [eax], 0
jne 0x4f2b6b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x50], 0
jne 0x4f2b5b
xor edx, edx
push ebp
push 0x4f2b37
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c], 1
je 0x4f29ff
mov eax, dword [0x5594bc]
test byte [eax], 2
jne 0x4f2a83
mov eax, dword [ebp - 4]
call fcn.004f2834
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, 0x4f2bbc
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.004be0ac
mov ebx, eax
mov dx, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx]
mov dl, 2
mov eax, ebx
call fcn.004bdea4
mov edx, 0x41
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.004be0ac
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 8]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.00414580
jmp 0x4f2b2d
mov edx, 0xff
mov eax, dword [0x4aa854]
call fcn.004aac04
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f2b0a
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
push 0xff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xb8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
push eax
mov eax, dword [0x558c20]
mov eax, dword [eax]
call eax
add esp, 0x14
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4aa854]
call fcn.004aace0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x50
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2b11
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4aa854]
call fcn.004aac20
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f2b5b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x50]
call fcn.0040449c
jmp 0x4f2b80
mov edx, dword [0x558dc4]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
mov ecx, 0x4f2c34
call fcn.00404754
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2baa
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040446c
lea eax, [ebp - 0x1c]
call fcn.00410f00
ret
Function at 0x4f3ccc
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, ecx
mov edi, edx
mov esi, eax
push 0
mov eax, dword [edi]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4f3cfe
mov eax, dword [edi]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [edi], eax
test bl, bl
je 0x4f3d1f
push 1
push 0x400
push 0x400
mov eax, dword [esi + 0xc4]
push eax
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
mov al, 1
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x519578
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x51959d
cmp dword [esp + 4], 5
jb 0x51959d
mov al, 1
jmp 0x51959f
xor eax, eax
add esp, 0x94
ret
Function at 0x5389b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5389bc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x538bae
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x538bc4
mov eax, esi
call fcn.00536840
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040449c
lea ecx, [ebp - 0x10]
mov edx, 0x538bd8
mov eax, esi
call fcn.00536840
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040449c
lea ecx, [ebp - 0x14]
mov edx, 0x538bf0
mov eax, esi
call fcn.00536840
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040449c
lea ecx, [ebp - 0x18]
mov edx, 0x538c0c
mov eax, esi
call fcn.00536840
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040449c
lea ecx, [ebp - 0x1c]
mov edx, 0x538c28
mov eax, esi
call fcn.00536840
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040449c
lea ecx, [ebp - 0x24]
mov edx, 0x538c40
mov eax, esi
call fcn.00536840
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408ef4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409524
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x538c58
mov eax, esi
call fcn.00536840
mov eax, dword [ebp - 0x28]
call fcn.0052eb50
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x538c68
mov eax, esi
call fcn.00536840
mov eax, dword [ebp - 0x2c]
call fcn.0052eb50
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x538c80
mov eax, esi
call fcn.00536840
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409524
inc eax
je 0x538b51
lea ecx, [ebp - 0x34]
mov edx, 0x538c80
mov eax, esi
call fcn.00536840
mov eax, dword [ebp - 0x34]
call fcn.004094e8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b170
fstp qword [ebp - 0x3c]
wait
call fcn.0040b4d4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x538b6c
lea ecx, [ebp - 0x40]
mov edx, 0x538c80
mov eax, esi
call fcn.00536840
mov eax, dword [ebp - 0x40]
call fcn.0052eb50
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x538c90
mov eax, esi
call fcn.00536840
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040449c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x538bb5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040446c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040446c
ret
Function at 0x53fd1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x53fd2f
add esp, 0xfffffff0
call fcn.00403898
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x53fda8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403504
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x14], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.00540148
mov edx, dword [ebp - 4]
lea eax, [esi + 8]
call fcn.0040449c
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
mov edx, 0x53fdd4
call fcn.00404754
mov ecx, esi
mov dl, 1
mov eax, dword [0x53fb50]
call fcn.005405a8
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53fdaf
lea eax, [ebp - 4]
call fcn.00404448
ret

Function at 0x5455bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [0x559280]
mov eax, dword [eax]
call fcn.00473e78
cmp byte [ebx + 0x28c], 0
je 0x5455f0
cmp byte [ebx + 0x294], 0
je 0x5455f0
push 0
mov eax, dword [0x559280]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
mov si, 0xffe8
call fcn.00403730
pop esi
pop ebx
ret

Function at 0x545d14
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov eax, ecx
and al, 0x20
mov ebx, ecx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or al, bl
and cl, 1
shl ecx, 4
or al, cl
and eax, 0xff
and edx, 0xff
shl edx, 3
lea edx, [edx*8 + 0x558790]
mov al, byte [edx + eax]
and al, 0xf
pop ebx
ret

Function at 0x545d4c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x545d62
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x545d5b
mov edx, esp
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, 7
call fcn.00402e78
xor edx, edx
mov eax, 0x558990
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x545dc9
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp + 0xc]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x545d7d
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8