joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4774b8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41a548]
call fcn.00404ee0
xor eax, eax
push ebp
push 0x4775fc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52621c], 0
jne 0x47750b
mov ecx, dword [0x5280a8]
mov dl, 1
mov eax, dword [0x407ea4]
call fcn.0040cc28
call fcn.00403cb4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402de4
mov eax, ebx
call fcn.00404ba4
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x47760c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004061dc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404bb4
test eax, eax
jle 0x4775a3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x47759c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004045a0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404588
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d64
test eax, eax
jne 0x47759c
mov ebx, 0x15
jmp 0x4775a8
mov ebx, 0x10
jmp 0x4775a8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x52621c]
call fcn.00477410
mov eax, dword [ebp - 8]
call fcn.00477410
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004061f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477603
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040433c
lea eax, [ebp - 0x10]
mov edx, dword [0x41a548]
call fcn.00404fb0
ret
Function at 0x47fe44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4800a4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x47fea7
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0047faec
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d570
cmp al, 1
jne 0x47fea7
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0047fdb4
test al, al
je 0x480033
cmp dword [ebp - 8], 0
jge 0x47fec5
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0047faec
mov eax, dword [ebp - 0x210]
call fcn.004045d8
cmp ebx, eax
jge 0x47ff0f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0047faec
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5288f8]
and eax, 0xff
bt dword [edx], eax
jae 0x47ff0f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x47ff23
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047fe20
cmp ebx, dword [ebp - 8]
je 0x480025
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47ff4f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403620
and eax, 0x7f
movzx eax, word [eax*2 + 0x52633c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x480012
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403620
and eax, 0x7f
movzx eax, word [eax*2 + 0x52633c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0045c3fc
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403620
and eax, 0x7f
movzx eax, word [eax*2 + 0x52633c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0045c3fc
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480019
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x480086
cmp dword [ebp - 8], 0
jge 0x48003e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0047faec
mov eax, dword [ebp - 0x218]
call fcn.004045d8
cmp eax, dword [ebp - 8]
jg 0x480078
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0047faec
mov eax, dword [ebp - 0x21c]
call fcn.004045d8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047fe20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4800ab
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040433c
ret
Function at 0x4aedec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4aee09
add esp, 0xfffffff0
call fcn.00403788
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4aefa5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a55f8
test al, al
jne 0x4aee46
mov ecx, 0x4aefd8
mov dl, 1
mov eax, dword [0x499cf4]
call fcn.0040cb6c
call fcn.00403cb4
xor eax, eax
push ebp
push 0x4aee72
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004a40a4
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004a3f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aee92
mov eax, dword [ebp - 0x10]
mov edx, 0x4af014
call fcn.00404ccc
je 0x4aeeaf
mov eax, esi
mov edx, 0x4af014
call fcn.00404ccc
jne 0x4aeed3
mov eax, edi
mov edx, 0x4af024
call fcn.00404ccc
je 0x4aeed3
mov ecx, 0x4aeffc
mov dl, 1
mov eax, dword [0x499f9c]
call fcn.0040cb6c
call fcn.00403cb4
mov eax, edi
xor edx, edx
call fcn.00404ccc
jne 0x4aef00
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404ccc
je 0x4aef00
mov ecx, 0x4aeffc
mov dl, 1
mov eax, dword [0x499f9c]
call fcn.0040cb6c
call fcn.00403cb4
mov eax, dword [ebp - 0x10]
mov edx, 0x4af064
call fcn.00404ccc
jne 0x4aef33
mov eax, edi
mov edx, 0x4af070
call fcn.00404ccc
je 0x4aef33
mov ecx, 0x4aeffc
mov dl, 1
mov eax, dword [0x499f9c]
call fcn.0040cb6c
call fcn.00403cb4
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004acedc
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404a60
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00404a60
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00404a60
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404a60
lea eax, [ebx + 8]
call fcn.00404a24
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x4af0bc]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aefac
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a3c
ret
Function at 0x4b08a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4b08bd
add esp, 0xfffffff0
call fcn.00403788
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4b0a58
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a55f8
test al, al
jne 0x4b08fa
mov ecx, 0x4b0a8c
mov dl, 1
mov eax, dword [0x499cf4]
call fcn.0040cb6c
call fcn.00403cb4
xor eax, eax
push ebp
push 0x4b0926
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004a40a4
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004a3f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0946
mov eax, edi
xor edx, edx
call fcn.00404ccc
jne 0x4b0973
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404ccc
je 0x4b0973
mov ecx, 0x4b0ab0
mov dl, 1
mov eax, dword [0x499f9c]
call fcn.0040cb6c
call fcn.00403cb4
mov eax, dword [ebp - 0x10]
mov edx, 0x4b0ac8
call fcn.00404ccc
jne 0x4b09a6
mov eax, edi
mov edx, 0x4b0ad4
call fcn.00404ccc
je 0x4b09a6
mov ecx, 0x4b0ab0
mov dl, 1
mov eax, dword [0x499f9c]
call fcn.0040cb6c
call fcn.00403cb4
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004acedc
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404a60
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00404a60
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00404a60
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404a60
lea eax, [ebx + 8]
call fcn.00404a24
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x41b0e8]
call fcn.004033ec
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x41b0e8]
call fcn.004033ec
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x41b0e8]
call fcn.004033ec
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x4b0b20]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x49cd18]
call fcn.004ac134
mov dword [ebx + 0x3c], eax
mov ax, word [0x4b0b24]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0a5f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a3c
ret
Function at 0x4b34b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4b34d6
add esp, 0xfffffff0
call fcn.00403788
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4b3641
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a55f8
test al, al
jne 0x4b3513
mov ecx, 0x4b3674
mov dl, 1
mov eax, dword [0x499cf4]
call fcn.0040cb6c
call fcn.00403cb4
push dword [0x526e48]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x526e48]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c84
mov eax, dword [ebp - 0xc]
call fcn.004a60d0
test al, al
jne 0x4b35e5
push dword [0x526e44]
push dword [ebp + 8]
push dword [0x526e44]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404c84
mov eax, dword [ebp - 0x14]
call fcn.004a60d0
test al, al
jne 0x4b35e5
push dword [0x526e48]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x526e48]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404c84
mov eax, dword [ebp - 0x18]
call fcn.004a61e8
test al, al
jne 0x4b35e5
push dword [0x526e44]
push edi
push dword [0x526e44]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404c84
mov eax, dword [ebp - 0x20]
call fcn.004a61e8
test al, al
jne 0x4b35e5
mov ecx, 0x4b3674
mov dl, 1
mov eax, dword [0x499cf4]
call fcn.0040cb6c
call fcn.00403cb4
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004acedc
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404a60
lea eax, [ebx + 8]
call fcn.00404a24
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.00404a60
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.00404a60
mov byte [ebx + 0xc], 0xc
mov ax, word [0x4b3690]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3648
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404a3c
ret

Function at 0x4e8144
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e81bf
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4e81a6
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404588
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00408bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e81c6
lea eax, [ebp - 0x104]
call fcn.00404318
ret
Function at 0x4f7118
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4f71d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x4f7157
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.00402b14
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x4f71ae
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.0041da70
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x4f71ae
lea edx, [ebp - 4]
mov eax, dword [0x528558]
call fcn.004066bc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004f7018
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f71d9
lea eax, [ebp - 4]
call fcn.00404318
ret
Function at 0x5182a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5182a8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x51849a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x5184b0
mov eax, esi
call fcn.0051612c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040436c
lea ecx, [ebp - 0x10]
mov edx, 0x5184c4
mov eax, esi
call fcn.0051612c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040436c
lea ecx, [ebp - 0x14]
mov edx, 0x5184dc
mov eax, esi
call fcn.0051612c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040436c
lea ecx, [ebp - 0x18]
mov edx, 0x5184f8
mov eax, esi
call fcn.0051612c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040436c
lea ecx, [ebp - 0x1c]
mov edx, 0x518514
mov eax, esi
call fcn.0051612c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040436c
lea ecx, [ebp - 0x24]
mov edx, 0x51852c
mov eax, esi
call fcn.0051612c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408dd4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409490
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x518544
mov eax, esi
call fcn.0051612c
mov eax, dword [ebp - 0x28]
call fcn.0050fc04
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x518554
mov eax, esi
call fcn.0051612c
mov eax, dword [ebp - 0x2c]
call fcn.0050fc04
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x51856c
mov eax, esi
call fcn.0051612c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409490
inc eax
je 0x51843d
lea ecx, [ebp - 0x34]
mov edx, 0x51856c
mov eax, esi
call fcn.0051612c
mov eax, dword [ebp - 0x34]
call fcn.00409454
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aaa8
fstp qword [ebp - 0x3c]
wait
call fcn.0040ae0c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x518458
lea ecx, [ebp - 0x40]
mov edx, 0x51856c
mov eax, esi
call fcn.0051612c
mov eax, dword [ebp - 0x40]
call fcn.0050fc04
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x51857c
mov eax, esi
call fcn.0051612c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040436c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5184a1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040433c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040433c
ret
Function at 0x51f22c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x51f286
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0051f21c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0050e870
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0050e470
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f28d
lea eax, [ebp - 4]
call fcn.00404318
ret
Function at 0x401710
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401722
mov eax, dword [0x50c08f]
shl eax, 2
mov dword [0x50c093], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004fd3d4
pop edx
call fcn.004fcff0
call fcn.004fd8c0
push 0
call fcn.004fea54
pop ecx
push 0x50c038
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x50c097], eax
push 0
jmp fcn.00507f44

Function at 0x402f50
Capabilities:
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
mov eax, 0x50c8bc
call fcn.004fde78
mov dword [ebp - 0x28], 0xa
and dword [ebp - 0x28], 2
push dword [ebp - 0x28]
push 0x50c7d6
call fcn.005004e0
add esp, 8
mov esi, 0x50c470
lea edi, [ebp - 0x25c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0xc
mov esi, 0x50c490
lea edi, [ebp - 0x228]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0x18
mov eax, dword [0x50c690]
mov dword [ebp - 0x234], eax
mov eax, dword [0x50c694]
mov dword [ebp - 0x230], eax
mov word [ebp - 0x14], 0x24
xor edx, edx
mov dword [ebp - 0x23c], edx
inc dword [ebp - 0x28]
xor dword [ebp - 0x28], 2
push dword [ebp - 0x28]
push 0x50c7df
call fcn.005004e0
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 0x229], 0
mov byte [ebp - 0x22a], 0
mov word [ebp - 0x236], 0
mov eax, dword [ebp - 0x23c]
add eax, eax
lea eax, [eax + eax*2]
and eax, 0x80000007
jns 0x403024
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, 0xa
sub ecx, eax
mov edx, dword [ebp - 0x23c]
add edx, edx
lea edx, [edx + edx*2]
test edx, edx
jns 0x40303d
add edx, 7
sar edx, 3
mov eax, dword [ebp + 8]
movzx edx, byte [eax + edx]
shl edx, 8
mov eax, dword [ebp - 0x23c]
add eax, eax
lea eax, [eax + eax*2]
test eax, eax
jns 0x40305c
add eax, 7
sar eax, 3
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx + eax + 1]
add edx, eax
sar edx, cl
mov word [ebp - 0x236], dx
movzx edx, word [ebp - 0x236]
sar edx, 5
and dl, 1
or dl, byte [ebp - 0x229]
add edx, edx
mov byte [ebp - 0x229], dl
movzx ecx, word [ebp - 0x236]
sar ecx, 0
and cl, 1
or cl, byte [ebp - 0x229]
mov byte [ebp - 0x229], cl
movzx eax, word [ebp - 0x236]
sar eax, 1
and al, 0xf
mov byte [ebp - 0x22a], al
mov ecx, dword [ebp - 0x23c]
inc ecx
and ecx, 0x80000001
jns 0x4030cb
dec ecx
or ecx, 0xfffffffe
inc ecx
shl ecx, 2
xor edx, edx
mov dl, byte [ebp - 0x229]
shl edx, 4
mov eax, dword [ebp - 0x23c]
shl eax, 6
lea eax, [ebp + eax - 0x228]
lea edx, [eax + edx]
xor eax, eax
mov al, byte [ebp - 0x22a]
mov dl, byte [edx + eax]
shl dl, cl
mov ecx, dword [ebp - 0x23c]
sar ecx, 1
jns 0x403106
adc ecx, 0
or byte [ebp + ecx - 0x234], dl
inc dword [ebp - 0x23c]
cmp dword [ebp - 0x23c], 7
jle 0x402ff6
push 0x20
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 8]
lea edx, [ebp - 0x234]
push edx
call fcn.00402c44
add esp, 0x10
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4087b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xa
and dword [ebp - 8], 2
push dword [ebp - 8]
push 0x50dd66
call fcn.005004e0
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jg 0x408826
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4]
shr ecx, 8
mov eax, dword [ebp - 4]
mov byte [eax + 0x52451c], cl
inc dword [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov al, byte [edx + ecx*4]
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 0x52451c], al
inc dword [ebp - 4]
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jle 0x4087ec
inc dword [ebp - 8]
xor dword [ebp - 8], 2
push dword [ebp - 8]
push 0x50dd6f
call fcn.005004e0
add esp, 8
mov eax, dword [ebp - 4]
mov byte [eax + 0x52451c], 0
mov edx, dword [ebp - 4]
dec edx
mov dword [ebp - 0x10], edx
jmp 0x40885d
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x52451c], 0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jle 0x408872
mov eax, dword [ebp - 0x10]
movsx edx, byte [eax + 0x52451c]
cmp edx, 0x20
je 0x408850
mov eax, 0x52451c
mov esp, ebp
pop ebp
ret

Function at 0x40887c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff34
push esi
push edi
mov eax, 0x50dda4
call fcn.004fde78
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov esi, 0x50db48
lea edi, [ebp - 0xcc]
mov ecx, 0x25
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0xc
mov dword [ebp - 0xcc], 0x94
lea eax, [ebp - 0xcc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004fd9b8
add esp, 0xc
mov dword [ebp - 0x34], 0xa
and dword [ebp - 0x34], 2
push dword [ebp - 0x34]
push 0x50dd78
call fcn.005004e0
add esp, 8
cmp dword [ebp - 0xbc], 2
jne 0x408975
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407ad8
add esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40892e
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408360
add esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x408945
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407ed8
add esp, 8
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x34]
xor dword [ebp - 0x34], 2
push dword [ebp - 0x34]
push 0x50dd81
call fcn.005004e0
add esp, 8
cmp dword [ebp - 0x28], 0
jne 0x4089aa
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408550
add esp, 8
mov dword [ebp - 0x28], eax
jmp 0x4089aa
xor edx, edx
mov dword [ebp - 0x38], edx
mov word [ebp - 0x14], 0xc
jmp 0x408996
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004081e8
add esp, 8
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xa
jge 0x4089aa
cmp dword [ebp - 0x28], 0
jne 0x4089aa
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x408982
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret