joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472d9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov byte [ebx], 0
cmp dword [ebp + 8], 0
jle 0x472dd3
call fcn.00473040
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
je 0x472dd3
mov ecx, dword [ebp + 8]
dec ecx
push ecx
call fcn.00472ff0
pop ecx
call fcn.0048c448
mov edi, dword [ebp + 0x10]
mov eax, edi
add eax, eax
push eax
call fcn.004aa5dc
pop ecx
mov esi, eax
mov word [esi], 0
push 0
push esi
push edi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
push eax
call fcn.00473ce8
mov word [esi + edi*2 - 2], 0
add esp, 8
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
push esi
call fcn.004b8058
add esp, 0xc
push esi
call fcn.004aa6ac
pop ecx
call fcn.0048c444
call fcn.00473cac
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x472e4a
mov edx, dword [ebp - 4]
dec edx
push edx
call fcn.00472ff0
pop ecx
push edi
call fcn.00473cd4
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ebx + ecx - 1], 0
test edi, edi
jne 0x472ecf
cmp byte [ebx], 0
je 0x472ecf
push ebx
call fcn.004fe810
pop ecx
mov dword [ebp - 8], ebx
mov esi, eax
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x472e77
add dword [ebp - 8], 2
sub esi, 2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx]
push ecx
push 0x5b92cb
call fcn.004fe7bc
add esp, 8
test eax, eax
je 0x472e94
inc dword [ebp - 8]
dec esi
test esi, esi
je 0x472eb4
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + esi - 1]
push edx
push 0x5b92cb
call fcn.004fe7bc
add esp, 8
test eax, eax
je 0x472eb4
dec esi
test esi, esi
je 0x472ecb
cmp ebx, dword [ebp - 8]
je 0x472ecb
push esi
mov ecx, dword [ebp - 8]
push ecx
push ebx
call fcn.004fe690
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x472ed8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [esi], 0
call fcn.0048c448
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edx
push edx
call fcn.004aa5dc
pop ecx
mov ebx, eax
mov word [ebx], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne dl
and edx, 1
mov edi, edx
push 0
push edi
call fcn.00473ce8
add esp, 8
mov eax, dword [ebp - 4]
mov word [ebx + eax*2 - 2], 0
mov edx, dword [ebp + 0xc]
dec edx
push edx
push esi
push ebx
call fcn.004b8058
add esp, 0xc
push ebx
call fcn.004aa6ac
pop ecx
call fcn.0048c444
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx - 1], 0
test edi, edi
je 0x472f8a
cmp byte [esi], 0
je 0x472f8a
push esi
call fcn.004fe810
pop ecx
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x472f8a
xor edx, edx
mov dl, byte [esi + ebx - 1]
push edx
push 0x5b92cb
call fcn.004fe7bc
add esp, 8
test eax, eax
jne 0x472f8a
mov byte [esi + ebx], 0x5c
inc ebx
mov byte [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x472f94
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00473714
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0048c448
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00473ce8
add esp, 8
push edi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.0048c444
test esi, esi
je 0x472fe7
push esi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x473de4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x473ec5
test edi, edi
je 0x473ec5
call fcn.0048c448
cmp dword [0x5b92d4], 0
jne 0x473e31
push 0x5b92dc
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x473e31
push str.CreateSymbolicLinkW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b92d4], eax
cmp dword [0x5b92d4], 0
je 0x473eb4
push edi
call fcn.00473714
pop ecx
mov esi, eax
mov dword [ebp - 4], eax
push ebx
call fcn.00473714
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x473e60
test al, 0x10
jne 0x473e64
xor edx, edx
jmp 0x473e69
mov edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x473e79
mov ecx, 1
jmp 0x473e7b
xor ecx, ecx
push ecx
push ebx
mov eax, dword [ebp - 4]
push eax
call dword [0x5b92d4]
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00473ce8
add esp, 8
test esi, esi
je 0x473ea7
push esi
call fcn.004aa6ac
pop ecx
test edi, edi
je 0x473ebe
push edi
call fcn.004aa6ac
pop ecx
jmp 0x473ebe
push 1
call fcn.00473cd4
pop ecx
xor ebx, ebx
call fcn.0048c444
jmp 0x473ecf
push 2
call fcn.00473cd4
pop ecx
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x473ed8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
je 0x473ff3
call fcn.0048c448
cmp dword [0x5b92d8], 0
jne 0x473f1f
push 0x5b92dc
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x473f1f
push str.GetFinalPathNameByHandleW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5b92d8], eax
cmp dword [0x5b92d8], 0
je 0x473fe4
push ebx
call fcn.00473714
pop ecx
mov esi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x473f46
test al, 0x10
jne 0x473f4a
xor edx, edx
jmp 0x473f4f
mov edx, 1
mov eax, edx
push 0
test eax, eax
je 0x473f5e
mov ecx, 0x2000010
jmp 0x473f63
mov ecx, 0x80
push ecx
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
jne 0x473f88
push 0
push 0
call fcn.00473ce8
add esp, 8
jmp 0x473fd7
push 0
push 0x108
lea edx, [ebp - 0x210]
push edx
push eax
call dword [0x5b92d8]
cmp eax, 0x108
jae 0x473fcf
test eax, eax
jbe 0x473fc1
mov word [ebp + eax*2 - 0x210], 0
lea eax, [ebp - 0x210]
push eax
call fcn.004b7fe8
pop ecx
mov edi, eax
push 0
push 1
call fcn.00473ce8
add esp, 8
jmp 0x473fd7
push 9
call fcn.00473cd4
pop ecx
test esi, esi
je 0x473fec
push esi
call fcn.004aa6ac
pop ecx
jmp 0x473fec
push 1
call fcn.00473cd4
pop ecx
call fcn.0048c444
jmp 0x473ffb
push 2
call fcn.00473cd4
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4743dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [eax], 0
call fcn.0048c448
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x474409
push ebx
call fcn.00473714
pop ecx
mov esi, eax
jmp 0x47440b
xor eax, eax
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x47442c
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x47442c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00473714
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x474463
lea edx, [ebp - 0x424]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
jne 0x474451
push 0
push 0
call fcn.00473ce8
add esp, 8
xor eax, eax
jmp 0x4744c5
mov word [ebp - 0x216], 0
lea edx, [ebp - 0x424]
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x214]
push ecx
push 0
test ebx, ebx
jne 0x474475
mov ebx, 0x5b9368
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov ebx, eax
test ebx, ebx
je 0x47449d
push 0x107
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.004b8058
add esp, 0xc
test esi, esi
je 0x4744a8
push esi
call fcn.004aa6ac
pop ecx
test edi, edi
je 0x4744b3
push edi
call fcn.004aa6ac
pop ecx
push 0
push ebx
call fcn.00473ce8
add esp, 8
call fcn.0048c444
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474514
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebx], 0
lea eax, [ebp - 0x210]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
je 0x47455a
mov word [ebp - 2], 0
push 0x107
push ebx
lea eax, [ebp - 0x210]
xor esi, esi
push eax
call fcn.004b8058
add esp, 0xc
test esi, esi
jne 0x474583
cmp byte [ebx], 0
je 0x474583
push ebx
call fcn.004fe810
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x47458e
cmp eax, 0x107
jge 0x47458e
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x47458e
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475a8c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x475b7d
call sub.USER32.DLL_EmptyClipboard
cmp dword [ebp + 8], 0xd
jne 0x475ac5
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.004b01f4
add esp, 0x10
mov esi, eax
jmp 0x475add
push 0
push 0
call fcn.004b7c38
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004b0120
add esp, 0x10
mov esi, eax
test esi, esi
je 0x475b73
cmp dword [ebp + 8], 0xd
lea eax, [esi + 1]
jne 0x475af5
mov edx, 2
jmp 0x475afa
mov edx, 1
imul edx
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x475b78
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x475b67
cmp dword [ebp + 8], 0xd
jne 0x475b35
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b01f4
add esp, 0x10
jmp 0x475b4d
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.004b7c38
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b0120
add esp, 0x10
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_SetClipboardData
test eax, eax
setne al
and eax, 1
mov edi, eax
test edi, edi
jne 0x475b78
push ebx
call sub.KERNEL32.DLL_GlobalFree
jmp 0x475b78
mov edi, 1
call sub.USER32.DLL_CloseClipboard
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x475b88
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
call sub.USER32.DLL_IsClipboardFormatAvailable
test eax, eax
je 0x475c4f
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x475c4f
push edi
call sub.USER32.DLL_GetClipboardData
mov esi, eax
test esi, esi
je 0x475c4a
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x475c4a
push esi
call sub.KERNEL32.DLL_GlobalSize
mov ebx, eax
mov eax, edi
dec eax
je 0x475c11
sub eax, 6
je 0x475c11
sub eax, 6
jne 0x475c20
shr ebx, 1
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004afc40
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x475c44
push ebx
mov ecx, dword [ebp - 4]
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.004b0320
add esp, 0x10
jmp 0x475c44
push ebx
mov edx, dword [ebp - 4]
push edx
call fcn.004f4170
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x475c44
push ebx
cmp edi, 1
mov ecx, dword [ebp - 4]
push ecx
jne 0x475c35
call fcn.004b7c38
jmp 0x475c37
xor eax, eax
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b0264
add esp, 0x10
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_CloseClipboard
test ebx, ebx
jne 0x475c61
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004acc48
add esp, 8
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x475ff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
xor ebx, ebx
push esp
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x4760dd
test byte [esp + 0x10], 0x80
je 0x476011
or ebx, 1
test byte [esp + 0x11], 0x80
je 0x47601b
or ebx, 2
test byte [esp + 0x12], 0x80
je 0x476025
or ebx, 4
test byte [esp + 0x5b], 0x80
je 0x476032
or ebx, 0x4000
test byte [esp + 0x5c], 0x80
je 0x47603f
or ebx, 0x8000
test byte [esp + 0x5d], 0x80
je 0x47604c
or ebx, 0x10000
test byte [esp + 0x91], 1
je 0x476059
or ebx, 0x10
test byte [esp + 0x90], 1
je 0x476066
or ebx, 0x20
test byte [esp + 0x14], 1
je 0x476070
or ebx, 0x40
test byte [esp + 0x2d], 1
je 0x47607d
or ebx, 0x80
test byte [esp + 0xa0], 0x80
je 0x47608d
or ebx, 0x100
test byte [esp + 0xa1], 0x80
je 0x47609d
or ebx, 0x200
test byte [esp + 0xa2], 0x80
je 0x4760ad
or ebx, 0x400
test byte [esp + 0xa3], 0x80
je 0x4760bd
or ebx, 0x800
test byte [esp + 0xa4], 0x80
je 0x4760cd
or ebx, 0x1000
test byte [esp + 0xa5], 0x80
je 0x4760dd
or ebx, 0x2000
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x4760e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test eax, eax
je 0x476210
test bl, 1
je 0x476112
mov dl, 0x80
jmp 0x476114
xor edx, edx
test bl, 2
mov byte [ebp - 0xf0], dl
je 0x476123
mov al, 0x80
jmp 0x476125
xor eax, eax
test bl, 4
mov byte [ebp - 0xef], al
je 0x476134
mov dl, 0x80
jmp 0x476136
xor edx, edx
test bh, 0x40
mov byte [ebp - 0xee], dl
je 0x476145
mov al, 0x80
jmp 0x476147
xor eax, eax
test bh, 0x80
mov byte [ebp - 0xa5], al
je 0x476156
mov dl, 0x80
jmp 0x476158
xor edx, edx
test ebx, 0x10000
mov byte [ebp - 0xa4], dl
je 0x47616a
mov al, 0x80
jmp 0x47616c
xor eax, eax
test bl, 0x10
mov byte [ebp - 0xa3], al
je 0x47617b
mov dl, 1
jmp 0x47617d
xor edx, edx
test bl, 0x20
mov byte [ebp - 0x6f], dl
je 0x476189
mov al, 1
jmp 0x47618b
xor eax, eax
test bl, 0x40
mov byte [ebp - 0x70], al
je 0x476197
mov dl, 1
jmp 0x476199
xor edx, edx
test bl, 0x80
mov byte [ebp - 0xec], dl
je 0x4761a8
mov al, 1
jmp 0x4761aa
xor eax, eax
test bh, 1
mov byte [ebp - 0xd3], al
je 0x4761b9
mov dl, 0x80
jmp 0x4761bb
xor edx, edx
test bh, 2
mov byte [ebp - 0x60], dl
je 0x4761c7
mov al, 0x80
jmp 0x4761c9
xor eax, eax
test bh, 4
mov byte [ebp - 0x5f], al
je 0x4761d5
mov dl, 0x80
jmp 0x4761d7
xor edx, edx
test bh, 8
mov byte [ebp - 0x5e], dl
je 0x4761e3
mov al, 0x80
jmp 0x4761e5
xor eax, eax
test bh, 0x10
mov byte [ebp - 0x5d], al
je 0x4761f1
mov dl, 0x80
jmp 0x4761f3
xor edx, edx
test bh, 0x20
mov byte [ebp - 0x5c], dl
je 0x4761ff
mov al, 0x80
jmp 0x476201
xor eax, eax
mov byte [ebp - 0x5b], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.DLL_SetKeyboardState
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476ae8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, 0xffffffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x476b1e
test ecx, ecx
je 0x476b1e
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x5b9390]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0x476b00
xor eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x476b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ax, 0xffff
test edx, edx
mov ecx, dword [ebp + 0x10]
je 0x476b63
test ecx, ecx
je 0x476b63
movzx ebx, ax
movzx edi, byte [edx]
mov esi, ebx
inc edx
xor esi, edi
and esi, 0xff
sar ebx, 8
mov si, word [esi*2 + 0x5b9790]
xor si, bx
dec ecx
mov eax, esi
jne 0x476b3f
xor ax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48601c
Capabilities:
Get hostname

Disassembly:
add esp, 0xffffffdc
mov dword [esp], 0x10
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
mov word [esp + 0x22], 0
cmp word [esp + 4], 0
je 0x486054
lea edx, [esp + 4]
push edx
call fcn.004b7fe8
pop ecx
jmp 0x48605f
push str.HOSTNAME
call fcn.004f21ec
pop ecx
add esp, 0x24
ret
Function at 0x48607c
Capabilities:
Get session user name

Disassembly:
add esp, 0xfffffdfc
mov dword [esp], 0x100
mov word [esp + 4], 0
push esp
lea eax, [esp + 8]
push eax
call sub.ADVAPI32.DLL_GetUserNameW
mov word [esp + 0x202], 0
cmp word [esp + 4], 0
je 0x4860ba
lea edx, [esp + 4]
push edx
call fcn.004b7fe8
pop ecx
jmp 0x4860c5
push str.USER
call fcn.004f21ec
pop ecx
add esp, 0x204
ret
Function at 0x4a6884
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
cmp dword [0x5cd3c4], 0
jne 0x4a68f7
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x4a68ae
mov edx, ebx
dec edx
test edx, ebx
je 0x4a68b3
call fcn.00505624
mov dword [0x5cd3cc], esi
mov dword [0x5cd3c8], ebx
mov dword [0x5cd3d0], 0x40000
mov eax, 5
mov dword [0x5cd3d4], 0x200000
mov dword [0x5cd3d8], eax
mov dword [0x5cd598], eax
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x5cd3c4], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x4aa7f4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
mov eax, dword [ebp + 8]
cmp eax, 0x69
jg 0x4aa857
je 0x4aa92b
cmp eax, 4
jg 0x4aa834
je 0x4aa8eb
sub eax, 1
jb 0x4aa890
je 0x4aa8a4
dec eax
je 0x4aa8c3
dec eax
je 0x4aa8d7
jmp case.0x4aa865.1006
sub eax, 0x65
je 0x4aa8f2
dec eax
je 0x4aa909
dec eax
je 0x4aa910
dec eax
je 0x4aa927
jmp case.0x4aa865.1006
add eax, 0xfffffc17
cmp eax, 8
ja case.0x4aa865.1006
jmp dword [eax*4 + 0x4aa86c]
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x4aa979
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x4aa8b8
mov eax, dword [ebp - 0x34]
jmp 0x4aa8bb
or eax, 0xffffffff
shr eax, 0xa
jmp 0x4aa979
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x4aa979
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x4aa979
xor eax, eax
jmp 0x4aa979
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x4aa979
mov eax, 1
jmp 0x4aa979
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x4aa979
xor eax, eax
jmp 0x4aa979
xor eax, eax
jmp 0x4aa979
call fcn.004aa49c
jmp 0x4aa979
xor eax, eax
jmp 0x4aa979
call fcn.004aa4a4
jmp 0x4aa979
call fcn.004a39f0
jmp 0x4aa979
call fcn.004a39f0
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x4aa979
mov eax, dword [0x5cd0c0]
sub eax, dword [0x5cd0c8]
test eax, eax
jns 0x4aa967
add eax, 3
sar eax, 2
jmp 0x4aa979
xor eax, eax
jmp 0x4aa979
mov eax, 1
jmp 0x4aa979
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4aae58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
jmp 0x4aaeca
test edx, 0x10000
jne 0x4aaf9b
test edx, 0x20000
je 0x4aae81
mov edx, dword [eax + 8]
push edx
mov eax, dword [eax + 0xc]
call dword [eax + 0x10]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x40
jne 0x4aaec3
cmp dword [eax + 0xc], 0
jne 0x4aaec3
cmp dword [eax + 0x10], 0
jl 0x4aaec3
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5bfba8]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x4aaf9b
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
push eax
call fcn.004ae62c
pop ecx
mov edx, dword [eax]
test dh, 0x20
jne 0x4aae60
test byte [eax + 1], 0x80
je 0x4aaf05
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx ecx, word [eax + 0xe]
and ecx, 0xfffffffd
movzx edx, word [0x5bfba8]
cmp ecx, edx
jne 0x4aaf9b
xor word [eax + 0xe], 1
lea ecx, [eax + 0x10]
push ecx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 4
je 0x4aaf34
mov eax, dword [eax + 8]
add eax, 0xfffffff0
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
movzx ecx, word [0x5bfba8]
cmp edx, ecx
jne 0x4aaf9b
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax + 1], 0x10
je 0x4aaf66
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5bfba8]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x4aaf9b
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
test byte [eax], 1
je 0x4aaf9b
cmp dword [eax + 0xc], 0
je 0x4aaf9b
mov ecx, dword [eax + 8]
add ecx, 0xfffffff0
mov eax, ecx
movzx ecx, word [0x5bfba8]
movzx edx, word [eax + 0xe]
and edx, 0xfffffffd
cmp edx, ecx
jne 0x4aaf9b
xor word [eax + 0xe], 1
lea edx, [eax + 0x10]
push edx
mov eax, dword [eax + 8]
call dword [eax + 4]
pop ecx
pop ebp
ret
Function at 0x4f2114
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4f214a
push esi
call fcn.00473714
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
test edi, edi
mov ebx, eax
je 0x4f214a
push edi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f2154
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4f218f
push esi
call fcn.00473714
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4f217b
test al, 0x50
je 0x4f217f
xor ebx, ebx
jmp 0x4f2184
mov ebx, 1
test edi, edi
je 0x4f218f
push edi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f2198
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4f21d3
push esi
call fcn.00473714
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4f21bf
test al, 0x10
jne 0x4f21c3
xor ebx, ebx
jmp 0x4f21c8
mov ebx, 1
test edi, edi
je 0x4f21d3
push edi
call fcn.004aa6ac
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f21ec
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.004b7ef4
pop ecx
mov ebx, eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov esi, eax
test esi, esi
je 0x4f2240
mov eax, esi
add eax, eax
push eax
call fcn.004aa5dc
pop ecx
mov dword [ebp - 4], eax
push esi
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b7fe8
pop ecx
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.004aa6ac
pop ecx
push ebx
call fcn.004aa6ac
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret