joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be7b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x4be7e5
je 0x4be83f
sub eax, 7
je 0x4be806
dec eax
je 0x4be830
sub eax, 0x17
je 0x4be8e4
jmp 0x4be922
add eax, 0xffffff00
sub eax, 9
jb 0x4be8d0
add eax, 0xffffff09
sub eax, 0xb
jb 0x4be898
jmp 0x4be922
mov eax, ebx
call fcn.004a7548
mov edi, eax
test edi, edi
je 0x4be982
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x4be98b
jmp 0x4be982
test byte [ebx + 0x44], 0x20
jne 0x4be98b
jmp 0x4be982
mov edx, esi
mov eax, ebx
call fcn.004bbce4
cmp dword [esi + 0xc], 0xffffffff
jne 0x4be98b
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.004eab74
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.004ba818
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.004be68c
test eax, eax
je 0x4be98b
mov dword [esi + 0xc], 1
jmp 0x4be98b
mov edx, esi
mov eax, ebx
call fcn.004be720
test al, al
je 0x4be982
cmp dword [esi + 0xc], 0
jne 0x4be98b
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.004c0ea0
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x4be98b
mov eax, ebx
call fcn.004bb380
test al, al
jne 0x4be98b
jmp 0x4be982
mov eax, ebx
call fcn.004c0ea0
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x4be982
cmp dword [0x6c35f0], 0
je 0x4be982
mov eax, dword [0x6c35f0]
cmp ebx, dword [eax + 0x24]
jne 0x4be982
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x6c35f0]
call fcn.004bbc18
jmp 0x4be982
mov eax, dword [0x71d940]
cmp byte [eax + 0x20], 0
je 0x4be982
mov eax, dword [0x71d940]
cmp dword [eax + 0x1c], 0
je 0x4be982
mov eax, dword [esi]
mov edx, dword [0x71d940]
cmp eax, dword [edx + 0x1c]
jne 0x4be982
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.004a748c
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.004f6464
jmp 0x4be98b
mov edx, esi
mov eax, ebx
call fcn.004bbce4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bee4c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4bee68
cmp dword [esi + 4], 0
je 0x4bee95
test byte [ebx + 0x45], 1
jne 0x4bee87
mov eax, ebx
call fcn.004bdcfc
test eax, eax
jne 0x4bee87
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4befa5
mov edx, esi
mov eax, ebx
call fcn.004beac4
jmp 0x4befa5
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bef9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004c0ea0
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004bbc18
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004bee4c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004c0ea0
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4befa5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cc494
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cc56c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x71d9c4], 0
jne 0x4cc550
lea eax, [ebp - 4]
mov edx, 0x4cc584
call fcn.004f6dd0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004f717c
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4cc550
mov eax, ebx
call fcn.004f5b58
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4cc549
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x4cc533
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4cc594
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4cc533
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x71d9c4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc550
mov eax, dword [ebp - 0xc]
call fcn.004f5b70
ret
mov ebx, dword [0x71d9c4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc573
lea eax, [ebp - 4]
call fcn.004f6d38
ret

Function at 0x4dda90
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ddb02
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4ddad6
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.004f6ef0
jmp 0x4ddadd
mov eax, ebx
call fcn.004f6d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddb09
cmp dword [ebp - 8], 0
je 0x4ddaf9
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret

Function at 0x4ddbc0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor eax, eax
push ebp
push 0x4ddc18
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddc1f
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret
Function at 0x4ddc28
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor edx, edx
push ebp
push 0x4ddc7d
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddc84
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret

Function at 0x4ddd78
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004dda14
xor eax, eax
push ebp
push 0x4ddded
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004dd9cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4dddd7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dddf4
mov eax, dword [ebp - 4]
call fcn.004dd9e8
ret
Function at 0x4eef50
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ef19d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004f6d8c
cmp dword [0x6c3904], 1
jne 0x4eef9b
cmp dword [0x6c3908], 4
jle 0x4eefda
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.004f717c
push eax
call sub.MPR.DLL_WNetGetUniversalNameA
test eax, eax
jne 0x4ef17f
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x420]
mov edx, dword [edx]
call fcn.004f6ef0
jmp 0x4ef17f
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.004f5df4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x41
jb 0x4ef17f
cmp byte [ebp - 0x15], 0x5a
ja 0x4ef17f
mov eax, dword [ebp - 4]
call fcn.004f6fb8
cmp eax, 3
jl 0x4ef17f
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x4ef17f
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x5c
jne 0x4ef17f
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
push 1
call sub.MPR.DLL_WNetOpenEnumA
test eax, eax
jne 0x4ef17f
xor edx, edx
push ebp
push 0x4ef178
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0x640
mov eax, dword [ebp - 0xc]
call fcn.004f5b58
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x4ef15a
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.MPR.DLL_WNetEnumResourceA
cmp eax, 0xea
jne 0x4ef0a9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.004f5b88
jmp 0x4ef06d
test eax, eax
je 0x4ef0bc
call fcn.004f6aa0
call fcn.004f6aa0
jmp 0x4ef17f
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x4ef06d
inc esi
xor edi, edi
mov eax, edi
shl eax, 2
mov edx, dword [ebp - 0x20]
lea ebx, [edx + eax*8]
cmp dword [ebx + 0x10], 0
je 0x4ef138
mov eax, dword [ebx + 0x10]
mov al, byte [eax]
call fcn.004f5df4
cmp al, byte [ebp - 0x15]
jne 0x4ef138
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.004f6fb8
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.004f71c0
mov eax, dword [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx + 0x14]
call fcn.004f6ef0
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
pop ecx
call fcn.004f7004
call fcn.004f6aa0
call fcn.004f6aa0
jmp 0x4ef17f
inc edi
dec esi
jne 0x4ef0c7
jmp 0x4ef06d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef1a4
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.004f6d5c
ret
Function at 0x4f1440
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4f1479
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004f6e20
jmp 0x4f1482
mov eax, ebx
mov edx, esi
call fcn.004f6d8c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f148c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4f14ad
mov al, byte [esp]
jmp 0x4f14af
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4f5d9c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4f5dcb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004f6e20
jmp 0x4f5de9
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004f5d24
mov edi, eax
test ebx, ebx
je 0x4f5de9
cmp dword [esi], 0
je 0x4f5de9
dec ebx
jmp 0x4f5dd2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4f6100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x6c3b70]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4f6198
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4f6178
xor eax, eax
push ebp
push 0x4f6171
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4f61b4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6178
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x6c3b70]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x6c3b70], ax
mov esp, ebp
pop ebp
ret
Function at 0x4f86cc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4f8888
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4f872d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4f88a4
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4f879f
xor eax, eax
push ebp
push 0x4f8798
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004f8524
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4f8781
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4f88c4
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f879f
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4f8880
cmp byte [ebp - 0xd], 0
jne 0x4f87e1
cmp byte [ebp - 0x12], 0
je 0x4f8880
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4f87fa
dec ebx
cmp byte [ebx], 0x2e
je 0x4f8809
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4f87f9
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4f8880
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4f8836
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4f8880
cmp byte [ebp - 0xd], 0
je 0x4f8880
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4f8880
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f8ca4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x4f8d8c
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x71e074], 1
jae 0x4f8d7e
xor eax, eax
mov dword [0x71dc80], eax
xor eax, eax
mov dword [0x71dc88], eax
xor eax, eax
mov dword [0x71dc8c], eax
mov byte [0x71dc92], 2
mov byte [0x71dc93], 2
mov byte [0x71dc94], 3
mov word [0x71e03c], 0
mov word [0x71e04c], 1
mov word [0x71e05c], 0xa
mov dword [0x71e064], 0x80020004
mov dword [0x71e030], 0x4f7a5c
mov dword [0x71e034], 0x4f7a54
mov dword [0x71e038], 0x4f7a5c
call fcn.004f60d0
test al, al
je 0x4f8d3d
call fcn.004f6100
call fcn.004f61c4
mov eax, 0x71dc98
mov edx, 0x4f8d98
call fcn.004f386e
mov eax, 0x71de64
mov edx, 0x4f8d98
call fcn.004f386e
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x71dc78], eax
call fcn.004f4814
mov dword [0x71dc74], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x71dc6c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8d93
ret

Function at 0x500344
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, eax
lea ecx, [eax + 4]
xor eax, eax
cmp ecx, edx
jbe 0x500368
movsx ebx, byte [edx]
add eax, ebx
mov ebx, eax
shl ebx, 0xa
add eax, ebx
mov ebx, eax
shr ebx, 6
xor eax, ebx
inc edx
cmp ecx, edx
ja 0x500350
mov edx, eax
shl edx, 3
add eax, edx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
shl edx, 0xf
add eax, edx
test eax, eax
jne 0x500384
or eax, 0xffffffff
pop ebx
ret

Function at 0x50760c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
cmp dword [0x6c727c], 0
jne 0x507627
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [esp + 0x14]
mov dword [0x6c727c], eax
mov eax, dword [0x6c727c]
add esp, 0x24
ret
Function at 0x542ab4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
push edi
push ecx
cmp dword [esi + 4], 0
jne 0x542ac4
xor eax, eax
jmp 0x542b28
push 4
push 0
lea edx, [esp + 8]
push edx
call fcn.0056420c
add esp, 0xc
push esp
push 4
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ebx, eax
test ebx, ebx
jge 0x542b25
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
mov eax, dword [esi + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ebx, eax
cmp ebx, 0x8007001e
jne 0x542b0d
call sub.KERNEL32.DLL_GetTickCount
sub eax, edi
cmp eax, 0x14
jb 0x542aee
test ebx, ebx
jl 0x542b25
push esp
push 4
mov eax, dword [esi + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x24]
test eax, eax
jge 0x542b25
xor eax, eax
jmp 0x542b28
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x543afc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
add esp, 0xffffffb0
mov eax, dword [ebx + 4]
mov ebp, esp
test eax, eax
jne 0x543b15
xor eax, eax
jmp 0x543c83
push eax
mov edx, dword [eax]
call dword [edx + 0x64]
test eax, eax
jge 0x543b2f
mov ecx, dword [ebx + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
xor eax, eax
jmp 0x543c83
push 0x50
push 0
push ebp
call fcn.0056420c
add esp, 0xc
push ebp
push 0x50
mov edx, dword [ebx + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
jge 0x543b8f
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
mov eax, dword [ebx + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov esi, eax
cmp esi, 0x8007001e
jne 0x543b74
call sub.KERNEL32.DLL_GetTickCount
sub eax, edi
cmp eax, 0x14
jb 0x543b55
test esi, esi
jl 0x543b8f
push ebp
push 0x50
mov eax, dword [ebx + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x24]
test eax, eax
jge 0x543b8f
xor eax, eax
jmp 0x543c83
xor eax, eax
cmp dword [ebp], 0x7998
jl 0x543ba1
mov edx, 2
jmp 0x543bb3
cmp dword [ebp], 0xffff8667
jg 0x543bb1
mov edx, 1
jmp 0x543bb3
xor edx, edx
or eax, edx
cmp dword [ebp + 4], 0x7998
jl 0x543bc5
mov ecx, 8
jmp 0x543bd7
cmp dword [ebp + 4], 0xffff8667
jg 0x543bd5
mov ecx, 4
jmp 0x543bd7
xor ecx, ecx
or eax, ecx
test byte [ebp + 0x30], 0x80
je 0x543be6
mov edx, 0x10
jmp 0x543be8
xor edx, edx
or eax, edx
test byte [ebp + 0x31], 0x80
je 0x543bf7
mov ecx, 0x20
jmp 0x543bf9
xor ecx, ecx
or eax, ecx
test byte [ebp + 0x32], 0x80
je 0x543c08
mov edx, 0x40
jmp 0x543c0a
xor edx, edx
or eax, edx
test byte [ebp + 0x33], 0x80
je 0x543c19
mov ecx, 0x80
jmp 0x543c1b
xor ecx, ecx
or eax, ecx
test byte [ebp + 0x34], 0x80
je 0x543c2a
mov edx, 0x100
jmp 0x543c2c
xor edx, edx
or eax, edx
test byte [ebp + 0x35], 0x80
je 0x543c3b
mov ecx, pe_nt_image_headers32
jmp 0x543c3d
xor ecx, ecx
or eax, ecx
test byte [ebp + 0x36], 0x80
je 0x543c4c
mov edx, 0x400
jmp 0x543c4e
xor edx, edx
or eax, edx
test byte [ebp + 0x37], 0x80
je 0x543c5d
mov ecx, 0x800
jmp 0x543c5f
xor ecx, ecx
or eax, ecx
test byte [ebp + 0x38], 0x80
je 0x543c6e
mov edx, 0x1000
jmp 0x543c70
xor edx, edx
or eax, edx
test byte [ebp + 0x39], 0x80
je 0x543c7f
mov ecx, 0x2000
jmp 0x543c81
xor ecx, ecx
or eax, ecx
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x544da4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 4]
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ecx + 8], 0x6d0254
mov dword [ecx + 0xc], esp
mov eax, 0x56498f
mov dword [ecx + 4], eax
xor eax, eax
mov word [ecx + 0x10], 0
mov dword [ecx + 0x1c], eax
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
mov word [ecx + 0x10], 8
mov eax, 0x6ace7c
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6ace94
mov ebx, dword [edx]
mov dword [ebx], eax
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 4
mov ebx, 0x6d1520
mov dword [eax], ebx
mov eax, 0x6d14a4
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6d14e0
mov ebx, dword [edx]
mov dword [ebx + 4], eax
mov eax, dword [edx]
add eax, 8
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 8], ebx
lea ebx, [eax + 0x10]
xor esi, esi
mov dword [ebx + 8], esi
mov dword [ebp - 0x2c], 0x80
mov dword [ebp - 0x30], 1
mov ebx, dword [ebp - 0x30]
cmp ebx, dword [ebp - 0x2c]
jbe 0x544e4d
lea ebx, [ebp - 0x30]
jmp 0x544e50
lea ebx, [ebp - 0x2c]
mov ebx, dword [ebx]
mov dword [eax], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 0x30
mov dword [eax + 8], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 0x5c
mov dword [eax], ebx
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 0xc], ebx
xor ebx, ebx
mov dword [eax + 0x10], ebx
xor ebx, ebx
mov byte [eax + 0x18], 0
mov dword [eax + 0x14], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
inc dword [ecx + 0x1c]
mov eax, dword [edx]
mov byte [eax + 0x28], 0
mov eax, dword [edx]
mov dword [eax + 0x50], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x58], ebx
xor ebx, ebx
mov eax, dword [edx]
add eax, 0x40
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov eax, dword [edx]
xor ebx, ebx
mov byte [eax + 0x54], 0
mov eax, dword [edx]
mov dword [eax + 0x3c], ebx
mov eax, dword [ecx]
mov dword fs:[0], eax
mov eax, dword [edx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret