joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464ec8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x464edf
add esp, 0xfffffff0
call fcn.00404948
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424930
mov eax, dword [0x4add94]
cmp word [eax + 2], 0
jne 0x464f07
mov eax, dword [0x4add94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00466960
mov eax, dword [0x4ade60]
cmp word [eax + 2], 0
jne 0x464f21
mov eax, dword [0x4ade60]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00466b6c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41be94]
call fcn.004045f4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41be94]
call fcn.004045f4
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41be94]
call fcn.004045f4
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x42f6dc]
call fcn.00437340
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4650d8
mov eax, dword [0x4adc90]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00437750
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x467230
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4adc90]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0041155c
test eax, eax
je 0x465028
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040cd3c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00411590
test eax, eax
je 0x46503c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405794
mov byte [ebx + 0xd4], 0
push ebx
push 0x466644
call fcn.00425aac
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4adb48]
cmp byte [eax], 0
jne 0x46508d
mov eax, ebx
call fcn.0046521c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00467444
mov eax, ebx
call fcn.00467fa8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4650cd
call fcn.004049a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46549c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46553b
cmp dword [ebx + 0x94], 0
jne 0x465535
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x465424
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x465535
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4654fb
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x465535
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e31c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46550a
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x465754
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4b61d4]
cmp dword [eax + 0x30], 0
je 0x4658b1
test bl, bl
jne 0x465802
cmp dword [esi + 0x9c], 0
jne 0x4657f7
mov eax, esi
call fcn.00467e24
push eax
push 0x465680
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4657c8
mov eax, dword [0x4b61d4]
call fcn.00468414
test al, al
je 0x4657c8
mov eax, dword [0x4b61f8]
call fcn.0040670c
mov edi, eax
cmp edi, 0
jl 0x4657c8
push 0
mov eax, dword [0x4b61f8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4657b2
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4657f7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041e31c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4657d7
inc dword [esi + 0x9c]
jmp 0x4658b1
cmp dword [esi + 0x9c], 0
jle 0x4658b1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4658b1
cmp dword [esi + 0x44], 0
je 0x46585d
mov eax, dword [0x4b61d4]
call fcn.00468414
test al, al
je 0x46585d
mov eax, dword [0x4b61f8]
call fcn.0040670c
mov edi, eax
cmp edi, 0
jl 0x46585d
push 5
mov eax, dword [0x4b61f8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x465847
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46588c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041e31c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46586c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4b61f8
mov ecx, 1
mov edx, dword [0x465660]
call fcn.004068c0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x466398
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x466402
mov eax, ebx
call fcn.00468414
test al, al
jne 0x466402
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405614
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4663ef
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46640f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405578
jmp 0x46640f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405578
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x467628
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x467696
mov eax, esi
call fcn.00450700
test al, al
je 0x467696
mov eax, dword [ebx + 0x84]
call fcn.00450404
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x467696
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46768a
push 0
mov eax, dword [ebx + 0x84]
call fcn.00450404
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004484a8
jmp 0x467696
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00467464
pop esi
pop ebx
ret

Function at 0x468644
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x4846c8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov dword [ecx], 0xffffffff
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x4846fb
inc eax
movzx edx, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x4ac10c]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x4846da
pop esi
pop ebx
ret

Function at 0x484700
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059a4
xor eax, eax
push ebp
push 0x484793
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 8]
mov eax, 0x4ac10c
mov edx, 0x400
call fcn.004846c8
not dword [ebp - 8]
cmp dword [ebp - 8], 0x6fcf9e13
jne 0x48477d
mov dword [ebx], 0xffffffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x484759
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x48477b
lea eax, [ebp - 4]
call fcn.00405a14
mov edx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x484773
sub eax, 4
mov eax, dword [eax]
mov ecx, ebx
xchg edx, eax
call fcn.004846c8
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48479a
lea eax, [ebp - 4]
call fcn.00405524
ret

Function at 0x4875e4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x487612
mov eax, ebx
call fcn.00488098
cmp dword [ebx + 0x40], 0
je 0x48760b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x487683
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x487675
cmp dword [ebx + 8], 0
je 0x487634
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x487646
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x487675
cmp dword [ebx + 8], 0
je 0x487627
cmp eax, 3
je 0x487659
dec eax
jne 0x487627
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x487627
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x487627
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4876a1
cmp dword [ebx + 0x14], 0xcc
je 0x4876a1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004876ac
pop ebx
ret
Function at 0x497b98
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4ace10]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x497be3
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x49d0b4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc40
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059a4
xor eax, eax
push ebp
push 0x49d2b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0049d3c8
test al, al
jne 0x49d0f2
mov byte [ebp - 5], 1
jmp 0x49d2a2
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x49d298
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor eax, eax
push ebp
push 0x49d287
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004059b4
mov edi, eax
mov word [ebp - 0x28], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
push edi
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebp - 0x24], esi
inc esi
jne 0x49d15d
call fcn.00404f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d2a2
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x49d183
call fcn.00404f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d2a2
xor eax, eax
push ebp
push 0x49d26d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x49d245
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_connect
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x49d245
lea eax, [ebp - 0x12c]
call fcn.0040abe4
lea eax, [ebp - 0x230]
call fcn.0040abe4
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0xc]
call fcn.0040abd4
lea edx, [ebp - 0x230]
mov eax, dword [ebp - 0xc]
call fcn.0040abd4
movzx eax, bl
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0
call sub.wsock32.dll_select
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0xc]
call fcn.0040abbc
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d274
cmp dword [ebp - 0xc], 0xffffffff
je 0x49d26c
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_shutdown
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d2bf
lea eax, [ebp - 4]
call fcn.00405524
ret
Function at 0x49d2cc
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405524
xor edx, edx
push ebp
push 0x49d360
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x49d34f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
call fcn.004059b4
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x49d33c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.0040571c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d356
call sub.wsock32.dll_WSACleanup
ret

Function at 0x49fc84
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49fd01
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 8]
call fcn.0040cf3c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49fcf0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040571c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fcf7
cmp dword [ebp - 4], 0
je 0x49fcef
mov eax, dword [ebp - 4]
call fcn.0040cf88
ret

Function at 0x49fd4c
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059a4
mov eax, dword [ebp - 8]
call fcn.004059a4
xor eax, eax
push ebp
push 0x49fe0d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49fde8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 1
mov eax, dword [ebp - 4]
call fcn.004059b4
mov ebx, eax
push ebx
call sub.mpr.dll_WNetCancelConnection2A
mov eax, dword [ebp - 8]
mov edx, 0x49fe24
call fcn.0040594c
jne 0x49fdb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49fdf2
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 8]
call fcn.004059b4
mov dword [ebp - 0x14], eax
mov eax, 0x49fe28
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call sub.mpr.dll_WNetAddConnection2A
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49fdf2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fe14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405548
ret
Function at 0x4a01bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0205
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00405794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a020f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a06c4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0755
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a0735
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfd
lea eax, [ebp - 4]
mov edx, 0xfe
call fcn.00405c44
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004059b4
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405c44
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040c05c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a073f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a075c
lea eax, [ebp - 4]
call fcn.00405524
ret

Function at 0x4a0a38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x4a0a73
push 0
push ebx
push 0
push 0x11
call sub.user32.dll_keybd_event
cmp ebx, 2
jne 0x4a0a73
push 0x11
call sub.user32.dll_GetAsyncKeyState
push 0xa2
call sub.user32.dll_GetAsyncKeyState
push 0xa3
call sub.user32.dll_GetAsyncKeyState
mov eax, dword [ebp + 8]
cmp byte [eax - 2], 0
je 0x4a0aa8
push 0
push ebx
push 0
push 0x12
call sub.user32.dll_keybd_event
cmp ebx, 2
jne 0x4a0aa8
push 0x12
call sub.user32.dll_GetAsyncKeyState
push 0xa4
call sub.user32.dll_GetAsyncKeyState
push 0xa5
call sub.user32.dll_GetAsyncKeyState
mov eax, dword [ebp + 8]
cmp byte [eax - 3], 0
je 0x4a0add
push 0
push ebx
push 0
push 0x10
call sub.user32.dll_keybd_event
cmp ebx, 2
jne 0x4a0add
push 0x10
call sub.user32.dll_GetAsyncKeyState
push 0xa0
call sub.user32.dll_GetAsyncKeyState
push 0xa1
call sub.user32.dll_GetAsyncKeyState
mov eax, dword [ebp + 8]
cmp byte [eax - 4], 0
je 0x4a0b05
push 0
push ebx
push 0
push 0x5b
call sub.user32.dll_keybd_event
cmp ebx, 2
jne 0x4a0b05
push 0x5b
call sub.user32.dll_GetAsyncKeyState
push 0x5c
call sub.user32.dll_GetAsyncKeyState
pop ebx
pop ebp
ret
Function at 0x4a0b08
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 8]
call fcn.004059a4
mov eax, dword [ebp - 0xc]
call fcn.004059a4
xor eax, eax
push ebp
push 0x4a0c6e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a0c49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x4a0c84
call fcn.0040594c
sete bl
mov eax, dword [ebp - 8]
mov edx, 0x4a0c90
call fcn.0040594c
sete byte [ebp - 0xe]
mov edx, dword [ebp - 0xc]
mov eax, 0x4a0c9c
call fcn.00405b00
test eax, eax
setg byte [ebp - 1]
mov edx, dword [ebp - 0xc]
mov eax, 0x4a0ca8
call fcn.00405b00
test eax, eax
setg byte [ebp - 2]
mov edx, dword [ebp - 0xc]
mov eax, 0x4a0cb4
call fcn.00405b00
test eax, eax
setg byte [ebp - 3]
mov edx, dword [ebp - 0xc]
mov eax, 0x4a0cc0
call fcn.00405b00
test eax, eax
setg byte [ebp - 4]
test bl, bl
jne 0x4a0bf4
cmp byte [ebp - 0xe], 0
jne 0x4a0bf4
push ebp
xor eax, eax
call fcn.004a0a38
pop ecx
push 0
push 0
push 0
movzx eax, byte [ebp - 0xd]
push eax
call sub.user32.dll_keybd_event
push 0
push 2
push 0
movzx eax, byte [ebp - 0xd]
push eax
call sub.user32.dll_keybd_event
push ebp
mov eax, 2
call fcn.004a0a38
pop ecx
jmp 0x4a0c3f
test bl, bl
je 0x4a0c1e
push ebp
xor eax, eax
call fcn.004a0a38
pop ecx
push 0
push 0
push 0
movzx eax, byte [ebp - 0xd]
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
movzx eax, byte [ebp - 0xd]
push eax
call sub.user32.dll_keybd_event
jmp 0x4a0c3f
cmp byte [ebp - 0xe], 0
je 0x4a0c3f
push 0
push 2
push 0
movzx eax, byte [ebp - 0xd]
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
movzx eax, byte [ebp - 0xd]
push eax
call sub.user32.dll_keybd_event
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0c53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0c75
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405548
ret