joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dbf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x49dc28]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49dc06
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49dc15
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x49dc24
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x49e4bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x44813c]
call fcn.00403c30
test al, al
je 0x49e4fe
mov eax, dword [0x4e482c]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x49e4fe
mov edx, dword [0x4e482c]
xor edx, edx
call fcn.00465490
push 0
mov eax, dword [0x4e482c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x49e9dc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416eb8]
call fcn.00405280
xor eax, eax
push ebp
push 0x49eb20
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e04e8], 0
jne 0x49ea2f
mov ecx, dword [0x4e42f8]
mov dl, 1
mov eax, dword [0x407e34]
call fcn.0040d968
call fcn.00404230
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004032f0
mov eax, ebx
call fcn.004050e0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x49eb30
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040634c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050f0
test eax, eax
jle 0x49eac7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x49eac0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404b00
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404ae8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408db8
test eax, eax
jne 0x49eac0
mov ebx, 0x15
jmp 0x49eacc
mov ebx, 0x10
jmp 0x49eacc
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4e04e8]
call fcn.0049e8d8
mov eax, dword [ebp - 8]
call fcn.0049e8d8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eb27
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040489c
lea eax, [ebp - 0x10]
mov edx, dword [0x416eb8]
call fcn.00405350
ret
Function at 0x4a7df4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4a7dfc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7fee
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4a8004
mov eax, esi
call fcn.004a5b84
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004048cc
lea ecx, [ebp - 0x10]
mov edx, 0x4a8018
mov eax, esi
call fcn.004a5b84
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004048cc
lea ecx, [ebp - 0x14]
mov edx, 0x4a8030
mov eax, esi
call fcn.004a5b84
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004048cc
lea ecx, [ebp - 0x18]
mov edx, 0x4a804c
mov eax, esi
call fcn.004a5b84
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004048cc
lea ecx, [ebp - 0x1c]
mov edx, 0x4a8068
mov eax, esi
call fcn.004a5b84
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004048cc
lea ecx, [ebp - 0x24]
mov edx, 0x4a8080
mov eax, esi
call fcn.004a5b84
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408e28
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004093a0
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4a8098
mov eax, esi
call fcn.004a5b84
mov eax, dword [ebp - 0x28]
call fcn.004a4c9c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4a80a8
mov eax, esi
call fcn.004a5b84
mov eax, dword [ebp - 0x2c]
call fcn.004a4c9c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4a80c0
mov eax, esi
call fcn.004a5b84
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004093a0
inc eax
je 0x4a7f91
lea ecx, [ebp - 0x34]
mov edx, 0x4a80c0
mov eax, esi
call fcn.004a5b84
mov eax, dword [ebp - 0x34]
call fcn.00409364
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aef0
fstp qword [ebp - 0x3c]
wait
call fcn.0040b288
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4a7fac
lea ecx, [ebp - 0x40]
mov edx, 0x4a80c0
mov eax, esi
call fcn.004a5b84
mov eax, dword [ebp - 0x40]
call fcn.004a4c9c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4a80d0
mov eax, esi
call fcn.004a5b84
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004048cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7ff5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040489c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040489c
ret
Function at 0x4b428c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4b42e6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004b427c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004a3908
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004a3508
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b42ed
lea eax, [ebp - 4]
call fcn.00404878
ret

Function at 0x4b9260
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004077d8
ret

Function at 0x4bb72c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bb89d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bb878
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404a60
lea eax, [ebp - 0x118]
mov edx, 0x4bb8b4
call fcn.00404b40
mov eax, dword [ebp - 0x118]
call fcn.00404d38
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4bb7ea
lea eax, [ebp - 0x111]
call fcn.00409f08
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404968
jmp 0x4bb7f1
mov eax, esi
call fcn.00404878
cmp bl, 0x61
jae 0x4bb812
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e77c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004048cc
jmp 0x4bb82c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e6f0
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004048cc
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4bb8c0
call fcn.0040a5e4
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004048cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb87f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4c0b88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c0c81
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004c24fc
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409d50
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c1548
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409c34
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c15bc
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0c88
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040489c
ret
Function at 0x4c0c90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c0d99
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004c24fc
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4c0d5f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409d50
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c1548
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409c34
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c15bc
jmp 0x4c0d71
xor edx, edx
mov eax, ebx
call fcn.004c1548
xor edx, edx
mov eax, ebx
call fcn.004c15bc
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0da0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040489c
ret

Function at 0x4c2758
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c27b6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004c2834
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4c279e
lea eax, [ebp - 4]
call fcn.004c2834
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4c27a0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c27bd
lea eax, [ebp - 4]
call fcn.00404878
ret

Function at 0x4c27c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c2828
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004c2834
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040a0f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c282f
lea eax, [ebp - 4]
call fcn.00404878
ret
Function at 0x4c7c78
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004c7eac
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004c7eac
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4c7cec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4c7d11
inc esi
mov eax, edi
call fcn.004c7cd0
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004c7c78
inc ebx
dec esi
jne 0x4c7cfb
pop edi
pop esi
pop ebx
ret

Function at 0x4c7da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404d28
xor eax, eax
push ebp
push 0x4c7e15
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c7d18
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004c7cd0
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004c7c78
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4c7de0
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7e1c
lea eax, [ebp - 4]
call fcn.00404878
ret
Function at 0x4c89d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c8bbc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4c8b78
mov eax, dword [ebp - 4]
call fcn.004ca328
cmp ebx, eax
jge 0x4c8b78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004bf2a0
mov edx, dword [0x4c0628]
call fcn.00403c54
mov esi, eax
mov eax, esi
call fcn.004c14dc
test al, al
je 0x4c8b6e
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4c8b62
xor eax, eax
push ebp
push 0x4c8b5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c8f90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041c558
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404ec4
mov eax, dword [ebp - 8]
call fcn.00404d90
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c8d54
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8ba6
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4c8b5a
mov eax, dword [ebp - 4]
call fcn.004c9014
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a0f4
jmp 0x4c8ba6
mov eax, dword [ebp - 8]
call fcn.00404878
jmp 0x4c8ba6
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040967c
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4174f4]
call fcn.0040d8e8
call fcn.00404230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8bc3
lea eax, [ebp - 0x54]
call fcn.00404878
ret
Function at 0x4cf9ec
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0
push 1
push 0x4cfa04
call sub.wininet.dll_InternetCheckConnectionA
cmp eax, 1
sbb eax, eax
inc eax
ret
Function at 0x4da948
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4da9b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4da98e
lea eax, [ebp - 4]
lea edx, [ebp - 0x19]
mov ecx, 0x11
call fcn.00404ae8
jmp 0x4da996
lea eax, [ebp - 4]
call fcn.00404878
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da9bd
lea eax, [ebp - 4]
call fcn.00404878
ret

Function at 0x4daee4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00404878
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4daf3e
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4daf32
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040a0f4
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4daf23
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4db070
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x4db087
jne 0x4db08e
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 1
jne 0x4db09d
mov dl, 1
cmp dword [ebp - 4], 1
jne 0x4db0a5
xor edx, edx
mov eax, edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x403468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x1c]
mov eax, 0x10624dd3
mov ecx, 0xa
mov dword [esp + 0x14], 0
mul dword [esi]
mov eax, edx
xor edx, edx
shr eax, 6
div ecx
lea ecx, [esp + 8]
add dl, 0x30
push edx
call sub.MFC42.DLL_CString::operator
mov eax, 0x51eb851f
mov ecx, 0xa
mul dword [esi]
mov eax, edx
xor edx, edx
shr eax, 5
div ecx
lea ecx, [esp + 8]
add dl, 0x30
push edx
call fcn.00402f80
mov eax, 0xcccccccd
mov ecx, 0xa
mul dword [esi]
mov eax, edx
xor edx, edx
shr eax, 3
div ecx
lea ecx, [esp + 8]
add dl, 0x30
push edx
call fcn.00402f80
mov eax, dword [esi]
xor edx, edx
mov ecx, 0xa
div ecx
lea ecx, [esp + 8]
add dl, 0x30
push edx
call fcn.00402f80
mov edx, dword [esp + 8]
mov ecx, edi
push edx
push 0x487
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x402551
push 0x405064
lea ecx, [esp + 0xc]
mov dword [edi + 0x74], 1
call sub.MFC42.DLL_CString::operator_1
push 0
push 0x488
mov ecx, edi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
jmp 0x4025af
mov eax, 0x51eb851f
mul ecx
mov eax, edx
xor edx, edx
shr eax, 5
mov ecx, 0xa
div ecx
lea ecx, [esp + 8]
add dl, 0x30
push edx
call sub.MFC42.DLL_CString::operator
mov eax, 0xcccccccd
mov ecx, 0xa
mul dword [esi + 0xc]
mov eax, edx
xor edx, edx
shr eax, 3
div ecx
lea ecx, [esp + 8]
add dl, 0x30
push edx
call fcn.00402f80
mov eax, dword [esi + 0xc]
xor edx, edx
mov ecx, 0xa
div ecx
lea ecx, [esp + 8]
add dl, 0x30
push edx
call fcn.00402f80
mov edx, dword [esp + 8]
mov ecx, edi
push edx
push 0x488
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
push 0
mov ecx, edi
call sub.MFC42.DLL_CWnd::UpdateData
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00402e60
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40b129
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
je 0x40b13f
xor eax, eax
jmp 0x40b184
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 3
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40bde3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40be8e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
call fcn.005142b0
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40be71
jmp 0x40be8e
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005142d9
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x18]
mov dword [edx + 8], 3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
xor eax, eax
cmp dword [ebp - 0xc], 0
sete al
mov esp, ebp
pop ebp
ret 0xc