joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f294
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49f4f4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49f2f7
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049ef3c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d964
cmp al, 1
jne 0x49f2f7
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0049f204
test al, al
je 0x49f483
cmp dword [ebp - 8], 0
jge 0x49f315
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049ef3c
mov eax, dword [ebp - 0x210]
call fcn.004044f0
cmp ebx, eax
jge 0x49f35f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049ef3c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x571a14]
and eax, 0xff
bt dword [edx], eax
jae 0x49f35f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49f373
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049f270
cmp ebx, dword [ebp - 8]
je 0x49f475
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49f39f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403618
and eax, 0x7f
movzx eax, word [eax*2 + 0x56f098]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49f462
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403618
and eax, 0x7f
movzx eax, word [eax*2 + 0x56f098]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004636d8
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403618
and eax, 0x7f
movzx eax, word [eax*2 + 0x56f098]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004636d8
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f469
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49f4d6
cmp dword [ebp - 8], 0
jge 0x49f48e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049ef3c
mov eax, dword [ebp - 0x218]
call fcn.004044f0
cmp eax, dword [ebp - 8]
jg 0x49f4c8
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049ef3c
mov eax, dword [ebp - 0x21c]
call fcn.004044f0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049f270
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f4fb
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404254
ret
Function at 0x4ba3f4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4ba3fc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ba5ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4ba604
mov eax, esi
call fcn.004b8290
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404284
lea ecx, [ebp - 0x10]
mov edx, 0x4ba618
mov eax, esi
call fcn.004b8290
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404284
lea ecx, [ebp - 0x14]
mov edx, 0x4ba630
mov eax, esi
call fcn.004b8290
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404284
lea ecx, [ebp - 0x18]
mov edx, 0x4ba64c
mov eax, esi
call fcn.004b8290
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404284
lea ecx, [ebp - 0x1c]
mov edx, 0x4ba668
mov eax, esi
call fcn.004b8290
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404284
lea ecx, [ebp - 0x24]
mov edx, 0x4ba680
mov eax, esi
call fcn.004b8290
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408bc0
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409108
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4ba698
mov eax, esi
call fcn.004b8290
mov eax, dword [ebp - 0x28]
call fcn.004ad318
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4ba6a8
mov eax, esi
call fcn.004b8290
mov eax, dword [ebp - 0x2c]
call fcn.004ad318
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4ba6c0
mov eax, esi
call fcn.004b8290
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409108
inc eax
je 0x4ba591
lea ecx, [ebp - 0x34]
mov edx, 0x4ba6c0
mov eax, esi
call fcn.004b8290
mov eax, dword [ebp - 0x34]
call fcn.004090cc
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a994
fstp qword [ebp - 0x3c]
wait
call fcn.0040ad24
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4ba5ac
lea ecx, [ebp - 0x40]
mov edx, 0x4ba6c0
mov eax, esi
call fcn.004b8290
mov eax, dword [ebp - 0x40]
call fcn.004ad318
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4ba6d0
mov eax, esi
call fcn.004b8290
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba5f5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404254
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404254
ret
Function at 0x4c14d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c1532
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c14c8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004abd8c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004ab98c
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1539
lea eax, [ebp - 4]
call fcn.00404230
ret

Function at 0x4c4d98
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x56fa14]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4c4dd4
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4c4dec
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4c4de5
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00402e08
xor edx, edx
mov eax, 0x56fc14
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4c4e56
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4c4e0a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4c5094
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4c50ad
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4c50a6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4c50bf
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4c50b8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004c4c88
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4c50d9
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004c4d98
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4c515e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4c517b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004c4d18
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4c51a4
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c51bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4c51d5
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4c51ce
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4c51e9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c4b80
test bl, bl
jne 0x4c52bc
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x5740c0
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4c5220
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4c5234
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c5094
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4c5266
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4c5215
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4c5289
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4c529a
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4c52ae
jmp 0x4c5377
cmp bl, 1
jne 0x4c5377
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x57411a
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4c52dc
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4c52f0
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c5094
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4c5322
sub ebx, 6
inc dword [ebp - 8]
jne 0x4c52d1
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4c5349
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4c535a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4c536e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c4c04
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4c59f0
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402e08
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4c8974
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046e0
mov eax, dword [ebp - 8]
call fcn.004046e0
xor eax, eax
push ebp
push 0x4c8a43
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x43e48c]
call fcn.0043e63c
mov dword [ebp - 0xc], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.0043e6d4
mov cl, 1
mov edx, 0x4c8a5c
mov eax, dword [ebp - 0xc]
call fcn.0043e73c
xor eax, eax
push ebp
push 0x4c8a0c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4c89f7
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0043ea28
jmp 0x4c8a02
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0043e860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c8a18
mov eax, dword [ebp - 0xc]
call fcn.0043e6a4
mov eax, dword [ebp - 0xc]
call fcn.0040341c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8a4a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404254
ret

Function at 0x4c8a8c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046e0
xor eax, eax
push ebp
push 0x4c8b3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x43e48c]
call fcn.0043e63c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c8b09
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0043e6d4
mov cl, 1
mov edx, 0x4c8b54
mov eax, dword [ebp - 8]
call fcn.0043e73c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0043ec10
test al, al
jne 0x4c8aff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c8b15
mov eax, dword [ebp - 8]
call fcn.0043e6a4
mov eax, dword [ebp - 8]
call fcn.0040341c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8b42
lea eax, [ebp - 4]
call fcn.00404230
ret
Function at 0x4c8e44
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4c8e4d
mov eax, dword [ebp - 4]
add esp, 0xfffffd88
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046e0
xor eax, eax
push ebp
push 0x4c8fa5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
lea eax, [ebp - 0x101c]
mov edx, 0x1004
call fcn.004c7820
test eax, eax
je 0x4c8f79
mov eax, dword [ebp - 8]
shr eax, 2
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4c8e20]
call fcn.004056d4
add esp, 4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x101c]
mov ecx, dword [ebp - 8]
call fcn.004029ec
mov eax, dword [ebp - 0xc]
call fcn.00405520
mov esi, eax
test esi, esi
jb 0x4c8f79
inc esi
xor edi, edi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edi*4]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x4c8f71
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x7e78]
mov ecx, 0x6e5c
mov eax, ebx
call fcn.004c7844
test eax, eax
je 0x4c8f6b
push 0x401
lea ecx, [ebp - 0x8279]
mov edx, dword [ebp - 0x7e78]
mov eax, ebx
call fcn.004c7874
test eax, eax
je 0x4c8f6b
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x8279]
mov ecx, 0x401
call fcn.004044a0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040463c
jne 0x4c8f6b
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4c8f79
mov eax, dword [ebp - 0x18]
push eax
push ebx
call sub.kernel32.dll_TerminateProcess
jmp 0x4c8f79
push ebx
call sub.kernel32.dll_CloseHandle
inc edi
dec esi
jne 0x4c8ee2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8fac
lea eax, [ebp - 0x14]
call fcn.00404230
lea eax, [ebp - 0xc]
mov edx, dword [0x4c8e20]
call fcn.004057f4
lea eax, [ebp - 4]
call fcn.00404230
ret
Function at 0x4ce9f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
call fcn.00402b78
xor ebx, ebx
mov eax, ebx
call fcn.00402e28
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp - 5], dl
cmp word [ebp + 8], 1
jge 0x4cea2e
mov ax, 5
jmp 0x4ceaf8
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [esi], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
mov byte [esi + 1], al
xor eax, eax
movsx edx, word [ebp + 8]
sub edx, 2
sub edx, 2
jl 0x4cea63
inc edx
mov dword [ebp - 0xc], edx
mov ebx, 2
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx]
xor al, dl
inc ebx
dec dword [ebp - 0xc]
jne 0x4cea55
movsx ecx, word [ebp + 8]
mov byte [esi + ecx - 1], al
mov eax, dword [ebp - 4]
mov dl, byte [eax + 2]
mov al, byte [ebp - 5]
xor al, dl
xor al, 0x58
mov byte [esi + 2], al
sub ecx, 2
sub ecx, 3
jl 0x4ceaa4
inc ecx
mov dword [ebp - 0xc], ecx
mov ebx, 3
mov eax, dword [ebp - 4]
mov dl, byte [eax + ebx]
mov al, byte [esi + ebx - 1]
xor dl, byte [ebp - 5]
xor al, dl
mov byte [esi + ebx], al
inc ebx
dec dword [ebp - 0xc]
jne 0x4cea8c
movsx ecx, word [ebp + 8]
mov dl, byte [esi + ecx - 1]
mov eax, ecx
dec eax
mov al, byte [esi + eax - 1]
xor dl, byte [ebp - 5]
xor al, dl
mov byte [esi + ecx - 1], al
not byte [ebp - 5]
mov al, byte [ebp - 5]
and al, 0xe0
and eax, 0xff
shr eax, 5
mov dl, byte [ebp - 5]
and dl, 0x1f
and edx, 0xff
shl edx, 3
or eax, edx
mov byte [esi + 1], al
mov ebx, ecx
cmp ebx, 0x40
jg 0x4ceaf6
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov byte [esi + ebx], al
inc ebx
cmp ebx, 0x41
jne 0x4ceae7
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ceb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [esi], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
mov byte [esi + 1], al
mov eax, dword [ebp - 4]
mov cl, byte [eax + 1]
mov byte [ebp - 5], cl
mov al, byte [ebp - 5]
and al, 7
shl eax, 5
mov byte [ebp - 5], al
and cl, 0xf8
xor eax, eax
mov al, cl
shr eax, 3
mov ecx, eax
or cl, byte [ebp - 5]
not cl
mov byte [esi + 1], cl
mov eax, dword [ebp - 4]
mov dl, byte [eax + 2]
mov eax, ecx
xor al, dl
xor al, 0x58
mov byte [esi + 2], al
and eax, 0xff
add eax, 2
cmp eax, 2
jle 0x4ceb7f
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax]
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + eax - 1]
mov byte [ebp - 6], bl
xor dl, cl
xor dl, byte [ebp - 6]
mov byte [esi + eax], dl
dec eax
cmp eax, 2
jg 0x4ceb61
mov byte [ebp - 5], 0
mov al, byte [esi + 2]
mov byte [ebp - 6], al
xor ecx, ecx
mov cl, byte [ebp - 6]
inc ecx
sub ecx, 2
jl 0x4ceba4
inc ecx
mov eax, 2
mov dl, byte [esi + eax]
xor byte [ebp - 5], dl
inc eax
dec ecx
jne 0x4ceb9a
mov dl, byte [esi + 2]
xor eax, eax
mov al, dl
mov al, byte [esi + eax + 2]
mov byte [ebp - 6], al
mov al, byte [ebp - 5]
cmp al, byte [ebp - 6]
je 0x4cebc0
mov ax, 0xfffb
jmp 0x4cebc2
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4d0bb4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 1], cl
mov ebx, edx
xor eax, eax
push ebp
push 0x4d0cd0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d0c94
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x105
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0x11c]
mov edx, ebx
call fcn.00404418
lea eax, [ebp - 0x11c]
mov edx, 0x4d0ce8
call fcn.004044f8
mov eax, dword [ebp - 0x11c]
call fcn.004046f0
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov al, byte [ebp - 1]
dec al
je 0x4d0c40
dec al
je 0x4d0c68
jmp 0x4d0c7d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x120], 0
lea edx, [ebp - 0x124]
xor ecx, ecx
mov eax, 0x4d0cf4
call fcn.0040a088
jmp 0x4d0c8a
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.004044a0
jmp 0x4d0c8a
mov eax, dword [ebp + 8]
mov edx, 0x4d0d04
call fcn.00404284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d0cb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0cd7
lea eax, [ebp - 0x11c]
call fcn.00404230
ret

Function at 0x4d0e84
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 1], cl
mov ebx, edx
mov eax, 0x40
call fcn.004027e4
mov dword [ebp - 8], eax
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.00407554
xor eax, eax
push ebp
push 0x4d0f06
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 8]
mov byte [esi + 0x30], bl
mov al, byte [ebp + 8]
mov byte [esi + 2], al
mov al, byte [ebp - 1]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
mov al, byte [ebp + 0xc]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], 0
mov byte [esi], 0x32
mov eax, dword [ebp - 8]
push eax
call sub.netapi32.dll_Netbios
mov al, byte [esi + 0x31]
mov byte [ebp - 2], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0f0d
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.00402804
ret