joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1a28
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d1bad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov edi, ebx
and edi, 0xff
mov eax, dword [esi + edi*4 + 0x34]
call fcn.00467b14
lea edx, [ebp - 0x14]
xor eax, eax
mov al, bl
inc eax
call fcn.00409350
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4d1bc8
call fcn.00404c6c
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x10]
call fcn.00404e18
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [esi + edi*4 + 0x74], eax
xor eax, eax
mov al, bl
cmp dword [esi + eax*4 + 0x74], 0
jg 0x4d1abd
mov eax, dword [esi + edi*4 + 0x34]
call fcn.00467b1c
jmp 0x4d1b92
lea eax, [esi + 4]
push eax
mov eax, dword [esi + edi*4 + 0x74]
push eax
call sub.kernel32.dll_GetCommState
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
mov al, byte [ebp + 0x24]
mov byte [esi + 0x17], al
mov al, byte [ebp + 0x20]
mov byte [esi + 0x16], al
mov al, byte [ebp + 0x1c]
mov byte [esi + 0x18], al
lea eax, [esi + 4]
push eax
mov eax, dword [esi + edi*4 + 0x74]
push eax
call sub.kernel32.dll_SetCommState
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [esi + edi*4 + 0x74]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x4d1b13
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp byte [ebp + 0x10], 0
je 0x4d1b7f
lea eax, [esi + 0x20]
push eax
mov eax, dword [esi + edi*4 + 0x74]
push eax
call sub.kernel32.dll_GetCommTimeouts
mov dword [esi + 0x20], 0x32
mov dword [esi + 0x24], 0x32
mov dword [esi + 0x28], 0x32
lea eax, [esi + 0x20]
push eax
mov eax, dword [esi + edi*4 + 0x74]
push eax
call sub.kernel32.dll_SetCommTimeouts
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp + 0x14], eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + edi*4 + 0x74]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x4d1b77
mov dword [ebp - 8], 0xffffffff
jmp 0x4d1b7f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [esi + edi*4 + 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi + edi*4 + 0x34]
call fcn.00467b1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1bb4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040498c
ret
Function at 0x501634
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x501662
mov eax, ebx
call fcn.005020ec
cmp dword [ebx + 0x3c], 0
je 0x50165b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x5016d3
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x5016c5
cmp dword [ebx + 8], 0
je 0x501684
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x501696
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5016c5
cmp dword [ebx + 8], 0
je 0x501677
cmp eax, 3
je 0x5016a9
dec eax
jne 0x501677
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x501677
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x501677
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x5016f1
cmp dword [ebx + 0x10], 0xcc
je 0x5016f1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005016fc
pop ebx
ret
Function at 0x51f8f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51f959
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x59592c]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x51f943
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0051f8e0
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x51eb28]
call fcn.005207a8
mov dword [0x595994], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f960
lea eax, [ebp - 8]
call fcn.004067fc
ret

Function at 0x51f9f8
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x51fa0b
or esi, 2
test dl, dl
je 0x51fa14
or esi, 0
jmp 0x51fa17
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x520634
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404e08
xor eax, eax
push ebp
push 0x52078c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x51e910]
call fcn.0041516c
test eax, eax
jl 0x52069b
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0051f9dc
and eax, 0x7f
mov eax, dword [eax*4 + 0x59592c]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x5206fe
mov eax, dword [ebx]
call fcn.00404c20
test eax, eax
jle 0x5206fe
mov eax, dword [ebx]
call fcn.00404c20
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x5206c2
mov eax, ebx
mov edx, 0x5207a4
call fcn.00404c28
mov eax, dword [ebx]
call fcn.00404c20
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.004057d0
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.0051f8e0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x520749
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x595bac]
call fcn.00406cc8
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a2fc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004049bc
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x408218]
call fcn.0040d320
call fcn.00404324
mov eax, dword [ebp - 8]
call fcn.005205ac
mov ebx, eax
test edi, edi
je 0x52075e
mov eax, edi
call fcn.00403b58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x520793
lea eax, [ebp - 0x1c]
call fcn.00404968
lea eax, [ebp - 0x18]
call fcn.004067fc
lea eax, [ebp - 0x14]
call fcn.00404968
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x521818
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x52182f
add esp, 0xfffffff0
call fcn.00403ebc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00479be0
xor eax, eax
mov dword [ebx + 0x340], eax
xor edx, edx
mov eax, ebx
call fcn.0047a6d0
mov al, byte [0x521908]
mov byte [ebx + 0x344], al
mov byte [ebx + 0x244], 1
mov byte [ebx + 0x34d], 1
mov byte [ebx + 0x34e], 0
xor eax, eax
mov dword [ebx + 0x350], eax
xor eax, eax
mov dword [ebx + 0x354], eax
mov byte [ebx + 0x359], 0
mov byte [ebx + 0x35a], 1
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x52190c
call sub.shell32.dll_SHGetFileInfoA
mov dword [ebx + 0x348], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x51edbc]
call fcn.0052144c
mov esi, eax
mov dword [ebx + 0x35c], esi
mov al, byte [esi + 0x24]
or al, byte [0x521910]
mov byte [esi + 0x24], al
lea eax, [ebx + 0x338]
mov edx, 0x52191c
call fcn.004049bc
mov byte [ebx + 0x34c], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5218ff
call fcn.00403f14
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x521e8c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x521ff6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5963a4]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x5963a4]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00464394
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004797ec
xor edx, edx
push ebp
push 0x521fd9
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x521f49
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.004067fc
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.0051fff4
push eax
mov eax, dword [0x5960cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x521f3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004043d0
jmp 0x521fe0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x521f85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004793cc
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00521d1c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x521f61
push 0
mov edx, 0x521cb4
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00478f84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521fe0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00479838
mov eax, dword [0x5963a4]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.00464394
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521ffd
lea eax, [ebp - 0x10]
call fcn.004067fc
ret
Function at 0x523dbc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
test dl, dl
je 0x523dd3
add esp, 0xfffffff0
call fcn.00403ebc
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0047ed94
xor eax, eax
mov dword [esi + 0x380], eax
mov dl, 1
mov eax, esi
call fcn.0047fc00
mov byte [esi + 0x387], 1
mov al, byte [0x523ebc]
mov byte [esi + 0x389], al
mov byte [esi + 0x384], 1
mov byte [esi + 0x386], 1
mov byte [esi + 0x385], 0
mov dl, 1
mov eax, dword [0x41686c]
call fcn.00403b28
mov dword [esi + 0x3a0], eax
xor eax, eax
mov dword [esi + 0x3a4], eax
mov byte [esi + 0x388], 0
mov byte [esi + 0x3b8], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x523ec0
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x390], eax
push 0x4000
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x523ec0
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x38c], eax
lea eax, [esi + 0x37c]
mov edx, 0x523ecc
call fcn.004049bc
xor edx, edx
mov eax, esi
call fcn.0048005c
mov eax, esi
test bl, bl
je 0x523eb4
call fcn.00403f14
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x524540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x524603
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x386], 0
je 0x5245e1
mov eax, ebx
call fcn.00481a68
test eax, eax
je 0x5245e1
mov eax, ebx
call fcn.00481a68
call fcn.0047e18c
mov edx, eax
mov eax, ebx
call fcn.00524978
mov esi, eax
mov eax, esi
call fcn.00521148
test al, al
je 0x52459d
mov edx, dword [esi + 8]
mov eax, ebx
call fcn.0052531c
jmp 0x5245e1
push 0
lea edx, [ebp - 8]
mov eax, esi
call fcn.00521198
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040990c
mov eax, dword [ebp - 4]
call fcn.00404e18
push eax
push 0
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00521198
mov eax, dword [ebp - 0xc]
call fcn.00404e18
push eax
push 0
mov eax, ebx
call fcn.0044c8d4
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.00447800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52460a
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040498c
ret
Function at 0x54e4c4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54e694
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd4]
lea edx, [ebp - 0xc]
mov eax, dword [0x596274]
mov eax, dword [eax]
call fcn.004e2c6c
push dword [ebp - 0xc]
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00409380
push dword [ebp - 0x10]
push 0x54e6ac
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404ce0
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00409498
mov esi, eax
lea eax, [ebp - 4]
call fcn.00404968
test esi, esi
jl 0x54e671
mov ecx, 2
xor edx, edx
mov eax, esi
call fcn.00409578
mov ecx, eax
mov eax, ecx
mov ecx, 0x140
cdq
idiv ecx
mov dword [ebx + 0x310], eax
cmp edi, dword [ebx + 0x310]
jl 0x54e582
mov eax, esi
call fcn.004095bc
jmp 0x54e671
mov edx, edi
shl edx, 6
lea edx, [edx + edx*4]
xor ecx, ecx
mov eax, esi
call fcn.00409578
mov eax, dword [ebx + 0x310]
sub eax, edi
mov edi, eax
cmp edi, 0x3c
jle 0x54e5a7
mov edi, 0x3c
mov ecx, edi
shl ecx, 6
lea ecx, [ecx + ecx*4]
lea edx, [ebx + 0x318]
mov eax, esi
call fcn.00409520
mov eax, esi
call fcn.004095bc
dec edi
test edi, edi
jl 0x54e671
inc edi
mov dword [ebp - 8], edi
xor esi, esi
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x22c]
call fcn.0047e2d8
mov edi, eax
mov eax, esi
and eax, 0xff
shl eax, 3
lea eax, [eax + eax*4]
push dword [ebx + eax*8 + 0x324]
push dword [ebx + eax*8 + 0x320]
lea edx, [ebp - 0x14]
mov eax, 0x54e6c4
call fcn.0040c138
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.0047dd28
lea eax, [ebp - 0x18]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3c1]
call fcn.00404bc4
mov edx, dword [ebp - 0x18]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1c]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3ac]
call fcn.00404bc4
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec dword [ebp - 8]
jne 0x54e5d2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e69b
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x54f3a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54f570
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd4]
lea edx, [ebp - 0xc]
mov eax, dword [0x596274]
mov eax, dword [eax]
call fcn.004e2c6c
push dword [ebp - 0xc]
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00409380
push dword [ebp - 0x10]
push 0x54f588
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404ce0
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00409498
mov esi, eax
lea eax, [ebp - 4]
call fcn.00404968
test esi, esi
jl 0x54f54d
mov ecx, 2
xor edx, edx
mov eax, esi
call fcn.00409578
mov ecx, eax
mov eax, ecx
mov ecx, 0x140
cdq
idiv ecx
mov dword [ebx + 0x310], eax
cmp edi, dword [ebx + 0x310]
jl 0x54f45e
mov eax, esi
call fcn.004095bc
jmp 0x54f54d
mov edx, edi
shl edx, 6
lea edx, [edx + edx*4]
xor ecx, ecx
mov eax, esi
call fcn.00409578
mov eax, dword [ebx + 0x310]
sub eax, edi
mov edi, eax
cmp edi, 0x3c
jle 0x54f483
mov edi, 0x3c
mov ecx, edi
shl ecx, 6
lea ecx, [ecx + ecx*4]
lea edx, [ebx + 0x318]
mov eax, esi
call fcn.00409520
mov eax, esi
call fcn.004095bc
dec edi
test edi, edi
jl 0x54f54d
inc edi
mov dword [ebp - 8], edi
xor esi, esi
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x22c]
call fcn.0047e2d8
mov edi, eax
mov eax, esi
and eax, 0xff
shl eax, 3
lea eax, [eax + eax*4]
push dword [ebx + eax*8 + 0x324]
push dword [ebx + eax*8 + 0x320]
lea edx, [ebp - 0x14]
mov eax, 0x54f5a0
call fcn.0040c138
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.0047dd28
lea eax, [ebp - 0x18]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3c1]
call fcn.00404bc4
mov edx, dword [ebp - 0x18]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1c]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3ac]
call fcn.00404bc4
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec dword [ebp - 8]
jne 0x54f4ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f577
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x54f5b8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54f788
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd4]
lea edx, [ebp - 0xc]
mov eax, dword [0x596274]
mov eax, dword [eax]
call fcn.004e2c6c
push dword [ebp - 0xc]
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00409380
push dword [ebp - 0x10]
push 0x54f7a0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404ce0
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00409498
mov esi, eax
lea eax, [ebp - 4]
call fcn.00404968
test esi, esi
jl 0x54f765
mov ecx, 2
xor edx, edx
mov eax, esi
call fcn.00409578
mov ecx, eax
mov eax, ecx
mov ecx, 0x140
cdq
idiv ecx
mov dword [ebx + 0x310], eax
cmp edi, dword [ebx + 0x310]
jl 0x54f676
mov eax, esi
call fcn.004095bc
jmp 0x54f765
mov edx, edi
shl edx, 6
lea edx, [edx + edx*4]
xor ecx, ecx
mov eax, esi
call fcn.00409578
mov eax, dword [ebx + 0x310]
sub eax, edi
mov edi, eax
cmp edi, 0x3c
jle 0x54f69b
mov edi, 0x3c
mov ecx, edi
shl ecx, 6
lea ecx, [ecx + ecx*4]
lea edx, [ebx + 0x318]
mov eax, esi
call fcn.00409520
mov eax, esi
call fcn.004095bc
dec edi
test edi, edi
jl 0x54f765
inc edi
mov dword [ebp - 8], edi
xor esi, esi
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x22c]
call fcn.0047e2d8
mov edi, eax
mov eax, esi
and eax, 0xff
shl eax, 3
lea eax, [eax + eax*4]
push dword [ebx + eax*8 + 0x324]
push dword [ebx + eax*8 + 0x320]
lea edx, [ebp - 0x14]
mov eax, 0x54f7b4
call fcn.0040c138
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.0047dd28
lea eax, [ebp - 0x18]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3c1]
call fcn.00404bc4
mov edx, dword [ebp - 0x18]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1c]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3ac]
call fcn.00404bc4
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec dword [ebp - 8]
jne 0x54f6c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f78f
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x54f7cc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54f99c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd4]
lea edx, [ebp - 0xc]
mov eax, dword [0x596274]
mov eax, dword [eax]
call fcn.004e2c6c
push dword [ebp - 0xc]
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00409380
push dword [ebp - 0x10]
push 0x54f9b4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404ce0
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00409498
mov esi, eax
lea eax, [ebp - 4]
call fcn.00404968
test esi, esi
jl 0x54f979
mov ecx, 2
xor edx, edx
mov eax, esi
call fcn.00409578
mov ecx, eax
mov eax, ecx
mov ecx, 0x140
cdq
idiv ecx
mov dword [ebx + 0x310], eax
cmp edi, dword [ebx + 0x310]
jl 0x54f88a
mov eax, esi
call fcn.004095bc
jmp 0x54f979
mov edx, edi
shl edx, 6
lea edx, [edx + edx*4]
xor ecx, ecx
mov eax, esi
call fcn.00409578
mov eax, dword [ebx + 0x310]
sub eax, edi
mov edi, eax
cmp edi, 0x3c
jle 0x54f8af
mov edi, 0x3c
mov ecx, edi
shl ecx, 6
lea ecx, [ecx + ecx*4]
lea edx, [ebx + 0x318]
mov eax, esi
call fcn.00409520
mov eax, esi
call fcn.004095bc
dec edi
test edi, edi
jl 0x54f979
inc edi
mov dword [ebp - 8], edi
xor esi, esi
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x22c]
call fcn.0047e2d8
mov edi, eax
mov eax, esi
and eax, 0xff
shl eax, 3
lea eax, [eax + eax*4]
push dword [ebx + eax*8 + 0x324]
push dword [ebx + eax*8 + 0x320]
lea edx, [ebp - 0x14]
mov eax, 0x54f9c8
call fcn.0040c138
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.0047dd28
lea eax, [ebp - 0x18]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3c1]
call fcn.00404bc4
mov edx, dword [ebp - 0x18]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x1c]
mov edx, esi
and edx, 0xff
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8 + 0x3ac]
call fcn.00404bc4
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec dword [ebp - 8]
jne 0x54f8da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f9a3
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.0040498c
lea eax, [ebp - 4]
call fcn.00404968
ret
Function at 0x55b208
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffff54
lea eax, [esp + 8]
mov edx, 0x94
call fcn.00407c54
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x18], 2
jne 0x55b28a
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xa0]
push eax
push 0x55b29c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x9c], 1
mov dword [esp + 0xa8], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0xa8]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 1
push 6
call sub.user32.dll_ExitWindowsEx
add esp, 0xac
ret

Function at 0x55b2b0
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffff54
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x18], 2
jne 0x55b324
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xa0]
push eax
push 0x55b334
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x9c], 1
mov dword [esp + 0xa8], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0xa8]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 1
push 0xc
call sub.user32.dll_ExitWindowsEx
add esp, 0xac
ret

Function at 0x55bc78
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x55bc98
push 0
mov eax, dword [0x597718]
push eax
push 0x55ba7c
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 4], eax
pop ebx
ret