joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474150
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x474158
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47434a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x474360
mov eax, esi
call fcn.00471c50
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045f8
lea ecx, [ebp - 0x10]
mov edx, 0x474374
mov eax, esi
call fcn.00471c50
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045f8
lea ecx, [ebp - 0x14]
mov edx, 0x47438c
mov eax, esi
call fcn.00471c50
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045f8
lea ecx, [ebp - 0x18]
mov edx, 0x4743a8
mov eax, esi
call fcn.00471c50
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045f8
lea ecx, [ebp - 0x1c]
mov edx, 0x4743c4
mov eax, esi
call fcn.00471c50
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045f8
lea ecx, [ebp - 0x24]
mov edx, 0x4743dc
mov eax, esi
call fcn.00471c50
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408b10
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004090ac
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4743f4
mov eax, esi
call fcn.00471c50
mov eax, dword [ebp - 0x28]
call fcn.00470cf0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x474404
mov eax, esi
call fcn.00471c50
mov eax, dword [ebp - 0x2c]
call fcn.00470cf0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x47441c
mov eax, esi
call fcn.00471c50
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004090ac
inc eax
je 0x4742ed
lea ecx, [ebp - 0x34]
mov edx, 0x47441c
mov eax, esi
call fcn.00471c50
mov eax, dword [ebp - 0x34]
call fcn.00409070
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040abf8
fstp qword [ebp - 0x3c]
wait
call fcn.0040af68
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x474308
lea ecx, [ebp - 0x40]
mov edx, 0x47441c
mov eax, esi
call fcn.00471c50
mov eax, dword [ebp - 0x40]
call fcn.00470cf0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x47442c
mov eax, esi
call fcn.00471c50
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004045f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474351
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004045c8
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004045c8
ret
Function at 0x4840e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.KERNEL32.DLL_GetTickCount_1
mov ebx, eax
jmp 0x484106
cmp byte [0x4c17b0], 0
jne 0x484133
mov eax, dword [0x4c2dd0]
mov eax, dword [eax]
call fcn.00447a18
call sub.KERNEL32.DLL_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x48412f
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4840f1
jmp 0x484133
pop edx
pop eax
jg 0x4840f1
pop esi
pop ebx
ret
Function at 0x484de0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a54
mov eax, dword [ebp - 8]
call fcn.00404a54
xor eax, eax
push ebp
push 0x484fc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 3
mov cl, 1
mov dl, 1
mov eax, dword [0x484720]
call fcn.0041f8f4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x48
mov edx, dword [ebp - 4]
call fcn.004045f8
mov eax, dword [ebp - 0x10]
add eax, 0x4c
mov edx, dword [ebp - 8]
call fcn.004045f8
mov eax, dword [ebp - 0x10]
add eax, 0x50
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call fcn.004045f8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x54], edx
mov eax, dword [ebp - 0x10]
mov dl, byte [ebp + 0xc]
mov byte [eax + 0x58], dl
mov eax, dword [ebp - 0x10]
call fcn.0041fc88
call sub.KERNEL32.DLL_GetTickCount_1
mov ebx, eax
jmp 0x484f3c
cmp byte [0x4c17b0], 0
jne 0x484ebb
cmp dword [ebp + 0x14], 0
jle 0x484f30
call sub.KERNEL32.DLL_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp + 0x14]
cdq
cmp edx, dword [esp + 4]
jne 0x484eb7
cmp eax, dword [esp]
pop edx
pop eax
jae 0x484f30
jmp 0x484ebb
pop edx
pop eax
jge 0x484f30
xor eax, eax
push ebp
push 0x484ede
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x484ef6
mov eax, dword [0x4c2dd0]
mov eax, dword [eax]
call fcn.00447a18
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xd], 0
je 0x484eea
mov edx, dword [0x4c2dd0]
mov edx, dword [edx]
mov eax, dword [ebp - 0x10]
call fcn.004847b4
jmp 0x484f1d
mov eax, dword [0x4c2dd0]
mov eax, dword [eax]
call fcn.00447a18
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x44], 0
jne 0x484f11
mov eax, dword [ebp + 8]
call fcn.004045a4
jmp 0x484f4f
mov eax, dword [0x4c2dd0]
mov eax, dword [eax]
call fcn.00447a18
cmp dword [ebp - 0x10], 0
je 0x484f4f
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xd], 0
je 0x484e7a
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x60], 0
jne 0x484f6e
mov eax, dword [ebp - 0x10]
call fcn.00403774
xor eax, eax
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x14]
jne 0x484e17
cmp dword [ebp - 0x10], 0
je 0x484fa4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x60]
call fcn.004045f8
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004847b4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x64]
call fcn.004045f8
mov eax, dword [ebp - 0x10]
call fcn.00403774
jmp 0x484fac
mov eax, dword [ebp + 8]
call fcn.004045a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484fce
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045c8
ret
Function at 0x486c04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x486c0d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a54
mov eax, dword [ebp - 8]
call fcn.00404a54
mov eax, dword [ebp - 0xc]
call fcn.00404a54
xor eax, eax
push ebp
push 0x486d9c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x4c2dd0]
mov eax, dword [eax]
call fcn.00448294
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409728
mov eax, dword [ebp - 0x14]
call fcn.00404864
mov edx, dword [ebp - 0x14]
cmp byte [edx + eax - 1], 0x5c
je 0x486c82
lea eax, [ebp - 0x14]
mov edx, 0x486db4
call fcn.0040486c
mov eax, dword [ebp - 0xc]
call fcn.004875c8
mov ebx, eax
lea eax, [ebp - 0x1c]
mov ecx, 0x486dc0
mov edx, dword [ebp - 0x14]
call fcn.004048b0
mov eax, dword [ebp - 0x1c]
call fcn.00486a10
cmp ebx, eax
je 0x486cfc
cmp ebx, 0x2710
jle 0x486cfc
mov dl, 1
mov eax, dword [0x417350]
call fcn.00403744
mov esi, eax
push 0
push 0
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00487c04
cmp ebx, eax
jne 0x486cf5
push 0
push 0
mov eax, esi
call fcn.0041b8f4
lea eax, [ebp - 0x20]
mov ecx, 0x486dc0
mov edx, dword [ebp - 0x14]
call fcn.004048b0
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.0041bfd0
mov eax, esi
call fcn.00403774
lea eax, [ebp - 0x24]
mov ecx, 0x486dc0
mov edx, dword [ebp - 0x14]
call fcn.004048b0
mov eax, dword [ebp - 0x24]
call fcn.00409470
test al, al
je 0x486d81
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00485828
push dword [ebp - 0x28]
push 0x486dd4
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.00485828
push dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404924
push 5
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404a64
push eax
lea eax, [ebp - 0x30]
mov ecx, 0x486de0
mov edx, dword [ebp - 0x14]
call fcn.004048b0
mov eax, dword [ebp - 0x30]
call fcn.00404a64
push eax
push 0x486dec
mov eax, dword [0x4c2dd0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486da3
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.004045c8
ret

Function at 0x486f58
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call sub.KERNEL32.DLL_GetCurrentThreadId_1
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowThreadProcessId
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_SetForegroundWindow
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x486fcc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x487075
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call sub.KERNEL32.DLL_GetCurrentThreadId_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowThreadProcessId
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0xffffffffffffffff
mov edi, dword [ebp - 0x18]
push edi
mov esi, dword [ebp - 0x10]
push esi
call sub.user32.dll_AttachThreadInput
mov eax, dword [ebp + 8]
push eax
call sub.user32.dll_SetForegroundWindow
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x487056
lea eax, [ebp - 0x1c]
push eax
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x487090
call fcn.00409fd4
push 0
push edi
push esi
call sub.user32.dll_AttachThreadInput
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48707c
lea eax, [ebp - 0x1c]
call fcn.004045a4
ret

Function at 0x4871c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x134], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4872d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov dword [ebp - 0x129], 0x128
xor eax, eax
mov dword [ebp - 0x121], eax
xor edx, edx
mov eax, 2
call fcn.00486978
mov esi, eax
lea edx, [ebp - 0x129]
mov eax, esi
call fcn.00486998
test eax, eax
je 0x487270
lea edx, [ebp - 0x129]
mov eax, esi
call fcn.004869b8
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x130]
mov eax, edi
call fcn.00408b10
mov eax, dword [ebp - 0x130]
push eax
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x105]
mov ecx, 0x104
call fcn.00404814
mov eax, dword [ebp - 0x134]
pop edx
call fcn.00408aa0
test eax, eax
je 0x487270
test bl, bl
jne 0x48721f
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x121]
test eax, eax
je 0x4872ae
push eax
push 0xffffffffffffffff
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x4872a2
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
jne 0x4872a6
mov byte [ebp - 1], 0
jmp 0x4872a6
mov byte [ebp - 1], 0
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4872b2
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4872d7
lea eax, [ebp - 0x134]
mov edx, 2
call fcn.004045c8
ret

Function at 0x4872e4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push esp
push 0x3ff
call sub.KERNEL32.DLL_GetTempPathA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404694
mov eax, dword [ebx]
call fcn.00404864
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x48731f
mov eax, ebx
mov edx, 0x487330
call fcn.0040486c
add esp, 0x400
pop ebx
ret
Function at 0x4875c8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a54
xor eax, eax
push ebp
push 0x487764
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x487716
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x120]
mov eax, dword [0x4c2dd0]
mov eax, dword [eax]
call fcn.00448294
mov eax, dword [ebp - 0x120]
call fcn.00404a64
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48770c
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404a64
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x487689
mov ecx, 0x487780
mov dl, 1
mov eax, dword [0x486adc]
call fcn.0040cd04
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x104
lea eax, [ebp - 0x11c]
xor ecx, ecx
mov edx, 0x104
call fcn.0040315c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11c]
push eax
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_HttpQueryInfoA
xor eax, eax
push ebp
push 0x4876fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x124]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404694
mov eax, dword [ebp - 0x124]
call fcn.00409070
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48770c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x487720
cmp dword [ebp - 0x10], 0
je 0x48772f
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 0xc], 0
je 0x48773e
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48776b
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.004045c8
lea eax, [ebp - 4]
call fcn.004045a4
ret
Function at 0x48cc14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov dword [esp + 4], eax
test edi, edi
je 0x48cca6
mov eax, edi
call fcn.00402ae0
mov esi, eax
mov eax, edi
call fcn.00402ae0
mov dword [esp], eax
mov edx, edi
dec edx
test edx, edx
jl 0x48cc6e
inc edx
xor eax, eax
mov ecx, dword [esp + 4]
mov cl, byte [ecx + eax]
mov ebx, ebp
shr ebx, 8
xor cl, bl
mov byte [esi + eax], cl
xor ecx, ecx
mov cl, byte [esi + eax]
add ebp, ecx
imul ecx, ebp, 0x12b59dc0
add ecx, 0x54354378
mov ebp, ecx
inc eax
dec edx
jne 0x48cc44
mov edx, edi
dec edx
test edx, edx
jl 0x48cc85
inc edx
xor eax, eax
mov cl, byte [esi + eax]
mov ebx, dword [esp]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x48cc78
mov edx, dword [esp + 4]
mov eax, dword [esp]
mov ecx, edi
call fcn.00402d00
mov edx, edi
mov eax, esi
call fcn.00402b10
mov edx, edi
mov eax, dword [esp]
call fcn.00402b10
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48ccb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov dword [esp + 4], eax
test edi, edi
je 0x48cd42
mov eax, edi
call fcn.00402ae0
mov dword [esp], eax
mov eax, edi
call fcn.00402ae0
mov esi, eax
mov edx, edi
dec edx
test edx, edx
jl 0x48ccee
inc edx
xor eax, eax
mov ecx, dword [esp + 4]
mov cl, byte [ecx + eax]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x48cce0
mov edx, edi
dec edx
test edx, edx
jl 0x48cd21
inc edx
xor eax, eax
mov cl, byte [esi + eax]
mov ebx, ebp
shr ebx, 8
xor cl, bl
mov ebx, dword [esp]
mov byte [ebx + eax], cl
xor ecx, ecx
mov cl, byte [esi + eax]
add ebp, ecx
imul ecx, ebp, 0x12b59dc0
add ecx, 0x54354378
mov ebp, ecx
inc eax
dec edx
jne 0x48ccf8
mov edx, dword [esp + 4]
mov eax, dword [esp]
mov ecx, edi
call fcn.00402d00
mov edx, edi
mov eax, dword [esp]
call fcn.00402b10
mov edx, edi
mov eax, esi
call fcn.00402b10
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x491448
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x491476
mov eax, ebx
call fcn.00491efc
cmp dword [ebx + 0x40], 0
je 0x49146f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4914e7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4914d9
cmp dword [ebx + 8], 0
je 0x491498
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4914aa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4914d9
cmp dword [ebx + 8], 0
je 0x49148b
cmp eax, 3
je 0x4914bd
dec eax
jne 0x49148b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49148b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x49148b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x491505
cmp dword [ebx + 0x14], 0xcc
je 0x491505
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00491510
pop ebx
ret

Function at 0x4a2a1c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4a2a5a
call sub.KERNEL32.DLL_GetLastError
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
jmp 0x4a2aab
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.KERNEL32.DLL_DosDateTimeToFileTime
test eax, eax
je 0x4a2a8e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
test eax, eax
je 0x4a2a8e
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.KERNEL32.DLL_SetFileTime
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov ax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a5878
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4a58c9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4a58b0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4a58a0
jmp 0x4a58c9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4a58b1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b3658
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4b3661
mov eax, dword [ebp - 4]
add esp, 0xfffffb70
push ebx
xor ecx, ecx
mov dword [ebp - 0x3494], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a54
xor eax, eax
push ebp
push 0x4b3744
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x3480
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x3490]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4b371b
lea eax, [ebp - 0x3490]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x3494]
mov edx, dword [ebp - 8]
add edx, 0x1b0
mov ecx, 0x10
call fcn.00404814
mov eax, dword [ebp - 0x3494]
lea edx, [ebp - 0x10]
call fcn.00408b10
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004049b0
jne 0x4b370d
mov ecx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x190]
mov eax, dword [ebp - 8]
add eax, 0x194
call fcn.004b35dc
jmp 0x4b371b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b36bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b374b
lea eax, [ebp - 0x3494]
call fcn.004045a4
lea eax, [ebp - 0x10]
call fcn.004045a4
lea eax, [ebp - 4]
call fcn.004045a4
ret
Function at 0x4b7670
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov edi, edx
xor eax, eax
push ebp
push 0x4b7753
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004045a4
lea eax, [ebp - 4]
mov edx, 0xff
call fcn.00404bf0
push 0xff
mov eax, dword [ebp - 4]
call fcn.00404a64
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 4]
call fcn.00404a64
call fcn.004098b4
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404bf0
mov eax, dword [ebp - 4]
call fcn.00404a64
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x4b776c
call fcn.00409fd4
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004045f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b775a
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045c8
ret