joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4649be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sar eax, 0x13
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
and eax, 0xff
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
dec edi
mov al, byte [eax + edi]
and eax, 0xff
push eax
call fcn.0044c978
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00447181
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x464a55
mov eax, dword [ebp + 0x14]
dec eax
mov dword [ebp + 0x14], eax
mov al, 0x2e
and eax, 0xff
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call fcn.00445c61
push dword [ebp - 0xc]
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
mov edx, eax
mov eax, dword [ebp + 0x14]
sub eax, edx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x4649ef
mov eax, dword [ebp + 0x14]
leave
ret 0x10

Function at 0x4884ec
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0x100
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x572678], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0xc], eax
mov eax, 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
and eax, 1
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x488547
mov eax, dword [ebp - 0xc]
shr eax, 1
jmp 0x488552
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jne 0x48852c
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [0x572678]
mov edi, dword [ebp - 0x10]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x101
jne 0x488519
leave
ret
Function at 0x488ef9
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0xf0000000
push 0x18
push 0
push 0
push 0x57267c
call dword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
leave
ret

Function at 0x488f35
Capabilities:
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
push 0x40
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0xc], 0
push dword [ebp + 0x10]
call fcn.00488589
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
cmp eax, 2
je 0x488fc4
cmp eax, 3
je 0x488fcb
cmp eax, 4
je 0x488fd2
cmp eax, 5
je 0x488fd9
cmp eax, 6
je 0x488fe0
push dword [ebp + 0x10]
call fcn.0044d19c
push eax
push 0xb
push dword [0x57b6fc]
call fcn.004557d4
push eax
push 3
push dword [0x57b6ec]
call fcn.004557d4
push eax
push 0xc
lea esi, [esp + 4]
push esi
push 3
call fcn.0042f6b1
mov eax, 0
jmp 0x488fe5
mov eax, 0x8003
jmp 0x488fe5
mov eax, 0x8004
jmp 0x488fe5
mov eax, 0x800c
jmp 0x488fe5
mov eax, 0x800d
jmp 0x488fe5
mov eax, 0x800e
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp + 0x10]
push dword [0x57267c]
call dword [sym.imp.ADVAPI32.DLL_CryptCreateHash]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_CryptHashData]
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_CryptGetHashParam]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_CryptDestroyHash]
mov eax, dword [ebp - 0x10]
leave
ret 0xc

Function at 0x489034
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 8]
xchg edx, eax
mov eax, dword [0x572684]
mov dword [eax], edx
mov eax, 0
mov dword [0x572680], 0
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 1
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x572684]
mov edi, dword [ebp - 0x10]
dec edi
mov eax, dword [eax + edi*4]
sar eax, 0x1e
push eax
pop edx
xchg edx, eax
mov eax, dword [0x572684]
mov edi, dword [ebp - 0x10]
dec edi
mov eax, dword [eax + edi*4]
xchg edx, eax
xor eax, edx
push edx
mov edx, 0x6c078965
mov ecx, edx
imul ecx
pop edx
mov edx, dword [ebp - 0x10]
add eax, edx
mov edx, eax
mov eax, dword [0x572684]
mov edi, dword [ebp - 0x18]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x270
jne 0x489070
leave
ret 4
Function at 0x489f7f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, dword [0x5726ac]
mov edx, dword [0x5726a8]
cmp eax, edx
jbe 0x489fda
call fcn.00489972
push eax
push dword [ebp + 8]
call fcn.0045dca7
push dword [ebp + 8]
call fcn.00489f23
mov eax, dword [0x5726a4]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push 0x4000000
call fcn.00489ba2
mov eax, dword [0x5726ac]
sub eax, 0x14
mov dword [0x5726ac], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5726a4], eax
mov eax, dword [0x5726ac]
mov edx, dword [0x5726a8]
cmp eax, edx
jne 0x48a019
mov eax, dword [0x5726ac]
mov eax, dword [eax]
mov edx, eax
mov eax, 0xf000000
and eax, edx
cmp eax, 0x4000000
je 0x48a019
mov eax, dword [0x5726ac]
mov eax, dword [eax]
mov edx, eax
mov eax, 0xf000000
and eax, edx
cmp eax, 0x5000000
je 0x48a019
jmp 0x48a01d
xor eax, eax
jmp 0x48a020
xor eax, eax
inc eax
cmp eax, 0
je 0x48a042
push dword [ebp + 8]
call fcn.0048a76c
xor eax, eax
push eax
call fcn.004794e7
push 0xfffffffffffffffe
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
push dword [ebp + 8]
call fcn.0048a81b
mov eax, 0x7fffffff
jmp 0x48a052
leave
cmp dword [ebp - 4], eax
jb 0x48a051
mov edx, eax
mov eax, dword [0x54402c]
mov dword [eax + 0x24], edx
mov edi, dword [ebp - 8]
cmp edi, 0
je 0x48a06e
jmp edi
pop edi
cmp edi, 0
je 0x48a076
jmp edi
leave
ret 4
Function at 0x4957a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, 0x57ea28
mov dword [ebp - 0x14], str.0000000000000000000000000000000
mov eax, dword [ebp + 0x10]
sar eax, 1
mov edx, eax
mov eax, dword [ebp + 0xc]
mov cl, dl
shl eax, cl
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
jle 0x4957f5
mov eax, dword [ebp + 0xc]
inc eax
sar eax, 2
inc eax
shl eax, 2
sub esp, eax
and esp, 0xfffffffc
mov eax, esp
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00445a48
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x27
je 0x49584a
mov eax, dword [ebp - 0xc]
and edx, 0xff
cmp eax, 0x2c
jne 0x49583a
mov eax, 0x2e
and eax, 0xff
mov dword [ebp - 0xc], 0x2e
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
add eax, edx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x4957fb
mov al, 0
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
add eax, edx
push eax
push dword [ebp - 0x18]
call fcn.00491764
xor al, 1
cmp eax, 0
je 0x4958a1
mov eax, 0xffffffff
xchg edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
push 0x7ff80000
push 0
fld qword [esp]
add esp, 8
jmp 0x4958af
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.00444fff
leave
ret 0x10

Function at 0x495bf9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov edx, eax
mov eax, 0xffffffff
cmp eax, edx
setne al
xor ah, ah
cwde
leave
ret 4

Function at 0x495c37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, 0
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x495c78
mov eax, 0xffffffff
jmp 0x495c7b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 0xc

Function at 0x495c85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
mov eax, 0
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x495cc6
mov eax, 0xffffffff
jmp 0x495cc9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 0xc
Function at 0x496314
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00454391
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.004961d3
cmp eax, 0
je 0x496343
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x49634c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne al
xor ah, ah
cwde
leave
ret 4
Function at 0x49749d
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push dword [ebp + 8]
call fcn.00454391
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call fcn.00454391
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.MSVCRT.DLL__wrename]
add esp, 8
mov edx, eax
mov eax, 0
cmp eax, edx
sete al
xor ah, ah
cwde
leave
ret 8
Function at 0x498a78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x34
jmp 0x498b74
mov eax, dword [0x573b18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
jmp 0x498d93
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x28
je 0x498c79
cmp eax, 0x1a
je 0x498c79
cmp eax, 0x1b
je 0x498c79
cmp eax, 0x1c
je 0x498c79
cmp eax, 0x19
je 0x498c79
cmp eax, 6
je 0x498c79
cmp eax, 0x24
je 0x498c79
cmp eax, 5
je 0x498c79
cmp eax, 0x20
je 0x498c88
cmp eax, 0x22
je 0x498c88
cmp eax, 0x13
je 0x498cd4
cmp eax, 0x11
je 0x498cd4
cmp eax, 0x12
je 0x498cd4
cmp eax, 0x10
je 0x498cd4
cmp eax, 0xf
je 0x498cd4
cmp eax, 0x15
je 0x498d36
cmp eax, 0x16
je 0x498d36
cmp eax, 0x17
je 0x498d42
cmp eax, 0x18
je 0x498d42
mov eax, dword [ebp - 0x10]
jmp 0x498d47
push 0
push dword [ebp - 0x10]
call fcn.00440ada
jmp 0x498d47
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x22
jne 0x498cc9
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x30
jmp 0x498cd2
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
jmp 0x498d47
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
and eax, 0x400000
cmp eax, 0
je 0x498d1d
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x3c], eax
call fcn.00498a87
jmp 0x498d34
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
jmp 0x498d47
push 0
push dword [ebp - 0x10]
call fcn.00440ada
jmp 0x498d47
call fcn.00498a87
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0x18
je 0x498d62
mov eax, dword [ebp - 0x3c]
cmp eax, 0x17
je 0x498d62
xor eax, eax
jmp 0x498d65
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x498d81
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp - 0x10]
xchg edx, eax
shl eax, 4
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0
jg 0x498b98
push dword [ebp + 0xc]
call fcn.0042f3b1
push eax
push dword [ebp - 0x10]
call fcn.0042f4f0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov edx, eax
mov eax, dword [ebp + 8]
xchg edx, eax
shl eax, 2
add eax, edx
add eax, 8
leave
ret 8
Function at 0x49cae2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov dword [ebp - 0xc], eax
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
cmp eax, 0
je 0x49cc26
push 0x64
call fcn.004415de
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x49cc09
mov eax, dword [ebp - 0x1c]
cmp eax, 0
je 0x49cb58
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
cmp al, 0x3d
jne 0x49cb58
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 1]
cmp al, 0
jne 0x49cb58
jmp 0x49cb5c
xor eax, eax
jmp 0x49cb5f
xor eax, eax
inc eax
cmp eax, 0
je 0x49cbf7
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.004472e0
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call fcn.004472e0
mov eax, dword [ebp - 0x1c]
shl eax, 1
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 2]
cmp al, 0
jne 0x49cbcd
mov esi, dword [ebp - 0x10]
mov al, byte [esi + 3]
cmp al, 0
jne 0x49cbcd
jmp 0x49cbd1
xor eax, eax
jmp 0x49cbd4
xor eax, eax
inc eax
cmp eax, 0
je 0x49cbe0
jmp 0x49cc12
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x14], eax
mov eax, 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
jne 0x49cb36
push dword [ebp - 0x18]
call fcn.00440960
mov dword [ebp - 0x1c], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.004616a0
leave
ret
Function at 0x49cc7f
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xe4
push 8
call fcn.0048a7ad
push eax
call fcn.004572b7
mov dword [ebp - 0xc], eax
call fcn.0048a7ad
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add eax, 0x14
mov dword [ebp - 0x10], eax
mov eax, 0x9c
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
lea eax, [ebp - 0xb4]
mov dword [eax + 0x14], edx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xb4]
mov al, byte [eax + 0x9a]
cmp al, 1
setne al
xor ah, ah
cwde
mov dword [ebp - 0xec], eax
push 0
push dword [ebp - 0x18]
push 8
push str.Windows
call fcn.0044721c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 4]
cmp eax, 5
je 0x49cdca
cmp eax, 6
je 0x49ce25
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49cd97
mov eax, dword [ebp - 0xe8]
cmp eax, 0x4f3d
jl 0x49cd67
mov eax, str.Server_2022
jmp 0x49cd95
mov eax, dword [ebp - 0xe8]
cmp eax, 0x42ee
jl 0x49cd7b
mov eax, str.Server_2019
jmp 0x49cd95
xor eax, eax
inc eax
je 0x49cd87
mov eax, str.Server_2016
jmp 0x49cd95
call fcn.0049cd8c
mov eax, dword [ebp - 0xe8]
cmp eax, 0x55f0
jl 0x49cdab
mov eax, 0x57eca2
jmp 0x49cdc5
xor eax, eax
inc eax
je 0x49cdb7
mov eax, 0x57eca5
jmp 0x49cdc5
call fcn.0049cdbc
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49cdf9
cmp eax, 1
je 0x49ce00
cmp eax, 2
je 0x49ce07
call fcn.0049cdf0
mov eax, 0x57ec1c
jmp 0x49ce20
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49ce1b
mov eax, str.Server_2003_R2
jmp 0x49ce20
mov eax, str.Server_2003
lea eax, [ebp - 0xb4]
mov eax, dword [eax + 8]
cmp eax, 0
je 0x49ce5b
cmp eax, 1
je 0x49ce76
cmp eax, 2
je 0x49ce91
cmp eax, 3
je 0x49ceac
call fcn.0049ce52
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49ce8a
mov eax, str.Server_2008_R1
jmp 0x49ce8f
mov eax, 0x57ec5b
jmp 0x49cec5
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49cea5
mov eax, str.Server_2012
jmp 0x49ceaa
mov eax, 0x57ec69
jmp 0x49cec5
mov eax, dword [ebp - 0xec]
cmp eax, 0
je 0x49cec0
mov eax, str.Server_2012_R2
jmp 0x49cec5
mov eax, 0x57ec7a
Function at 0x49d274
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, 0x1000
mov dword [ebp - 0x18], 0x1000
mov eax, 0
mov dword [ebp - 0x20], 0
mov eax, 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub eax, edx
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x20]
add eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x49d318
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x49d318
mov eax, 2
push edx
mov edx, dword [ebp - 0x18]
imul edx
pop edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.MSVCRT.DLL_realloc]
add esp, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
jne 0x49d296
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret 8
Function at 0x52041f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x52146c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x52149a
cmp eax, 5
je 0x5214d1
mov dword [ebp - 0x20], 0
jmp 0x521586
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044e23a
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044e23a
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x521586
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.00440a34
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.00440a6a
mov dword [ebp - 0x14], eax
jmp 0x52155c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x521515
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x521515
xor eax, eax
jmp 0x521518
xor eax, eax
inc eax
cmp eax, 0
je 0x521551
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044e23a
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044e23a
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x521574
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x521574
jmp 0x521578
xor eax, eax
jmp 0x52157b
xor eax, eax
inc eax
cmp eax, 0
jne 0x5214f0
mov eax, dword [0x57269c]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x521ee6
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x521f14
cmp eax, 0xf
je 0x521f42
mov eax, 0
jmp 0x52214f
push dword [ebp + 8]
call fcn.00440a34
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00440960
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x521f40
mov eax, 0
jmp 0x52214f
jmp 0x521f54
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x52214c
Function at 0x526079
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
and eax, 0x1000000
cmp eax, 0
setne al
xor ah, ah
cwde
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
je 0x5260d1
cmp eax, 0x11
je 0x5260e1
cmp eax, 0x12
je 0x5260fc
mov eax, 0
jmp 0x526115
push 3
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_MapVirtualKeyW]
mov dword [ebp - 0x10], eax
jmp 0x526115
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x5260f2
mov eax, 0xa3
jmp 0x5260f7
mov eax, 0xa2
mov dword [ebp - 0x10], eax
jmp 0x526115
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x52610d
mov eax, 0xa5
jmp 0x526112
mov eax, 0xa4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x52611c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, 0
mov dword [ebp - 0xc], 0
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x526152
mov eax, 0x10000000
mov dword [ebp - 0xc], 0x10000000
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x526171
mov eax, dword [ebp - 0xc]
or eax, 0x20000000
mov dword [ebp - 0xc], eax
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x526190
mov eax, dword [ebp - 0xc]
or eax, 0x40000000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor al, 1
cmp eax, 0
je 0x526218
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x5261bb
mov eax, dword [ebp - 0xc]
or eax, 0x2000000
mov dword [ebp - 0xc], eax
push 2
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x5261da
mov eax, dword [ebp - 0xc]
or eax, 0x800000
mov dword [ebp - 0xc], eax
push 4
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x5261f9
mov eax, dword [ebp - 0xc]
or eax, 0x1000000
mov dword [ebp - 0xc], eax
push 5
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x526218
mov eax, dword [ebp - 0xc]
or eax, 0x400000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x52de44
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x57ccfc]
xor al, 1
cmp eax, 0
je 0x52de8c
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x52de7b
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052bdd9
leave
ret 8