joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4748d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4748fe
mov eax, ebx
call fcn.00475384
cmp dword [ebx + 0x40], 0
je 0x4748f7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47496f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x474961
cmp dword [ebx + 8], 0
je 0x474920
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x474932
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x474961
cmp dword [ebx + 8], 0
je 0x474913
cmp eax, 3
je 0x474945
dec eax
jne 0x474913
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x474913
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x474913
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47498d
cmp dword [ebx + 0x14], 0xcc
je 0x47498d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00474998
pop ebx
ret

Function at 0x484fbc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov eax, ebp
call fcn.00404f58
mov edx, eax
mov eax, dword [esp]
call fcn.004052e4
mov eax, ebp
call fcn.00404f58
test al, al
jbe 0x485027
mov byte [esp + 4], al
mov bl, 1
mov eax, dword [esp]
call fcn.004051b0
mov edi, ebx
and edi, 0xff
mov dl, byte [ebp + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
xor eax, eax
mov al, byte [ebp + edi - 1]
add si, ax
imul ax, si, 0xa03b
add ax, 0x4fcf
mov esi, eax
inc ebx
dec byte [esp + 4]
jne 0x484fec
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x485030
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00404f58
mov edx, eax
mov eax, ebp
call fcn.004052e4
mov eax, dword [esp]
call fcn.00404f58
test al, al
jbe 0x4850a0
mov byte [esp + 4], al
mov bl, 1
mov eax, ebp
call fcn.004051b0
mov edi, ebx
and edi, 0xff
mov edx, dword [esp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xa03b
add ax, 0x4fcf
mov esi, eax
inc ebx
dec byte [esp + 4]
jne 0x485061
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48871c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48897c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x48877f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004881e4
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040dc98
cmp al, 1
jne 0x48877f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004884fc
test al, al
je 0x48890b
cmp dword [ebp - 8], 0
jge 0x48879d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004881e4
mov eax, dword [ebp - 0x210]
call fcn.00404f58
cmp ebx, eax
jge 0x4887e7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004881e4
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4d746c]
and eax, 0xff
bt dword [edx], eax
jae 0x4887e7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4887fb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004886f8
cmp ebx, dword [ebp - 8]
je 0x4888fd
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x488827
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040c0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d6a20]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4888ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040c0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d6a20]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00453ef4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040c0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4d6a20]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00453ef4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4888f1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x48895e
cmp dword [ebp - 8], 0
jge 0x488916
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004881e4
mov eax, dword [ebp - 0x218]
call fcn.00404f58
cmp eax, dword [ebp - 8]
jg 0x488950
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004881e4
mov eax, dword [ebp - 0x21c]
call fcn.00404f58
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004886f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488983
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404cbc
ret
Function at 0x4970d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497218
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetLogicalDrives
mov dword [ebp - 0xd], eax
mov dword [ebp - 8], 0xa0
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x497115
bt dword [ebp - 0xd], eax
jae 0x4971f3
mov ebx, esi
add bl, 0x61
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404e80
lea eax, [ebp - 0x18]
mov edx, 0x497230
call fcn.00404f60
mov eax, dword [ebp - 0x18]
call fcn.00405158
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
mov byte [ebp - 9], al
mov eax, ebx
call fcn.00402c34
mov ebx, eax
mov al, byte [ebp - 9]
sub al, 3
jne 0x4971f3
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x43e0e0]
call fcn.004447d8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
call fcn.004031a4
mov edx, 0x497234
lea eax, [ebp - 0x24]
mov cl, 2
call fcn.00403174
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x1c]
call fcn.00404efc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.0044d72c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2f8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x68]
push 0x2d
push 0x2d
mov ecx, 0x2b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x84]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax + 0x124], edx
mov dword [eax + 0x120], 0x497644
mov eax, dword [ebp - 8]
add eax, 0x2d
add eax, 5
mov dword [ebp - 8], eax
inc esi
cmp esi, 0x1a
jne 0x49710a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49721f
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404cbc
ret

Function at 0x49c454
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff98
mov ebx, edx
push 0x64
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
mov edx, esp
mov ecx, 0x65
call fcn.00404f08
add esp, 0x68
pop ebx
ret
Function at 0x4a082c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a099d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a0978
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404e80
lea eax, [ebp - 0x118]
mov edx, 0x4a09b4
call fcn.00404f60
mov eax, dword [ebp - 0x118]
call fcn.00405158
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4a08ea
lea eax, [ebp - 0x111]
call fcn.00409db8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404d88
jmp 0x4a08f1
mov eax, esi
call fcn.00404c98
cmp bl, 0x61
jae 0x4a0912
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e074
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404cec
jmp 0x4a092c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040dfe8
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404cec
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4a09c0
call fcn.0040a480
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a097f
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
Function at 0x4a09c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a0aca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax]
call dword [edx + 0xd8]
call sub.KERNEL32.DLL_GetLogicalDrives
mov dword [ebp - 9], eax
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x4a0a12
bt dword [ebp - 9], eax
jae 0x4a0a9d
mov ebx, esi
add bl, 0x61
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404e80
lea eax, [ebp - 0x10]
mov edx, 0x4a0ae0
call fcn.00404f60
mov eax, dword [ebp - 0x10]
call fcn.00405158
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
mov byte [ebp - 5], al
mov eax, ebx
call fcn.00402c34
mov ebx, eax
mov al, byte [ebp - 5]
sub al, 3
jne 0x4a0a9d
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x20], 2
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.004a082c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4a0aec
call fcn.0040a480
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
cmp esi, 0x1a
jne 0x4a0a07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0ad1
lea eax, [ebp - 0x28]
call fcn.00404c98
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404cbc
ret
Function at 0x4a1128
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a1299
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1274
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404e80
lea eax, [ebp - 0x118]
mov edx, 0x4a12b0
call fcn.00404f60
mov eax, dword [ebp - 0x118]
call fcn.00405158
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4a11e6
lea eax, [ebp - 0x111]
call fcn.00409db8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404d88
jmp 0x4a11ed
mov eax, esi
call fcn.00404c98
cmp bl, 0x61
jae 0x4a120e
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e074
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404cec
jmp 0x4a1228
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040dfe8
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404cec
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4a12bc
call fcn.0040a480
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a127b
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
Function at 0x4a12c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4a1405
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, dword [esi + 0x314]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov bl, 0x41
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404e80
lea eax, [ebp - 4]
mov edx, 0x4a1420
call fcn.00404f60
mov eax, dword [ebp - 4]
call fcn.00405158
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
sub eax, 2
je 0x4a132a
dec eax
je 0x4a137e
jmp 0x4a13c3
cmp byte [esi + 0x31c], 0
je 0x4a13c3
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404e80
push dword [ebp - 0xc]
push 0x4a142c
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004a1128
push dword [ebp - 0x10]
push 0x4a1438
lea eax, [ebp - 8]
mov edx, 4
call fcn.00405018
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x314]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4a13c3
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404e80
push dword [ebp - 0x18]
push 0x4a142c
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004a1128
push dword [ebp - 0x1c]
push 0x4a1454
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405018
mov edx, dword [ebp - 0x14]
mov eax, dword [esi + 0x314]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp bl, 0x5b
jne 0x4a12f8
xor edx, edx
mov eax, dword [esi + 0x314]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov edx, dword [esi + 0x314]
mov eax, esi
call fcn.004a1514
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a140c
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404cbc
ret
Function at 0x4b0c7c
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
xor edx, edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405148
xor eax, eax
push ebp
push 0x4b0ebe
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 4]
call fcn.00405158
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4b0d6c
mov eax, 0x4d8d04
lea edx, [ebp - 0x130]
mov ecx, pe_nt_image_headers32
call fcn.00404f08
mov eax, 0x4d8d08
lea edx, [ebp - 0x230]
mov ecx, pe_nt_image_headers32
call fcn.00404f08
mov eax, dword [ebp - 8]
call fcn.00407c64
movzx eax, ax
lea ecx, [ebp - 0x234]
mov edx, 4
call fcn.00409548
push dword [ebp - 0x234]
push 0x4b0ed4
lea ecx, [ebp - 0x238]
movzx eax, word [ebp - 8]
mov edx, 4
call fcn.00409548
push dword [ebp - 0x238]
mov eax, 0x4d8d0c
mov edx, 3
call fcn.00405018
mov eax, dword [ebp - 0xc]
mov dword [0x4d8d10], eax
jmp 0x4b0d87
mov eax, 0x4d8d04
call fcn.00404c98
mov eax, 0x4d8d08
call fcn.00404c98
xor eax, eax
mov dword [0x4d8d10], eax
push 0x4d8d20
push 0x4d8d1c
push 0x4d8d18
push 0x4d8d14
push ebx
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x4b0e52
mov eax, dword [0x4d8d1c]
mov dword [ebp - 0x240], eax
xor eax, eax
mov dword [ebp - 0x23c], eax
fild qword [ebp - 0x240]
fstp qword [ebp - 0x18]
wait
mov eax, dword [0x4d8d18]
mov dword [ebp - 0x240], eax
xor eax, eax
mov dword [ebp - 0x23c], eax
fild qword [ebp - 0x240]
fstp qword [ebp - 0x20]
wait
mov eax, dword [0x4d8d14]
mov dword [ebp - 0x240], eax
xor eax, eax
mov dword [ebp - 0x23c], eax
fild qword [ebp - 0x240]
fstp qword [ebp - 0x28]
wait
mov eax, dword [0x4d8d20]
mov dword [ebp - 0x240], eax
xor eax, eax
mov dword [ebp - 0x23c], eax
fild qword [ebp - 0x240]
fstp qword [ebp - 0x30]
wait
fld qword [ebp - 0x18]
fmul qword [ebp - 0x20]
fmul qword [ebp - 0x28]
fstp qword [0x4d8d24]
wait
fld qword [ebp - 0x30]
fmul qword [ebp - 0x20]
fmul qword [ebp - 0x28]
fstp qword [0x4d8d34]
wait
fld qword [0x4d8d34]
fsub qword [0x4d8d24]
fstp qword [0x4d8d2c]
wait
jmp 0x4b0e98
xor eax, eax
mov dword [0x4d8d24], eax
mov dword [0x4d8d28], eax
xor eax, eax
mov dword [0x4d8d34], eax
mov dword [0x4d8d38], eax
xor eax, eax
mov dword [0x4d8d2c], eax
mov dword [0x4d8d30], eax
xor eax, eax
mov dword [0x4d8d14], eax
xor eax, eax
mov dword [0x4d8d18], eax
xor eax, eax
mov dword [0x4d8d1c], eax
xor eax, eax
mov dword [0x4d8d20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0ec5
lea eax, [ebp - 0x238]
mov edx, 2
call fcn.00404cbc
lea eax, [ebp - 4]
call fcn.00404c98
ret
Function at 0x4ca6dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
mov byte [ebp - 1], 0
or ebx, 0xffffffff
lea eax, [ebp - 0x148]
push eax
mov eax, edi
call fcn.00405158
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ca7ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
je 0x4ca791
cmp ebx, 0xffffffff
jne 0x4ca741
mov ebx, dword [ebp - 0x128]
mov eax, esi
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404f08
mov byte [ebp - 1], 1
jmp 0x4ca77b
mov ecx, dword [ebp - 0x128]
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x4ca75f
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4ca77b
jmp 0x4ca763
pop edx
pop eax
jge 0x4ca77b
mov ebx, ecx
mov eax, esi
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404f08
mov byte [ebp - 1], 1
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4ca71e
jmp 0x4ca795
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca7b3
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FindClose
ret

Function at 0x4cb338
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cb3cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404e80
lea eax, [ebp - 0x10]
mov edx, 0x4cb3e0
call fcn.00404f60
mov eax, dword [ebp - 0x10]
call fcn.00405158
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4cb3a9
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov edx, esi
mov eax, 8
call fcn.00409570
jmp 0x4cb3b5
mov eax, esi
mov edx, 0x4cb3ec
call fcn.00404cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb3d2
lea eax, [ebp - 0x10]
call fcn.00404c98
ret
Function at 0x4cc8e4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405148
xor eax, eax
push ebp
push 0x4cca11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4cc9e5
xor eax, eax
push ebp
push 0x4cc9de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f58
inc eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cc9b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4cc9a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f58
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00405158
mov edx, ebx
pop ecx
call fcn.00402a80
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc9a9
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, 0x4d6a90
mov dl, 1
mov eax, dword [0x4082b0]
call fcn.0040d350
call fcn.00404650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cca18
lea eax, [ebp - 4]
call fcn.00404c98
ret
Function at 0x4cca20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ccbd1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405348
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4ccbe8
call fcn.00404fa4
mov eax, ebx
call fcn.0041f5f8
mov edi, eax
dec edi
test edi, edi
jl 0x4ccad8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041f5cc
mov edx, dword [0x43e0e0]
call fcn.00404050
test al, al
je 0x4ccad4
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041f5cc
lea edx, [ebp - 0x14]
call fcn.0044d6fc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405348
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405018
inc esi
dec edi
jne 0x4cca86
mov al, byte [0x4ccbec]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4ccbf8
mov eax, dword [ebp - 0xc]
call fcn.0040e7e0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404d30
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044d6fc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4ccbe8
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0044d6fc
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4ccbe8
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4ccbe8
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4ccc04
call fcn.0040a480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccbd8
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404cbc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404cbc
lea eax, [ebp - 0x14]
call fcn.00404c98
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404cbc
ret