joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbb38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00407918
cmp ax, 0xffff
jne 0x4dbb59
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4dbbda
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4dbbda
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4dbba0
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x4dbb93
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4dbbda
cmp dword [ebp + 8], 0
jle 0x4dbbda
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042ef34
mov esi, eax
test esi, esi
jle 0x4dbbd1
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040792c
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4e18c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x53b288]
cmp byte [eax], 0
jne 0x4e18ee
mov ecx, 0xaf
mov edx, 0x4e193c
mov eax, 0x4e197c
call fcn.004041c8
mov eax, ebx
call fcn.00404994
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4e192d
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404b40
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e1990
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x53b288]
cmp byte [eax], 0
jne 0x4e19b3
mov ecx, 0xbd
mov edx, 0x4e19f4
mov eax, 0x4e1a34
call fcn.004041c8
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4e19e6
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4e19e6
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4e19e6
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4e4f38
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4e4f9c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044dc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004098a0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4fa3
lea eax, [ebp - 0xc]
call fcn.0040426c
ret
Function at 0x4e5040
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4e509c
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4e506b
call fcn.0040efac
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402930
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4e509c
call fcn.0040efac
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4ece8c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4ed010
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x4ecff5
cmp byte [ebx + 0x268], 0
je 0x4ecff5
mov eax, dword [ebp - 4]
call fcn.004e6418
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x4ecfee
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x4ecf32
dec ax
je 0x4ecf08
sub ax, 0x12
jne 0x4ecf4c
call fcn.00403c94
jmp 0x4ecff5
cmp byte [ebx + 0x269], 0
je 0x4ecfd4
mov eax, ebx
call fcn.00463700
test al, al
je 0x4ecfd4
xor edx, edx
mov eax, ebx
call fcn.00463724
jmp 0x4ecfd4
mov eax, dword [esi]
call fcn.00404be8
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00404dd0
jmp 0x4ecfd4
cmp byte [ebx + 0x269], 0
je 0x4ecf69
mov eax, ebx
call fcn.00463700
test al, al
jne 0x4ecf69
mov dl, 1
mov eax, ebx
call fcn.00463724
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x4ecf81
mov eax, esi
call fcn.00404994
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.00404aac
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00404c54
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.004eccbc
test al, al
je 0x4ecfd4
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.00404aac
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404bf4
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecff5
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.004e644c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed017
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004049ac
ret
Function at 0x4f3618
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404738
xor eax, eax
push ebp
push 0x4f3745
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4f3719
xor eax, eax
push ebp
push 0x4f3712
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404548
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f36e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4f36d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404548
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404748
mov edx, ebx
pop ecx
call fcn.00402930
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f36dd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, 0x4f375c
mov dl, 1
mov eax, dword [0x408000]
call fcn.0040d928
call fcn.00403be8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f374c
lea eax, [ebp - 4]
call fcn.0040426c
ret
Function at 0x4f3774
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f3925
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404938
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4f393c
call fcn.00404594
mov eax, ebx
call fcn.004244a8
mov edi, eax
dec edi
test edi, edi
jl 0x4f382c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042447c
mov edx, dword [0x45e470]
call fcn.004035a8
test al, al
je 0x4f3828
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042447c
lea edx, [ebp - 0x14]
call fcn.0046e8d0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404938
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404608
inc esi
dec edi
jne 0x4f37da
mov al, byte [0x4f3940]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4f394c
mov eax, dword [ebp - 0xc]
call fcn.0040ee70
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404304
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0046e8d0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4f393c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0046e8d0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4f393c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4f393c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4f3958
call fcn.0040a7cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f392c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404290
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404290
lea eax, [ebp - 0x14]
call fcn.0040426c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404290
ret

Function at 0x4f4c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov eax, dword [edi]
call fcn.00404548
mov esi, eax
test esi, esi
jle 0x4f4c62
mov ebx, 1
mov eax, edi
call fcn.004047a0
mov edx, dword [edi]
movzx edx, byte [edx + ebx - 1]
xor edx, ebp
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4f4c4a
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f56c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004042c0
mov esi, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404548
test ax, ax
jbe 0x4f5732
mov word [ebp - 0xa], ax
mov bx, 1
mov eax, dword [ebp - 8]
call fcn.004047a0
movzx edi, bx
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [ebp - 0xa]
jne 0x4f56f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f59e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.004042c0
mov eax, dword [esi]
call fcn.00404548
test ax, ax
jbe 0x4f5a4c
mov word [ebp - 2], ax
mov bx, 1
mov eax, esi
call fcn.004047a0
movzx edx, bx
lea eax, [eax + edx - 1]
push eax
movzx eax, bx
mov edx, dword [esi]
mov al, byte [edx + eax - 1]
movzx edx, di
shr edx, 8
xor al, dl
pop edx
mov byte [edx], al
movzx eax, bx
mov edx, dword [esi]
movzx eax, byte [edx + eax - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [ebp - 2]
jne 0x4f5a0a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f5c1c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404738
mov eax, dword [ebp - 8]
call fcn.00404738
xor eax, eax
push ebp
push 0x4f5d72
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040426c
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 4]
mov edx, 0x4f5d88
call fcn.00404550
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004047a0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x4f5d4f
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.004048d4
lea eax, [ebp - 0xc]
call fcn.004047a0
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004047a0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4f5d4f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4f5d8c
lea eax, [ebp - 0xc]
call fcn.004047a0
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f5d22
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call fcn.00407918
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x38]
mov ecx, 2
mov eax, 0x4f5db0
call fcn.0040a7cc
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.00404304
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.004047a0
push eax
lea eax, [ebp - 0xc]
call fcn.004047a0
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f5d4f
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.0040a2dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5d79
lea eax, [ebp - 0x20]
call fcn.0040426c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404290
ret

Function at 0x4f76b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x4f76f9
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x4f76d8
mov eax, dword [0x53b6ec]
mov eax, dword [eax]
call fcn.0048eb50
push 0xa
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x4f76f5
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4f76c5
jmp 0x4f76f9
pop edx
pop eax
jge 0x4f76c5
pop esi
pop ebx
ret
Function at 0x4f76fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x4f7749
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x4f7723
mov eax, dword [0x53b6ec]
mov eax, dword [eax]
call fcn.0048eb50
push 3
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x4f7740
cmp eax, dword [esp]
pop edx
pop eax
jb 0x4f7749
jmp 0x4f7744
pop edx
pop eax
jl 0x4f7749
cmp byte [edi], 0
je 0x4f7710
pop edi
pop esi
pop ebx
ret

Function at 0x4f7e04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404738
mov eax, dword [ebp - 8]
call fcn.00404738
xor eax, eax
push ebp
push 0x4f7e7d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4f7e62
push esi
push 0x4f7e8c
mov eax, dword [ebp - 8]
call fcn.00404748
push eax
mov eax, dword [ebp - 4]
call fcn.00404748
push eax
push 0x4f7e90
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7e84
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404290
ret

Function at 0x4f8944
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404738
mov eax, dword [ebp - 8]
call fcn.00404738
xor eax, eax
push ebp
push 0x4f89ed
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.00404748
push eax
mov eax, dword [ebp - 4]
call fcn.00404748
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
mov eax, 0x12c
call fcn.004f76b4
test ebx, ebx
jg 0x4f89d2
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
imul eax, edi, 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x4f89ce
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4f897a
jmp 0x4f89d2
pop edx
pop eax
jge 0x4f897a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f89f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404290
ret
Function at 0x4f8ac4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f8c1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040426c
test esi, esi
je 0x4f8c01
mov eax, dword [0x53b6ec]
mov eax, dword [eax]
call fcn.0048eb50
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.004048d4
imul eax, dword [ebp - 4], 0x3e8
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [0x53b6ec]
mov eax, dword [eax]
call fcn.0048eb50
push 0
push 0
push 0
push 0
push 0x4f8c2c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
mov eax, dword [0x53b6ec]
mov eax, dword [eax]
call fcn.0048eb50
xor eax, eax
push ebp
push 0x4f8bfa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4f8bda
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.00404748
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4f8bda
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x10]
call fcn.004047a0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004047a8
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00404550
mov eax, dword [0x53b6ec]
mov eax, dword [eax]
call fcn.0048eb50
cmp dword [ebp - 0x14], 0
jne 0x4f8b92
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8c01
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8c26
lea eax, [ebp - 0x18]
call fcn.0040426c
lea eax, [ebp - 0x10]
call fcn.0040426c
ret

Function at 0x4f9f90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4fa00b
call sub.user32.dll_EmptyClipboard
mov eax, edi
xor edx, edx
call fcn.00404d00
je 0x4fa004
mov eax, edi
call fcn.00404be8
inc eax
add eax, eax
push eax
push 0x2000
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
test esi, esi
je 0x4fa006
push esi
call sub.kernel32.dll_GlobalLock
mov ebx, eax
mov eax, edi
call fcn.00404be8
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.00404bd8
mov edx, ebx
pop ecx
call fcn.00402930
push esi
call sub.kernel32.dll_GlobalUnlock
push esi
push 0xd
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
jmp 0x4fa006
mov bl, 1
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4fa334
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov byte [esp + 1], cl
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, eax
jge 0x4fa383
test edi, edi
jne 0x4fa456
mov ebx, 1
cmp byte [esp + 1], 0
je 0x4fa365
or ebx, 2
cmp byte [esp], 0
je 0x4fa36e
or ebx, 4
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
jmp 0x4fa456
lea eax, [esp + 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0x10]
push eax
push 0x4fa460
mov eax, edi
call fcn.00404748
mov esi, eax
push esi
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4fa456
push esi
push edi
lea esi, [esp + 0x14]
lea edi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 2
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
lea eax, [esp + 0x10]
push eax
push 0x4fa474
push esi
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4fa456
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 2
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp byte [esp + 1], 1
cmc
sbb eax, eax
push eax
cmp byte [esp + 4], 1
cmc
sbb eax, eax
push eax
push 0
push 0
push esi
call sub.advapi32.dll_InitiateSystemShutdownA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
add esp, 0x2c
pop edi
pop esi
pop ebx
ret

Function at 0x502378
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x502432
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404994
mov eax, dword [0x53b280]
cmp byte [eax], 0
je 0x5023e7
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404f4c
mov eax, dword [ebx]
call fcn.00404be8
push eax
mov eax, dword [ebx]
call fcn.00404bd8
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404be8
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404f4c
jmp 0x502419
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a2dc
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502439
lea eax, [ebp - 0x3f0]
call fcn.0040426c
ret
Function at 0x50568c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5056e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.005056f0
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5056ed
ret

Function at 0x50e7e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.004751fc
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.0046e7f0
pop ebx
ret