joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4cd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e4d8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040493c
mov eax, dword [0x571238]
cmp byte [eax], 0
je 0x4e4d3f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404c9c
mov eax, dword [ebx]
call fcn.00404ac8
push eax
mov eax, dword [ebx]
call fcn.00404ab8
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404ac8
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404c9c
jmp 0x4e4d71
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409b98
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4d91
lea eax, [ebp - 0x3f0]
call fcn.00404230
ret

Function at 0x4e4d98
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409b98
add esp, 0x3ec
pop ebx
ret

Function at 0x4e4f58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov esi, edx
mov ebp, eax
mov edx, esi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
cmp dword [esi + 0xc], 0
jne 0x4e501e
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0047491c
mov ebx, eax
mov dx, word [esi + 4]
mov eax, ebp
call fcn.004e4c14
mov edi, eax
test edi, edi
je 0x4e4fb7
mov al, byte [0x4e502c]
cmp al, bl
jne 0x4e4fb7
mov edx, edi
mov eax, ebp
call fcn.004e4b4c
mov dword [esi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x4e501e
cmp byte [ebp + 0x161], 2
jne 0x4e4fe2
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x5718f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, 0xb006
call fcn.0045e06c
test eax, eax
jne 0x4e501e
jmp 0x4e5019
mov edx, dword [0x571704]
mov edx, dword [edx]
mov edx, dword [edx + 0x44]
mov eax, dword [ebp + 0x128]
cmp edx, eax
je 0x4e5019
test byte [eax + 0x2f4], 8
jne 0x4e5019
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x571704]
mov eax, edx
mov edx, 0xb006
call fcn.0045e06c
xor eax, eax
mov dword [esi + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4eb07c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x5718f0]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x4eb122
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x4eb0c1
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4eb0fd
jmp 0x4eb0c5
pop edx
pop eax
jge 0x4eb0fd
mov eax, dword [0x5718f0]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004e5d44
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x4eb122
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4eb122
cmp dword [ebx + 0x11c], 0
je 0x4eb122
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00437da8
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4f1fb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f206a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040493c
mov eax, dword [0x571238]
cmp byte [eax], 0
je 0x4f201f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404c9c
mov eax, dword [ebx]
call fcn.00404ac8
push eax
mov eax, dword [ebx]
call fcn.00404ab8
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404ac8
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404c9c
jmp 0x4f2051
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409b98
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2071
lea eax, [ebp - 0x3f0]
call fcn.00404230
ret

Function at 0x4f5244
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4f529e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.004f52a8
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f52a5
ret
Function at 0x4fb6ec
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4fb722
jmp 0x4fb7c8
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x4fb766
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x17c], 0
je 0x4fb766
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x14]
jmp 0x4fb776
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x178]
test edx, edx
je 0x4fb776
mov eax, dword [edx + 0x14]
test eax, eax
je 0x4fb78f
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.004f8090
jmp 0x4fb7c8
mov dl, 1
mov eax, dword [0x427cc4]
call fcn.00429ccc
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.0042a850
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xbc]
mov eax, dword [esi + 0x10]
call fcn.0042987c
mov edx, esp
mov eax, esi
call fcn.0042a3d0
mov eax, esi
call fcn.0040341c
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4fdfcc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.004636d8
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.0045cdd8
pop ebx
ret
Function at 0x508660
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5087d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x5087b6
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409b98
mov dl, 1
mov eax, dword [0x4dec3c]
call fcn.004dec94
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x41ae50]
call fcn.004033ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004ded10
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x5087b3
mov dl, 1
mov eax, dword [0x4e0860]
call fcn.004e08c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x5087e8
call fcn.004df478
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040453c
xor eax, eax
push ebp
push 0x5087ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004e0bc8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005087f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5087b3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.0040341c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0040341c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0040341c
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5087d8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404254
ret
Function at 0x50e1ec
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419a48]
call fcn.00404d00
xor eax, eax
push ebp
push 0x50e330
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x570094], 0
jne 0x50e23f
mov ecx, dword [0x571138]
mov dl, 1
mov eax, dword [0x407ba8]
call fcn.0040d01c
call fcn.00403be8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402e08
mov eax, ebx
call fcn.00404ab8
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x50e340
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405ee0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404ac8
test eax, eax
jle 0x50e2d7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x50e2d0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004044b8
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004044a0
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b50
test eax, eax
jne 0x50e2d0
mov ebx, 0x15
jmp 0x50e2dc
mov ebx, 0x10
jmp 0x50e2dc
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x570094]
call fcn.0050e144
mov eax, dword [ebp - 8]
call fcn.0050e144
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405ef8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e337
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404254
lea eax, [ebp - 0x10]
mov edx, dword [0x419a48]
call fcn.00404dd0
ret

Function at 0x516760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x516798]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x516776
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x516785
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x516794
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x517aa8
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x571704]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x517ace
push 0
mov eax, dword [0x571704]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x51aa54
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x51aa82
mov eax, ebx
call fcn.0051b508
cmp dword [ebx + 0x40], 0
je 0x51aa7b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x51aaf3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x51aae5
cmp dword [ebx + 8], 0
je 0x51aaa4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x51aab6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x51aae5
cmp dword [ebx + 8], 0
je 0x51aa97
cmp eax, 3
je 0x51aac9
dec eax
jne 0x51aa97
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x51aa97
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x51aa97
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x51ab11
cmp dword [ebx + 0x14], 0xcc
je 0x51ab11
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0051ab1c
pop ebx
ret

Function at 0x52fcfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a2ec
cmp ebx, dword [ebp - 8]
jge 0x52fd5f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a738
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a738
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a764
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x52fd25
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x52fd68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a2ec
cmp ebx, dword [ebp - 8]
jge 0x52fdcb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a738
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a738
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a764
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x52fd91
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x54f904
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54f9bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004046f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x54f946
call fcn.00403c94
jmp 0x54f9c2
mov eax, ebx
call fcn.004027e4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.004046f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x54f96f
call fcn.00403c94
jmp 0x54f9c2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x54f9cc
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x54f990
call fcn.00403c94
jmp 0x54f9c2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f9c2
mov eax, dword [ebp - 8]
call fcn.00402804
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56a078
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004046e0
xor eax, eax
push ebp
push 0x56a144
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x57163c]
cmp byte [eax], 0
je 0x56a0f9
mov eax, dword [0x571344]
mov eax, dword [eax]
mov dl, 2
call fcn.00477db0
mov eax, dword [0x571344]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.005645b4
mov eax, dword [0x571344]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.00564560
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x571704]
mov eax, dword [eax]
mov edx, 0x56a158
call fcn.0047d33c
mov eax, dword [0x571344]
mov eax, dword [eax]
call fcn.0047a1cc
jmp 0x56a129
push 5
lea eax, [ebp - 0xc]
call fcn.004c8b84
push dword [ebp - 0xc]
push 0x56a170
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004045b0
mov eax, dword [ebp - 8]
call fcn.004046f0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56a14b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404254
ret

Function at 0x56b3e4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
xor eax, eax
push ebp
push 0x56b51a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x56b530
call fcn.00404284
lea edx, [ebp - 0xc]
mov eax, 2
call fcn.004d2b40
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x56b53c
call fcn.0040453c
xor eax, eax
push ebp
push 0x56b4eb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004046f0
push eax
mov eax, dword [0x571948]
mov eax, dword [eax]
call fcn.004046f0
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov eax, dword [ebp - 4]
call fcn.0040960c
test al, al
jne 0x56b499
push 0x2040
push 0x56b548
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x56b558
call fcn.0040453c
mov eax, dword [ebp - 0x10]
call fcn.004046f0
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56b4ff
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004c67f8
mov eax, dword [ebp - 4]
call fcn.00409658
mov eax, dword [ebp - 8]
call fcn.004044f0
mov esi, eax
mov edx, dword [ebp - 8]
mov eax, 0x56b57c
call fcn.00404834
mov edi, eax
lea ecx, [ebp - 0x14]
mov edx, esi
sub edx, edi
sub edx, 8
mov eax, dword [ebp - 8]
call fcn.00439168
mov eax, dword [ebp - 0x14]
mov edx, ebx
call fcn.00408bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56b4ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56b521
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404254
ret
Function at 0x4012b0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll_malloc]
push esi
push edi
push 0x288
mov esi, ecx
mov dword [esp + 0x10], 0
call ebx
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esi + 4], eax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x401300
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.MSVCR80.dll_free]
mov eax, dword [esp + 0x10]
push eax
call ebx
add esp, 8
mov dword [esi + 4], eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x401329
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x194]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [eax + 0x198]
mov dword [ecx + 4], eax
mov esi, dword [esi + 4]
fld1
fld qword [0x404598]
mov dword [esp + 0x14], esi
fld qword [0x404590]
add esi, 0x194
mov edi, 8
jmp 0x40134d
fxch st(2)
mov bl, byte [esi]
fxch st(2)
fcom st(1)
not bl
fnstsw ax
test ah, 0x41
jne 0x401395
call fcn.00403156
shrd eax, edx, 0xf
shr edx, 0xf
mov dword [esp + 0x18], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0
fild qword [esp + 0x18]
fild qword [esp + 0x20]
fchs
faddp st(1)
test bl, bl
je 0x4013a8
movzx ecx, bl
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fmulp st(1)
jmp 0x4013aa
fmul st(2)
add esi, 1
sub edi, 1
jne 0x40134b
mov edx, dword [esp + 0x14]
fstp st(1)
fstp st(1)
push edx
fstp qword [esp + 0x24]
call dword [sym.imp.MSVCR80.dll_free]
fld qword [esp + 0x24]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401cd0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x408148]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
xor ecx, ecx
lea eax, [esi + 0x16]
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [esp + ecx + 0xc], dl
movzx edx, byte [eax - 1]
mov byte [esp + ecx + 0xd], dl
movzx edx, byte [eax]
mov byte [esp + ecx + 0xe], dl
movzx edx, byte [eax + 1]
mov byte [esp + ecx + 0xf], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x401cf0
mov ecx, dword [esi + 0x14]
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
mov eax, 0x38
jb 0x401d32
mov eax, 0x78
sub eax, ecx
push eax
lea ebp, [esi + 0x5c]
push ebp
mov ecx, esi
call fcn.00401c00
push 8
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00401c00
lea ecx, [edi + 1]
lea eax, [esi + 6]
mov edi, 4
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x401d60
push 0x9c
push 0
push esi
call sub.MSVCR80.dll_memset
push 0x40
push 0
push ebp
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0x18
pop edi
pop esi
mov byte [ebp], 0x80
pop ebp
xor ecx, esp
call fcn.0040310a
add esp, 0xc
ret 4