joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401710
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x144
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
pop edi
cmp esi, 0xffffffff
pop eax
je 0x401776
lea edi, [ebp - 0x148]
mov dword [ebp - 0x148], 0x128
push ebx
push ebx
push edi
push esi
call sub.kernel32.dll_Process32First
jmp 0x401764
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x130], eax
je 0x401790
push ecx
push ecx
push edi
push esi
call sub.kernel32.dll_Process32Next
pop edx
test eax, eax
pop ecx
jne 0x401750
sub esp, 0xc
push esi
call sub.kernel32.dll_CloseHandle
add esp, 0xc
mov eax, dword [ebp + 8]
push edx
push edx
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_TerminateProcess
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
mov eax, dword [ebp - 0x140]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
pop eax
test ebx, ebx
je 0x40175b
push eax
push eax
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_TerminateProcess
push eax
push ebx
call sub.kernel32.dll_CloseHandle
add esp, 0xc
jmp 0x40175b

Function at 0x4017f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push 0
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_ReadFile
xor edx, edx
add esp, 0xc
test eax, eax
je 0x401819
mov edx, dword [ebp - 4]
mov eax, edx
leave
ret

Function at 0x401820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push 0
mov edx, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call sub.kernel32.dll_WriteFile
xor edx, edx
add esp, 0xc
test eax, eax
je 0x401849
mov edx, dword [ebp - 4]
mov eax, edx
leave
ret
Function at 0x41f0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41f154
mov edx, dword [ebp + 8]
xor ebx, ebx
xor ecx, ecx
mov eax, dword [edx]
mov byte [eax + 0x16], 0
mov eax, dword [edx]
mov byte [eax + 0x17], 0
mov eax, dword [edx]
mov byte [eax + 0x18], 0
mov eax, dword [edx]
mov byte [eax + 0x19], 0
mov esi, dword [edx + 4]
cmp esi, 0
jle 0x41f15a
mov edi, dword [edx]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
xor eax, eax
mov edx, ebx
shr ebx, 0x18
mov al, byte [ecx + edi]
xor eax, ebx
inc ecx
shl edx, 8
mov ebx, edx
mov edi, dword [eax*4 + 0x6560e0]
xor ebx, edi
cmp esi, ecx
jg 0x41f0e2
mov edx, dword [ebp + 8]
xor ecx, ecx
mov edi, dword [edx + 0xc]
cmp edi, 0
jle 0x41f133
mov esi, dword [edx + 8]
xor eax, eax
mov edx, ebx
shr ebx, 0x18
mov al, byte [ecx + esi]
xor eax, ebx
inc ecx
shl edx, 8
mov ebx, edx
mov edx, dword [eax*4 + 0x6560e0]
xor ebx, edx
cmp edi, ecx
jg 0x41f114
mov edi, dword [ebp - 0x10]
mov byte [edi + 0x16], bl
shr ebx, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov byte [eax + 0x17], bl
shr ebx, 8
mov eax, dword [edx]
mov byte [eax + 0x18], bl
shr ebx, 8
mov eax, dword [edx]
mov byte [eax + 0x19], bl
pop ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
jmp 0x41f104
Function at 0x439870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x234
lea edi, [ebp - 0x228]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], edx
mov ebx, dword [ebp + 8]
push edi
push eax
mov esi, 0x200
call fcn.00431630
add esp, 0x10
sub esp, 0xc
push edi
call fcn.00431a10
add esp, 0x10
cmp esi, ebx
jbe 0x4398b2
mov esi, ebx
mov ecx, dword [ebp - 0x230]
push ecx
push esi
push 1
push eax
call sub.msvcrt.dll_fread
mov edx, dword [ebp - 0x228]
add edx, eax
add esp, 0x10
sub ebx, eax
mov dword [ebp - 0x228], edx
setne dl
cmp eax, esi
sete al
and eax, 0xff
test eax, edx
jne 0x4398a0
sub esp, 0xc
xor esi, esi
push edi
call fcn.00431930
add esp, 0x10
test ebx, ebx
jne 0x439907
mov esi, 1
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
push 0xffffffffffffffff
mov edi, dword [ebp - 0x22c]
push edi
call fcn.00432a70
add esp, 0x10
test eax, eax
jne 0x4398f8
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x43b650
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x128
mov ebx, eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, edx
push eax
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x43b741
push 0x6580a2
push 0x6580a6
push eax
push ebx
call fcn.00431ae0
push esi
push 0x6580a9
push eax
push ebx
call fcn.00431ae0
add esp, 0x18
push 0xfffffffffffffffe
push ebx
call fcn.00432580
add esp, 0xc
lea esi, [ebp - 0x128]
push 0x105
push esi
push 0
call sub.kernel32.dll_GetModuleFileNameA
test eax, eax
pop edx
sete dl
cmp eax, 0x105
sete al
or eax, edx
test al, 1
jne 0x43b720
push eax
push eax
push 0x5c
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
test eax, eax
je 0x43b720
mov byte [eax], 0
push esi
push 0x6580ab
sub esp, 0xc
push 0
push 0xffffffffffffffff
push ebx
call fcn.004329f0
add esp, 0x18
push eax
push ebx
call fcn.00431ae0
pop esi
pop eax
push 0xfffffffffffffffe
push ebx
call fcn.00432580
add esp, 0xc
push edi
push 0xfffffffffffffffe
push ebx
call fcn.00433130
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
push str.unable_to_get_ModuleFileName
push ebx
call fcn.00430f20
add esp, 0xc
push edi
push 0xfffffffffffffffe
push ebx
call fcn.00433130
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ecx
push ecx
push esi
push ebx
call fcn.00432c90
jmp 0x43b6a0
Function at 0x44a430
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
je 0x44a50d
cmp eax, 0xcb
je 0x44a490
cmp eax, 0xcc
jne 0x44a45f
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
jmp fcn.0044a300
mov eax, dword [ebx]
sub esp, 0xc
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebx]
push ebx
call dword [eax]
mov eax, ebx
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
jmp fcn.0044a300
mov dword [ebx + 0x14], 0xcb
nop
lea esi, [esi]
mov eax, dword [ebx + 0x1ec]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x44a4f6
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x44a535
sub esp, 0xc
mov eax, dword [ebx + 0x1ec]
push ebx
call dword [eax]
add esp, 0x10
test eax, eax
je 0x44a543
cmp eax, 2
je 0x44a4f6
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x44a4a8
cmp eax, 3
sete dl
dec eax
sete al
or eax, edx
test al, 1
je 0x44a4a0
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
inc eax
mov dword [ecx + 4], eax
cmp eax, edx
jl 0x44a4a0
mov eax, dword [ebx + 0x178]
add edx, eax
mov dword [ecx + 8], edx
jmp 0x44a4a0
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
jmp fcn.0044a300
sub esp, 0xc
push ebx
call fcn.0044f3f0
mov eax, dword [ebx + 0x40]
add esp, 0x10
test eax, eax
je 0x44a484
mov dword [ebx + 0x14], 0xcf
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push ebx
call dword [ecx]
add esp, 0x10
jmp 0x44a4a8
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x44c1e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov dword [esi + 4], 0
push esi
call fcn.0044f8b0
pop ebx
mov dword [ebp - 0x10], eax
pop eax
push 0x54
push esi
call fcn.0044f840
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x44c314
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebx], fcn.0044b420
mov dword [ebx + 4], fcn.0044b5c0
mov dword [ebx + 8], fcn.0044b670
mov dword [ebx + 0xc], fcn.0044b720
mov dword [ebx + 0x10], 0x44b7f0
mov dword [ebx + 0x14], 0x44b870
mov dword [ebx + 0x18], 0x44b8f0
mov dword [ebx + 0x1c], 0x44bca0
mov dword [ebx + 0x20], 0x44be70
mov dword [ebx + 0x24], fcn.0044c040
mov dword [ebx + 0x28], 0x44c190
mov dword [ebx + 0x30], 0x3b9aca00
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
push str.JPEGMEM
call sub.msvcrt.dll_getenv
add esp, 0x10
mov edx, eax
test eax, eax
je 0x44c2f8
lea eax, [ebp - 9]
mov byte [ebp - 9], 0x78
push eax
lea eax, [ebp - 0x10]
push eax
push str._ld_c
push edx
call sub.msvcrt.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x44c2f8
mov al, byte [ebp - 9]
cmp al, 0x6d
sete dl
cmp al, 0x4d
sete al
or eax, edx
test al, 1
jne 0x44c300
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [ebp - 0x10], eax
jmp 0x44c2e9
sub esp, 0xc
push esi
call fcn.0044f8c0
mov eax, dword [esi]
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x36
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax]
add esp, 0x10
jmp 0x44c212
Function at 0x462330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov word [eax + 4], 0xffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov word [eax + 0x10], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0x20
mov dword [eax + 0x60], 0x20
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 2
mov dword [eax + 0x70], 2
mov dword [eax + 0x74], 0x1388
mov dword [eax + 0x78], 0x1f4
mov dword [eax + 0x7c], 0x1f4
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 0
mov dword [eax + 0x88], 0x1f4
mov dword [eax + 0x8c], 0
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
mov dword [eax + 0x98], 0
mov word [eax + 0x90], dx
mov dword [eax + 0x9c], 0
mov dword [eax + 0x94], 0x8000
pop ebp
jmp fcn.00462260

Function at 0x462b60
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
cmp dword [ebp + 8], 2
sete al
and eax, 0xff
push 0
inc eax
push eax
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x2c], 1
mov ebx, eax
mov dword [ebp - 0x30], 0x40000
pop eax
or eax, 0xffffffff
cmp ebx, 0xffffffff
je 0x462c0b
cmp dword [ebp + 8], 2
je 0x462c42
lea esi, [ebp - 0x28]
xor eax, eax
cld
mov ecx, 4
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x28], 2
test edi, edi
je 0x462c33
mov edx, dword [ebp + 0xc]
sub esp, 0xc
mov ax, word [edx + 4]
and eax, 0xffff
push eax
call sub.ws2_32.dll_htons
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov word [ebp - 0x26], ax
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
push ecx
push 0x10
push esi
push ebx
call sub.ws2_32.dll_bind
pop edx
inc eax
je 0x462c25
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 1
sete dl
test eax, eax
setne al
and eax, 0xff
test eax, edx
jne 0x462c13
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push edi
push edi
push 0x7fffffff
push ebx
call sub.ws2_32.dll_listen
pop ecx
inc eax
pop esi
jne 0x462c09
sub esp, 0xc
push ebx
call sub.ws2_32.dll_closesocket
or eax, 0xffffffff
jmp 0x462c0b
mov word [ebp - 0x26], 0
mov dword [ebp - 0x24], 0
jmp 0x462be3
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x8004667e
push ebx
call sub.ws2_32.dll_ioctlsocket
push eax
push eax
lea eax, [ebp - 0x30]
push 4
push eax
push 0x1002
push 0xffff
push ebx
call sub.ws2_32.dll_setsockopt
add esp, 0xc
jmp 0x462ba3
Function at 0x462d60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x462d92
mov word [ebp - 0x18], 2
sub esp, 0xc
mov ax, word [ebx + 4]
and eax, 0xffff
push eax
call sub.ws2_32.dll_htons
add esp, 0xc
mov word [ebp - 0x16], ax
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
sub esp, 0xc
cmp ebx, 1
sbb eax, eax
xor eax, 0xffffffff
push 0
and eax, 0x10
push 0
push eax
xor eax, eax
test ebx, ebx
je 0x462dae
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ws2_32.dll_WSASendTo
add esp, 0xc
inc eax
je 0x462dd4
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 4]
leave
ret
call sub.ws2_32.dll_WSAGetLastError
mov ebx, dword [ebp - 4]
cmp eax, 0x2733
leave
sete al
and eax, 0xff
dec eax
ret

Function at 0x462df0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push 0
test ebx, ebx
push 0
je 0x462e71
push eax
xor eax, eax
test ebx, ebx
je 0x462e1d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ws2_32.dll_WSARecvFrom
add esp, 0xc
inc eax
je 0x462e75
or eax, 0xffffffff
cmp word [ebp - 0x20], 0
js 0x462e6c
test ebx, ebx
je 0x462e69
mov eax, dword [ebp - 0x14]
sub esp, 0xc
mov dword [ebx], eax
mov ax, word [ebp - 0x16]
and eax, 0xffff
push eax
call sub.ws2_32.dll_htons
add esp, 0xc
mov word [ebx + 4], ax
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 4]
leave
ret
xor eax, eax
jmp 0x462e13
call sub.ws2_32.dll_WSAGetLastError
mov edx, eax
cmp eax, 0x2733
je 0x462e8e
or eax, 0xffffffff
cmp edx, 0x2746
jne 0x462e6c
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x462ea0
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x10624dd3
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x23c
mov dword [ebp - 0x128], 0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x238], 0
mov eax, ecx
mov ebx, dword [ebp + 8]
mul edx
shr edx, 6
mov dword [ebp - 0x240], edx
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
shl edx, 3
sub ecx, edx
mov edx, dword [ebp + 0xc]
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [ebp - 0x23c], eax
mov eax, dword [edx]
test al, 1
je 0x462f11
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x238], 1
test al, 2
je 0x462f34
mov edx, dword [ebp - 0x128]
xor eax, eax
cmp edx, 0
jbe 0x462f30
cmp dword [ebp + eax*4 - 0x124], ebx
je 0x462f30
inc eax
cmp edx, eax
ja 0x462f22
cmp edx, eax
je 0x462fae
sub esp, 0xc
lea eax, [ebp - 0x240]
lea esi, [ebp - 0x238]
lea edi, [ebp - 0x128]
push eax
lea eax, [ebx + 1]
push 0
push esi
push edi
push eax
call sub.ws2_32.dll_select
or edx, 0xffffffff
add esp, 0xc
test eax, eax
jl 0x462f6e
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jne 0x462f78
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
push esi
push ebx
call sub.ws2_32.dll___WSAFDIsSet
pop edx
test eax, eax
pop ecx
jne 0x462fa2
push eax
push eax
push edi
push ebx
call sub.ws2_32.dll___WSAFDIsSet
pop ebx
test eax, eax
pop esi
je 0x462f6c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, 2
mov dword [eax], ecx
jmp 0x462f6c
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 1
mov dword [edx], eax
jmp 0x462f87
cmp eax, 0x3f
ja 0x462f34
mov dword [ebp + eax*4 - 0x124], ebx
inc eax
mov dword [ebp - 0x128], eax
jmp 0x462f34
Function at 0x46f1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
lea ecx, [edx + edx*2]
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
shl ebx, 5
mov esi, dword [ebp + 8]
add ecx, ebx
mov ebx, dword [eax + 0x70]
shl ecx, 2
mov eax, dword [eax + 0x6c]
add ecx, ebx
mov dword [ebp - 0x10], 0
add ecx, 0x28
dec edx
sete dl
and edx, 0xff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], edx
test al, 4
je 0x46f270
test esi, esi
js 0x46f301
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x46f2f8
test byte [ebp - 0x28], 2
jne 0x46f280
mov edi, dword [ecx + 8]
test edi, edi
je 0x46f240
mov edx, dword [ecx + 0x10]
mov eax, esi
sub eax, edx
js 0x46f381
cmp eax, 0x27
jg 0x46f240
mov esi, edx
cmp edx, 0x2f
jg 0x46f260
mov esi, 0x30
jmp 0x46f260
cmp esi, 0x35
jg 0x46f32d
mov eax, 0x36
sub eax, esi
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
add esi, eax
nop
lea esi, [esi]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x46f270
neg esi
lea esi, [esi]
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ecx + 8]
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x62
mov dword [ebp - 0x24], esi
cmp edi, eax
jge 0x46f2c3
add ecx, 0x10
lea esi, [esi]
mov edx, dword [ecx]
mov ebx, esi
sub ebx, edx
mov eax, ebx
sar eax, 0x1f
xor ebx, eax
sub ebx, eax
cmp ebx, dword [ebp - 0x20]
jge 0x46f2ba
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], edx
inc edi
add ecx, 0xc
cmp edi, dword [ebp - 0x18]
jl 0x46f2a0
mov eax, dword [ebp - 0x24]
add eax, 0x20
and eax, 0xffffffc0
cmp esi, dword [ebp - 0x24]
jl 0x46f30f
add eax, 0x30
cmp eax, esi
jle 0x46f2de
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
test ebx, ebx
je 0x46f318
cmp esi, 0x3f
jle 0x46f323
add esi, 0x10
and esi, 0xffffffc0
jmp 0x46f260
test byte [ebp - 0x28], 1
jmp 0x46f216
neg esi
mov dword [ebp - 0x10], 1
jmp 0x46f207
sub eax, 0x30
cmp eax, esi
jge 0x46f2de
jmp 0x46f2d8
test byte [ebp - 0x28], 8
je 0x46f357
cmp esi, 0x3f
jg 0x46f36c
mov esi, 0x40
jmp 0x46f260
cmp esi, 0xbf
jg 0x46f260
mov eax, esi
and esi, 0xffffffc0
and eax, 0x3f
cmp eax, 9
jle 0x46f259
cmp eax, 0x15
jg 0x46f38a
add esi, 0xa
jmp 0x46f260
cmp esi, 0x2f
jle 0x46f377
cmp esi, 0x7f
jg 0x46f36c
add esi, 0x16
and esi, 0xffffffc0
jmp 0x46f260
add esi, 0x20
and esi, 0xffffffc0
jmp 0x46f260
add esi, 0x40
sar esi, 1
jmp 0x46f260
mov eax, edx
sub eax, esi
jmp 0x46f22c
cmp eax, 0x29
jle 0x46f259
cmp eax, 0x35
jg 0x46f259
add esi, 0x36
jmp 0x46f260
Function at 0x490a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0x11c]
mov eax, dword [eax + 0x118]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
test eax, eax
jle 0x490a76
xor ebx, ebx
push eax
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebx + eax]
push eax
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x490a46
mov edi, 1
inc esi
mov eax, edi
add ebx, 0xc
cmp dword [ebp - 0x18], esi
setg dl
xor eax, 1
and eax, 0xff
test eax, edx
jne 0x490a28
mov edx, dword [ebp - 0x14]
lea eax, [esi + esi*2]
lea eax, [edx + eax*4 - 0xc]
mov edx, edi
test dl, dl
je 0x490a76
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4b5e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
jne 0x4b5e69
mov esi, dword [edi + 0x18]
push eax
push eax
push esi
push edi
call fcn.004b5c20
mov edx, dword [edi + 0x14]
xor ecx, ecx
add esp, 0x10
jmp 0x4b5ea6
movsx eax, word [edx + 2]
sub eax, 0xffffff80
test eax, 0xffffff00
je 0x4b5e99
sar eax, 0x1f
xor eax, 0xffffffff
and eax, 0xff
mov byte [ebx], al
inc ecx
mov dword [edx], 0
inc ebx
add edx, 4
cmp ecx, esi
jl 0x4b5e80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4b7170
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa8
lea ebx, [ebp - 0xa8]
push 0x94
push 0x5dbc7c
push ebx
call fcn.004c86b0
mov eax, dword [0x679360]
add esp, 0x10
test eax, eax
je 0x4b71a1
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
push ebx
call sub.kernel32.dll_GetVersionExA
add esp, 0xc
test eax, eax
je 0x4b71ba
cmp dword [ebp - 0x98], 2
je 0x4b7205
mov dword [0x679390], 1
call sub.kernel32.dll_GetCurrentThreadId
mov dword [0x679340], eax
push eax
push 0
push 0x4b6d60
push 3
call sub.USER32.dll_SetWindowsHookExA
sub esp, 0xc
mov dword [0x679330], eax
push 1
call sub.WINMM.DLL_timeBeginPeriod
push 0x4b6b40
call fcn.00401335
mov dword [0x679360], 1
mov ebx, dword [ebp - 4]
leave
ret
mov dword [0x679320], 1
jmp 0x4b71ba
Function at 0x4b7220
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
lea esi, [ebp - 0x28]
sub esp, 0xc
push 1
push 0
push 0
push 0
push esi
call sub.USER32.dll_PeekMessageA
add esp, 0xc
test eax, eax
je 0x4b735e
mov eax, dword [ebp - 0x24]
cmp eax, 0x100
jb 0x4b7300
cmp eax, 0x101
jbe 0x4b726a
sub eax, 0x104
cmp eax, 1
ja 0x4b7300
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x4b7300
cmp eax, 0x12
jbe 0x4b7283
sub eax, 0x5b
cmp eax, 1
ja 0x4b7300
sub esp, 0xc
mov dword [0x679350], 0
push 0x10
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
js 0x4b739e
sub esp, 0xc
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
js 0x4b73c1
sub esp, 0xc
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
js 0x4b73e4
sub esp, 0xc
push 0x5b
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
js 0x4b738c
sub esp, 0xc
push 0x5c
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
js 0x4b738c
nop
lea esi, [esi]
mov eax, dword [ebp - 0x28]
call fcn.004b6b70
test eax, eax
je 0x4b7330
sub esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
jmp 0x4b7322
call fcn.004b6b70
test eax, eax
je 0x4b7365
sub esp, 0xc
push ebx
call sub.USER32.dll_GetParent
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x4b7315
sub esp, 0xc
push esi
call sub.USER32.dll_TranslateMessage
push esi
call sub.USER32.dll_DispatchMessageA
add esp, 0xc
sub esp, 0xc
push 1
push 0
push 0
push 0
push esi
call sub.USER32.dll_PeekMessageA
add esp, 0xc
test eax, eax
jne 0x4b7247
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
push eax
push eax
push esi
push ebx
call sub.USER32.dll_IsDialogMessage
pop edx
test eax, eax
pop ecx
jne 0x4b722b
sub esp, 0xc
push esi
call sub.USER32.dll_TranslateMessage
push esi
call sub.USER32.dll_DispatchMessageA
add esp, 0xc
jmp 0x4b7342
mov eax, dword [0x679350]
or eax, 8
mov dword [0x679350], eax
jmp 0x4b7300
mov eax, dword [0x679350]
sub esp, 0xc
or eax, 1
mov dword [0x679350], eax
push 0x11
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jns 0x4b72b9
mov eax, dword [0x679350]
sub esp, 0xc
or eax, 2
mov dword [0x679350], eax
push 0x12
call sub.USER32.dll_GetKeyState
add esp, 0xc
test ax, ax
jns 0x4b72cf
mov eax, dword [0x679350]
or eax, 4
mov dword [0x679350], eax
jmp 0x4b72cf

Function at 0x4b7400
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0xff
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.USER32.dll_MsgWaitForMultipleObjects
add esp, 0xc
leave
jmp fcn.004b7220

Function at 0x4b7a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [0x679320]
mov eax, dword [ebp + 8]
test edx, edx
je 0x4b7aa0
push ecx
push ecx
push 0xa
push 0
push 0
push edx
push edx
push eax
call fcn.004bc0f0
add esp, 0xc
push eax
push 0
push 0
call sub.SHELL32.dll_ShellExecuteW
cmp eax, 0x20
pop edx
setg al
and eax, 0xff
pop ecx
leave
ret
push ecx
push ecx
push 0xa
push 0
push 0
push edx
push edx
push eax
call fcn.004bc0d0
add esp, 0xc
push eax
push 0
push 0
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
pop edx
setg al
and eax, 0xff
pop ecx
leave
ret