joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e274
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x46e2a5
dec al
je 0x46e2e1
dec al
je 0x46e325
dec al
je 0x46e390
jmp 0x46e41a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x46e41a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x46e2b5
jmp 0x46e41a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46e41a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x46e2f1
jmp 0x46e41a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46e41a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x46e353
xor ebp, ebp
jmp 0x46e364
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x46e36d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x46e335
jmp 0x46e41a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46e41a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x46e3e8
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0046b42c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x46e3a4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x490fbc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x490fc4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4911b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4911cc
mov eax, esi
call fcn.0048ee48
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404900
lea ecx, [ebp - 0x10]
mov edx, 0x4911e0
mov eax, esi
call fcn.0048ee48
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404900
lea ecx, [ebp - 0x14]
mov edx, 0x4911f8
mov eax, esi
call fcn.0048ee48
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404900
lea ecx, [ebp - 0x18]
mov edx, 0x491214
mov eax, esi
call fcn.0048ee48
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404900
lea ecx, [ebp - 0x1c]
mov edx, 0x491230
mov eax, esi
call fcn.0048ee48
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404900
lea ecx, [ebp - 0x24]
mov edx, 0x491248
mov eax, esi
call fcn.0048ee48
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409130
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409554
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x491260
mov eax, esi
call fcn.0048ee48
mov eax, dword [ebp - 0x28]
call fcn.0047765c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x491270
mov eax, esi
call fcn.0048ee48
mov eax, dword [ebp - 0x2c]
call fcn.0047765c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x491288
mov eax, esi
call fcn.0048ee48
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409554
inc eax
je 0x491159
lea ecx, [ebp - 0x34]
mov edx, 0x491288
mov eax, esi
call fcn.0048ee48
mov eax, dword [ebp - 0x34]
call fcn.00409518
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040b10c
fstp qword [ebp - 0x3c]
wait
call fcn.0040b47c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x491174
lea ecx, [ebp - 0x40]
mov edx, 0x491288
mov eax, esi
call fcn.0048ee48
mov eax, dword [ebp - 0x40]
call fcn.0047765c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x491298
mov eax, esi
call fcn.0048ee48
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4911bd
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004048d0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004048d0
ret
Function at 0x497f48
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x497fa2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00497f38
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004761cc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00475dcc
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497fa9
lea eax, [ebp - 4]
call fcn.004048ac
ret
Function at 0x49f8dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
xor eax, eax
push ebp
push 0x49f93a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0049f9b8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x49f922
lea eax, [ebp - 4]
call fcn.0049f9b8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x49f924
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f941
lea eax, [ebp - 4]
call fcn.004048ac
ret

Function at 0x49f948
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
xor eax, eax
push ebp
push 0x49f9ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.0049f9b8
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040a2e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f9b3
lea eax, [ebp - 4]
call fcn.004048ac
ret

Function at 0x49ffac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
xor eax, eax
push ebp
push 0x4a00a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0049f678
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409f14
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a0998
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409df8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a0a0c
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a00ac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004048d0
ret
Function at 0x4a00b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
xor eax, eax
push ebp
push 0x4a01bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0049f678
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4a0183
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409f14
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a0998
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409df8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a0a0c
jmp 0x4a0195
xor edx, edx
mov eax, ebx
call fcn.004a0998
xor edx, edx
mov eax, ebx
call fcn.004a0a0c
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a01c4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004048d0
ret
Function at 0x4a3694
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a3805
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a37e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404a94
lea eax, [ebp - 0x118]
mov edx, 0x4a381c
call fcn.00404b74
mov eax, dword [ebp - 0x118]
call fcn.00404d6c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4a3752
lea eax, [ebp - 0x111]
call fcn.0040a0d8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0040499c
jmp 0x4a3759
mov eax, esi
call fcn.004048ac
cmp bl, 0x61
jae 0x4a377a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040e1c4
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404900
jmp 0x4a3794
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040e138
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404900
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4a3828
call fcn.0040a7f8
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a37e7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4ac198
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004ac3cc
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004ac3cc
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4ac20c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4ac231
inc esi
mov eax, edi
call fcn.004ac1f0
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004ac198
inc ebx
dec esi
jne 0x4ac21b
pop edi
pop esi
pop ebx
ret

Function at 0x4ac2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
xor eax, eax
push ebp
push 0x4ac335
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004ac238
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004ac1f0
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004ac198
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4ac300
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac33c
lea eax, [ebp - 4]
call fcn.004048ac
ret
Function at 0x4acef8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ad0dc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4ad098
mov eax, dword [ebp - 4]
call fcn.004ae854
cmp ebx, eax
jge 0x4ad098
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0049ddc0
mov edx, dword [0x49fa4c]
call fcn.00403c38
mov esi, eax
mov eax, esi
call fcn.004a092c
test al, al
je 0x4ad08e
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4ad082
xor eax, eax
push ebp
push 0x4ad07b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ad4b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041bdd8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404ef8
mov eax, dword [ebp - 8]
call fcn.00404dc4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ad274
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad0c6
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4ad07a
mov eax, dword [ebp - 4]
call fcn.004ad534
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a2e0
jmp 0x4ad0c6
mov eax, dword [ebp - 8]
call fcn.004048ac
jmp 0x4ad0c6
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409830
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x416cc8]
call fcn.0040d314
call fcn.0040421c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad0e3
lea eax, [ebp - 0x54]
call fcn.004048ac
ret
Function at 0x4b2a44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4b2a7c]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b2a5a
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b2a69
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b2a78
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4b3da0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4da2f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b3dc6
push 0
mov eax, dword [0x4da2f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4bd3b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
xor eax, eax
push ebp
push 0x4bd4b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4bd488
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d6c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4bd477
mov eax, dword [ebp - 8]
shl eax, 0x10
shr eax, 0x10
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x214]
mov eax, 4
call fcn.004094e8
mov eax, dword [ebp - 0x214]
push eax
mov eax, dword [ebp - 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x218]
mov eax, 3
call fcn.004094e8
mov edx, dword [ebp - 0x218]
mov eax, ebx
pop ecx
call fcn.00404bb8
jmp 0x4bd47e
mov eax, ebx
call fcn.004bd1c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bd492
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd4bf
lea eax, [ebp - 0x218]
mov edx, 2
call fcn.004048d0
lea eax, [ebp - 4]
call fcn.004048ac
ret
Function at 0x4bd4c8
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
lea edi, [ebp - 0x18]
xor eax, eax
push ebp
push 0x4bd6a2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
je 0x4bd51c
mov edx, dword [ebp - 4]
mov eax, 0x4bd6b8
call fcn.004bd3b0
jmp 0x4bd687
mov eax, dword [ebp - 4]
call fcn.004048ac
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bd66b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4bd64b
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4bd64b
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x1a0]
cmp esi, 0x18
je 0x4bd57f
cmp esi, 1
jne 0x4bd58c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x4bd641
mov eax, dword [ebp - 0xc]
add eax, 0x1ac
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
add eax, 0x1d4
mov dword [ebp - 0x14], eax
cmp dword [edi], 0
je 0x4bd635
lea eax, [ebp - 0x20]
mov edx, dword [edi]
add edx, 4
mov ecx, 0x10
call fcn.00404b1c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409130
mov eax, dword [ebp - 0x1c]
mov edx, 0x4bd6c4
call fcn.00404cb8
je 0x4bd61e
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, 0x10
call fcn.00404b1c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00409130
mov eax, dword [ebp - 0x24]
mov edx, 0x4bd6c4
call fcn.00404cb8
je 0x4bd61e
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x190]
mov eax, dword [ebp - 8]
add eax, 0x194
call fcn.004bd124
jmp 0x4bd635
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp dword [edi], 0
jne 0x4bd5aa
test bl, bl
jne 0x4bd64b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4bd56c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd672
push 0x1000
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualFree_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd6a9
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.004048d0
ret