joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000265d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100c22d4
push dword [ebp + 8]
call fcn.100a9338
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1000268d
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.100a94a6
push esi
call fcn.100a91fd
add esp, 0x14
pop esi
pop ebp
ret

Function at 0x1000f81f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
and al, 1
mov byte [ebp + 8], al
push dword [ebp + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0xc]
test al, al
je 0x1000f848
mov eax, 0x911a
jmp 0x1000f90d
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
test al, al
je 0x1000f85e
mov eax, 0x911d
jmp 0x1000f90d
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
jne 0x1000f870
mov eax, 0x911b
jmp 0x1000f90d
push ebx
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.100a9770
push ebx
push 0xf4240
push edx
push eax
call fcn.100a9770
mov edi, eax
mov ebx, edx
add edi, dword [ebp - 8]
adc ebx, dword [ebp - 4]
cmp dword [ebp - 4], ebx
jg 0x1000f8e0
jge 0x1000f8db
mov ecx, dword [esi + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test al, al
jne 0x1000f8e0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [ebp - 4], ebx
jl 0x1000f8b3
jg 0x1000f8e0
cmp dword [ebp - 8], edi
jb 0x1000f8b3
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
test al, al
je 0x1000f8f3
mov eax, 0x911d
jmp 0x1000f90b
cmp dword [ebp - 4], ebx
jl 0x1000f906
jg 0x1000f8ff
cmp dword [ebp - 8], edi
jb 0x1000f906
mov eax, 0x911b
jmp 0x1000f90b
mov eax, 0x911c
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100337d9
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cdq
and edx, 3
push esi
push edi
lea esi, [edx + eax]
mov edx, dword [ebp + 0x10]
sar esi, 2
lea edi, [ecx + esi*4]
neg esi
je 0x10033819
imul eax, dword [edi + esi*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, edx
rol eax, 0xd
imul edx, eax, 5
sub edx, 0x19ab949c
inc esi
jne 0x100337f8
mov eax, dword [ebp + 0xc]
xor ecx, ecx
and eax, 3
dec eax
je 0x1003383a
dec eax
je 0x10033831
dec eax
jne 0x10033850
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, dword [ebp + 0xc]
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
pop ebp
ret
Function at 0x100a1e2c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x100dc948
call fcn.100ac2d2
add eax, 0x40
push eax
call fcn.100ac3ae
add esp, 0xc
push 2
call fcn.100ac9e5
int3
Function at 0x441ab4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x441b00
mov eax, esi
call fcn.00457368
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x441b00
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x441b00
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x441c3f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x441b40
cmp eax, 0x108
ja 0x441b40
mov eax, esi
call fcn.00457368
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x441c36
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x441c3f
jmp 0x441c36
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x441c1f
cmp eax, 0x20a
ja 0x441c1f
test byte [esi + 0x50], 0x80
jne 0x441b72
sub eax, 0x203
je 0x441b6f
sub eax, 3
je 0x441b6f
sub eax, 3
jne 0x441b72
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x441b86
dec eax
je 0x441b9b
dec eax
je 0x441bb8
dec eax
je 0x441b9b
jmp 0x441bbf
mov ecx, ebx
mov eax, dword [0x4b16bc]
mov eax, dword [eax]
mov edx, esi
call fcn.00460b14
jmp 0x441c36
cmp byte [esi + 0x5d], 1
jne 0x441bb1
mov eax, esi
mov si, 0xffed
call fcn.00403da8
jmp 0x441c3f
or word [esi + 0x54], 1
jmp 0x441c36
and word [esi + 0x54], 0xfffe
jmp 0x441c36
mov eax, dword [0x4b2b18]
cmp byte [eax + 0x20], 0
je 0x441c36
mov eax, dword [0x4b2b18]
cmp dword [eax + 0x1c], 0
je 0x441c36
mov eax, dword [ebx]
mov edx, dword [0x4b2b18]
cmp eax, dword [edx + 0x1c]
jne 0x441c36
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.004572ac
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403da8
jmp 0x441c3f
cmp eax, 0xb00b
jne 0x441c36
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0044039c
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ea34
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45ea4b
add esp, 0xfffffff0
call fcn.00403ed0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f60c
mov eax, dword [0x4b15a4]
cmp word [eax + 2], 0
jne 0x45ea73
mov eax, dword [0x4b15a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046010c
mov eax, dword [0x4b1700]
cmp word [eax + 2], 0
jne 0x45ea8d
mov eax, dword [0x4b1700]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00460304
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41640c]
call fcn.00403b7c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41640c]
call fcn.00403b7c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x421c10]
call fcn.00429af8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45ec14
mov eax, dword [0x4b140c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429ec8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4608a4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4b140c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d6b4
test eax, eax
je 0x45eb82
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004097c4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d6dc
test eax, eax
je 0x45eb96
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404bf0
mov eax, dword [0x4b11a4]
cmp byte [eax], 0
jne 0x45ebca
mov eax, ebx
call fcn.0045ed3c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00460a80
mov eax, ebx
call fcn.00461444
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45ec0a
call fcn.00403f28
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45efbc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b2bb8]
cmp dword [eax + 0x30], 0
je 0x45f066
cmp dword [ebx + 0x94], 0
jne 0x45f060
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45ef4c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f060
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f026
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f060
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418ac4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f035
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45fbc8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45fbfd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a70
jmp 0x45fc0a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049d4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x460c5c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x460c9d
mov eax, esi
call fcn.00447358
test al, al
je 0x460c9d
mov eax, dword [ebx + 0x84]
call fcn.00447054
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x460c9d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447054
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x464364
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x464392
mov eax, ebx
call fcn.00464e18
cmp dword [ebx + 0x40], 0
je 0x46438b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x464403
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4643f5
cmp dword [ebx + 8], 0
je 0x4643b4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4643c6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4643f5
cmp dword [ebx + 8], 0
je 0x4643a7
cmp eax, 3
je 0x4643d9
dec eax
jne 0x4643a7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4643a7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4643a7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x464421
cmp dword [ebx + 0x14], 0xcc
je 0x464421
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046442c
pop ebx
ret
Function at 0x476130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x47615f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4761de
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004749ec
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4761ac
mov cx, word [esp]
sub cx, si
jmp 0x4761ae
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x476195
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4761d4
mov cx, word [esp]
sub cx, si
jmp 0x4761d6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4761bd
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x47623b
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00475e04
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x476226
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x47623b
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x47613a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47c780
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4b2bf0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x47c7a2
shr eax, 1
xor eax, 0xedb88320
jmp 0x47c7a4
shr eax, 1
dec edx
jne 0x47c790
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x47c789
mov byte [0x4b2ff0], 1
pop esi
pop ebx
ret

Function at 0x47c7c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4b2ff0], 0
jne 0x47c7d7
call fcn.0047c780
mov eax, edi
dec eax
test eax, eax
jl 0x47c800
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b2bf0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x47c7e1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x47f590
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x47f5c1
dec al
je 0x47f5fd
dec al
je 0x47f641
dec al
je 0x47f6ac
jmp 0x47f736
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x47f736
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x47f5d1
jmp 0x47f736
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x47f736
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x47f60d
jmp 0x47f736
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x47f736
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x47f66f
xor ebp, ebp
jmp 0x47f680
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x47f689
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x47f651
jmp 0x47f736
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x47f736
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x47f704
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0047c808
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x47f6c0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4841bc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415994]
call fcn.0040530c
xor eax, eax
push ebp
push 0x484300
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b0040], 0
jne 0x48420f
mov ecx, dword [0x4b11d0]
mov dl, 1
mov eax, dword [0x407d8c]
call fcn.0040c8b4
call fcn.00404338
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403294
mov eax, ebx
call fcn.004051bc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x484310
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004063a4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004051cc
test eax, eax
jle 0x4842a7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4842a0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404c08
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404bf0
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408c38
test eax, eax
jne 0x4842a0
mov ebx, 0x15
jmp 0x4842ac
mov ebx, 0x10
jmp 0x4842ac
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4b0040]
call fcn.00484114
mov eax, dword [ebp - 8]
call fcn.00484114
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004063bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484307
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004049a4
lea eax, [ebp - 0x10]
mov edx, dword [0x415994]
call fcn.004053dc
ret
Function at 0x499228
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x499230
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x499422
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x499438
mov eax, esi
call fcn.004970b4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004049d4
lea ecx, [ebp - 0x10]
mov edx, 0x49944c
mov eax, esi
call fcn.004970b4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004049d4
lea ecx, [ebp - 0x14]
mov edx, 0x499464
mov eax, esi
call fcn.004970b4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004049d4
lea ecx, [ebp - 0x18]
mov edx, 0x499480
mov eax, esi
call fcn.004970b4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004049d4
lea ecx, [ebp - 0x1c]
mov edx, 0x49949c
mov eax, esi
call fcn.004970b4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004049d4
lea ecx, [ebp - 0x24]
mov edx, 0x4994b4
mov eax, esi
call fcn.004970b4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408ca8
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004090b8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4994cc
mov eax, esi
call fcn.004970b4
mov eax, dword [ebp - 0x28]
call fcn.00490b8c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4994dc
mov eax, esi
call fcn.004970b4
mov eax, dword [ebp - 0x2c]
call fcn.00490b8c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4994f4
mov eax, esi
call fcn.004970b4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004090b8
inc eax
je 0x4993c5
lea ecx, [ebp - 0x34]
mov edx, 0x4994f4
mov eax, esi
call fcn.004970b4
mov eax, dword [ebp - 0x34]
call fcn.0040907c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a734
fstp qword [ebp - 0x3c]
wait
call fcn.0040aa98
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4993e0
lea ecx, [ebp - 0x40]
mov edx, 0x4994f4
mov eax, esi
call fcn.004970b4
mov eax, dword [ebp - 0x40]
call fcn.00490b8c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x499504
mov eax, esi
call fcn.004970b4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004049d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499429
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004049a4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004049a4
ret
Function at 0x4a01b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4a020e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004a01a4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0048f7f8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0048f3f8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0215
lea eax, [ebp - 4]
call fcn.00404980

Function at 0x4a353c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, edx
sub eax, 1
jae 0x4a354c
call fcn.00403aec
test eax, eax
jb 0x4a3582
inc eax
xor edx, edx
mov dl, byte [esi]
mov ebx, dword [ecx]
and ebx, 0xff
xor edx, ebx
cmp edx, 0xff
jbe 0x4a356c
call fcn.00403ae4
mov edx, dword [edx*4 + 0x4b08f8]
mov ebx, dword [ecx]
shr ebx, 8
xor edx, ebx
mov dword [ecx], edx
add esi, 1
dec eax
jne 0x4a3551
pop esi
pop ebx
ret