joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0794
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4a07a9
add esp, 0xfffffff0
call fcn.00404158
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405294
xor eax, eax
push ebp
push 0x4a0884
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0049b2e4
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00419280
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x28], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00419280
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00419280
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x38], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.00419280
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004192a8
push esi
lea edi, [esi + 0x44]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x56], 0
mov byte [esi + 0x57], 0
mov byte [esi + 0x58], 0
mov byte [esi + 0x59], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a088b
lea eax, [ebp - 4]
call fcn.00404e14
ret
Function at 0x4b6480
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, byte [0x4b64bc]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b6497
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b64a6
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b64b5
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4b6e20
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x448810]
call fcn.00403fc0
test al, al
je 0x4b6e62
mov eax, dword [0x5bf158]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4b6e62
mov edx, dword [0x5bf158]
xor edx, edx
call fcn.00463cdc
push 0
mov eax, dword [0x5bf158]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x4e7df0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4e7f1c
cmp dword [eax + 0xf8], 0
je 0x4e7f1c
mov eax, dword [ebx + 0x3c]
call fcn.0046386c
mov dword [esp], eax
mov eax, dword [ebx + 0x3c]
call fcn.0046388c
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov esi, dword [ebx + 0x48]
mov eax, dword [esi + 0xe8]
add dword [esp], eax
mov eax, dword [esi + 0xec]
add dword [esp + 4], eax
add edi, dword [esi + 0xf0]
add ebp, dword [esi + 0xf4]
mov eax, dword [esi + 0x34]
sub dword [esp], eax
mov eax, dword [esi + 0x38]
sub dword [esp + 4], eax
lea eax, [esi + 0x34]
call fcn.00534f1c
mov edx, dword [esi + 0xf8]
add edi, dword [edx + 8]
sub edi, eax
mov esi, dword [ebx + 0x48]
lea eax, [esi + 0x34]
call fcn.00534f38
mov edx, dword [esi + 0xf8]
add ebp, dword [edx + 0xc]
sub ebp, eax
mov esi, dword [ebx + 0xd4]
xor eax, eax
mov dword [ebx + 0xd4], eax
push edi
push ebp
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, ebx
call fcn.004e6bbc
mov edi, esi
xor ebp, ebp
xor esi, esi
mov eax, edi
mov ecx, 0xf
cdq
idiv ecx
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x4e7ecb
mov dword [esp + 8], 1
mov eax, dword [0x5bf158]
mov eax, dword [eax]
call fcn.0046c23c
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebp
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4e7ef8
cmp eax, 5
jbe 0x4e7f18
jmp 0x4e7efa
jle 0x4e7f18
call sub.kernel32.dll_GetTickCount
mov ebp, eax
add esi, dword [esp + 8]
cmp edi, esi
jge 0x4e7f0b
mov esi, edi
mov dword [ebx + 0xd4], esi
mov eax, ebx
call fcn.004e7bf8
cmp edi, esi
jg 0x4e7ed7
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f9900
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045546c
test al, al
je 0x4f9aa0
mov eax, dword [ebp - 4]
mov byte [eax + 0x288], 1
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_HideCaret
xor eax, eax
push ebp
push 0x4f9a8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f9a6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f9a45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
inc eax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4f9a27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9a2e
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x501740
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405294
xor eax, eax
push ebp
push 0x501866
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x3b0]
test eax, eax
je 0x501850
cmp dword [eax + 0x458], 0
je 0x501850
cmp byte [ebx + 0x354], 0
je 0x5017c8
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x34c]
cmp eax, 0x1f4
jb 0x5017a1
lea eax, [ebx + 0x350]
call fcn.00404e14
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x34c], eax
lea eax, [ebx + 0x350]
mov edx, dword [ebp - 4]
call fcn.004050e0
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x350]
call fcn.00404eac
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x5017d6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x501840
mov eax, edx
test eax, eax
je 0x5017e5
sub eax, 4
mov eax, dword [eax]
dec eax
jne 0x501817
mov eax, dword [ebp - 4]
call fcn.004052a4
push eax
mov eax, ebx
call fcn.005023bc
push eax
push 0x18f
mov eax, dword [ebx + 0x3b0]
mov eax, dword [eax + 0x458]
call fcn.004550cc
push eax
call sub.user32.dll_SendMessageA
jmp 0x501843
mov eax, dword [ebp - 4]
call fcn.004052a4
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x3b0]
mov eax, dword [eax + 0x458]
call fcn.004550cc
push eax
call sub.user32.dll_SendMessageA
jmp 0x501843
or eax, 0xffffffff
test eax, eax
jl 0x501850
mov edx, eax
mov eax, ebx
call fcn.005023c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50186d
lea eax, [ebp - 4]
call fcn.00404e14
ret
Function at 0x501874
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x5019e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x3b0]
test eax, eax
je 0x5019b4
cmp dword [eax + 0x458], 0
je 0x5019b4
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x34c]
cmp eax, 0xc8
jbe 0x5019b4
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x34c], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0044cfac
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5018e9
sub eax, 4
mov eax, dword [eax]
dec eax
jne 0x501927
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044cfac
mov eax, dword [ebp - 0x14]
call fcn.004052a4
push eax
mov eax, ebx
call fcn.005023bc
push eax
push 0x18f
mov eax, dword [ebx + 0x3b0]
mov eax, dword [eax + 0x458]
call fcn.004550cc
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x50195a
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0044cfac
mov eax, dword [ebp - 0x18]
call fcn.004052a4
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x3b0]
mov eax, dword [eax + 0x458]
call fcn.004550cc
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x5019b4
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0044cfac
mov edx, esi
mov eax, ebx
call fcn.005023c8
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0044cfac
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x501989
sub eax, 4
mov eax, dword [eax]
mov edx, eax
mov eax, ebx
call fcn.00501a50
mov eax, dword [ebp - 8]
test eax, eax
je 0x50199e
sub eax, 4
mov eax, dword [eax]
mov edx, esi
test edx, edx
je 0x5019a9
sub edx, 4
mov edx, dword [edx]
sub eax, edx
mov edx, eax
mov eax, ebx
call fcn.00501a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5019eb
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404e38
lea eax, [ebp - 0xc]
call fcn.00404e14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e38
ret
Function at 0x505820
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.00534d28
test al, al
je 0x50592b
mov eax, dword [esi + 4]
mov edx, dword [0x4f2be8]
call fcn.00403fc0
test al, al
je 0x50592b
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x355], 0
je 0x505890
cmp byte [esi + 0x5a0], 0
jne 0x505890
push 0xffffffffffffffec
mov eax, esi
call fcn.004550cc
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x5058c6
cmp byte [ebx + 0x355], 0
jne 0x5058c6
cmp byte [esi + 0x5a0], 0
je 0x5058c6
push 0xffffffffffffffec
mov eax, esi
call fcn.004550cc
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowLongA
movzx eax, byte [ebx + 0x355]
mov byte [esi + 0x5a0], al
movzx eax, byte [esi + 0x5a1]
cmp al, byte [ebx + 0x357]
je 0x50592b
cmp byte [ebx + 0x355], 0
je 0x50592b
cmp byte [ebx + 0x356], 0
je 0x50590b
mov eax, esi
call fcn.004550cc
xor edx, edx
call fcn.00534d64
mov byte [esi + 0x5a1], 0
jmp 0x50592b
mov eax, esi
call fcn.004550cc
movzx edx, byte [ebx + 0x357]
call fcn.00534d64
movzx eax, byte [ebx + 0x357]
mov byte [esi + 0x5a1], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.0044cecc
call fcn.00534d28
test al, al
je 0x5059fa
test ebx, ebx
je 0x5059fa
cmp byte [ebx + 0x356], 0
je 0x5059fa
cmp byte [ebx + 0x355], 0
je 0x5059fa
mov eax, dword [0x5bf158]
mov eax, dword [eax]
call fcn.0046c23c
xor edi, edi
xor ebp, ebp
movzx eax, byte [ebx + 0x357]
mov ecx, 0xf
xor edx, edx
div ecx
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x5059b1
mov dword [esp + 8], 1
call sub.kernel32.dll_GetTickCount
sub eax, ebp
cmp eax, 5
jbe 0x5059e3
call sub.kernel32.dll_GetTickCount
mov ebp, eax
add edi, dword [esp + 8]
movzx eax, byte [ebx + 0x357]
cmp edi, eax
jle 0x5059d5
mov edi, eax
mov eax, esi
call fcn.004550cc
mov edx, edi
call fcn.00534d64
mov eax, dword [0x5bf158]
mov eax, dword [eax]
call fcn.0046c23c
movzx eax, byte [ebx + 0x357]
cmp edi, eax
jl 0x5059b1
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x52e3f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0052f13c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0052e314
pop ecx
call fcn.00534d28
test al, al
je 0x52e4a2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
cmp byte [eax + 0x60], 0
je 0x52e4a2
push 0xffffffffffffffec
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
cmp byte [eax + 0x61], 0
je 0x52e488
mov eax, dword [ebp - 4]
call fcn.004550cc
xor edx, edx
call fcn.00534d64
jmp 0x52e4a2
mov eax, dword [ebp - 4]
call fcn.004550cc
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x268]
movzx edx, byte [edx + 0x62]
call fcn.00534d64
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0044cecc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x268]
cmp byte [ebx + 0x61], 0
je 0x52e569
cmp byte [ebx + 0x60], 0
je 0x52e569
call fcn.00534d28
test al, al
je 0x52e569
mov eax, dword [0x5bf158]
mov eax, dword [eax]
call fcn.0046c23c
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
movzx eax, byte [eax + 0x62]
mov ecx, 0xf
xor edx, edx
div ecx
mov edi, eax
test edi, edi
jne 0x52e521
mov edi, 1
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 5
jbe 0x52e558
call sub.kernel32.dll_GetTickCount
mov esi, eax
add ebx, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x52e549
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004550cc
mov edx, ebx
call fcn.00534d64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x52e521
mov eax, dword [ebp - 4]
call fcn.0052f684
mov eax, dword [ebp - 4]
call fcn.004550cc
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53c850
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov byte [ebp - 9], 0
push ebx
call sub.kernel32.dll_GetModuleHandleA_2
mov edi, eax
test edi, edi
jne 0x53c879
push ebx
call sub.kernel32.dll_LoadLibraryA
mov edi, eax
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x53c975
mov eax, dword [eax + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x53c975
mov edx, dword [eax + 0x80]
test edx, edx
je 0x53c975
cmp dword [eax + 0x84], 0
je 0x53c975
add edx, edi
mov dword [ebp - 0x10], edx
jmp 0x53c968
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, edi
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0040ad4c
test eax, eax
je 0x53c8e4
mov eax, dword [ebp - 0x10]
add eax, 0x14
mov dword [ebp - 0x10], eax
jmp 0x53c968
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
add ebx, edi
mov dword [ebp - 0x1c], 1
jmp 0x53c95f
mov eax, dword [ebx]
add eax, edi
add eax, 2
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.0040ad4c
test eax, eax
jne 0x53c959
mov eax, dword [ebp - 0x10]
mov esi, dword [eax + 0x10]
add esi, edi
mov eax, dword [ebp - 0x1c]
dec eax
add eax, eax
add eax, eax
add esi, eax
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
call sub.kernel32.dll_VirtualQuery_1
lea eax, [ebp - 0x30]
push eax
push 4
push 4
push esi
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
mov byte [ebp - 9], 1
inc dword [ebp - 0x1c]
add ebx, 4
cmp dword [ebx], 0
jne 0x53c8f4
add dword [ebp - 0x10], 0x14
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
jne 0x53c8bc
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x54a474
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x5ba5fc], 0
mov eax, dword [0x5bf594]
cmp dword [eax], 2
jne 0x54a64d
mov eax, dword [0x5bed74]
cmp dword [eax], 5
jl 0x54a64d
call fcn.005420cc
test al, al
jne 0x54a4a5
call fcn.005420d8
call fcn.005420c4
mov dword [0x5ba604], eax
push 0x54a650
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5c8], eax
cmp dword [0x5ba5c8], 0
jne 0x54a500
mov edx, 0x8000
mov eax, 0x54a664
call fcn.004105c8
mov dword [0x5ba600], eax
mov eax, dword [0x5ba600]
mov dword [0x5ba604], eax
push 0x54a650
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5c8], eax
cmp dword [0x5ba5c8], 0
je 0x54a648
push 0x54a670
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5cc], eax
cmp dword [0x5ba5cc], 0
je 0x54a648
push 0x54a67c
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5d0], eax
cmp dword [0x5ba5d0], 0
je 0x54a648
mov byte [0x5ba5fc], 1
push 0x54a68c
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5d4], eax
push 0x54a698
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5d8], eax
push 0x54a6a4
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5dc], eax
push 0x54a6b4
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5e0], eax
push 0x54a6c4
mov eax, dword [0x5ba604]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5e4], eax
mov edx, 0x8000
mov eax, 0x54a6dc
call fcn.004105c8
mov dword [0x5ba608], eax
cmp dword [0x5ba608], 0
je 0x54a64d
push 0x54a6ec
mov eax, dword [0x5ba608]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5e8], eax
push 0x54a708
mov eax, dword [0x5ba608]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5ec], eax
push 0x54a728
mov eax, dword [0x5ba608]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5f0], eax
push 0x54a744
mov eax, dword [0x5ba608]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5f4], eax
push 0x54a75c
mov eax, dword [0x5ba608]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5ba5f8], eax
ret
call fcn.0054a3f4
ret
Function at 0x54c458
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x54c580
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0054c344
mov eax, dword [esi]
call fcn.00406258
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53d2a4]
call fcn.00406414
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.0040319c
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.0040319c
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00406258
mov dword [ebp - 0xc], eax
mov eax, dword [0x5bf400]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.0053ef40
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00403730
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00406258
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.0053ee60
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.0053ec74
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0053ef38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c587
lea eax, [ebp - 4]
mov edx, dword [0x53d2a4]
call fcn.00406514
ret

Function at 0x558184
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00405534
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5581a9
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.004052a4
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x5581c8
mov eax, ebx
mov edx, dword [esp]
call fcn.00405534
pop ecx
pop edx
pop ebx
ret

Function at 0x56bfd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x56c032
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0056bfcc
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00569a44
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0056965c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c039
lea eax, [ebp - 4]
call fcn.00404e14
ret