joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496cc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa2c
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
rep stosd dword es:[edi], eax
mov ecx, dword [0x6dcf80]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x220]
push eax
push 0x76
push ecx
call esi
mov eax, dword [0x6dcf80]
lea edx, [esp + 0x424]
push 0x104
push edx
push 0x4c
push eax
call esi
lea ecx, [esp + 0x21c]
push ecx
call fcn.004a8150
mov ebx, dword [esp + 0xa44]
lea edx, [esp + 0x18]
push 0x104
push edx
push ebx
call fcn.004a8580
push 0
push 0
push 0x80802
lea eax, [esp + 0x30]
push 0x4fcef4
lea ecx, [esp + 0x23c]
push eax
mov eax, dword [ebp + 4]
lea edx, [esp + 0x448]
push ecx
mov ecx, dword [0x6dcf84]
push edx
push eax
push ecx
call fcn.004a8300
add esp, 0x34
test eax, eax
je 0x496e51
lea edx, [esp + 0x14]
push 0x4ee540
push edx
xor edi, edi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x496e2f
push esi
push 1
lea eax, [esp + 0x18]
push 2
push eax
mov dword [esp + 0x20], 0xfeff
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_fputws]
add esp, 0x18
cmp eax, 0xffffffff
je 0x496dc5
mov edi, 1
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
test edi, edi
je 0x496e2f
lea ecx, [esp + 0x14]
push ecx
push 0x62
call fcn.004ae820
add esp, 4
lea edx, [esp + 0x630]
push eax
push 0x208
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, dword [0x68f38c]
add esp, 0x10
lea eax, [esp + 0x62c]
mov word [esp + 0xa3a], 0
push eax
push 0x7d0
push 0x4402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 4
push 0x10
mov ecx, 0x68f388
call fcn.004ba9b0
push eax
push 0x65
call fcn.004ae820
mov edx, dword [ebp + 4]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 4
Function at 0x499b40
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [edx]
push edi
mov edi, dword [esp + 0x14]
mov ecx, esi
xor ecx, eax
and ecx, 0xff
shr esi, 8
mov ecx, dword [edi + ecx*4]
xor ecx, esi
mov esi, dword [edx + 4]
mov dword [edx], ecx
and ecx, 0xff
add ecx, esi
mov esi, dword [edx + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov ebx, esi
mov dword [edx + 4], ecx
and ebx, 0xff
shr ecx, 0x18
xor ecx, ebx
shr esi, 8
mov ecx, dword [edi + ecx*4]
pop edi
xor ecx, esi
pop esi
mov dword [edx + 8], ecx
pop ebx
ret
Function at 0x49aef0
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9e70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1558
call fcn.004d3780
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 0x418]
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
je 0x49af40
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebx + 0x418], esi
lea edi, [ebx + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4ee540
push edi
call dword [sym.imp.MSVCRT.dll__wfopen]
add esp, 8
cmp eax, esi
mov dword [ebx + 0x418], eax
je 0x49b0d9
mov ecx, dword [ebx + 0x420]
cmp ecx, esi
jne 0x49af75
xor eax, eax
jmp 0x49af80
mov eax, dword [ebx + 0x424]
sub eax, ecx
sar eax, 2
mov ecx, eax
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*8]
lea eax, [edx*8 + 0x500]
lea eax, [eax + eax + 0x12]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov word [ebp - 0x22], si
add esp, 4
mov dword [ebp - 0x1c], edi
mov word [edi], 0xfeff
mov ecx, dword [ebx + 0x424]
mov esi, dword [ebx + 0x420]
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x49b03e
mov eax, dword [esi]
test eax, eax
je 0x49b039
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x10]
push edx
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax]
mov eax, dword [eax + 4]
push ecx
push edx
push eax
push str._d::_d::_d::_d::_s::_s_r_n
lea ecx, [ebp - 0x1568]
push 0xaa3
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x24
cmp eax, 0xaa4
ja 0x49b039
test eax, eax
jle 0x49b039
mov edx, dword [ebp - 0x18]
add eax, eax
mov ecx, eax
add edi, edx
mov edx, ecx
lea esi, [ebp - 0x1568]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x18], ecx
add esi, 4
jmp 0x49afc2
mov eax, dword [ebp - 0x18]
cmp eax, 2
jle 0x49b050
push eax
push edi
call fcn.0049aeb0
add esp, 8
mov eax, dword [ebx + 0x418]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
push eax
push 1
push 7
push str.TW.2.10
call esi
mov ecx, dword [ebx + 0x418]
mov edx, dword [ebp - 0x18]
push ecx
push 1
push edx
push edi
call esi
add esp, 0x20
jmp 0x49b0a6
mov ecx, dword [ebx + 0x418]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea edx, [ebx + 0x14]
push 2
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test edi, edi
je 0x49b0cf
push edi
call fcn.004d3765
add esp, 4
mov dword [ebx + 0x418], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c0e0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1024]
mov eax, dword [esi + 4]
inc ecx
test eax, eax
mov dword [esi + 0x1024], ecx
jne 0x49c133
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esi + 0x20]
mov dword [esi + 0x1020], 0
rep stosd dword es:[edi], eax
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push esi
push 0x49c180
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
pop edi
pop esi
ret

Function at 0x49c140
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1024]
dec eax
mov dword [esi + 0x1024], eax
jne 0x49c172
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop esi
ret
Function at 0x49c214
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x18
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
push edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1020]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x18], ebp
jle 0x49c37a
lea eax, [esi + 0x30]
lea ecx, [esi + 0x2c]
mov dword [esp + 0x14], eax
lea eax, [esi + 0x28]
push ebx
lea ebx, [esi + 0x20]
lea edi, [esi + 0x24]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
cmp dword [ebx], 0
je 0x49c338
mov ecx, dword [eax]
test ecx, ecx
jle 0x49c26d
add ecx, 0xfffffa24
mov dword [eax], ecx
cmp dword [eax], 0
jg 0x49c338
mov eax, dword [edi]
test eax, eax
je 0x49c2de
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x49c2d5
cmp dword [esp + 0x20], 0x103
jne 0x49c2d5
mov eax, dword [esi + 0x1028]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x49c334
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
test eax, eax
je 0x49c2b7
call eax
mov edx, dword [edi]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [edi]
push edx
jmp 0x49c2d8
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x18]
mov ecx, 0xff0
sub ecx, ebp
push ecx
push edx
push ebx
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
add esp, 0xc
dec eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, 0x10
sub edx, eax
sub ebp, eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x18]
sub ecx, eax
sub edi, eax
sub edx, eax
sub ebx, eax
mov eax, dword [esi + 0x1020]
mov dword [esp + 0x10], ecx
dec eax
mov dword [esp + 0x18], edx
mov dword [esi + 0x1020], eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
add edx, 0x10
inc ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x18]
add edx, 0x10
add ebp, 0x10
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x1020]
add eax, 0x10
add edi, 0x10
add ebx, 0x10
cmp ecx, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
jl 0x49c256
mov edi, dword [esp + 0x24]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x49c410
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1c]
mov esi, eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xc]
push ecx
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 8]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x28
ret
Function at 0x49dee0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x1c
mov dx, word [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
push edi
mov dword [esi + 0x2580], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x25f4], ecx
lea ecx, [esi + 0x25ac]
push eax
push ecx
mov word [esi + 0x25a8], dx
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x25c0], eax
mov eax, dword [esi + 0x2580]
xor edi, edi
mov dword [esi + 0x25bc], edx
cmp eax, edi
jne 0x49df4f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x48]
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x18
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x34], edi
lea eax, [esi + 0x25a4]
push eax
push 0
push esi
push 0x49db10
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x25a0], eax
mov eax, dword [esi + 0x25f0]
test eax, eax
jne 0x49e02b
push 1
push 0x210
push 0x210
lea eax, [esp + 0x1c]
push 0
push eax
call ebx
test eax, eax
je 0x49dfc0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x49dfcd
push 1
call ebp
inc edi
cmp edi, 0x1b58
ja 0x49dfef
mov ecx, dword [esi + 0x25a0]
lea eax, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x49e02b
cmp dword [esp + 0x44], 0x103
jne 0x49e02b
jmp 0x49df81
call fcn.0049d430
mov edx, dword [esi + 0x25a0]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.0049d4f0
mov eax, dword [esp + 0x34]
inc eax
cmp eax, 2
mov dword [esp + 0x34], eax
jae 0x49e01f
xor edi, edi
jmp 0x49df5f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x18
mov eax, dword [esi + 0x2590]
test eax, eax
je 0x49e04f
lea ecx, [esi + 0x30]
push ecx
push 0x4ddd88
push eax
call dword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov dword [esi + 0x2590], 0
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x18
Function at 0x49e110
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2094
call fcn.004d3780
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 8], edi
call fcn.0049f8b0
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [esp + 8]
cmp eax, edi
jne 0x49e149
pop edi
xor eax, eax
pop esi
add esp, 0x2094
ret 4
cmp dword [esp + 0x20a0], edi
je 0x49e168
mov ecx, esi
call fcn.0049f8b0
push eax
call fcn.004a8a30
add esp, 4
test eax, eax
je 0x49e1a8
jmp 0x49e1a3
push eax
push str.mailto:_subjectFrom_Browserbody_s
lea eax, [esp + 0x14]
push 0x1048
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 0xc]
push 5
push 0x4ffec0
push 0x4ffec0
push ecx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x49e1a8
mov edi, 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
pop edi
pop esi
add esp, 0x2094
ret 4

Function at 0x49ea14
Capabilities:
Get keyboard layout
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x2578], eax
sub eax, 0
mov dword [esi + 0x28], 0xffffffff
je 0x49ea79
sub eax, 2
jne 0x49eb0a
mov ecx, dword [esi + 0x25ec]
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x49ea5d
call fcn.004b2700
test eax, eax
je 0x49ea5d
push 0x6da2d8
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
jne 0x49ea5d
mov word [0x6da2d8], ax
mov ecx, dword [esi + 0x25ec]
push esi
call fcn.004b2510
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
mov ecx, dword [esi + 0x25ec]
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x49eaaf
call fcn.004b2700
test eax, eax
je 0x49eaaf
push 0x6da2d8
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x49eaaf
mov eax, dword [esi + 0x40]
test eax, eax
je 0x49eaaf
mov ecx, esi
call fcn.004a1040
mov ecx, dword [esi + 0x25ec]
push esi
call fcn.004b2500
mov ecx, dword [esi + 0x25ec]
mov eax, dword [esi + 4]
push 0x2043
push 0
mov edx, dword [ecx + 0x40]
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esi + 0x25c8]
test ecx, ecx
je 0x49eaf7
mov eax, dword [ecx]
push 0x4ffec0
call dword [eax + 8]
mov ecx, dword [esi + 4]
push 0
push 1
push 0x9411
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret 4
Function at 0x4a08c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov ecx, 0x6da2a0
call fcn.004abcc0
test eax, eax
je 0x4a09ff
mov eax, dword [esp + 0x20]
push ebx
test eax, eax
mov dword [esp + 0xc], 0
lea ebx, [edi + 0xc8]
jne 0x4a0905
cmp word [ebx], 0
je 0x4a08fe
mov dword [esp + 0xc], 1
mov word [ebx], 0
jmp 0x4a0931
cmp word [ebx], 0
jne 0x4a0913
mov dword [esp + 0xc], 1
push eax
push 0x4eb504
push 0x104
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov word [edi + 0x2ce], 0
mov ecx, dword [edi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub esi, ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + 0x25fc]
and esi, 0xffff
sub edx, ecx
shl esi, 0x10
and edx, 0xffff
or esi, edx
cmp word [ebx], 0
pop ebx
je 0x4a09d0
test eax, eax
jne 0x4a09b2
mov ecx, dword [edi + 4]
xor eax, eax
mov ax, word [edi + 0x25a8]
push 0
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push 0x4600004c
push str.HINT
push 4
lea ecx, [edi + 0x25f8]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x1a
call fcn.004d22a0
mov eax, dword [edi + 0x25fc]
push 0x2043
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4a09e3
test eax, eax
je 0x4a09e3
mov ecx, dword [edi + 0x25fc]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 8]
test eax, eax
je 0x4a09ff
mov edx, esi
and esi, 0xffff
shr edx, 0x10
push edx
push esi
mov ecx, edi
call fcn.004a1150
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x4a0c40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov eax, dword [edi + 4]
cmp eax, 0x201
jne 0x4a0c6d
mov eax, dword [edi + 0x14]
mov dword [esi + 0x131c], eax
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x1320], ecx
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
cmp eax, 0x20a
jne 0x4a0c65
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
shr eax, 8
test al, al
je 0x4a0c65
mov eax, dword [esi + 0x25ec]
test eax, eax
je 0x4a0c65
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x4a0c65
push 0x12
call ebx
movsx edx, ax
shr edx, 0x10
je 0x4a0cb6
push 0
mov ecx, esi
call fcn.004a01c0
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
mov eax, dword [edi + 8]
mov ecx, esi
shr eax, 0x10
push eax
call fcn.004a01c0
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
Function at 0x4a17d0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x6da37c
call fcn.004a1b10
push 0x40
push 0x4dcfc4
push 0x6da37c
push 0x6da37c
call fcn.004a1a30
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x4a185b
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x4fd5b4]
mov ecx, 8
mov esi, eax
mov edi, 0x6da35c
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004a1970
mov ecx, dword [0x4fd5b0]
mov edx, dword [0x4fd5b4]
push 0x20
push ecx
push edx
call fcn.004a1a80
mov edi, dword [0x4fd5b0]
add esp, 0x14
mov ecx, 8
mov esi, 0x6da35c
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4a180f
jmp 0x4a18b4
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x4fd5b0]
mov ecx, 8
mov esi, eax
mov edi, 0x6da35c
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004a1970
mov ecx, dword [0x4fd5b4]
mov edx, dword [0x4fd5b0]
push 0x20
push ecx
push edx
call fcn.004a1a80
mov edi, dword [0x4fd5b4]
add esp, 0x14
mov ecx, 8
mov esi, 0x6da35c
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4a186a
push 0x40
push 0x4dd004
push 0x6da37c
push 0x6da37c
call fcn.004a1a30
mov eax, dword [esp + 0x24]
push 0x40
push 0x6da37c
push eax
call fcn.004a1b50
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4a18f0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x6da31c
call fcn.004a1b10
push 0x38
push str.91__
push 0x6da31c
push 0x6da31c
call fcn.004a1a30
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x4dd0fc]
mov edx, dword [0x4fd5b8]
push ecx
push 0x1c
push edx
call fcn.004a1ab0
movsx eax, byte [esi + 0x4dd0fc]
mov ecx, dword [0x4fd5bc]
push eax
push 0x1c
push ecx
call fcn.004a1ab0
push 0x30
push 0x4dd0cc
push 0x6da31c
push edi
call fcn.004a1a30
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x4a1922
pop edi
pop esi
ret

Function at 0x4a1970
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x4dd044
push esi
push 0x6da2ec
call fcn.004a1a30
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x6da2ec
call fcn.004a1a80
push 0x6da2ec
push esi
call fcn.004a19c0
push 0x20
push 0x4dd074
push esi
push esi
call fcn.004a1a30
add esp, 0x34
pop esi
ret

Function at 0x4a1a80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x4a1aa2
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x4a1a94
pop ebx
pop esi
ret
Function at 0x4a2450
Capabilities:
Parse url

Disassembly:
sub esp, 0x3c
push esi
mov esi, dword [esp + 0x48]
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x912
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [esi + 8]
lea edx, [esi + 0x48]
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x48]
mov eax, 0x800
mov dword [esp + 0x34], edx
lea ecx, [esi + 0x2148]
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], eax
lea edx, [esi + 0x2348]
mov eax, 0x80
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
lea ecx, [esi + 0x1048]
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x50]
lea edx, [esp + 8]
mov dword [esp + 0x3c], ecx
push edx
lea ecx, [esi + 0x2048]
push eax
push edi
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x1c], 0x20
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x38], ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4a2524
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x4a250e
cmp eax, 4
je 0x4a250e
cmp eax, 1
jne 0x4a2524
mov cx, word [esp + 0x20]
mov dword [esi + 4], eax
mov word [esi], cx
pop edi
mov eax, 1
pop esi
add esp, 0x3c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x3c
ret

Function at 0x4a2530
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x4a2540
xor eax, eax
pop esi
pop ecx
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 0x2454], eax
je 0x4a2587
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push esi
push 0x4a2880
push 0
push 0
mov dword [esi + 0x5ceb4], 8
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 8], eax
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4a34d0
Capabilities:
Send data

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [edi + 0x26c4]
mov esi, dword [eax + ecx*4]
mov edx, dword [esi + 0x1c]
mov dword [esi + 0x20], 2
cmp dword [edx + 4], 1
je 0x4a355d
mov eax, dword [edi + 0x246c]
test eax, eax
je 0x4a358b
mov eax, dword [esi + 8]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [edi + 0x2470]
mov eax, dword [edi + 0x246c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4a3546
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
mov eax, 1
pop esi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4a3595
pop edi
mov eax, 1
pop esi
ret 4
cmp dword [esi], 0
jne 0x4a3576
mov eax, dword [esi + 4]
test eax, eax
je 0x4a3576
mov dword [esi + 0x14], eax
pop edi
mov eax, 1
pop esi
ret 4
push 1
push ecx
mov ecx, edi
mov dword [esi + 0x20], 0
call fcn.004a48d0
test eax, eax
je 0x4a3595
pop edi
mov eax, 1
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4