joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abccc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405ea0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4abce5
test al, 0x10
je 0x4abce9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4abcf0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00405e74
add esp, 0x20c
pop ebx
ret

Function at 0x4abd34
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00405d1c
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00405ea0
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x4abd79
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00405e14
jmp 0x4abd92
mov edx, ebx
dec edx
mov eax, esi
call fcn.004060f4
push ebx
mov eax, dword [esi]
call fcn.00405ea0
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b1918
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, 0xffffffff
mov ecx, edi
shr ecx, 2
jecxz 0x4b196f
mov edx, dword [esi]
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x4ea53c]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0x4ea53c]
shr edx, 0x10
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x4ea53c]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0x4ea53c]
add esi, 4
loop 0x4b192d
mov ecx, edi
and ecx, 3
jecxz 0x4b1987
mov bl, al
xor bl, byte [esi]
shr eax, 8
inc esi
xor eax, dword [ebx*4 + 0x4ea53c]
loop 0x4b1976
xor eax, 0xffffffff
pop ebx
pop edi
pop esi
ret
Function at 0x4c7190
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4c71ee
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004c726c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4c71d6
lea eax, [ebp - 4]
call fcn.004c726c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4c71d8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c71f5
lea eax, [ebp - 4]
call fcn.004054f8
ret

Function at 0x4c71fc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4c7260
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004c726c
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b884
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7267
lea eax, [ebp - 4]
call fcn.004054f8
ret

Function at 0x4c7820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4c7919
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004c6f20
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b428
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c81f0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b2e8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c8268
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7920
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040551c
ret
Function at 0x4c7928
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4c7a31
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004c6f20
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4c79f7
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b428
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c81f0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b2e8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c8268
jmp 0x4c7a09
xor edx, edx
mov eax, ebx
call fcn.004c81f0
xor edx, edx
mov eax, ebx
call fcn.004c8268
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7a38
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040551c
ret

Function at 0x4ce320
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004ce55c
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004ce55c
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4ce394
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4ce3ba
inc esi
mov eax, edi
call fcn.004ce378
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.004ce320
inc ebx
dec esi
jne 0x4ce3a3
pop edi
pop esi
pop ebx
ret
Function at 0x4ce450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4ce4c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004ce3c0
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004ce378
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004ce320
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4ce490
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce4cd
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x4cf160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf346
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4cf302
mov eax, dword [ebp - 4]
call fcn.004d0b08
cmp ebx, eax
jge 0x4cf302
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004c5754
mov edx, dword [0x4c72c0]
call fcn.0040478c
mov esi, eax
mov eax, esi
call fcn.004c8184
test al, al
je 0x4cf2f8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4cf2ec
xor eax, eax
push ebp
push 0x4cf2e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004cf718
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041db70
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405c34
mov eax, dword [ebp - 8]
call fcn.00405a04
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004cf4dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf330
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4cf2e4
mov eax, dword [ebp - 4]
call fcn.004cf79c
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b884
jmp 0x4cf330
mov eax, dword [ebp - 8]
call fcn.004054f8
jmp 0x4cf330
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040ac70
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x418834]
call fcn.0040ef98
call fcn.00404e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf34d
lea eax, [ebp - 0x54]
call fcn.004054f8
ret
Function at 0x4d47c8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403bd0
ret

Function at 0x4d4bb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
xor edx, edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d4cf9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d4d0c
call fcn.004d4a1c
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d4cbf
xor edx, edx
push ebp
push 0x4d4cb8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x3e9
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d4d4c
call fcn.004d4a1c
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d4c9e
push ebp
mov eax, 0x4d4d78
call fcn.004d4b0c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4cbf
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4d00
lea eax, [ebp - 0x408]
call fcn.004054f8
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4d4f14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4d50d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4d50ec
call fcn.004d4d7c
lea eax, [ebp - 0x3f0]
call fcn.004054f8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004059a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d5099
xor eax, eax
push ebp
push 0x4d5092
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x4d5124
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d4fee
push ebp
mov eax, 0x4d5140
call fcn.004d4e6c
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4d514c
call fcn.004d4d7c
mov eax, dword [ebp - 0x408]
call fcn.004059a4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d5078
push dword [ebp - 0x3f0]
push 0x4d5170
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405768
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004058a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5099
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d50df
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4dae98
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4dafd3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4dafa3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004059a4
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040ae94
test al, al
jne 0x4daf13
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.0040392c
lea eax, [ebp - 0x1d0]
call fcn.004036c8
call fcn.004030f4
push dword [0x4f5dcc]
push 0x4dafec
push dword [0x4f5dd0]
push 0x4dafec
push dword [0x4f5dd4]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004058a8
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004e20f4
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405cc4
call fcn.00404024
call fcn.004030f4
lea eax, [ebp - 0x1d0]
call fcn.004039f4
call fcn.004030f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dafad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dafda
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x4dc154
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4dc2bc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004db32c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004db34c
mov ebx, eax
jmp 0x4dc28e
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040b428
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409d7c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409d7c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040593c
je 0x4dc26e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405768
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409d7c
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409d7c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040593c
jne 0x4dc283
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004db36c
mov ebx, eax
test ebx, ebx
jne 0x4dc1cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc2c3
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret

Function at 0x4de64c
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x4de668
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
setne al
ret

Function at 0x4de8f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4de9d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4de9e8
mov edx, dword [ebp - 4]
call fcn.0040582c
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4de942.0
jmp dword [eax*4 + 0x4de949]
mov eax, ebx
mov edx, 0x4de9f4
call fcn.0040554c
jmp 0x4de9b7
mov eax, ebx
mov edx, 0x4dea04
call fcn.0040554c
jmp 0x4de9b7
mov eax, ebx
mov edx, 0x4dea14
call fcn.0040554c
jmp 0x4de9b7
mov eax, ebx
mov edx, 0x4dea28
call fcn.0040554c
jmp 0x4de9b7
mov eax, ebx
mov edx, 0x4dea38
call fcn.0040554c
jmp 0x4de9b7
mov eax, ebx
mov edx, 0x4dea4c
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de9d9
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret
Function at 0x4deea4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405994
xor eax, eax
push ebp
push 0x4def39
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4def50
mov edx, dword [ebp - 4]
call fcn.0040582c
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.004059a4
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a88c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4def40
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040551c
ret

Function at 0x4e286c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e293d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.0040b884
lea ecx, [ebp - 0x108]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043e77c
mov eax, dword [ebp - 0x108]
mov edx, 0x4e2954
call fcn.0040593c
je 0x4e290d
lea ecx, [ebp - 0x10c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0043e77c
mov eax, dword [ebp - 0x10c]
mov edx, 0x4e2960
call fcn.0040593c
je 0x4e290d
lea eax, [ebp - 4]
mov edx, 0x4e2960
call fcn.004057e0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040554c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2944
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040551c
lea eax, [ebp - 4]
call fcn.004054f8
ret
Function at 0x414dd1
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], ecx
add edi, ebx
add edi, 0xb42e393f
or edi, edi
add esi, 4
mov ebx, 0x19c66604
sub ebx, 0xfc2f5f7
cmp esi, edx
jne fcn.00414dd1
or edi, ebx
or edi, eax
add ebx, ebx
ret