joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a26e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a280a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004a1e98
xor eax, eax
push ebp
push 0x4a27ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4a2738
call fcn.00403bf8
jmp 0x4a27f4
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4a27d7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4a27d7
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004035bc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4a27d7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bc78
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4a2824
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4ace20]
mov dl, 1
mov eax, dword [0x4a1130]
call fcn.0040c5a8
call fcn.00403b4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a27f4
mov eax, dword [ebp - 4]
call fcn.004a1ea4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2811
lea eax, [ebp - 0x28]
call fcn.004041b0
ret
Function at 0x4a2870
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a29ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004a1e98
xor eax, eax
push ebp
push 0x4a299d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4a28d5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4a28d5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4a2987
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4a28e8
call fcn.00403bf8
jmp 0x4a29a4
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4a2987
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4a2987
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004035bc
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4a2987
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bc78
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4a29d4
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4ace20]
mov dl, 1
mov eax, dword [0x4a1130]
call fcn.0040c5a8
call fcn.00403b4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a29a4
mov eax, dword [ebp - 4]
call fcn.004a1ea4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a29c1
lea eax, [ebp - 0x28]
call fcn.004041b0
ret

Function at 0x4a3068
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
lea eax, [esp + 8]
call fcn.004a1048
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
call fcn.004a1038
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x10c
pop esi
pop ebx
ret
Function at 0x10001940
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10020060]
xor eax, ebp
mov dword [ebp - 4], eax
push 7
mov eax, dword [ebp + 8]
push eax
call fcn.100018c0
add esp, 8
mov dword [ebp - 0x28], eax
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
push eax
call fcn.10008373
add esp, 4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000848e
mov esp, ebp
pop ebp
ret

Function at 0x100019a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
cmp dword [0x1002152c], 0
je 0x100019b5
jmp 0x10001b2f
push 0x11
push 0x10018554
call fcn.10001500
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.10001940
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001a20
mov ecx, dword [ebp - 4]
push ecx
call fcn.10008373
add esp, 4
push 0xc
push 0x1001867c
call fcn.10001500
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call fcn.10001940
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001a20
mov eax, dword [ebp - 4]
push eax
call fcn.10008373
add esp, 4
jmp 0x10001b2f
mov ecx, dword [ebp - 8]
add ecx, 8
push ecx
call fcn.100083ab
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
add edx, 2
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
push edx
call fcn.10008373
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x10001a67
mov eax, dword [ebp - 8]
add eax, 2
cmp dword [ebp - 0x14], eax
jbe 0x10001a78
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10008373
add esp, 4
jmp 0x10001b2f
push 0x1f
push 0x10018604
call fcn.10001500
add esp, 8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.10007610
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.10007610
add esp, 4
lea ecx, [esi + eax + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 8
push edx
call fcn.100083ab
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push str._s_s
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.10007f24
add esp, 0x14
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10008373
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10008373
add esp, 4
push 0x10018624
mov eax, dword [ebp - 4]
push eax
call fcn.10007e8b
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10001b23
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10007d50
add esp, 4
mov edx, dword [ebp - 4]
mov dword [0x1002152c], edx
jmp 0x10001b2f
mov eax, dword [ebp - 4]
push eax
call fcn.10008373
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001d40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001de0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10001dd6
cmp dword [ebp - 0xc], 0xea
je 0x10001dd6
mov edx, dword [ebp + 0x10]
push edx
call fcn.10007610
add esp, 4
push eax
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10001dc9
mov dword [ebp - 0x10], 1
jmp 0x10001dd0
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x10002f40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x10325476
pop ebp
ret
Function at 0x100041b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
push 0x3000
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
jne 0x100041da
mov dword [ebp - 4], 1
jmp 0x100041e1
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10004220
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1000423c
mov dword [ebp - 4], 1
jmp 0x10004243
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10004250
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 3
mov eax, dword [ebp + 8]
push eax
call fcn.100018c0
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10004294
mov dword [ebp - 8], 1
jmp 0x1000429b
mov dword [ebp - 8], 0
mov cl, byte [ebp - 8]
mov byte [ebp - 1], cl
mov edx, dword [ebp - 0xc]
push edx
call fcn.10008373
add esp, 4
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x10006540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10006578
xor eax, eax
jmp 0x100065fd
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10006598
jmp 0x100065f0
mov eax, dword [ebp - 8]
add eax, 2
push eax
call fcn.100083ab
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100065b4
jmp 0x100065f0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100065dd
mov dword [ebp - 4], 0
jmp 0x100065f0
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov byte [edx], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov byte [eax + 1], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42abc8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42abce
ret

Function at 0x441768
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x441919
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404e80
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x441930
call fcn.00404adc
mov eax, ebx
call fcn.00428aa0
mov edi, eax
dec edi
test edi, edi
jl 0x441820
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00428a74
mov edx, dword [0x438cb4]
call fcn.00403a18
test al, al
je 0x44181c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00428a74
lea edx, [ebp - 0x14]
call fcn.0044945c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404e80
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b50
inc esi
dec edi
jne 0x4417ce
mov al, byte [0x441934]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x441940
mov eax, dword [ebp - 0xc]
call fcn.0040ef6c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404868
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044945c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x441930
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0044945c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x441930
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x441930
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x44194c
call fcn.0040a8e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441920
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004047f4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004047f4
lea eax, [ebp - 0x14]
call fcn.004047d0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004047f4
ret
Function at 0x498800
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x49883b
cmp dword [ebx + 0x5c], 0
je 0x49883b
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.004908f8
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x498986
cmp dword [ebx + 0x7c], 0
jne 0x498861
mov dl, 1
mov eax, dword [0x41c5fc]
call fcn.00403850
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x49895f
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x49898c]
push eax
mov al, byte [0x498990]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x5589cc]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x488738]
call fcn.0048a688
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x498958
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004908f8
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.004908f8
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x48def0]
call fcn.00405f98
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x49892b
mov edx, dword [0x558d5c]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x49893c
cmp eax, 0x1007
jne 0x498938
mov byte [ebx + 0x74], 0x18
jmp 0x49893c
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498986
mov eax, dword [ebp - 4]
call fcn.00403880
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004908f8
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b2688
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4b26a2
add esp, 0xfffffff0
call fcn.00403bf8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4b273f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403850
mov dword [edi + 0x20], esi
mov dl, 1
mov eax, dword [0x429f9c]
call fcn.0042b734
mov esi, eax
mov dword [edi + 0x10], esi
mov eax, edi
call fcn.004b2ad4
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [edi + 0x10]
mov dword [eax + 0xc], edi
mov dword [eax + 8], 0x4b2978
mov dl, 1
mov eax, dword [0x41cba4]
call fcn.00403850
mov dword [edi + 4], eax
lea eax, [ebp - 0x10]
call fcn.00419de8
lea edx, [ebp - 0x10]
lea eax, [edi + 0x30]
call fcn.00411dcc
mov byte [edi + 0x28], 1
mov dl, byte [0x4b2764]
mov ax, 0x2e
call fcn.00458e84
mov word [edi + 0x26], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2746
lea eax, [ebp - 0x10]
call fcn.004119a0
ret
Function at 0x4f14e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [ebp + 8]
add edi, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov word [eax], 0
test dl, dl
je 0x4f151a
test bl, bl
je 0x4f150b
mov eax, dword [edi]
mov esi, dword [eax + 0x21c]
jmp 0x4f1515
mov eax, dword [edi]
movzx esi, byte [eax + 0x405]
dec esi
xor bl, 1
jmp 0x4f152b
mov eax, dword [edi]
mov edx, dword [eax + 0x420]
mov eax, dword [edi]
call fcn.004e2904
mov esi, eax
mov eax, esi
test bl, bl
je 0x4f1534
inc esi
jmp 0x4f1535
dec esi
mov edx, dword [edi]
cmp esi, dword [edx + 0x21c]
jl 0x4f154a
mov edx, dword [edi]
movzx esi, byte [edx + 0x405]
jmp 0x4f156a
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
cmp esi, edx
jge 0x4f156a
mov edx, dword [edi]
mov esi, dword [edx + 0x21c]
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
sub esi, edx
cmp eax, esi
je 0x4f15ae
jmp 0x4f1586
test bl, bl
je 0x4f1577
inc esi
jmp 0x4f1578
dec esi
test esi, esi
jl 0x4f15ae
mov eax, dword [edi]
cmp esi, dword [eax + 0x21c]
jge 0x4f15ae
mov eax, dword [edi]
mov edx, esi
call fcn.004e28f8
mov edx, eax
mov eax, dword [edi]
call fcn.004f04d0
test al, al
je 0x4f1570
mov eax, dword [edi]
mov edx, esi
call fcn.004e28f8
mov edx, eax
mov eax, dword [edi]
call fcn.004f05a4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4fbf30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4fbf4a
add esp, 0xfffffff0
call fcn.00403bf8
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4fbfd8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403850
mov dword [edi + 4], esi
lea eax, [edi + 0x40]
call fcn.004cdf4c
mov byte [edi + 0x34], 1
mov dl, 1
mov eax, dword [0x41cba4]
call fcn.00403850
mov dword [edi + 0x28], eax
mov dl, 1
mov eax, dword [0x41cba4]
call fcn.00403850
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x4abe5c]
call fcn.004abffc
mov esi, eax
mov dword [edi + 0x30], esi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], 0x4fc908
lea eax, [ebp - 0x10]
call fcn.00419de8
lea edx, [ebp - 0x10]
lea eax, [edi + 0x18]
call fcn.00411dcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbfdf
lea eax, [ebp - 0x10]
call fcn.004119a0
ret
Function at 0x5174a8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5174b0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x51764c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 8]
mov edx, 0x517664
mov eax, esi
call fcn.00515234
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xc]
call fcn.00404824
lea ecx, [ebp - 0xc]
mov edx, 0x517678
mov eax, esi
call fcn.00515234
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x28]
call fcn.00404824
lea ecx, [ebp - 0x10]
mov edx, 0x517690
mov eax, esi
call fcn.00515234
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x10]
call fcn.00404824
lea ecx, [ebp - 0x14]
mov edx, 0x5176ac
mov eax, esi
call fcn.00515234
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x14]
call fcn.00404824
lea ecx, [ebp - 0x18]
mov edx, 0x5176c8
mov eax, esi
call fcn.00515234
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x24]
call fcn.00404824
lea ecx, [ebp - 0x20]
mov edx, 0x5176e0
mov eax, esi
call fcn.00515234
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004094ac
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
call fcn.00409c2c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x24]
mov edx, 0x5176f8
mov eax, esi
call fcn.00515234
mov eax, dword [ebp - 0x24]
call fcn.00514324
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x28]
mov edx, 0x517708
mov eax, esi
call fcn.00515234
mov eax, dword [ebp - 0x28]
call fcn.00514324
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 4]
mov edx, 0x517720
mov eax, esi
call fcn.00515234
mov eax, dword [ebp - 4]
call fcn.00513ed8
test al, al
je 0x517603
mov eax, dword [ebp - 4]
call fcn.00409bf0
mov edi, eax
test edi, edi
jl 0x5175f9
call fcn.0040bb48
mov dword [ebp - 0x2c], edi
fild dword [ebp - 0x2c]
fdiv dword [0x517728]
faddp st(1)
fstp qword [ebx + 0x38]
wait
jmp 0x51760f
xor eax, eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
jmp 0x51760f
mov eax, dword [ebp - 4]
call fcn.00514324
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x517734
mov eax, esi
call fcn.00515234
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x48]
call fcn.00404824
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517653
lea eax, [ebp - 0x30]
call fcn.004047d0
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004047f4
ret

Function at 0x524138
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x524192
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00524128
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00512cf0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.005128f0
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524199
lea eax, [ebp - 4]
call fcn.004047d0
ret
Function at 0x5326d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x53272a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.00532734
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532731
ret