joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c068
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47c099
mov ecx, dword [0x4eace4]
mov dl, 1
mov eax, dword [0x47a734]
call fcn.0040de0c
call fcn.00404a9c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x47c0c6
mov ecx, dword [0x4ea9f4]
mov dl, 1
mov eax, dword [0x47a734]
call fcn.0040de0c
call fcn.00404a9c
xor eax, eax
push ebp
push 0x47c147
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00404424
cmp byte [ebp + 8], 0
je 0x47c121
mov eax, dword [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047bfd0
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047be28
jmp 0x47c13d
mov eax, dword [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047b980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c164
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x47c170
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47c1a1
mov ecx, dword [0x4eaa84]
mov dl, 1
mov eax, dword [0x47a734]
call fcn.0040de0c
call fcn.00404a9c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x47c1ce
mov ecx, dword [0x4ea9f4]
mov dl, 1
mov eax, dword [0x47a734]
call fcn.0040de0c
call fcn.00404a9c
xor eax, eax
push ebp
push 0x47c24a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00404424
cmp byte [ebp + 8], 0
je 0x47c226
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047bfd0
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0047beb0
jmp 0x47c240
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047b980
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c267
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47c448
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0047bc48
xor eax, eax
push ebp
push 0x47c5bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x47c5a5
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x47c494
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47c49e
call fcn.00404b48
jmp 0x47c5c2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bb74
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x47c59a
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x47c54d
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x47c53a
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404424
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0047c400
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x47c5d0]
cmp dl, byte [eax + 0x28]
je 0x47c5a1
call fcn.0040dd24
jmp 0x47c5a1
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bb94
jmp 0x47c5a1
cmp edi, ebx
jge 0x47c569
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bb94
jmp 0x47c49e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041bb74
cmp edx, dword [esp + 4]
jne 0x47c589
cmp eax, dword [esp]
pop edx
pop eax
jne 0x47c49e
push ebp
call fcn.0047c400
pop ecx
jmp 0x47c5a1
push ebp
call fcn.0047c400
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c5c2
mov eax, dword [ebp - 4]
call fcn.0047bc54
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c5d4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c6f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047bc48
xor eax, eax
push ebp
push 0x47c6d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47c624
call fcn.00404b48
jmp 0x47c6e0
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47c6c3
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47c6c3
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404424
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47c6c3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d50c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47c710
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4eab9c]
mov dl, 1
mov eax, dword [0x47a734]
call fcn.0040de48
call fcn.00404a9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c6e0
mov eax, dword [ebp - 4]
call fcn.0047bc54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c6fd
lea eax, [ebp - 0x28]
call fcn.00405128
ret
Function at 0x47c75c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c8a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047bc48
xor eax, eax
push ebp
push 0x47c889
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x47c7c1
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47c7c1
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x47c873
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47c7d4
call fcn.00404b48
jmp 0x47c890
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47c873
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47c873
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00404424
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47c873
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d50c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47c8c0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4eab9c]
mov dl, 1
mov eax, dword [0x47a734]
call fcn.0040de48
call fcn.00404a9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c890
mov eax, dword [ebp - 4]
call fcn.0047bc54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c8ad
lea eax, [ebp - 0x28]
call fcn.00405128
ret
Function at 0x4ac07c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor ecx, ecx
push ebp
push 0x4ac297
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [esi]
lea eax, [ebp - 0x48]
mov ecx, 0x40
call fcn.00408370
cmp word [ebp - 0x48], 0x5a4d
je 0x4ac0d6
mov eax, 0x4f1934
mov edx, 0x4ac2cc
call fcn.0040517c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b7
mov edx, dword [esi]
add edx, dword [ebp - 0xc]
lea eax, [ebp - 0x140]
mov ecx, 0xf8
call fcn.00408370
cmp dword [ebp - 0x140], 0x4550
je 0x4ac113
mov eax, 0x4f1934
mov edx, 0x4ac304
call fcn.0040517c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b7
push 4
push 0x2000
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x10c]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
jne 0x4ac14a
push 4
push 0x2000
mov eax, dword [ebp - 0xf0]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
jne 0x4ac16a
mov eax, 0x4f1934
mov edx, 0x4ac340
call fcn.0040517c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b7
push 0x11
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 0
push 4
push 0x1000
mov eax, dword [ebp - 0xf0]
push eax
push ebx
call sub.kernel32.dll_VirtualAlloc_1
push 4
push 0x1000
mov eax, dword [ebp - 0xec]
push eax
push ebx
call sub.kernel32.dll_VirtualAlloc_1
mov edi, eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xec]
mov edx, dword [esi]
mov eax, edi
call fcn.00408370
mov eax, edi
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov edi, ebx
mov dword [eax + 0x34], edi
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x140]
push eax
mov eax, dword [esi]
push eax
call fcn.004abb30
mov eax, edi
sub eax, dword [ebp - 0x10c]
test eax, eax
je 0x4ac20d
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004abbd8
mov eax, dword [ebp - 8]
push eax
call fcn.004abc90
test al, al
jne 0x4ac22e
mov eax, 0x4f1934
mov edx, 0x4ac370
call fcn.004053f4
call fcn.0040dd24
mov eax, dword [ebp - 8]
push eax
call fcn.004abf8c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4ac28d
mov edx, eax
add edx, edi
mov esi, edx
test edx, edx
jne 0x4ac261
mov eax, 0x4f1934
mov edx, 0x4ac3a8
call fcn.0040517c
call fcn.0040dd24
push 0
push 1
push edi
call esi
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4ac286
mov eax, 0x4f1934
mov edx, 0x4ac3dc
call fcn.0040517c
call fcn.0040dd24
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b1
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4adbbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405a9c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4adbd5
test al, 0x10
jne 0x4adbd9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4adef8
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405c84
xor eax, eax
push ebp
push 0x4ae021
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405b70
je 0x4adff1
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004adb50
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405940
mov eax, dword [ebp - 4]
call fcn.004adbbc
test al, al
jne 0x4adff1
mov eax, dword [ebp - 4]
call fcn.00405aac
cmp eax, 3
jl 0x4adff1
mov eax, dword [ebp - 4]
call fcn.004adbbc
test al, al
jne 0x4adff1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004053b0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040a754
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405a8c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405b70
je 0x4adff1
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004adad4
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.004adef8
test al, al
je 0x4adfd0
push 0
mov eax, dword [ebp - 4]
call fcn.00405a9c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4adfd4
xor ebx, ebx
jmp 0x4adfd6
mov bl, 1
test bl, bl
je 0x4adff1
test si, si
jbe 0x4adff1
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.00405a9c
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae028
lea eax, [ebp - 0x18]
call fcn.004058dc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040514c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058f4
ret

Function at 0x4aff78
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x4aff8a
add esp, 0xfffffff0
call fcn.0040454c
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.00405c84
xor eax, eax
push ebp
push 0x4b0036
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.004041f8
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.00405918
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
movzx eax, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x4accac]
call fcn.004066c8
add esp, 4
mov eax, edi
call fcn.004afdcc
test al, al
jne 0x4b0020
call fcn.0040dd24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b003d
lea eax, [ebp + 0x1c]
call fcn.004058dc
ret
Function at 0x4b06a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x4b06a9
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.00405c84
xor eax, eax
push ebp
push 0x4b08c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.004add3c
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.004ae030
mov eax, dword [ebp - 0x14018]
mov edx, 0x4b08dc
call fcn.00405b70
jne 0x4b0899
mov dword [ebx + 0xa8], 0
mov dword [ebx + 0xac], 0
mov byte [ebx + 0xa0], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.00405a9c
mov ecx, 1
mov edx, 0x80000000
call fcn.004ae0f4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0892
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004ae188
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae188
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x4b0807
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.004b0668
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4b0803
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
jmp 0x4b0807
inc esi
dec edi
jne 0x4b07ce
cmp byte [ebx + 0xa0], 0
jne 0x4b087b
push ebp
call fcn.004b0578
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x4b087b
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ae188
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.004b0668
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x4b087b
mov eax, esi
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0899
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b08c9
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.004058f4
lea eax, [ebp - 0x14008]
call fcn.004058dc
ret

Function at 0x4b6460
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x4e8558]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret
Function at 0x4b6498
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4b64b0
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b64a9
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403a24
xor edx, edx
mov eax, 0x4e8758
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4b6517
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4b64ce
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4b6758
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4b6771
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4b676a
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4b6783
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b677c
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004b6350
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b679d
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.004b6460
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4b6825
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4b6843
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004b63e0
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b686d
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ba6bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4ba73b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405310
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4ba750
call fcn.00405440
mov eax, dword [ebp - 4]
call fcn.004055b8
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
je 0x4ba71a
cmp eax, 1
je 0x4ba71a
cmp eax, 3
jne 0x4ba71a
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x5b
jne 0x4ba6da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba742
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040514c
ret
Function at 0x4c1c74
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c1ce9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x1400
mov eax, dword [ebp - 8]
call fcn.00402f74
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405128
test esi, esi
je 0x4c1cc2
push esi
call sub.kernel32.dll_SetLastError
call fcn.0040f3a8
mov esi, ebx
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x190]
lea eax, [esi + 0x194]
call fcn.004c1be8
mov eax, ebx
call fcn.00402f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c1cfb
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4dcb28
Capabilities:
Encode data using xor

Disassembly:
push ebx
test eax, eax
je 0x4dcb51
test edx, edx
je 0x4dcb51
dec ecx
test ecx, ecx
jb 0x4dcb51
inc ecx
movzx ebx, byte [eax]
xor bl, 0x9e
movzx ebx, bl
movzx ebx, byte [ebx + 0x4ea520]
xor bl, 0x34
mov byte [edx], bl
inc eax
inc edx
dec ecx
jne 0x4dcb37
pop ebx
ret

Function at 0x4dd214
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 5
push ebx
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x4eaad8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
cmp dword [0x4ea6c8], 0
je 0x4dd258
push 1
mov eax, dword [0x4ea6c8]
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 3
mov eax, dword [0x4ea6c8]
push eax
call sub.user32.dll_SendMessageA
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
call sub.user32.dll_SetWindowPos
push 0x43
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x4eaad8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
pop ebx
ret