joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6980
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4c699a
push ebx
call fcn.004c6980
push dword [edi + 0xc]
push str._n__s__n_n
push ebx
call fcn.004c6c20
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x10], ecx
cmp dword [edi + 0x14], ecx
jle 0x4c6ae1
push ebp
mov ebp, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
push esi
mov eax, dword [edi + 0x10]
mov edi, dword [eax + ecx*8 + 4]
lea eax, [eax + ecx*8]
push dword [eax]
test edi, edi
je 0x4c6abb
push 0x56eac8
push ebx
call fcn.004c6c20
add esp, 0xc
lea eax, [edi + 2]
xor esi, esi
nop dword [eax]
cmp byte [eax - 2], 0
je 0x4c6a35
cmp byte [eax - 1], 0
je 0x4c6a34
cmp byte [eax], 0
je 0x4c6a2f
cmp byte [eax + 1], 0
je 0x4c6a2a
cmp byte [eax + 2], 0
je 0x4c6a25
cmp byte [eax + 3], 0
je 0x4c6a20
add esi, 6
add eax, 6
cmp esi, 0x3c
jb 0x4c69f0
jmp 0x4c6a35
add esi, 5
jmp 0x4c6a35
add esi, 4
jmp 0x4c6a35
add esi, 3
jmp 0x4c6a35
add esi, 2
jmp 0x4c6a35
inc esi
push ebx
push 1
push esi
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push 0x56c794
push ebx
call fcn.004c6c20
add edi, esi
add esp, 0x18
cmp byte [edi], 0
je 0x4c6ac9
xor esi, esi
lea eax, [edi + 2]
nop word [eax + eax]
cmp byte [eax - 2], 0
je 0x4c6a9a
cmp byte [eax - 1], 0
je 0x4c6a99
cmp byte [eax], 0
je 0x4c6a94
cmp byte [eax + 1], 0
je 0x4c6a8f
cmp byte [eax + 2], 0
je 0x4c6a8a
add esi, 5
add eax, 5
cmp esi, 0x50
jb 0x4c6a60
jmp 0x4c6a9a
add esi, 4
jmp 0x4c6a9a
add esi, 3
jmp 0x4c6a9a
add esi, 2
jmp 0x4c6a9a
inc esi
push ebx
push 0x2b
call ebp
push ebx
push 1
push esi
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push ebx
push 0xa
call ebp
add edi, esi
add esp, 0x20
cmp byte [edi], 0
jne 0x4c6a55
jmp 0x4c6ac9
push 0x56eacc
push ebx
call fcn.004c6c20
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [edi + 0x14]
jl 0x4c69c2
pop esi
pop ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x4c6aed
push ebx
call fcn.004c6980
and byte [edi + 0x1c], 0xfe
xor eax, eax
pop edi
pop ebx
pop ecx
ret 4
Function at 0x4d6be0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x4d6bfd
mov eax, dword [eax + 0x8c]
test eax, eax
je 0x4d6bfd
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4d9ff0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.shell32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0xc], ebx
lea ecx, [ecx*4 + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, dword [esp + 0x1c]
add esp, 4
mov ecx, dword [esp + 0x14]
xor esi, esi
mov dword [edi], eax
test ecx, ecx
jle 0x4da0ce
push ebp
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebx + esi*4]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
jle 0x4da0ad
push ebp
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x10]
push 0
push 0
push ebp
push ebx
push 0xffffffffffffffff
push dword [eax + esi*4]
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
je 0x4da08d
mov eax, dword [edi]
mov dword [eax + esi*4], ebx
mov ebx, dword [esp + 0x10]
jmp 0x4da0c0
push 0x55e0cc
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov ecx, dword [edi]
push ebx
mov dword [ecx + esi*4], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [esp + 0x18]
add esp, 8
jmp 0x4da0c0
push 0x55e0cc
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov ecx, dword [edi]
add esp, 4
mov dword [ecx + esi*4], eax
mov ecx, dword [esp + 0x18]
inc esi
cmp esi, ecx
jl 0x4da036
pop ebp
mov eax, dword [edi]
push ebx
mov dword [eax + ecx*4], 0
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
pop ecx
ret 8

Function at 0x4da5a0
Capabilities:
Get disk information

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
mov ebp, dword [esp + 0x18]
lea esi, [edi + 0x41]
mov ebx, eax
test bl, 1
je 0x4da5dc
push esi
push str._c:_
push dword [esp + 0x24]
push ebp
call fcn.004e0780
mov ecx, dword [esp + 0x24]
add esp, 0x10
push dword [esp + 0x20]
push ebp
call fcn.004f33b0
inc edi
inc esi
shr ebx, 1
cmp esi, 0x5a
jle 0x4da5b5
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x4da930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4da940
sub esi, ecx
test esi, esi
jle 0x4da95a
mov al, byte [esi + ebx - 1]
cmp al, 0x2f
je 0x4da959
cmp al, 0x5c
jne 0x4da95a
dec esi
cmp esi, 1
jl 0x4daa01
cmp esi, 2
jne 0x4da9a5
movsx eax, byte [ebx]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
add esp, 4
test eax, eax
je 0x4da9a5
cmp byte [ebx + 1], 0x3a
jne 0x4da9a5
movzx eax, byte [ebx]
mov esi, 3
mov byte [esp + 0xc], al
lea ebx, [esp + 0xc]
mov ax, word [0x570510]
mov word [esp + 0xd], ax
movzx eax, byte [0x570512]
mov byte [esp + 0xf], al
push edi
push 0
push 0
push esi
push ebx
call fcn.004d4690
lea edi, [eax + 1]
lea ecx, [edi + edi]
push ecx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
push edi
push eax
push esi
push ebx
mov dword [0x59cabc], eax
call fcn.004d4690
mov ecx, dword [0x59cabc]
add esp, 0x28
xor edx, edx
mov word [ecx + eax*2], dx
push dword [0x59cabc]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
je 0x4daa01
test al, 0x10
je 0x4daa01
pop esi
mov eax, 1
pop ebx
ret 4
pop esi
xor eax, eax
pop ebx
ret 4

Function at 0x4db0f0
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4db100
push 0
sub esi, ecx
push 0
push esi
push ebx
call fcn.004d4690
lea edi, [eax + 1]
lea ecx, [edi + edi]
push ecx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
push edi
push eax
push esi
push ebx
mov dword [0x59cabc], eax
call fcn.004d4690
mov ecx, dword [0x59cabc]
xor edx, edx
mov word [ecx + eax*2], dx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
add esp, 0x2c
pop edi
pop esi
pop ebx
ret 8
Function at 0x4db160
Capabilities:
Get hostname

Disassembly:
sub esp, 0x68
mov eax, dword [0x598b80]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [0x59cb08]
push esi
mov esi, dword [esp + 0x70]
test eax, eax
jne 0x4db194
push str.Rpcrt4.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x59cb08], eax
test eax, eax
je 0x4db21f
push str.UuidCreate
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x4db21f
lea ecx, [esp + 0x38]
push ecx
call eax
test eax, eax
je 0x4db1bd
cmp eax, 0x720
je 0x4db1bd
cmp eax, 0x6cb
jne 0x4db21f
movzx eax, byte [esp + 0x47]
mov ecx, dword [esp + 0x44]
push eax
movzx eax, byte [esp + 0x4a]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, byte [esp + 0x53]
push eax
movzx eax, byte [esp + 0x56]
push eax
movzx eax, byte [esp + 0x59]
push eax
movzx eax, byte [esp + 0x5c]
push eax
movzx eax, word [esp + 0x5e]
push eax
movzx eax, word [esp + 0x60]
push eax
push dword [esp + 0x60]
push str._08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x25
push esi
call fcn.004e0780
add esp, 0x38
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00515f8b
add esp, 0x68
ret 4
push ebx
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ebx, eax
mov dword [esp + 0x10], edx
mov eax, edx
mov dword [esp + 0x3c], ebx
mov ecx, ebx
mov dword [esp + 0xc], ebx
shrd ecx, eax, 8
mov eax, edx
add esp, 4
mov dword [esp + 0x34], ecx
mov ecx, ebx
shrd ecx, eax, 0x10
mov eax, ebx
shrd eax, edx, 0x18
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov dword [esp + 0x10], 0x10
sar eax, 8
lea ebx, [esp + 8]
mov dword [esp + 0x24], eax
mov eax, ecx
sar eax, 0x10
mov dword [esp + 0x20], eax
mov eax, ecx
sar eax, 0x18
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
shr eax, 8
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
shr eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x60]
mov dword [esp + 0x2c], ecx
push eax
shr ebx, 0x18
call dword [sym.imp.kernel32.dll_GetComputerNameA]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x58], eax
movzx eax, byte [esp + 0x5b]
push eax
movzx eax, byte [esp + 0x5e]
push eax
movzx eax, byte [esp + 0x61]
push eax
movzx eax, byte [esp + 0x64]
push eax
mov eax, dword [esp + 0x24]
movzx eax, al
push ebx
push eax
mov eax, dword [esp + 0x30]
movzx eax, al
push eax
lea eax, [esp + 0x24]
movzx eax, al
push eax
mov eax, dword [esp + 0x3c]
movzx eax, al
push eax
mov eax, dword [esp + 0x44]
movzx eax, al
push eax
mov eax, dword [esp + 0x4c]
movzx eax, al
push eax
mov eax, dword [esp + 0x54]
movzx eax, al
push eax
mov eax, dword [esp + 0x5c]
movzx eax, al
push eax
mov eax, dword [esp + 0x64]
movzx eax, al
push eax
mov eax, dword [esp + 0x6c]
movzx eax, al
push eax
mov eax, dword [esp + 0x74]
movzx eax, al
push eax
push str._02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x25
push esi
call fcn.004e0780
mov ecx, dword [esp + 0xb8]
add esp, 0x4c
pop ebx
pop esi
xor ecx, esp
call fcn.00515f8b
add esp, 0x68
ret 4
Function at 0x4db460
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x4db47e
push dword [esp + 4]
push str.open__s
push dword [esp + 0x14]
push eax
call fcn.004e0780
add esp, 0x10
push 5
push 0
push 0
push dword [esp + 0x10]
push str.open
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov ecx, 0x20
cmp ecx, eax
sbb eax, eax
neg eax
ret 0xc

Function at 0x4db4e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x59cb0c]
test eax, eax
jne 0x4db4fc
push 0x1000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x59cb0c], eax
cmp byte [esp + 8], 0
mov ecx, 0x1a
push eax
push 0
push 0
mov eax, 0x23
cmovne eax, ecx
push eax
push 0
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
test eax, eax
je 0x4db525
xor eax, eax
ret 0x10
push ebx
push ebp
mov ebp, dword [0x59cb0c]
push esi
push edi
mov edi, ebp
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4db534
sub edi, ecx
sar edi, 1
push edi
push ebp
push 0
push 0
call fcn.004d45e0
lea esi, [eax + 1]
push esi
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
push edi
push ebp
mov ebx, eax
push esi
push ebx
call fcn.004d45e0
mov edx, dword [0x59cb0c]
add esp, 0x28
mov ecx, ebx
sub edx, ebx
mov byte [eax + ebx], 0
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4db576
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [esp + 0x20]
add esp, 4
test esi, esi
je 0x4db59a
cmp byte [esi], 0
jne 0x4db59f
mov esi, str.unknown
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4db5ac
cmp byte [edi], 0
jne 0x4db5b1
mov edi, str.unknown
mov ebx, dword [0x59cb0c]
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4db5c0
sub ecx, edx
mov edx, ebx
lea ebp, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4db5d0
push edi
push esi
sub edx, ebp
mov eax, 0x800
sub eax, ecx
push str.__s__s.prefs
push eax
lea eax, [edx + ebx]
push eax
call fcn.004e0780
mov edx, dword [0x59cb0c]
add esp, 0x14
mov ecx, edx
mov al, byte [edx]
pop edi
pop esi
pop ebp
pop ebx
test al, al
je 0x4db615
cmp al, 0x5c
jne 0x4db60d
mov byte [ecx], 0x2f
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4db606
mov eax, edx
ret 0x10
Function at 0x4db680
Capabilities:
Move file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4db690
push 0
sub esi, ecx
push 0
push esi
push ebx
call fcn.004d4690
lea edi, [eax + 1]
lea ecx, [edi + edi]
push ecx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
push edi
push eax
push esi
push ebx
mov dword [0x59cabc], eax
call fcn.004d4690
mov ecx, dword [0x59cabc]
add esp, 0x28
mov ebx, dword [esp + 0x14]
xor edx, edx
mov edi, ebx
mov word [ecx + eax*2], dx
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x4db6e0
push 0
sub edi, ecx
push 0
push edi
push ebx
call fcn.004d4690
lea esi, [eax + 1]
lea ecx, [esi + esi]
push ecx
push dword [0x59cac0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
push esi
push eax
push edi
push ebx
mov dword [0x59cac0], eax
call fcn.004d4690
mov ecx, dword [0x59cac0]
xor edx, edx
mov word [ecx + eax*2], dx
push dword [0x59cac0]
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
add esp, 0x30
pop edi
pop esi
pop ebx
ret 8

Function at 0x4db740
Capabilities:
Delete directory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4db750
push 0
sub esi, ecx
push 0
push esi
push ebx
call fcn.004d4690
lea edi, [eax + 1]
lea ecx, [edi + edi]
push ecx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
push edi
push eax
push esi
push ebx
mov dword [0x59cabc], eax
call fcn.004d4690
mov ecx, dword [0x59cabc]
xor edx, edx
mov word [ecx + eax*2], dx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]
add esp, 0x2c
pop edi
pop esi
pop ebx
ret 4

Function at 0x4db7b0
Capabilities:
Execute command

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4db7c0
push 0
sub esi, ecx
push 0
push esi
push ebx
call fcn.004d4690
lea edi, [eax + 1]
lea ecx, [edi + edi]
push ecx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
push edi
push eax
push esi
push ebx
mov dword [0x59cabc], eax
call fcn.004d4690
mov ecx, dword [0x59cabc]
xor edx, edx
mov word [ecx + eax*2], dx
push dword [0x59cabc]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
add esp, 0x2c
pop edi
pop esi
pop ebx
ret 4
Function at 0x4dbf20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0x1c]
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ebx
push edi
mov edi, dword [eax + 0x24]
lea eax, [ecx + 7]
cdq
and edx, 7
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebx
lea ebp, [edx + eax]
lea eax, [ecx + 0xf]
sar ebp, 3
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add eax, eax
mov dword [esp + 0x18], eax
imul eax, ebx
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, eax
test ebx, ebx
jle 0x4dbfc3
mov dword [esp + 0x10], ebx
nop dword [eax + eax]
test ebp, ebp
jle 0x4dbfac
mov ebx, ebp
movzx esi, byte [edi]
inc edi
mov eax, esi
shr esi, 4
and eax, 0xf
mov dl, byte [eax + 0x598a98]
mov al, byte [esi + 0x598a98]
xor al, dl
and al, 0xf
xor al, dl
mov byte [ecx], al
inc ecx
sub ebx, 1
jne 0x4dbf86
mov eax, dword [esp + 0x18]
sub eax, ebp
add ecx, eax
sub dword [esp + 0x10], 1
jne 0x4dbf80
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
push 1
push 1
push ebx
push dword [esp + 0x30]
call dword [sym.imp.gdi32.dll_CreateBitmap]
push dword [esp + 0x14]
mov esi, eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, dword [esp + 0x2c]
add esp, 4
pop edi
mov dword [eax + 0x2c], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x4e3680
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x4e36b4
push esi
call fcn.004e3870
add esp, 4
cmp byte [esi + 0x40], 0
je 0x4e36ab
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x4e36bb
cmp eax, 0xcb
jne 0x4e3733
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x4e371e
mov eax, dword [esi + 8]
test eax, eax
je 0x4e36d6
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x4e3719
cmp eax, 2
je 0x4e371e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4e36c7
cmp eax, 3
je 0x4e36fe
cmp eax, 1
jne 0x4e36c7
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x4e36c7
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x4e36c7
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.004e3770
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x4e3755
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.004e3770
add esp, 4
pop edi
pop esi
ret

Function at 0x4e3770
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x4e379f
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x4e3822
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x4e37f6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4e37d5
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x4e3839
cmp eax, dword [esi + 0x60]
jb 0x4e37b7
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x4e37b0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x4f1b40
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x10]
mov edx, 0x40000000
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esi], 0
mov eax, edi
sub eax, ecx
cmp eax, 0x40000000
cmova eax, edx
push eax
lea eax, [ecx + ebp]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
test eax, eax
jle 0x4f1b93
mov ecx, dword [esi]
mov edx, 0x40000000
add ecx, eax
mov dword [esi], ecx
cmp ecx, edi
jb 0x4f1b61
test eax, eax
jns 0x4f1bb7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
push eax
push 0xffffffffffffffff
push ebx
call fcn.004f13b0
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test eax, eax
jne 0x4f1bc2
mov dword [ebx + 0x40], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x4f3d30
Capabilities:
Log keystrokes via polling

Disassembly:
push dword [esp + 4]
call fcn.004f3d50
add esp, 4
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xfffffffe
ret 4

Function at 0x4f3de0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x598b80]
xor eax, esp
mov dword [esp + 0x100], eax
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push dword [esp + 0x108]
call fcn.004f3d50
mov ecx, dword [esp + 0x104]
add esp, 4
xor ecx, esp
movzx eax, byte [esp + eax]
and eax, 0xfffffffe
call fcn.00515f8b
add esp, 0x104
ret 4
Function at 0x4f59c0
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov dword [edi + 4], 0
call fcn.0048bd90
push 0x54
push edi
mov dword [esp + 0x14], eax
call fcn.00507a70
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4f5a07
push edi
call fcn.00495cc0
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], esi
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 8
mov dword [esi], fcn.004f5770
mov dword [esi + 4], fcn.004f55f0
mov dword [esi + 8], fcn.004f56c0
mov dword [esi + 0xc], fcn.004f5540
mov dword [esi + 0x10], 0x4f5e10
mov dword [esi + 0x14], 0x4f5da0
mov dword [esi + 0x18], 0x4f5c00
mov dword [esi + 0x1c], 0x4f5400
mov dword [esi + 0x20], 0x4f52b0
mov dword [esi + 0x24], 0x4f5af0
mov dword [esi + 0x28], 0x4f5e80
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x4f5ae9
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0x78
push ecx
lea ecx, [esp + 0xc]
push ecx
push str._ld_c
push eax
call fcn.00494410
add esp, 0x10
test eax, eax
jle 0x4f5ae9
mov al, byte [esp + 0x10]
cmp al, 0x6d
je 0x4f5ad8
cmp al, 0x4d
mov eax, dword [esp + 8]
jne 0x4f5ae0
imul eax, dword [esp + 8], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ecx
ret
Function at 0x4fc5d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov esi, dword [edi + 0x4c]
cmp esi, 1
mov ebp, dword [edi + 0x1c0]
sete al
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esi
mov byte [ebp + 0x1c], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x4fc6ff
nop dword [eax]
mov ecx, dword [ebp + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
cmp esi, 1
jne 0x4fc64e
mov eax, dword [ebp + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [ebp + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x4fc694
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x4fc682
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x18]
cmp esi, 0xff
jle 0x4fc670
mov esi, dword [esp + 0x1c]
cmp esi, 1
jne 0x4fc6e1
mov ecx, esi
lea edx, [ebp - 1]
nop
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x4fc6c0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
jl 0x4fc630
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret