joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48eda0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x48edd1
dec al
je 0x48ee0d
dec al
je 0x48ee51
dec al
je 0x48eebc
jmp 0x48ef46
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x48ef46
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x48ede1
jmp 0x48ef46
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48ef46
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x48ee1d
jmp 0x48ef46
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48ef46
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x48ee7f
xor ebp, ebp
jmp 0x48ee90
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x48ee99
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x48ee61
jmp 0x48ef46
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48ef46
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x48ef14
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0048c348
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x48eed0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x493f40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x493f91
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x493f78
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x493f68
jmp 0x493f91
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x493f79
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1460
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0041af50
mov esi, eax
xor eax, eax
push ebp
push 0x4a14da
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x4a14be
mov edx, ebx
mov eax, esi
call fcn.0041ab50
test byte [eax + 0x58], 1
je 0x4a14b8
push 0
mov edx, ebx
mov eax, esi
call fcn.0041ab50
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.0041aa40
dec ebx
cmp ebx, 0xffffffff
jne 0x4a148c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a14e1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0041afb4
ret

Function at 0x4a4a00
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a4a2e
mov eax, ebx
call fcn.004a54b4
cmp dword [ebx + 0x40], 0
je 0x4a4a27
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a4a9f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a4a91
cmp dword [ebx + 8], 0
je 0x4a4a50
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a4a62
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a4a91
cmp dword [ebx + 8], 0
je 0x4a4a43
cmp eax, 3
je 0x4a4a75
dec eax
jne 0x4a4a43
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a4a43
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a4a43
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a4abd
cmp dword [ebx + 0x14], 0xcc
je 0x4a4abd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a4ac8
pop ebx
ret
Function at 0x4b65a4
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4b6652
push 0xf01ff
mov eax, ebx
call fcn.00404818
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4b6652
xor eax, eax
push ebp
push 0x4b662f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6652
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b665c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4b670a
push 0xf01ff
mov eax, ebx
call fcn.00404818
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4b670a
xor eax, eax
push ebp
push 0x4b66e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b670a
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6714
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, 0x4b6870
call fcn.004043ac
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x4b6861
push 0xf01ff
mov eax, esi
call fcn.00404818
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4b6861
xor edx, edx
push ebp
push 0x4b683e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x4b679f
mov eax, ebx
mov edx, 0x4b6880
call fcn.004043ac
jmp 0x4b6822
cmp eax, 4
jne 0x4b67b2
mov eax, ebx
mov edx, 0x4b688c
call fcn.004043ac
jmp 0x4b6822
cmp eax, 2
jne 0x4b67c5
mov eax, ebx
mov edx, 0x4b688c
call fcn.004043ac
jmp 0x4b6822
cmp eax, 3
jne 0x4b67d8
mov eax, ebx
mov edx, 0x4b688c
call fcn.004043ac
jmp 0x4b6822
cmp eax, 7
jne 0x4b67eb
mov eax, ebx
mov edx, 0x4b688c
call fcn.004043ac
jmp 0x4b6822
cmp eax, 1
jne 0x4b67fe
mov eax, ebx
mov edx, 0x4b689c
call fcn.004043ac
jmp 0x4b6822
cmp eax, 5
jne 0x4b6811
mov eax, ebx
mov edx, 0x4b688c
call fcn.004043ac
jmp 0x4b6822
cmp eax, 6
jne 0x4b6822
mov eax, ebx
mov edx, 0x4b688c
call fcn.004043ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6861
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b6950
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp bl, 0x90
jne 0x4b69a5
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x4b6990
and byte [ebp - 0x72], 0xfe
jmp 0x4b6994
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x4b6a2b
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x4b6a2b
mov eax, ebx
and eax, 0xff
bt dword [0x4e18e4], eax
jae 0x4b69fb
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.004b6904
pop ecx
cmp byte [ebp - 1], 0
je 0x4b6a26
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.004b6904
pop ecx
jmp 0x4b6a26
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.004b6904
pop ecx
cmp byte [ebp - 1], 0
je 0x4b6a26
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.004b6904
pop ecx
dec si
jne 0x4b69bb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6a34
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x4e18e4], edx
jae 0x4b6a6c
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.004b6904
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.004b6904
pop ecx
pop ebx
pop ebp
ret
Function at 0x4bdd28
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404a64
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4bdd77
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404bf8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bdd7c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4bddb4
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4bddb4
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4bddb4
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4c1b9c
Capabilities:
Set global application hook

Disassembly:
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x4c1b3c
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4e4190], eax
cmp dword [0x4e4190], 0
jne 0x4c1bc3
call fcn.0040ebb0
ret

Function at 0x4c257c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4c25e0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004045c8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004096f0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c25e7
lea eax, [ebp - 0xc]
call fcn.00404358
ret

Function at 0x4c263c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4c2698
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c2667
call fcn.0040ebb0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004029dc
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c2698
call fcn.0040ebb0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4c4cf4
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c4e29
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 4]
mov edx, 0x4c4e44
call fcn.004043f0
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 4]
call fcn.00404818
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x4c4e00
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 0xc
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
dec ebx
jne 0x4c4d5d
mov ebx, 0x400
lea eax, [ebp - 0x418]
mov byte [eax], 0
inc eax
dec ebx
jne 0x4c4d6f
push 0
lea eax, [ebp - 8]
push eax
push 0x400
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x418]
push eax
call sub.kernel32.dll_lstrcpynA_1
push eax
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_lstrcpynA_1
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4c4e00
mov ebx, 0x400
lea edi, [ebp - 0x418]
lea eax, [ebp - 0x41c]
mov dl, byte [edi]
call fcn.00404540
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0xc]
call fcn.00404620
inc edi
dec ebx
jne 0x4c4dc9
push esi
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x418]
mov edx, 0x3ff
call fcn.004c4e58
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4e30
lea eax, [ebp - 0x41c]
call fcn.00404358
lea eax, [ebp - 0xc]
call fcn.00404358
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x4c4e58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
add esp, 0xfffffbf0
mov dword [esp], eax
xor ecx, ecx
lea eax, [edx + 1]
cmp eax, 1
jl 0x4c4f0f
xor ebx, ebx
lea esi, [esp + 0x10]
mov edx, ebx
mov ecx, 8
test dl, 1
je 0x4c4e93
shr edx, 1
and edx, 0x7fffffff
xor edx, 0xedb88320
jmp 0x4c4e9b
shr edx, 1
and edx, 0x7fffffff
dec ecx
jne 0x4c4e7e
mov dword [esi], edx
inc ebx
add esi, 4
cmp ebx, 0x100
jne 0x4c4e77
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4c4f09
inc ebx
mov ecx, dword [esp]
movzx esi, byte [ecx]
mov eax, dword [esp + 8]
and eax, 0xff
xor esi, eax
mov eax, dword [esp + esi*4 + 0x10]
cdq
push edx
push eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
shrd eax, edx, 8
shr edx, 8
and eax, 0xffffff
xor edx, edx
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
inc ecx
dec ebx
jne 0x4c4ec7
mov ecx, dword [esp + 8]
not ecx
mov eax, ecx
add esp, 0x410
pop esi
pop ebx
ret
Function at 0x4c4fe0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c5090
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xc8
mov eax, ebx
call fcn.00404358
mov eax, dword [ebp - 8]
call fcn.00402768
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407890
xor eax, eax
push ebp
push 0x4c5073
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4c505d
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404550
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.0040914c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004043ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c507a
mov eax, dword [ebp - 4]
call fcn.00402788
ret

Function at 0x4c509c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov dword [ebp - 4], 0xff
mov ebx, 0x4c50d8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x103]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4c50cc
lea ebx, [ebp - 0x103]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c50fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4c518c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404358
mov eax, dword [ebp - 4]
call fcn.00404618
test al, al
jbe 0x4c5176
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00404540
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404620
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp + 0x10]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x4c5138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5193
lea eax, [ebp - 0xc]
call fcn.00404358
ret
Function at 0x4c519c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4c5293
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x23456789
push 0x34567890
lea eax, [ebp - 8]
push eax
mov ecx, 0x12345678
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004c50fc
lea eax, [ebp - 0xc]
call fcn.00404358
lea eax, [ebp - 0x10]
call fcn.00404358
mov eax, dword [ebp - 8]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4c5233
mov ebx, 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
shl eax, 8
xor eax, 7
or eax, 5
call fcn.00409464
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404620
inc ebx
dec esi
jne 0x4c520b
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00404618
mov ecx, 0xc
cdq
idiv ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
imul edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404878
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00404620
inc ebx
cmp ebx, 0xc
jne 0x4c5235
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.004043ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c529a
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040437c
ret

Function at 0x4c6408
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407890
ret

Function at 0x4c7be8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov ebx, edx
shl ebx, 2
add ebx, eax
mov eax, ebx
call fcn.00405b90
test eax, eax
je 0x4c7c28
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov dword [ebx], esi
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
push 4
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop esi
pop ebx
ret

Function at 0x4c7cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.004029dc
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4c8240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov eax, dword [0x4e454c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4c8283
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x4e454c]
call fcn.0041ab50
mov ebx, eax
mov eax, dword [esp]
cmp eax, dword [ebx]
jne 0x4c827f
mov eax, dword [ebx + 4]
jmp 0x4c8349
inc edi
dec esi
jne 0x4c8262
mov edi, dword [esp]
mov ebx, edi
xor esi, esi
mov edx, ebp
mov eax, ebx
call fcn.004c7ee8
test al, al
jne 0x4c829b
mov byte [ebp], 1
xor eax, eax
mov al, byte [ebp]
add esi, eax
xor eax, eax
mov al, byte [ebp]
add ebx, eax
cmp esi, 5
jb 0x4c828a
mov edx, esi
mov eax, edi
call fcn.004c8020
add eax, 5
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
call fcn.00402768
mov ebp, eax
mov eax, 0x14
call fcn.00402768
mov ebx, eax
mov eax, dword [esp]
mov dword [ebx], eax
mov dword [ebx + 4], ebp
mov eax, dword [esp + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], esi
mov eax, esi
call fcn.00402768
mov dword [ebx + 0xc], eax
mov edx, dword [ebx + 0xc]
mov eax, edi
mov ecx, esi
call fcn.004029dc
mov edx, ebx
mov eax, dword [0x4e454c]
call fcn.0041a9f4
lea eax, [esp + 0xc]
push eax
push 0x40
mov eax, dword [esp + 0x10]
push eax
push ebp
call sub.kernel32.dll_VirtualProtect
mov edx, ebp
mov eax, edi
mov ecx, esi
call fcn.004029dc
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.004c80bc
lea edx, [esi + edi]
lea eax, [esi + ebp]
call fcn.004c7d30
mov edx, dword [esp + 4]
mov eax, edi
call fcn.004c7d30
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c85a8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.004c7b98
test al, al
je 0x4c85ec
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4c85ec
cmp dword [eax + 0x3c], 0
je 0x4c85ec
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.004c7b98
test al, al
je 0x4c85ea
cmp dword [esi], 0x4550
je 0x4c85ec
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4ccd30
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.0040a108
add esp, 0x108
pop ebx
ret

Function at 0x4ccd58
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040a108
add esp, 0x108
pop ebx
ret