joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8272
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
push 0x40
push 0x56a7f1
push dword [ebp + 8]
call fcn.005541f4
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x4c829a
xor eax, eax
jmp 0x4c849b
push 0x1000
push 0
push 0
push esi
call fcn.00552f84
add esp, 0x10
lea edx, [ebp - 0x2c]
push edx
push dword [ebp + 8]
call fcn.0055482c
add esp, 8
test eax, eax
je 0x4c82cd
push esi
call fcn.005516ec
pop ecx
xor eax, eax
jmp 0x4c849b
imul ecx, dword [0x56a720], 0x3e8
cmp ecx, dword [ebp - 0x1a]
jl 0x4c82ed
push esi
call fcn.005516ec
pop ecx
mov eax, 1
jmp 0x4c849b
mov eax, ecx
mov ebx, 3
cdq
idiv ebx
sub ecx, eax
mov eax, dword [ebp - 0x1a]
sub eax, ecx
mov ecx, eax
push 0
push ecx
push esi
call fcn.00551ee4
add esp, 0xc
test eax, eax
je 0x4c831e
push esi
call fcn.005516ec
pop ecx
xor eax, eax
jmp 0x4c849b
push 0
push 0
push 0x588ae3
push 0x588ae0
push dword [ebp + 8]
call fcn.0050e5fc
add esp, 0x14
push 0
call fcn.00553350
pop ecx
push eax
push 0x588ae3
push 0x588ae0
push 0x56a7f4
push 0x582088
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 0x40
push 0x56a7fc
push 0x582088
call fcn.005541f4
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4c8384
push esi
call fcn.005516ec
pop ecx
xor eax, eax
jmp 0x4c849b
push 0x1000
push 0
push 0
push edi
call fcn.00552f84
add esp, 0x10
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x4c8472
push esi
push pe_nt_image_headers32
push 1
push 0x57cddf
call fcn.00551e44
add esp, 0x10
mov ecx, eax
test ecx, ecx
jg 0x4c83f2
test byte [esi + 0x12], 0x10
je 0x4c8472
push edi
call fcn.005516ec
pop ecx
push esi
call fcn.005516ec
pop ecx
push 0x582088
call sub.KERNEL32.dll_DeleteFileA
xor eax, eax
jmp 0x4c849b
cmp ecx, 0x200
jge 0x4c83ff
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
je 0x4c8435
xor eax, eax
mov edx, 0x57cddf
cmp ecx, eax
jle 0x4c841b
cmp byte [edx], 0xa
je 0x4c841b
inc eax
inc edx
cmp ecx, eax
jg 0x4c8410
cmp byte [eax + 0x57cddf], 0xa
jne 0x4c83a4
mov edx, 0x57cde0
add edx, eax
inc eax
sub ecx, eax
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4c843a
mov edx, 0x57cddf
push edi
push 1
push ecx
push edx
call fcn.00551fe4
add esp, 0x10
cmp eax, 1
je 0x4c8468
push edi
call fcn.005516ec
pop ecx
push esi
call fcn.005516ec
pop ecx
push 0x582088
call sub.KERNEL32.dll_DeleteFileA
xor eax, eax
jmp 0x4c849b
cmp dword [ebp - 8], 0
jne 0x4c83ae
push edi
call fcn.005516ec
pop ecx
push esi
call fcn.005516ec
pop ecx
push 0
push dword [ebp + 8]
push 0x582088
call sub.KERNEL32.dll_CopyFileA
push 0x582088
call sub.KERNEL32.dll_DeleteFileA
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c8a07
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4c8c3a
cmp byte [ebx], 0
je 0x4c8c3a
cmp dword [0x56a710], 0
je 0x4c8b59
cmp byte [edi + 0x1814], 0
je 0x4c8b59
test esi, esi
je 0x4c8a56
cmp esi, 1
je 0x4c8a56
cmp esi, 2
jne 0x4c8b59
push 0x588ce3
push 0x588be3
push 0x588ae3
push 0x588ae0
push ebx
call fcn.0050e5fc
add esp, 0x14
cmp byte [0x588be3], 0
jne 0x4c8a89
cmp byte [0x588ce3], 0
je 0x4c8c3a
mov byte [ebx], 0
cmp dword [0x56a714], 0
je 0x4c8b2b
cmp dword [ebp + 0x10], 0
je 0x4c8b02
lea eax, [edi + 0x1814]
push eax
push 0x588ae3
push 0x588ae0
push 0x56a84c
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
push 2
push ebx
call fcn.0042cbc2
test eax, eax
je 0x4c8afd
push 0x588ce3
push 0x588be3
lea edx, [edi + 0x1814]
push edx
push 0x588ae3
push 0x588ae0
push 0x56a854
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x1c
jmp 0x4c8b2b
mov byte [ebx], 0
jmp 0x4c8b2b
push 0x588ce3
push 0x588be3
lea ecx, [edi + 0x1814]
push ecx
push 0x588ae3
push 0x588ae0
push str._s_s_s_s_s
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x1c
cmp byte [ebx], 0
jne 0x4c8b59
push 0x588ce3
add edi, 0x1814
push edi
push 0x588be3
push 0x588ae3
push 0x588ae0
push str._s_s_s._s_s
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x1c
cmp dword [0x56a704], 0
je 0x4c8c3a
cmp dword [0x56a718], 0
je 0x4c8b77
test esi, esi
je 0x4c8c3a
push 0x588ce3
push 0x588be3
push 0x588ae3
push 0x588ae0
push ebx
call fcn.0050e5fc
add esp, 0x14
cmp byte [0x588be3], 0
jne 0x4c8baa
cmp byte [0x588ce3], 0
je 0x4c8c3a
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetLocalTime
cmp dword [0x56c294], 0
jle 0x4c8c09
cmp word [ebp - 0xa], 1
jae 0x4c8bff
mov word [ebp - 0xa], 1
jmp 0x4c8bff
mov edx, dword [0x56c294]
cmp edx, 1
jne 0x4c8bf0
cmp ax, 1
je 0x4c8c09
cmp ax, 7
je 0x4c8c09
cmp ax, 0xe
je 0x4c8c09
cmp ax, 0x15
je 0x4c8c09
jmp 0x4c8bfb
cmp edx, 2
jne 0x4c8bfb
cmp ax, 1
je 0x4c8c09
dec word [ebp - 0xa]
mov ax, word [ebp - 0xa]
cmp ax, 1
jae 0x4c8bcb
push 0x588ce3
movzx edx, word [ebp - 0xa]
push edx
movzx ecx, word [ebp - 0xe]
push ecx
movzx eax, word [ebp - 0x10]
push eax
push 0x588be3
push 0x588ae3
push 0x588ae0
push str._s_s_s._04d_02d_02d_s
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c8c43
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [0x56f010]
test ebx, ebx
je 0x4c8c9e
cmp dword [ebx + 0x66c], 0
je 0x4c8c94
mov eax, dword [ebx + 0x6bc]
test eax, eax
je 0x4c8c79
cmp eax, 1
je 0x4c8c79
cmp eax, 2
jne 0x4c8c94
mov eax, dword [ebx + 0x670]
test eax, eax
jl 0x4c8c94
push eax
call fcn.005516dc
pop ecx
mov dword [ebx + 0x670], 0xffffffff
mov ebx, dword [ebx + 0xd3c]
test ebx, ebx
jne 0x4c8c5c
mov ebx, dword [0x56f010]
test ebx, ebx
je 0x4c8e0d
cmp dword [ebx + 0x66c], 0
je 0x4c8dff
mov eax, dword [ebx + 0x6bc]
test eax, eax
je 0x4c8cd1
cmp eax, 1
je 0x4c8cd1
cmp eax, 2
jne 0x4c8dc5
lea edx, [ebx + 0x568]
push edi
mov edi, edx
lea esi, [ebp - 0x104]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push dword [ebx + 0xb6c]
push 1
push dword [ebx + 0x6bc]
lea eax, [ebp - 0x104]
push eax
call fcn.004c8a07
lea edx, [ebp - 0x104]
push edx
lea esi, [ebx + 0x464]
push esi
call fcn.0054e450
add esp, 8
test eax, eax
je 0x4c8dff
test edi, edi
je 0x4c8d8c
push 0
push ebx
call fcn.004c8620
push 1
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.0042d3d9
test eax, eax
jne 0x4c8d5b
push esi
call sub.KERNEL32.dll_DeleteFileA
push esi
push edi
lea edi, [ebp - 0x104]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0
push ebx
call fcn.004c84a4
jmp 0x4c8dff
push 1
push ebx
call fcn.004c8620
push esi
push edi
lea edi, [ebp - 0x104]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 1
push ebx
call fcn.004c84a4
jmp 0x4c8dff
push 0
call fcn.0055ca2c
pop ecx
push eax
call fcn.00512a24
push eax
push 0
push 0xe85
call fcn.0042c771
push eax
lea eax, [ebp - 0x104]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 1
lea edx, [ebp - 0x104]
push edx
push ebx
call fcn.004c86d8
mov ebx, dword [ebx + 0xd3c]
test ebx, ebx
jne 0x4c8cac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c9437
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x14b
push 0x67
push ebx
call sub.USER32.dll_SendDlgItemMessageA
push 0x582088
push 0x180
push 0xd
push 0x193
push dword [0x56c1fc]
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x582088], 0
jne 0x4c94a3
mov esi, 0x582088
mov edi, 0x583780
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x582088
push 0x56a902
push 0x585ce2
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.Main_folder
push 0
push 0x143
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
lea eax, [ebp - 0x140]
push eax
push 0x585ce2
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c94f0
mov edi, 1
jmp 0x4c9598
xor edi, edi
jmp 0x4c9598
test byte [ebp - 0x140], 0x10
je 0x4c9509
cmp byte [ebp - 0x114], 0x2e
jne 0x4c9521
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9598
mov edi, 1
jmp 0x4c9598
push esi
push edi
mov esi, 0x585ce2
lea edi, [ebp - 0x114]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x585ce2
push 0
push 0x158
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
inc eax
jne 0x4c9582
push 0x585ce2
push 0
push 0x143
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
je 0x4c95a0
cmp eax, 0xfffffffe
je 0x4c95a0
lea eax, [ebp - 0x140]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4c9598
mov edi, 1
test edi, edi
je 0x4c94f7
cmp esi, 0xffffffff
je 0x4c95ab
push esi
call sub.KERNEL32.dll_FindClose
push 0
push 0
push 0x146
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
jne 0x4c95c3
xor eax, eax
mov edx, dword [0x56a73c]
test edx, edx
jl 0x4c95d1
cmp eax, edx
jge 0x4c95d9
xor ecx, ecx
mov dword [0x56a73c], ecx
push 0
push dword [0x56a73c]
push 0x14e
push 0x6c
push ebx
call sub.USER32.dll_SendDlgItemMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cb825
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4

Function at 0x4cec2e
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x579f7a
call fcn.004cf8ff
push 2
push dword [0x56aa64]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x7c
jne 0x4cec6b
cmp dword [0x55f2c4], 0
je 0x4cec95
push 0x400
push 2
push dword [0x56aa64]
call sub.USER32.dll_DeleteMenu
jmp 0x4cec95
cmp dword [0x55f2c4], 0
jne 0x4cec95
push 0
push 0xefc
call fcn.0042c771
push eax
push 0x7c
push 0x400
push 2
push dword [0x56aa64]
call sub.USER32.dll_InsertMenuA
push dword [0x56aa64]
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
dec ebx
test ebx, ebx
jle 0x4cecd0
push ebx
push dword [0x56aa64]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x82
je 0x4cecd0
push 0x400
push ebx
push dword [0x56aa64]
call sub.USER32.dll_DeleteMenu
dec ebx
test ebx, ebx
jg 0x4ceca7
cmp dword [0x56f010], 0
je 0x4cedc7
push 0x56acf9
push 0
push 0x800
push dword [0x56aa64]
call sub.USER32.dll_AppendMenuA
mov ebx, 1
mov edi, 0x320
mov esi, dword [0x56f010]
test esi, esi
je 0x4cedc7
cmp dword [esi + 0x6bc], 0
jne 0x4ced20
push 4
push ebp
push esi
call fcn.004bd6e1
jmp 0x4ced2a
push 0x3c
push ebp
push dword [esi]
call sub.USER32.dll_GetWindowTextA
push ebp
call fcn.0054e28c
pop ecx
cmp eax, 0x32
jbe 0x4ced45
push esi
push edi
mov esi, 0x56acfd
lea edi, [ebp + 0x32]
mov eax, edi
movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp ebx, 1
jl 0x4ced65
cmp ebx, 9
jg 0x4ced65
push ebp
push ebx
push 0x56ad02
push 0x57a361
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x4ced92
cmp ebx, 0xa
jne 0x4ced7f
push ebp
push str.0__s
push 0x57a361
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x4ced92
push ebp
push str.____s
push 0x57a361
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov edx, dword [0x56f024]
cmp edx, dword [esi]
jne 0x4ceda3
mov eax, 8
jmp 0x4ceda5
xor eax, eax
push 0x57a361
push edi
push eax
push dword [0x56aa64]
call sub.USER32.dll_AppendMenuA
inc ebx
inc edi
mov esi, dword [esi + 0xd3c]
test esi, esi
jne 0x4ced0c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cf0a7
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
call fcn.004cf8ff
push dword [0x56aa68]
call sub.USER32.dll_GetMenuItemCount
mov ebx, eax
lea eax, [ebx - 1]
push eax
push dword [0x56aa68]
call sub.USER32.dll_GetMenuItemID
cmp eax, 0x86
jne 0x4cf0e0
mov esi, 5
jmp 0x4cf0e5
mov esi, 4
cmp esi, ebx
jge 0x4cf100
push 0x400
push 3
push dword [0x56aa68]
call sub.USER32.dll_DeleteMenu
dec ebx
cmp esi, ebx
jl 0x4cf0e9
xor ebp, ebp
mov dword [esp + 4], 1
cmp dword [esp + 4], 1
jne 0x4cf139
push 0x581f80
push 0x56ad24
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x57a361
push 0xf11
call fcn.0042c771
jmp 0x4cf199
cmp dword [esp + 4], 3
jne 0x4cf168
push 0x581f80
push str._s.txt
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x57a361
push 0xf12
call fcn.0042c771
jmp 0x4cf199
cmp dword [esp + 4], 4
jne 0x4cf2e2
push 0x581f80
push str._s.htm
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x57a361
push 0xf22
call fcn.0042c771
call sub.USER32.dll_CreatePopupMenu
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4cf2e2
xor eax, eax
mov dword [esp], eax
lea edx, [esp + 0xc]
push edx
push 0x579f7a
call sub.KERNEL32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4cf1cf
mov edi, 1
jmp 0x4cf239
xor edi, edi
jmp 0x4cf239
test byte [esp + 0xc], 0x10
je 0x4cf1f0
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4cf239
mov edi, 1
jmp 0x4cf239
lea eax, [esp + 0x38]
push eax
call fcn.00556250
pop ecx
xor edx, edx
mov dl, byte [esp + 0x38]
push edx
call fcn.005562c4
pop ecx
mov byte [esp + 0x38], al
push 0
lea ecx, [esp + 0x3c]
push ecx
push dword [esp + 8]
call fcn.004c6a18
mov ebx, eax
test ebx, ebx
je 0x4cf225
mov dword [esp], ebx
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4cf239
mov edi, 1
test edi, edi
je 0x4cf1d3
cmp esi, 0xffffffff
je 0x4cf248
push esi
call sub.KERNEL32.dll_FindClose
cmp dword [esp + 4], 1
jne 0x4cf273
mov dword [esp + 4], 2
push 0x581f80
push str._s.chm
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x4cf1b2
push 0
push 0
push dword [esp + 8]
call fcn.0050cb45
mov dword [esp], eax
xor esi, esi
mov ebx, dword [esp]
test ebx, ebx
je 0x4cf2a9
push dword [ebx]
lea eax, [ebp + 0x12c]
push eax
push 0
push dword [esp + 0x14]
call sub.USER32.dll_AppendMenuA
inc esi
inc ebp
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4cf28c
push esp
call fcn.004c6e49
test esi, esi
je 0x4cf2d0
push 0x57a361
push dword [esp + 0xc]
push 0x10
push 0x85
push dword [0x56aa68]
call sub.USER32.dll_InsertMenuA
jmp 0x4cf2d9
push dword [esp + 8]
call sub.USER32.dll_DestroyMenu
inc dword [esp + 4]
jmp 0x4cf10a
test ebp, ebp
jle 0x4cf302
push 0x56ad48
push 0
push 0x800
push 0x85
push dword [0x56aa68]
call sub.USER32.dll_InsertMenuA
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d1a5e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0x96
push 0x57a361
push ebx
push dword [0x56aa6c]
call sub.USER32.dll_GetMenuStringA
test eax, eax
jle 0x4d1c38
cmp ebx, 0x513
jne 0x4d1ad6
push edi
call fcn.00411de0
mov edi, eax
test edi, edi
je 0x4d1c38
push edi
push 0
push 0
push 0
push 0x56ae8e
call fcn.0052637f
mov ebx, eax
mov dword [edi], ebx
push ebx
call fcn.0051fafa
test eax, eax
jne 0x4d1acc
push edi
call fcn.00412479
jmp 0x4d1c38
mov eax, 1
jmp 0x4d1c41
call fcn.00505c4c
mov esi, dword [0x56dba0]
test esi, esi
je 0x4d1b77
mov eax, dword [esi]
push esi
push edi
mov esi, 0x579f7a
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x56ae9d
push 0x579f7a
call fcn.0054e5a0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4d1b6c
mov byte [ebx], 0
jmp 0x4d1b33
mov byte [ebx], 0x2c
push 0x3a
push 0x579f7a
call fcn.0054e1ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d1b30
mov ebx, 0x579f7a
jmp 0x4d1b50
inc ebx
cmp byte [ebx], 0x2e
je 0x4d1b4f
cmp byte [ebx], 0
je 0x4d1b6c
push 0x57a361
push ebx
call fcn.0054e450
add esp, 8
test eax, eax
je 0x4d1b77
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x4d1ae9
test esi, esi
je 0x4d1c38
cmp dword [0x56c21c], 0
je 0x4d1bba
push 0
push 1
push dword [esi]
push dword [0x56dba0]
call fcn.004c6b3f
mov esi, eax
test esi, esi
je 0x4d1c38
mov eax, esi
mov dword [0x56dba0], eax
push eax
push 0x56aea6
push 0x588074
call fcn.004acf4c
push 0x10
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x4d1c05
push edi
call fcn.00411de0
mov edi, eax
test edi, edi
je 0x4d1c38
push edi
push 0
push 0
push 0
push 0x56aeb1
call fcn.0052637f
mov ebx, eax
mov dword [edi], ebx
push ebx
call fcn.0051fafa
test eax, eax
jne 0x4d1c05
push edi
call fcn.00412479
jmp 0x4d1c38
lea eax, [edi + 0xc]
push eax
call fcn.004c6e49
push 0
push dword [esi]
push 0
call fcn.004c6a18
mov dword [edi + 0xc], eax
push edi
push dword [esi]
call fcn.005065d4
mov dword [edi + 0x14], 0xc
push edi
call fcn.00458c84
mov eax, 1
jmp 0x4d1c41
push 0
call fcn.0042c6cc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4d2a51
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jg 0x4d2b0e
test esi, esi
jne 0x4d2a94
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jge 0x4d2a94
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov cl, byte [ecx + ebx]
inc dword [ebp - 0xc]
jmp 0x4d2aa1
mov esi, 1
mov dword [ebp - 4], edx
xor ecx, ecx
inc dword [ebp - 0xc]
test esi, esi
je 0x4d2aa9
test edx, edx
je 0x4d2ab9
and ecx, 0xff
shl dword [ebp - 8], 8
add edx, 8
or dword [ebp - 8], ecx
cmp edx, 6
jl 0x4d2b02
sub edx, 6
mov ecx, edx
mov ebx, dword [ebp - 8]
shr ebx, cl
mov ecx, ebx
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0x10]
mov byte [ebx + eax], cl
inc eax
cmp eax, 0x3c
jl 0x4d2ae8
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0
jmp 0x4d2b3f
cmp eax, dword [ebp + 0x14]
jl 0x4d2af7
mov eax, 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x4d2b3f
test esi, esi
je 0x4d2afd
xor edx, edx
cmp edx, 6
jge 0x4d2abe
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jle 0x4d2a7a
cmp dword [ebp - 4], 2
jne 0x4d2b26
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0x3d
inc eax
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0x3d
inc eax
jmp 0x4d2b34
cmp dword [ebp - 4], 4
jne 0x4d2b34
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0x3d
inc eax
test eax, eax
je 0x4d2b3f
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
mov edx, dword [ebp + 0x1c]
mov dword [edx], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4d3519
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
cmp dword [0x56af98], 0
jne 0x4d3549
cmp dword [0x56afa8], 0
jne 0x4d353a
cmp dword [0x56af94], 0
je 0x4d353f
call fcn.004d365f
mov eax, 1
jmp 0x4d3659
call fcn.004d3412
mov dword [esp + 4], eax
mov eax, dword [0x56af94]
test eax, eax
je 0x4d35c3
mov ebx, eax
mov esi, dword [esp + 4]
xor edi, edi
jmp 0x4d3582
push dword [esi]
push dword [ebx]
call fcn.0054e450
add esp, 8
test eax, eax
je 0x4d357c
mov edi, 1
jmp 0x4d358a
mov ebx, dword [ebx + 0x40]
mov esi, dword [esi + 0x40]
test ebx, ebx
je 0x4d358a
test esi, esi
jne 0x4d3565
lea eax, [esp + 4]
push eax
call fcn.004c6e49
test edi, edi
jne 0x4d35aa
xor edx, edx
mov dword [0x56af9c], edx
mov eax, 1
jmp 0x4d3659
mov dword [0x56af9c], 1
call fcn.004d365f
mov eax, 1
jmp 0x4d3659
xor edx, edx
mov dword [0x56af9c], edx
xor ecx, ecx
mov dword [0x56afa8], ecx
xor eax, eax
mov dword [0x56afac], eax
mov eax, dword [esp + 4]
mov dword [0x56af94], eax
test eax, eax
jne 0x4d35ee
mov eax, 1
jmp 0x4d3659
push 0
push 0
push 1
push 0
call sub.KERNEL32.dll_CreateEventA
mov ebx, eax
mov dword [0x56afac], ebx
test ebx, ebx
jne 0x4d3615
push 0x56af94
call fcn.004c6e49
xor eax, eax
jmp 0x4d3659
push esp
push 0
push 0
push 0x4d32f6
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov ebx, eax
mov dword [0x56afa8], ebx
test ebx, ebx
jne 0x4d3654
push dword [0x56afac]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [0x56afac], eax
push 0x56af94
call fcn.004c6e49
xor eax, eax
jmp 0x4d3659
mov eax, 1
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4d4535
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
or eax, 0xffffffff
mov dword [0x56bab0], eax
mov dword [0x56baac], eax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0x56baac], eax
cmp eax, 0xffffffff
jne 0x4d455f
push 0
call fcn.004d44b5
ret
mov dx, word [0x56baa8]
push edx
push dword [0x56baac]
call fcn.004f30ad
test eax, eax
jne 0x4d457e
push 0
call fcn.004d44b5
ret
push 5
push dword [0x56baac]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x4d4597
push 0
call fcn.004d44b5
ret
push 8
push 0x8034
push dword [0x56f018]
push dword [0x56baac]
call sub.WSOCK32.dll_WSAAsyncSelect
ret