joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b3a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x537bec]
cmp dword [eax + 0x30], 0
je 0x46b44e
cmp dword [ebx + 0x94], 0
jne 0x46b448
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46b334
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46b448
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46b40e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46b448
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e694
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46b41d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46bfac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46bfe1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404cec
jmp 0x46bfee
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c50
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46d1b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46d1f9
mov eax, esi
call fcn.00453004
test al, al
je 0x46d1f9
mov eax, dword [ebx + 0x84]
call fcn.00452d00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46d1f9
push 0
mov eax, dword [ebx + 0x84]
call fcn.00452d00
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46dedc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41b344]
call fcn.00405728
xor eax, eax
push ebp
push 0x46e020
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5300fc], 0
jne 0x46df2f
mov ecx, dword [0x535784]
mov dl, 1
mov eax, dword [0x40886c]
call fcn.0040e4dc
call fcn.00404550
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004035f4
mov eax, ebx
call fcn.004054dc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46e030
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406b70
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004054ec
test eax, eax
jle 0x46dfc7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46dfc0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404e94
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404e7c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409830
test eax, eax
jne 0x46dfc0
mov ebx, 0x15
jmp 0x46dfcc
mov ebx, 0x10
jmp 0x46dfcc
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5300fc]
call fcn.0046de34
mov eax, dword [ebp - 8]
call fcn.0046de34
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e027
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404c20
lea eax, [ebp - 0x10]
mov edx, dword [0x41b344]
call fcn.004057f8
ret

Function at 0x4717fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0047129c
test byte [ebx + 0x23d], 4
jne 0x471891
mov edx, esp
mov eax, ebx
call fcn.0044be80
push esp
mov eax, ebx
call fcn.00452afc
push eax
push 0
mov eax, ebx
test eax, eax
je 0x471831
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x471862
mov ecx, dword [0x535b68]
mov dl, 1
mov eax, dword [0x46daf4]
call fcn.0040e4dc
call fcn.00404550
mov eax, ebx
call fcn.00471dd0
cmp byte [ebx + 0x57], 0
jne 0x471898
mov eax, ebx
call fcn.00452d00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x471898
push 0
mov eax, ebx
call fcn.00452d00
push eax
call sub.user32.dll_ShowWindow
jmp 0x471898
mov eax, ebx
call fcn.0044fc80
add esp, 0x10
pop ebx
ret
Function at 0x47d374
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x530508], 0
mov eax, dword [0x536058]
cmp dword [eax], 2
jne 0x47d54d
mov eax, dword [0x535a48]
cmp dword [eax], 5
jl 0x47d54d
call fcn.0047a468
test al, al
jne 0x47d3a5
call fcn.0047a474
call fcn.0047a460
mov dword [0x530510], eax
push 0x47d550
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304d4], eax
cmp dword [0x5304d4], 0
jne 0x47d400
mov edx, 0x8000
mov eax, 0x47d564
call fcn.004101c4
mov dword [0x53050c], eax
mov eax, dword [0x53050c]
mov dword [0x530510], eax
push 0x47d550
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304d4], eax
cmp dword [0x5304d4], 0
je 0x47d548
push 0x47d570
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304d8], eax
cmp dword [0x5304d8], 0
je 0x47d548
push 0x47d57c
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304dc], eax
cmp dword [0x5304dc], 0
je 0x47d548
mov byte [0x530508], 1
push 0x47d58c
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304e0], eax
push 0x47d598
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304e4], eax
push 0x47d5a4
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304e8], eax
push 0x47d5b4
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304ec], eax
push 0x47d5c4
mov eax, dword [0x530510]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304f0], eax
mov edx, 0x8000
mov eax, 0x47d5dc
call fcn.004101c4
mov dword [0x530514], eax
cmp dword [0x530514], 0
je 0x47d54d
push 0x47d5ec
mov eax, dword [0x530514]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304f4], eax
push 0x47d608
mov eax, dword [0x530514]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304f8], eax
push 0x47d628
mov eax, dword [0x530514]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5304fc], eax
push 0x47d644
mov eax, dword [0x530514]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x530500], eax
push 0x47d65c
mov eax, dword [0x530514]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x530504], eax
ret
call fcn.0047d2f4
ret
Function at 0x489270
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov ebx, ecx
xor eax, eax
push ebp
push 0x489489
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax], 5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dl, byte [ebp + 0x10]
mov byte [eax + 1], dl
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 2], 0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00477f18
mov eax, dword [ebp - 8]
call fcn.00404ecc
test eax, eax
jle 0x489348
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 4], 0x10
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov edx, ebx
mov eax, dword [0x486a90]
call fcn.00486b94
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489336
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x489320
push 4
push 0x10
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00486b30
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.0047779c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48933d
lea eax, [ebp - 4]
call fcn.004100f8
ret
mov eax, dword [0x535f24]
mov eax, dword [eax]
mov edx, ebx
call fcn.0048084c
test al, al
je 0x4893ca
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 1
mov edx, ebx
mov eax, dword [0x486a90]
call fcn.00486b94
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4893b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4893a2
push 4
push 4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00486b30
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.0047779c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4893bf
lea eax, [ebp - 4]
call fcn.004100f8
ret
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 3
mov eax, ebx
call fcn.00404ecc
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov byte [edx + 4], al
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov eax, ebx
call fcn.00404ecc
test eax, eax
jle 0x48941d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov eax, ebx
call fcn.00404ecc
push eax
lea ecx, [ebp - 0x14]
mov dl, 1
mov eax, ebx
call fcn.00479264
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.0047779c
mov eax, ebx
call fcn.00404ecc
mov edx, dword [ebp + 8]
add dword [edx], eax
mov eax, dword [0x535f24]
mov eax, dword [eax]
mov dx, word [ebp + 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 2
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00479470
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.0047779c
mov eax, dword [ebp + 8]
add dword [eax], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489490
lea eax, [ebp - 0x18]
mov edx, dword [0x476de8]
mov ecx, 4
call fcn.00405844
lea eax, [ebp - 8]
call fcn.00404bfc
ret
Function at 0x499530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49958a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00499524
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004973c0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00496f9c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499591
lea eax, [ebp - 4]
call fcn.00404bfc
ret
Function at 0x4ac570
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ac7d0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4ac5d3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004ac038
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ee2c
cmp al, 1
jne 0x4ac5d3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004ac350
test al, al
je 0x4ac75f
cmp dword [ebp - 8], 0
jge 0x4ac5f1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004ac038
mov eax, dword [ebp - 0x210]
call fcn.00404ecc
cmp ebx, eax
jge 0x4ac63b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004ac038
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x536038]
and eax, 0xff
bt dword [edx], eax
jae 0x4ac63b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4ac64f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ac54c
cmp ebx, dword [ebp - 8]
je 0x4ac751
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4ac67b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fb8
and eax, 0x7f
movzx eax, word [eax*2 + 0x53166c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4ac73e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fb8
and eax, 0x7f
movzx eax, word [eax*2 + 0x53166c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00452d00
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fb8
and eax, 0x7f
movzx eax, word [eax*2 + 0x53166c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00452d00
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac745
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4ac7b2
cmp dword [ebp - 8], 0
jge 0x4ac76a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004ac038
mov eax, dword [ebp - 0x218]
call fcn.00404ecc
cmp eax, dword [ebp - 8]
jg 0x4ac7a4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004ac038
mov eax, dword [ebp - 0x21c]
call fcn.00404ecc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ac54c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac7d7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404c20
ret
Function at 0x4b70a8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x5317d8]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4b70e4
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4b70fc
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b70f5
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.004035f4
xor edx, edx
mov eax, 0x5319d8
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4b7166
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4b711a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4b73a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4b73bd
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4b73b6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4b73cf
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4b73c8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004b6f98
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b73e9
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004b70a8
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4b746e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4b748b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004b7028
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4b74b4
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b74cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4b74e5
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4b74de
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4b74f9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b6e90
test bl, bl
jne 0x4b75cc
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x538dec
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b7530
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b7544
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b73a4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4b7576
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4b7525
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b7599
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4b75aa
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4b75be
jmp 0x4b7687
cmp bl, 1
jne 0x4b7687
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x538e46
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4b75ec
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4b7600
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b73a4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4b7632
sub ebx, 6
inc dword [ebp - 8]
jne 0x4b75e1
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4b7659
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4b766a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4b767e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004b6f14
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4b7d38
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004035f4
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4ba118
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4ba194
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4ba070]
mov eax, 0x10
call fcn.00405c6c
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409678
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404c50
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x538e64]
mov dword [ebx], eax
mov dword [0x538e64], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba19b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c20
ret
Function at 0x4beb1c
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x4beb2c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4beb41
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4bec44
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004bebb0
mov esi, eax
mov eax, ebx
call fcn.00403db0
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4bf184
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bf224
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4bf20e
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4bf1e7
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404e04
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4bf1d5
call sub.wsock32.dll_WSACleanup
cmp dword [ebp - 4], 0
je 0x4bf208
mov eax, dword [ebp - 4]
mov edx, 0x4bf23c
call fcn.00405018
jne 0x4bf20c
xor ebx, ebx
jmp 0x4bf20e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf22b
lea eax, [ebp - 4]
call fcn.00404bfc
ret

Function at 0x4bf248
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff0
lea eax, [esp + 0xc]
push eax
push 0x4bf2b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4bf2a5
mov dword [esp], 4
push esp
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x4bf2e4
mov eax, dword [esp + 0x20]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4bf292
cmp byte [esp + 4], 1
sete bl
jmp 0x4bf299
call fcn.004bf184
mov ebx, eax
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4bf2ac
call fcn.004bf184
mov ebx, eax
mov eax, ebx
add esp, 0x10
pop ebx
ret