joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fe24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x48fe45
inc edi
mov eax, esi
call fcn.00405334
cmp edi, eax
jg 0x48fe57
cmp byte [esi + edi - 1], 0x20
je 0x48fe44
mov eax, esi
test eax, eax
je 0x48fe62
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x48ff24
cmp byte [esi + edi - 1], 0x2e
je 0x48ff48
jmp 0x48ff24
cmp byte [esi + edi - 1], 0x2e
jne 0x48fecc
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x48ff48
cmp dword [esp + 8], 0xff
jg 0x48ff48
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x48feb0
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x48feb8
mov bl, 1
jmp 0x48fec6
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x48ff48
jmp 0x48ff23
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x48fef1
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x48ff23
inc edi
mov eax, esi
call fcn.00405334
cmp edi, eax
jg 0x48ff03
cmp byte [esi + edi - 1], 0x20
je 0x48fef0
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x48ff1b
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x48ff48
jmp 0x48ff33
inc edi
mov eax, esi
call fcn.00405334
cmp edi, eax
jle 0x48fe7a
cmp dword [esp + 4], 3
jne 0x48ff48
cmp dword [esp + 8], 0xff
jg 0x48ff48
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4aa720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aa82b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x69c], 0
je 0x4aa773
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4aa773
inc eax
xor edx, edx
mov ecx, dword [ebp - 0xc]
lea esi, [ecx + edx]
movzx ecx, byte [ebx + 0x69c]
xor byte [esi], cl
inc edx
dec eax
jne 0x4aa760
lea edx, [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xd8]
mov esi, eax
mov dl, 9
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x94]
test al, al
je 0x4aa80d
inc dword [0x4d9a80]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x44]
mov edx, 8
mov eax, ebx
call fcn.0040c498
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0x11
mov eax, dword [ebx + 0x4b4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x1c], 0
mov eax, dword [0x4d9a80]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x40]
mov ecx, 5
mov eax, 0x4aa848
call fcn.0040db5c
mov ecx, dword [ebp - 0x10]
mov dl, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x90]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa832
lea eax, [ebp - 0x44]
call fcn.00405c2c
lea eax, [ebp - 0x10]
call fcn.00405c2c
ret
Function at 0x4c112c
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.004058ac
cmp byte [ebp - 1], 0
jne 0x4c118c
mov eax, esi
call fcn.004057a8
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4c11a6
sub al, 2
jb 0x4c11ad
jmp 0x4c11b2
mov ebx, 2
jmp 0x4c11b2
mov ebx, 1
mov eax, esi
call fcn.004057a8
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4c1296
test edi, edi
jle 0x4c120e
mov eax, esi
call fcn.004057a8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.004057a8
mov byte [eax + ebx - 1], 0
jmp 0x4c128a
test edi, edi
jge 0x4c1254
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.004057a8
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4c128a
mov eax, esi
call fcn.004057a8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.004057a8
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4c11ca
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4c12a7
sub al, 2
jb 0x4c12e1
jmp 0x4c1329
cmp edi, 2
jne 0x4c12ad
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4c1329
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.004057a8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x4d9ab0]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4c12bd
jmp 0x4c1329
cmp edi, 2
jne 0x4c12e7
dec ebx
test ebx, ebx
jle 0x4c1324
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.004057a8
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x4d9ab4]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4c12f3
jmp 0x4c1324
inc ebx
mov eax, esi
call fcn.004057a8
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4c1317
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.00405814
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c3c74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4d9ae4]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4c3c9f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4c3d60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4d9ae4]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4c3d9b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4c3e70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4d9ae4]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4c3ebb
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4c66e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edx, dword [eax]
mov ecx, dword [esp]
xor edx, dword [ecx]
mov dword [esp + 8], edx
lea edx, [eax + 4]
mov edx, dword [edx]
mov ecx, dword [esp]
xor edx, dword [ecx + 4]
mov dword [esp + 0xc], edx
lea edx, [eax + 8]
mov edx, dword [edx]
mov ecx, dword [esp]
xor edx, dword [ecx + 8]
mov dword [esp + 0x10], edx
add eax, 0xc
mov eax, dword [eax]
mov edx, dword [esp]
xor eax, dword [edx + 0xc]
mov dword [esp + 0x14], eax
movzx eax, byte [esp + 8]
mov edx, dword [eax*4 + 0x4d9b60]
mov eax, dword [esp + 0xc]
shr eax, 8
movzx eax, al
mov eax, dword [eax*4 + 0x4d9b60]
mov ecx, dword [esp + 0x10]
shr ecx, 0x10
movzx ecx, cl
mov esi, dword [ecx*4 + 0x4d9b60]
mov ecx, dword [esp + 0x14]
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x4d9b60]
mov ebx, eax
shl ebx, 8
shr eax, 0x18
or ebx, eax
xor edx, ebx
mov eax, esi
shl eax, 0x10
shr esi, 0x10
or eax, esi
xor edx, eax
mov eax, ecx
shl eax, 0x18
shr ecx, 8
or eax, ecx
xor edx, eax
mov eax, dword [esp]
xor edx, dword [eax + 0x10]
mov dword [esp + 0x18], edx
movzx eax, byte [esp + 0xc]
mov edx, dword [eax*4 + 0x4d9b60]
mov eax, dword [esp + 0x10]
shr eax, 8
movzx eax, al
mov eax, dword [eax*4 + 0x4d9b60]
mov ecx, dword [esp + 0x14]
shr ecx, 0x10
movzx ecx, cl
mov esi, dword [ecx*4 + 0x4d9b60]
mov ecx, dword [esp + 8]
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x4d9b60]
mov ebx, eax
shl ebx, 8
shr eax, 0x18
or ebx, eax
xor edx, ebx
mov eax, esi
shl eax, 0x10
shr esi, 0x10
or eax, esi
xor edx, eax
mov eax, ecx
shl eax, 0x18
shr ecx, 8
or eax, ecx
xor edx, eax
mov eax, dword [esp]
xor edx, dword [eax + 0x14]
mov dword [esp + 0x1c], edx
movzx eax, byte [esp + 0x10]
mov edx, dword [eax*4 + 0x4d9b60]
mov eax, dword [esp + 0x14]
shr eax, 8
movzx eax, al
mov eax, dword [eax*4 + 0x4d9b60]
mov ecx, dword [esp + 8]
shr ecx, 0x10
movzx ecx, cl
mov esi, dword [ecx*4 + 0x4d9b60]
mov ecx, dword [esp + 0xc]
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x4d9b60]
mov ebx, eax
shl ebx, 8
shr eax, 0x18
or ebx, eax
xor edx, ebx
mov eax, esi
shl eax, 0x10
shr esi, 0x10
or eax, esi
xor edx, eax
mov eax, ecx
shl eax, 0x18
shr ecx, 8
or eax, ecx
xor edx, eax
mov eax, dword [esp]
xor edx, dword [eax + 0x18]
mov dword [esp + 0x20], edx
movzx eax, byte [esp + 0x14]
mov edx, dword [eax*4 + 0x4d9b60]
mov eax, dword [esp + 8]
shr eax, 8
movzx eax, al
mov eax, dword [eax*4 + 0x4d9b60]
mov ecx, dword [esp + 0xc]
shr ecx, 0x10
movzx ecx, cl
mov esi, dword [ecx*4 + 0x4d9b60]
mov ecx, dword [esp + 0x10]
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x4d9b60]
mov ebx, eax
shl ebx, 8
jecxz 0x4c68bb
Function at 0x4c9c90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4c9c99
xchg dword [ebp - 4], ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c24
mov eax, dword [ebp - 8]
call fcn.00405c24
xor eax, eax
push ebp
push 0x4c9da2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x4c9ce0
lea edx, [ebp - 0xc]
mov eax, 0x4c9dbc
call fcn.004c9084
jmp 0x4c9ceb
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004c9084
push 0
push 0
push 0x4c9e24
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.00405e68
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00405e68
mov eax, dword [ebp - 0x1c]
mov cl, 2
pop edx
call fcn.004c9520
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00405e40
mov esi, dword [ebx]
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x4c9e44
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
call fcn.00409e94
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00405c3c
mov ecx, dword [ebx]
lea eax, [ebp - 0x24]
mov edx, 0x4c9e58
call fcn.004060f8
mov eax, dword [ebp - 0x24]
call fcn.00405cc8
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9da9
lea eax, [ebp - 0x24]
call fcn.00405c2c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404f94
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405c34
ret

Function at 0x4cb38c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb481
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4cb443
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004caec0
test al, al
je 0x4cb3e8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x4cb494
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x4cb405
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4cb439
cmp eax, 0x1d
je 0x4cb439
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004cb1a0
mov eax, dword [ebp - 0x10]
call fcn.00405cc8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb46b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb488
lea eax, [ebp - 0x10]
call fcn.00405c2c
ret
Function at 0x4cb570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c24
mov eax, dword [ebp - 8]
call fcn.00405c24
mov eax, dword [ebp - 0xc]
call fcn.00405c24
xor eax, eax
push ebp
push 0x4cb6ee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x4cb5b5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4cb5bc
mov dword [ebp - 0x10], 1
xor edx, edx
push ebp
push 0x4cb651
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405cc8
mov esi, eax
push esi
mov eax, dword [ebp - 8]
call fcn.00405cc8
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00405cc8
push eax
push 0x4cb700
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x4cb644
push ebp
call fcn.004cb4b0
pop ecx
test al, al
je 0x4cb629
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00405cc8
mov ecx, eax
mov edx, 0x4cb700
xor eax, eax
call fcn.004cb38c
jmp 0x4cb644
mov eax, dword [ebp - 0x10]
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
call fcn.00405cc8
push eax
push 0x4cb700
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb6d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb6f5
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c34
ret

Function at 0x4cb88c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4cb895
mov eax, dword [ebp - 4]
add esp, 0xffffffa4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c24
xor eax, eax
push ebp
push 0x4cb965
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4cb980
call fcn.004cb70c
mov ebx, eax
mov eax, 0x4cb980
call fcn.004cb70c
mov esi, eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004035b4
mov dword [ebp - 0x4c], 0x44
mov eax, 0x4cb99c
mov dword [ebp - 0x44], eax
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x205e]
mov edx, dword [ebp - 4]
call fcn.0040d2cc
push 0xffffffffffffffff
push esi
lea eax, [ebp - 8]
push eax
call sub.userenv.dll_CreateEnvironmentBlock
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 0x8000400
push 0
push 0
push 0
lea eax, [ebp - 0x205e]
push eax
push 0
push ebx
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.userenv.dll_DestroyEnvironmentBlock
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb96c
lea eax, [ebp - 4]
call fcn.00405c2c
ret

Function at 0x4ccafc
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
test dl, dl
je 0x4ccb17
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.00403cec
pop ebx
ret
mov byte [ebx + 0x44], 1
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_SetEvent
pop ebx
ret
Function at 0x4d1f9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d2103
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call sub.user32.dll_GetForegroundWindow
lea edx, [ebp - 8]
push edx
push eax
call sub.user32.dll_GetWindowThreadProcessId
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004ccb28
mov edx, 0x4d211c
mov eax, dword [ebp - 4]
call fcn.0040ba1c
test al, al
je 0x4d20ed
push 0x4d212c
push 0x4d2158
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
je 0x4d20ed
push 0xfffffffffffffff0
push ebx
call sub.user32.dll_GetWindowLongW
and eax, 0x10000000
cmp eax, 0x10000000
jne 0x4d20ed
fld qword [esi + 0x10]
fcomp dword [0x4d216c]
wait
fnstsw ax
sahf
jne 0x4d203b
call fcn.004cc2e0
fstp qword [esi + 0x10]
wait
jmp 0x4d20ed
call fcn.004cc2e0
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.0043a608
cmp edx, 0
jne 0x4d2064
cmp eax, 0x1f4
jbe 0x4d20ed
jmp 0x4d206a
jle 0x4d20ed
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x4d20ce
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.00420e7c
xor eax, eax
mov edx, dword [ebp - 0x20]
add edx, eax
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x1c]
add edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x18]
sub edx, eax
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jne 0x4d20ed
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x4d20ed
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x4d20ed
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
sub ecx, eax
push ecx
push edx
push eax
call fcn.004d1b28
mov byte [esi + 8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d210a
lea eax, [ebp - 4]
call fcn.00405c2c
ret