joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463e50
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
cmp ebx, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
jne 0x463e94
cmp ebp, ebx
jne 0x463e94
mov eax, dword [esp + 0x334]
push eax
call fcn.00463e20
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x463eaf
mov esi, edi
call fcn.00453270
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
je 0x463ee3
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
cmp ebp, 0xffffffff
mov dword [esp + 0x228], eax
je 0x463f2a
test ecx, ecx
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
jbe 0x463f12
cmp dword [esp + eax*4 + 0x24], ebp
je 0x463f12
add eax, 1
cmp eax, ecx
jb 0x463f05
cmp eax, ecx
jne 0x463f24
cmp ecx, 0x40
jae 0x463f24
mov dword [esp + eax*4 + 0x24], ebp
add dword [esp + 0x20], 1
cmp ebp, edx
jbe 0x463f2a
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
sub ebx, 1
and ebx, ecx
lea ecx, [ecx]
xor eax, eax
cmp edi, eax
jle 0x463f71
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x463f7b
jne 0x463f7b
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x463fe5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x463fae
cmp eax, 0x2714
jne 0x463fe9
test edi, edi
jle 0x463f40
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00453270
push edx
push eax
call fcn.004532a0
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x463f40
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x463ff7
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x464006
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x46403d
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x46402b
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x46403d
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x464070
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x46405e
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x464070
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x465bc0
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x465bcf
jmp dword [ecx*4 + 0x465c24]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x465db0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x50db70]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0043b895
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x465e15
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x465e15
lea edx, [esp]
push edx
call dword [0x50ef9c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004221b5
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004221b5
add esp, 0x108
ret
jmp 0x465db0

Function at 0x465e30
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x50db70]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0043b895
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x465e15
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x465e15
lea edx, [esp]
push edx
call dword [0x50ef9c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004221b5
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004221b5
add esp, 0x108
ret
jmp 0x465db0

Function at 0x4688b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x47679b
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x4767b1
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x4767bd
or edi, 1
push 1
call esi
test ax, ax
jge 0x4767c9
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x4767d5
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x4767e1
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x47694f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0x214], eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004221d0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call sym.setup_DongFangInput.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004221b5
leave
ret

Function at 0x478e13
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
cmp eax, ecx
mov ebx, dword [ebp + 8]
je 0x478e38
cmp ebx, dword [esi + 0x54]
je 0x478e38
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x478efa
test eax, eax
push edi
je 0x478e8b
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x54]
mov ecx, esi
call sym.setup_DongFangInput.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov dword [esi + 0x54], edi
test ebx, ebx
je 0x478ef9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x478ef9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x478ef9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x478ef9
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x54]
mov ecx, esi
call sym.setup_DongFangInput.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4790f7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xd0]
mov ecx, edi
xor ebx, ebx
call sym.setup_DongFangInput.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
test eax, eax
jle 0x479146
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call sym.setup_DongFangInput.exe_public:_void____thiscall_DuiLib::CStdPtrArray::operator___int_const
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x4791aa
mov ecx, edi
inc ebx
call sym.setup_DongFangInput.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
cmp ebx, eax
jl 0x479115
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x479203
sub eax, 4
je 0x4791ae
dec eax
dec eax
jne 0x4791fa
and word [ebp + 8], 0
push dword [ebp + 0xc]
xor eax, eax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.004aa10d
pop ecx
mov ecx, dword [esi + 0x50]
push reloc.WS2_32.dll_ioctlsocket
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push sym.setup_DongFangInput.exe_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x4791fa
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x4791fc
cmp dword [esi + 0x54], 0
je 0x4791fa
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.0047679b
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4791fa
cmp dword [esi + 0x54], 0
je 0x479252
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x479252
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x479252
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.004230b6
test eax, eax
pop ecx
pop ecx
je 0x479252
mov ecx, dword [esi + 0x54]
call sym.setup_DongFangInput.exe_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x4791fa
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
mov ecx, esi
push eax
call sym.setup_DongFangInput.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
jmp 0x4791aa
Function at 0x48a8a7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x18], bl
push edi
je 0x48a918
cmp dword [esi + 0x10], ebx
je 0x48a918
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.004325f0
cmp esp, ebx
mov dword [ebp - 8], esp
je 0x48a918
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.00475cf7
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.setup_DongFangInput.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004221b5
leave
ret 0x10

Function at 0x48e97f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d4], ebx
je 0x48e9e7
cmp dword [ebp + 8], 0x100
jne 0x48e9d6
cmp word [ebp + 0xc], 0xd
jne 0x48e9d6
cmp byte [esi + 0x4da], bl
je 0x48e9bd
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x48e9d6
cmp byte [esi + 0x4db], bl
jne 0x48e9d6
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x48e9d2
push ebx
push ebx
push ebx
push str.return
push esi
call sym.setup_DongFangInput.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x48e9ea
mov eax, dword [esi + 0x4d4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4975dd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4975e8
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x4976a3
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
sub eax, 8
dec edi
jne 0x497608
pop edi
test eax, eax
je 0x4976bc
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4dba18]
inc edx
dec eax
jne 0x4976a7
mov eax, esi
pop esi
not eax
pop ebx
ret

Function at 0x497b4a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x497b7e
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x497b79
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x497ba6
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x497b8f
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00421e50
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x49893c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4989e5
movzx ecx, word [esi]
test cx, cx
je 0x4989e5
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x49897a
cmp cx, 0x5c
jne 0x49897c
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x49896e
cmp eax, esi
je 0x4989b9
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004223bb
and word [ebp + edi*2 - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0049893c
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0042235e
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00422334
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004221b5
leave
ret
Function at 0x499f16
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x499f91
cmp dword [esi + 4], 0xffffffff
jne 0x499f91
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4eaef0
push edi
call fcn.00422334
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x499f63
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x499f63
mov eax, 0x2000000
jmp 0x499f96
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00497960
add esp, 0x10
test eax, eax
jne 0x499f81
mov eax, dword [ebp + 0x10]
jmp 0x499f96
push eax
call fcn.00499b12
mov dword [esi], eax
mov eax, dword [0x5145e0]
pop ecx
jmp 0x499f96
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x49cdd5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x49cdfa
cmp eax, edi
jge 0x49cdf2
mov eax, esi
call fcn.0049c7c9
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x49ce1c
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x49ce01
cmp ecx, 4
jge 0x49ce3b
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x49ce29
xor eax, eax
jmp 0x49ce31
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x49ce1f
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x49ce6d
mov eax, str.zlib_corrupt
call fcn.0049a403
jmp 0x49cea8
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x49ce7d
mov eax, str.read_past_buffer
jmp 0x49ce66
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x49ce92
mov ecx, edi
call fcn.0049c7f4
test eax, eax
je 0x49cea8
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00421e50
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x4a8a0f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004a89a4
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004221d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4a8a5e
cmp dword [ebp - 0x1c], 5
jb 0x4a8a76
jmp 0x4a8a72
cmp dword [ebp - 0x10], 1
jne 0x4a8a76
cmp dword [ebp - 0x1c], 4
ja 0x4a8a72
jne 0x4a8a76
cmp dword [ebp - 0x18], 0
jbe 0x4a8a76
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4dc990
call fcn.00412acb
test eax, eax
jge 0x4a8a97
mov byte [0x5147d4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004221b5
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor ebx, ebx
push 0x417084
mov dword [ebp - 4], ebx
call fcn.00403cd9
mov esi, dword [ebp + 0xc]
pop ecx
cmp byte [esi + 0x52c], bl
lea eax, [esi + 0x52c]
je 0x40102d
mov dword [ebp - 4], eax
lea edi, [esi + 0x428]
push eax
push edi
push 0x417060
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x2a], bx
mov dword [ebp - 0x28], ebx
call fcn.00403cd9
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401084
push dword [ebp + 8]
push esi
call fcn.00403ed4
pop ecx
jmp 0x4010b7
push 0x417040
call fcn.00403cd9
pop ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 8], 0x103
je 0x40108f
push 0x417030
call fcn.00403cd9
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40123f
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x4172c4
call fcn.00403cd9
lea eax, [ebp - 0x104]
mov dword [esp], 0x104
push eax
push 0x4172bc
push 0x417284
push reloc.WSOCK32.dll_bind
call fcn.0040638c
add esp, 0x14
test al, al
jne 0x40128e
push 0x417228
call fcn.00403cd9
mov dword [esp], 0x4171f8
jmp 0x4012bb
lea eax, [ebp - 0x104]
push eax
push 0x4171e0
call fcn.00403cd9
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push eax
push 0x401227
call fcn.00405ccf
test eax, eax
jne 0x4012c6
push 0x4171b8
call fcn.00403cd9
pop ecx
push 1
pop eax
leave
ret
push 0x41718c
call fcn.00403cd9
pop ecx
xor eax, eax
leave
ret
Function at 0x4012d5
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
movsx eax, word [esi + 0x7d8]
push eax
push dword [esi]
push 0x417384
call fcn.00403cd9
mov eax, dword [esi]
add esp, 0xc
sub eax, 0
je 0x40131f
dec eax
je 0x40131b
dec eax
je 0x401316
dec eax
jne 0x401356
mov ebx, dword [esi + 0x750]
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 7
inc ebx
jmp 0x401359
push 1
pop ebx
jmp 0x401359
push 2
jmp 0x401318
cmp dword [esi + 0x750], 2
jne 0x401352
push esi
call fcn.0040123f
test eax, eax
pop ecx
jne 0x401352
push 0x417350
push 4
push esi
call fcn.00403e44
push 0x41733c
call fcn.00403cd9
add esp, 0x10
jmp 0x40142e
xor ebx, ebx
jmp 0x401359
mov ebx, dword [ebp + 8]
cmp word [esi + 0x7d8], 0
je 0x401366
or ebx, 4
movsx eax, word [esi + 0x7d4]
lea edi, [esi + 0x7d4]
push eax
push 0x417330
call fcn.00403cd9
cmp word [edi], 0
pop ecx
pop ecx
je 0x40139d
push esi
push dword [ebp + 8]
call fcn.0040c3c8
pop ecx
test eax, eax
pop ecx
jne 0x40139d
push 1
pop eax
jmp 0x401430
movsx eax, word [esi + 0x7d6]
lea edi, [esi + 0x7d6]
push eax
push 0x417320
call fcn.00403cd9
cmp word [edi], 0
pop ecx
pop ecx
je 0x4013c8
push esi
push dword [ebp + 8]
call section..text
pop ecx
pop ecx
push esi
call fcn.004010bd
push eax
push 0x417310
push 4
push esi
call fcn.00403e44
add esp, 0x14
cmp word [esi + 0x14], 0
je 0x4013f6
push 0x417300
push dword [ebp + 8]
push esi
call fcn.00403da4
jmp 0x401420
push 0
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x401413
push dword [ebp + 8]
push esi
call fcn.00403ed4
pop ecx
or eax, 0xffffffff
pop ecx
jmp 0x401430
push 0x4172dc
push 4
push esi
call fcn.00403e44
add esp, 0xc
push 0x41733c
call fcn.00403cd9
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret