joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a06b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc8d6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp + 8]
mov dword [ebp - 0x14], 7
push eax
mov dword [ebp - 0x18], 0
call fcn.00438df0
push 1
push ecx
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], 0x5c
call fcn.004490a0
cmp eax, 0xffffffff
je 0x4a07b5
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044e1d0
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x4a0770
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4a0753
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
xor eax, eax
mov dword [ebp - 0x14], 7
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.0044e210
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4a0789
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433600
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00438df0
call fcn.004a06b0
add esp, 0x18
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4a07df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4a07df
or esi, 0xffffffff
jmp 0x4a07e1
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4a07f6
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433600
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp ecx, 8
jb 0x4a081f
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00433600
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret

Function at 0x4a09a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004a8960
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4a0a0d
mov eax, dword [ebp - 0x114]
cmp eax, 6
jb 0x4a09fa
jne 0x4a0a0d
cmp dword [ebp - 0x110], 0
jne 0x4a0a0d
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x4a0a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc960
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
cmp dword [ebx + 0x84], 0
mov esi, dword [ebp + 8]
je 0x4a0a63
xor eax, eax
jmp 0x4a0c37
cmp dword [ebx + 4], 0
je 0x4a0a5c
call fcn.004a09a0
push esi
test eax, eax
je 0x4a0b23
lea ecx, [ebp - 0x40]
call fcn.00438600
push 8
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.0044e1d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x14]
lea ebx, [ebp - 0x28]
mov esi, dword [ebp - 0x28]
cmp edi, 8
mov eax, dword [ebp - 0x18]
cmovae ecx, esi
mov dword [ebp - 0x48], fcn.004b60e3
cmovae ebx, esi
lea edx, [ecx + eax*2]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
cmovae ecx, esi
push ebx
call fcn.00456200
add esp, 8
lea ecx, [ebp - 0x28]
mov edx, str.https:__
call fcn.0045a590
test al, al
je 0x4a0af3
push 7
push str.http:__
push 8
push 0
lea ecx, [ebp - 0x40]
call fcn.0044c590
mov ebx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
lea ecx, [ebx + 0x10]
cmp ecx, eax
je 0x4a0b0a
push 0xffffffffffffffff
push 0
push eax
call fcn.00438df0
lea ecx, [ebp - 0x28]
call fcn.004335b0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.004335b0
jmp 0x4a0b2b
lea ecx, [ebx + 0x10]
call fcn.00439260
cmp dword [ebx + 8], 0
jne 0x4a0b42
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x4a0a5c
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebx + 0x80]
test ecx, ecx
je 0x4a0b6e
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 0x80], 0
call fcn.004a1990
test eax, eax
je 0x4a0b8d
push 0x58
call fcn.004a5d55
add esp, 4
mov dword [ebp - 0x44], eax
mov ecx, eax
call fcn.004a29d0
jmp 0x4a0bc0
push 0x2c
call fcn.004a5d55
add esp, 4
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov dword [eax], vtable.QQDectector2::CWininetFile.0
mov dword [eax + 0x20], 7
mov dword [eax + 0x1c], 0
mov word [eax + 0xc], cx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.STATIC
push 0
mov dword [ebx + 0x80], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x4a18b0
push 0xfffffffffffffffc
push eax
mov dword [ebx + 0x60], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x4c]
mov dword [ebx + 0x84], 1
push eax
push 0
push ebx
push 0x4a1040
push 0
push 0
mov dword [ebp - 0x4c], 0
call fcn.004afd9b
mov ecx, eax
add esp, 0x18
mov dword [ebx + 0xc], ecx
test ecx, ecx
jne 0x4a0c30
mov dword [ebx + 0x84], eax
xor eax, eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 4
Function at 0x4a0f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x412
mov dword [ebp - 0x41c], eax
mov ebx, edx
lea eax, [ebp - 0x418]
mov esi, ecx
push 0
push eax
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x2f
push esi
call fcn.004a8591
mov edi, eax
add esp, 8
test edi, edi
je 0x4a1003
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x418]
push str.QMDownload
push eax
call esi
sub esp, 0x18
lea eax, [ebp - 0x418]
mov ecx, esp
push eax
call fcn.00438600
call fcn.004a06b0
add esp, 0x18
lea eax, [ebp - 0x418]
add edi, 2
push edi
push eax
call esi
cmp word [ebp - 0x418], 0
jne 0x4a0fb8
xor ecx, ecx
jmp 0x4a0fd0
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a0fc1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x418]
mov ecx, ebx
push eax
call fcn.00439160
cmp word [edi], 0
jne 0x4a0feb
xor ecx, ecx
push ecx
push edi
jmp 0x4a1018
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a0ff0
sub ecx, edx
sar ecx, 1
push ecx
push edi
jmp 0x4a1018
push 0
push 0x4ed230
mov ecx, ebx
call fcn.00439160
push 0
push 0x4ed230
mov ecx, dword [ebp - 0x41c]
call fcn.00439160
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a5d13
mov esp, ebp
pop ebp
ret

Function at 0x4a17f0
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
push 0
push eax
mov esi, ecx
call fcn.004a8960
push edi
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004af9ef
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a1869
sub esp, 0x18
lea eax, [ebp - 0x210]
mov ecx, esp
push eax
call fcn.00438600
call fcn.004a06b0
add esp, 0x18
add esi, 0x28
cmp dword [esi + 0x14], 8
jb 0x4a1876
mov eax, dword [esi]
jmp 0x4a1878
mov eax, esi
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp + 0xc], 0
mov edi, eax
je 0x4a1899
cmp dword [esi + 0x14], 8
jb 0x4a1892
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 8
Function at 0x4a1990
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004a8960
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4a1a19
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x4a19ee
mov eax, dword [ebp - 0x118]
cmp eax, 1
jne 0x4a1a00
cmp word [ebp - 0xc], ax
jae 0x4a1a19
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x4a1a19
cmp word [ebp - 0xc], 3
jae 0x4a1a19
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
Function at 0x4a3950
Capabilities:
Check http status code
Check internet connectivity via wininet
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x50db80
push 0x4aac40
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x511070]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x54], edi
xor esi, esi
mov dword [ebp - 0x58], esi
movups xmm0, xmmword [str.Accept:___r_n_r_n]
movups xmmword [ebp - 0x3c], xmm0
movups xmm0, xmmword [0x4fcd00]
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 4
test edx, edx
jne 0x4a39d5
xor eax, eax
jmp 0x4a3b24
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], ebx
push 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [ebp - 0x44], 0x20
je 0x4a39fe
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x40]
jmp 0x4a3b1c
mov edx, dword [ebp - 0x5c]
test edx, edx
je 0x4a3a28
mov ecx, edx
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a3a10
sub ecx, edi
sar ecx, 1
je 0x4a3a28
mov eax, 3
jmp 0x4a3a2c
xor eax, eax
xor edx, edx
push 0
push 0
push edx
push eax
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_6.1__QQPCMgr7.0_
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [ebp - 0x54], edi
test edi, edi
je 0x4a39ef
push 0
push 0x84000100
push 0xffffffffffffffff
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x60]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
je 0x4a39ef
push 0x20a
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.004a8960
add esp, 0xc
mov dword [ebp - 0x64], 0x208
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x278]
push 0x2f
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov dword [ebp - 0x48], 0
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4a39ef
cmp dword [ebp - 0x48], 0xc8
jne 0x4a39ef
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x20000005
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov ecx, dword [ebp - 0x40]
test eax, eax
je 0x4a3aed
mov eax, dword [ebp - 0x50]
mov dword [ecx + 0x24], eax
mov ebx, 1
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x4a3b1c
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret 8
Function at 0x4a3cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5153d0], 0
jne 0x4a3d3f
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004a8960
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4fcd2c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [0x5153d0], eax
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004a5d13
mov esp, ebp
pop ebp
ret

Function at 0x4c39b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c3834

Function at 0x4c9b99
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c9859
Function at 0x401c31
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x400
push esi
xor esi, esi
cmp dword [0x2457374], 0x400
push edi
jne 0x401c84
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.004041a1
push esi
call fcn.00404928
push esi
push esi
call fcn.00404773
push esi
call fcn.004049de
push esi
push esi
call fcn.004041db
add esp, 0x1c
xor edi, edi
cmp edi, 0x16c76
jge 0x401c96
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x401cbc
inc edi
cmp edi, 0x3003f
jl 0x401c86
mov eax, dword [0x439b7c]
mov dword [0x2457374], eax
call fcn.0040192c
mov edi, 0x3078f
cmp dword [0x2457374], 0x51f
jne 0x401ce8
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x401cd0
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x4027bb
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43262d
call fcn.004324b0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00403491
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.004049ed
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x402803
call fcn.00403245
mov dword [ebx], eax
call fcn.00403004
mov ecx, eax
call fcn.004011a5
mov eax, ebx
jmp 0x402805
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x405075
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43899c]
jne 0x40507f
repz ret
jmp fcn.0040b92c
Function at 0x402954
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x49b030], 0x8088405
inc edx
mov dword [0x49b030], edx
mul edx
mov eax, edx
ret

Function at 0x406fa4
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4071e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403494
cmp dword [0x4990dc], 1
je 0x407025
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.mpr.dll_WNetGetUniversalNameA
test eax, eax
jne 0x4071ca
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x420]
mov edx, dword [edx]
call fcn.0040352c
jmp 0x4071ca
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.004027b4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x41
jb 0x4071ca
cmp byte [ebp - 0x15], 0x5a
ja 0x4071ca
mov eax, dword [ebp - 4]
call fcn.00403574
cmp eax, 3
jl 0x4071ca
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x4071ca
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x5c
jne 0x4071ca
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
push 1
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x4071ca
xor edx, edx
push ebp
push 0x4071c3
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0x640
mov eax, dword [ebp - 0x10]
call fcn.00402648
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x4071a5
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x4070f4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00402678
jmp 0x4070b8
test eax, eax
je 0x407107
call fcn.004031bc
call fcn.004031bc
jmp 0x4071ca
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4070b8
inc esi
xor edi, edi
mov eax, edi
shl eax, 2
mov edx, dword [ebp - 0x20]
lea ebx, [edx + eax*8]
cmp dword [ebx + 0x10], 0
je 0x407183
mov eax, dword [ebx + 0x10]
mov al, byte [eax]
call fcn.004027b4
cmp al, byte [ebp - 0x15]
jne 0x407183
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.00403574
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx + 0x14]
call fcn.0040352c
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
pop ecx
call fcn.004035c0
call fcn.004031bc
call fcn.004031bc
jmp 0x4071ca
inc edi
dec esi
jne 0x407112
jmp 0x4070b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4071ef
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00403420
ret
Function at 0x407280
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004034e0
add esp, 0x104
pop ebx
ret

Function at 0x408568
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4085a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004034e0
jmp 0x4085aa
mov eax, ebx
mov edx, esi
call fcn.00403494
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4085b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4085d5
mov al, byte [esp]
jmp 0x4085d7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x411070
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403400
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4110d1
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x4110d1
cmp byte [ebp - 0x102], 0
je 0x4110d1
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040355c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412310
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x412391
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x412342
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x412354
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x412360
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.004121e8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412385
push ebp
mov eax, dword [ebp - 4]
call fcn.00412284
pop ecx
mov ebx, eax
cmp bl, 2
je 0x412360
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419b04
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419b0a
ret
Function at 0x41f3c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49b650
cmp dword [edi], 0
jne 0x41f440
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x49b64c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x499594
mov ecx, 2
call fcn.00402738
mov edx, 0x41f39c
lea eax, [esi + 5]
call fcn.0041f3bc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f3bc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f415
mov dword [0x49b64c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f544
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f594]
test si, 4
je 0x41f558
or bl, 1
test si, 8
je 0x41f562
or bl, 4
test si, 1
je 0x41f56c
or bl, 8
test si, 2
je 0x41f576
or bl, 0x10
test si, 0x10
je 0x41f580
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f58f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41f598
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f5d0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f5b1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f5c0
or bl, 4
test esi, 0x20000000
je 0x41f5cb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret