joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49066c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x490685
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x49067e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x490699
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00490030
test bl, bl
jne 0x49076c
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4f4f74
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4906d0
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4906e4
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00490544
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x490716
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4906c5
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x490739
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x49074a
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x49075e
jmp 0x490827
cmp bl, 1
jne 0x490827
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4f4fce
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x49078c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4907a0
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00490544
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4907d2
sub ebx, 6
inc dword [ebp - 8]
jne 0x490781
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4907f9
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x49080a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x49081e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004900b4
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4924ec
Capabilities:
Set socket configuration

Disassembly:
push ebx
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [0x4efab4]
push eax
lea eax, [esp + 4]
push eax
push 0x1005
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
mov eax, dword [0x4efab4]
push eax
lea eax, [esp + 4]
push eax
push 0x1006
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
mov eax, dword [0x4efab4]
push eax
lea eax, [esp + 8]
push eax
push 0x1002
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
mov eax, dword [0x4efab4]
push eax
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
pop ecx
pop edx
pop ebx
ret

Function at 0x492634
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 5], cl
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x4927b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 4], 0
je 0x49278e
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00492100
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.004048cc
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.00403150
mov word [ebx], 2
push edi
call sub.wsock32.dll_htons
mov word [ebx + 2], ax
mov eax, dword [ebp - 4]
call fcn.00491f98
test al, al
je 0x4926cc
mov eax, dword [ebp - 4]
call fcn.00404ce4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 4], eax
jmp 0x492709
lea ecx, [ebp - 0x14]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00492a9c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004048cc
cmp dword [ebp - 4], 0
jne 0x4926f8
mov dword [esi], 0x271e
jmp 0x49278e
mov eax, dword [ebp - 4]
call fcn.00404ce4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 4], eax
mov al, byte [ebp - 5]
dec al
jne 0x49272a
push esi
mov ecx, 0x11
mov edx, 2
mov eax, 2
call fcn.004923d4
mov dword [ebp - 0xc], eax
jmp 0x49278e
push esi
mov ecx, 6
mov edx, 1
mov eax, 2
call fcn.004923d4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x49275b
cmp byte [ebp + 0x10], 0
jne 0x49275b
mov ecx, esi
mov dl, byte [ebp + 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00492414
cmp dword [ebp - 0xc], 0xffffffff
je 0x49278e
mov ecx, esi
mov edx, 0x1f4
mov eax, dword [ebp - 0xc]
call fcn.0049248c
push 0x10
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x49278e
call sub.wsock32.dll_WSAGetLastError
mov dword [esi], eax
lea eax, [ebp - 0xc]
call fcn.004925b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4927b8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404858
lea eax, [ebp - 4]
call fcn.00404834
ret

Function at 0x4928e8
Capabilities:
Get socket status

Disassembly:
add esp, 0xfffffefc
mov dword [esp], 1
mov dword [esp + 4], eax
push 0x4f4fe0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x104
ret
Function at 0x49298c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push ebx
push ecx
push edx
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
mov eax, ebx
call fcn.00492408
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x492a24
Capabilities:
Get socket status

Disassembly:
push esi
push edi
add esp, 0xfffffef4
mov esi, ecx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
test dl, dl
je 0x492a56
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
jmp 0x492a67
push esp
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
call sub.wsock32.dll_select
add esp, 0x10c
pop edi
pop esi
ret

Function at 0x492a9c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x492b38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404ce4
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x492b1b
movsx edx, word [eax + 0xa]
test edx, edx
jns 0x492ade
add edx, 3
sar edx, 2
cmp esi, edx
jg 0x492b12
dec esi
mov edx, esi
shl edx, 2
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
add eax, edx
lea edx, [ebp - 4]
mov ecx, 4
call fcn.00402a0c
mov eax, dword [ebp - 4]
call fcn.00493174
mov edx, eax
mov eax, ebx
call fcn.00404a24
jmp 0x492b22
mov eax, ebx
call fcn.00404834
jmp 0x492b22
mov eax, ebx
call fcn.00404834
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492b3f
lea eax, [ebp - 8]
call fcn.00404834
ret

Function at 0x492b48
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
push ebx
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x492b74
mov ax, word [esp + 6]
call fcn.0049316c
movzx eax, ax
jmp 0x492b76
xor eax, eax
add esp, 0x14
pop ebx
ret

Function at 0x492b7c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
mov dword [esp], 0x10
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x10
call fcn.00403150
push esp
lea eax, [esp + 8]
push eax
push ebx
call sub.wsock32.dll_getsockname
mov eax, dword [esp + 8]
call fcn.00493174
mov edx, eax
mov eax, esi
call fcn.00404a24
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x4b3448
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4b346d
cmp dword [esp + 4], 5
jb 0x4b346d
mov al, 1
jmp 0x4b346f
xor eax, eax
add esp, 0x94
ret
Function at 0x4c5028
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x4c5052
cmp dword [ebx + 0x64], 0
jne 0x4c5052
cmp dword [ebx + 0x6c], 0
jne 0x4c5052
mov edi, esi
jmp 0x4c50d9
cmp edi, 0xffffffff
jne 0x4c505a
dec edi
jmp 0x4c50d9
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4c50d9
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004c3d60
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c50a7
mov cx, word [esp]
sub cx, si
jmp 0x4c50a9
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c5090
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c50cf
mov cx, word [esp]
sub cx, si
jmp 0x4c50d1
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c50b8
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4c5136
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.004c4dc4
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4c5121
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4c5136
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4c5032
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4cbb44
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x4cbbe9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cbbcc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x466fe4]
call fcn.004670b8
mov dword [ebp - 8], eax
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00467158
xor ecx, ecx
mov edx, 0x4cbbfc
mov eax, dword [ebp - 8]
call fcn.004671bc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004673e4
test al, al
je 0x4cbbb6
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004672e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbbd3
mov eax, dword [ebp - 8]
call fcn.00403944
ret
Function at 0x4cc104
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cd4
mov eax, dword [ebp - 8]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x4cc1ad
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cc18b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x466fe4]
call fcn.004670b8
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00467158
xor ecx, ecx
mov edx, 0x4cc1c0
mov eax, dword [ebp - 0xc]
call fcn.004671bc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00467350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc192
mov eax, dword [ebp - 0xc]
call fcn.00403944
ret

Function at 0x4cc980
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00404834
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4cc9da
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4cc9ce
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.00409e94
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4cc9bf
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cd058
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4cd061
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404cd4
mov eax, dword [ebp - 8]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x4cd1d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cd173
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x38]
test al, al
je 0x4cd0b5
mov eax, ebx
call fcn.004a3f14
lea edx, [ebp - 0x2c]
mov eax, 0x4cd1f0
call fcn.0049d4f4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.004059cc
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00409b2c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x14]
mov ecx, 0x4cd208
call fcn.00404b38
mov eax, dword [ebp - 0x14]
call fcn.004098dc
test al, al
je 0x4cd102
mov eax, dword [ebp - 0x14]
call fcn.00404ce4
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cbdf0
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.004cbdf0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4cd210
lea eax, [ebp - 0x28]
push eax
push 0
call fcn.00405908
add esp, 0x14
mov eax, dword [ebp - 4]
call fcn.00404ce4
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
je 0x4cd169
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.004099f4
mov eax, dword [ebp + 8]
mov edx, 0x4cd230
call fcn.00404888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cd1a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd1df
lea eax, [ebp - 0x30]
call fcn.00404834
lea eax, [ebp - 0x2c]
call fcn.004068ec
lea eax, [ebp - 0x28]
call fcn.00405a28
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404858
ret
Function at 0x4d3394
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d35f4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4d33f7
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004d2eac
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040dbf4
cmp al, 1
jne 0x4d33f7
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004d3174
test al, al
je 0x4d3583
cmp dword [ebp - 8], 0
jge 0x4d3415
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004d2eac
mov eax, dword [ebp - 0x210]
call fcn.00404aec
cmp ebx, eax
jge 0x4d345f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004d2eac
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4f30a0]
and eax, 0xff
bt dword [edx], eax
jae 0x4d345f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4d3473
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d3370
cmp ebx, dword [ebp - 8]
je 0x4d3575
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4d349f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b40
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f2228]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4d3562
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b40
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f2228]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044b000
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b40
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f2228]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044b000
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3569
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4d35d6
cmp dword [ebp - 8], 0
jge 0x4d358e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004d2eac
mov eax, dword [ebp - 0x218]
call fcn.00404aec
cmp eax, dword [ebp - 8]
jg 0x4d35c8
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004d2eac
mov eax, dword [ebp - 0x21c]
call fcn.00404aec
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d3370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d35fb
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404858
ret
Function at 0x4d9898
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
test dl, dl
je 0x4d98b0
push 5
mov eax, ebx
call fcn.0044b000
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
push 0
mov eax, ebx
call fcn.0044b000
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4e3690
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x308], 0
jne 0x4e3730
mov esi, dword [ebx + 0x338]
test esi, esi
je 0x4e36bc
mov ecx, ebx
mov dl, 1
mov eax, esi
call dword [eax + 0x2c]
mov dword [ebx + 0x308], eax
jmp 0x4e36d0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4d6630]
call fcn.004d9efc
mov dword [ebx + 0x308], eax
xor edx, edx
mov eax, dword [ebx + 0x308]
call fcn.00444774
mov dl, 1
mov eax, dword [ebx + 0x308]
call fcn.0044b140
mov edx, ebx
mov eax, dword [ebx + 0x308]
mov ecx, dword [eax]
call dword [ecx + 0x68]
push 0
mov eax, dword [ebx + 0x308]
call fcn.0044b000
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x308]
mov dword [eax + 0xe4], ebx
mov dword [eax + 0xe0], 0x4e3764
mov dword [eax + 0x2ac], ebx
mov dword [eax + 0x2a8], 0x4e373c
mov eax, dword [ebx + 0x308]
pop esi
pop ebx
ret

Function at 0x4e695c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x4e6aae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4e6a86
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.00409d34
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4e6a6f
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4e6a69
mov ebx, dword [edx]
test ebx, ebx
je 0x4e6a63
lea eax, [ebp - 0x29c]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x4e6ac8
call fcn.0040a410
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00404888
mov byte [ebp - 5], 1
jmp 0x4e6a73
mov byte [ebp - 5], 0
jmp 0x4e6a73
mov byte [ebp - 5], 0
jmp 0x4e6a73
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6a8d
call sub.wsock32.dll_WSACleanup
ret
Function at 0x4e7128
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x4e7156
inc eax
xor edx, edx
mov dl, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x4f2300]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x4e7134
pop esi
pop ebx
ret