joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7bc4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00409150
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004c2278
test ebx, ebx
jne 0x4c7c17
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004c7a58
mov ebx, eax
test ebx, ebx
je 0x4c7d02
cmp esi, ebx
je 0x4c7c40
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4c7c55
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4c7c8d
add eax, 0xffffff5f
sub eax, 2
jb 0x4c7ca5
dec eax
sub eax, 2
jb 0x4c7cb9
dec eax
sub eax, 2
jb 0x4c7caf
jmp 0x4c7cc3
add eax, 0xfffffdff
sub eax, 2
jb 0x4c7ca5
dec eax
sub eax, 2
jb 0x4c7cb9
dec eax
sub eax, 2
jb 0x4c7caf
jmp 0x4c7cc3
mov byte [esp + 0x120], 0
jmp 0x4c7ccb
mov byte [esp + 0x120], 2
jmp 0x4c7ccb
mov byte [esp + 0x120], 1
jmp 0x4c7ccb
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004a34d0
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004c3a20
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4c7d04
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4d2eb0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
mov dword [esp], 0x104
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.004068d8
add esp, 0x20c
pop ebx
ret

Function at 0x4d2ee4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
mov dword [esp], 0x104
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4d2f15
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.004068d8
jmp 0x4d2f1e
mov eax, ebx
xor edx, edx
call fcn.004066d8
add esp, 0x20c
pop ebx
ret

Function at 0x4d2f74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d2fe8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x55ab20]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.004068d8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.00477398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2fef
lea eax, [ebp - 0x20c]
call fcn.004066c8
ret
Function at 0x4d2ff4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d3068
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x55ab20]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.004068d8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.00477398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d306f
lea eax, [ebp - 0x20c]
call fcn.004066c8
ret

Function at 0x4d3074
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d30e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004068d8
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.00477398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d30ea
lea eax, [ebp - 0x210]
call fcn.004066c8
ret
Function at 0x4d33a4
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066c0
xor eax, eax
push ebp
push 0x4d3589
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x11], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d33f6
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4d33f6
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405b54
test eax, eax
je 0x4d33ff
sub eax, 4
mov eax, dword [eax]
lea ebx, [eax + 1]
mov eax, ebx
call fcn.004708cc
mov dword [ebp - 0x10], eax
mov edx, ebx
add edx, edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.004039d0
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00470628
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.004039d0
lea eax, [ebp - 0x6c]
xor ecx, ecx
mov edx, 0x10
call fcn.004039d0
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 1
movzx eax, word [ebp - 8]
mov word [ebp - 0x2c], ax
xor edx, edx
push ebp
push 0x4d356c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4d34a1
call fcn.00405280
jmp 0x4d3573
cmp dword [ebp + 0xc], 0
je 0x4d34af
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x64]
mov dword [eax], edx
test esi, esi
jbe 0x4d3513
cmp byte [ebp + 0x10], 0
je 0x4d34fe
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
push 0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
push 0xa
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x5571e8]
mov eax, dword [eax]
call fcn.004ae690
cmp ebx, 0xffffffff
jne 0x4d34e9
mov byte [ebp - 0x11], 0
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp esi, eax
jbe 0x4d3513
cmp ebx, 0x102
je 0x4d34c0
jmp 0x4d3513
push esi
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4d3513
mov byte [ebp - 0x11], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3573
cmp byte [ebp - 0x11], 0
jne 0x4d352e
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x4d3549
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x4d3556
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x4d3563
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x10]
call fcn.0047090c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3590
lea eax, [ebp - 4]
call fcn.004066c8
ret
Function at 0x4d45d4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004039d0
ret

Function at 0x4d4850
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066c0
xor eax, eax
push ebp
push 0x4d499e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004d45d4
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00406764
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4d497d
xor eax, eax
push ebp
push 0x4d4976
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4d495f
xor eax, eax
push ebp
push 0x4d4958
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d4941
xor eax, eax
push ebp
push 0x4d493a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004d460c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4941
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d495f
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d497d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004d4694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d49a5
lea eax, [ebp - 4]
call fcn.004066c8
ret
Function at 0x4d5678
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d5806
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d57c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xc]
call fcn.004d4b44
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 4]
add eax, 4
mov edx, dword [ebx + 0xc]
add edx, 0x864
mov ecx, 0x33
call fcn.004068d8
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebx + 0xc]
add edx, 0x8ca
mov ecx, pe_nt_image_headers32
call fcn.004068d8
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebx + 0xc]
add edx, 0xaca
mov ecx, 0x15
call fcn.004068d8
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebx + 0xc]
add edx, 0xaf8
mov ecx, 0x33
call fcn.004068d8
lea eax, [ebp - 8]
mov edx, dword [ebx + 0xc]
add edx, 0xaf8
mov ecx, 0x33
call fcn.004068d8
mov eax, dword [ebp - 8]
call fcn.004d4bc4
mov eax, dword [ebp - 4]
fstp qword [eax + 0x18]
wait
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0xaf4], 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x20], al
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0xc]
add edx, 0xb5e
mov ecx, 6
call fcn.004068d8
mov eax, dword [ebp - 0xc]
or edx, 0xffffffff
call fcn.0046f870
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0xb6c], 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x28], al
mov eax, dword [ebp - 4]
add eax, 0x2c
mov edx, dword [ebx + 0xc]
add edx, 0xb70
mov ecx, 0x33
call fcn.004068d8
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebx + 0xc]
add edx, 0xbd6
mov ecx, 0x33
call fcn.004068d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d57eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d580d
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004066d0
ret
Function at 0x4d7438
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x54ea1c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4d7463
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4d7524
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x54ea1c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4d755f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4d7634
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x54ea1c]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4d767f
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4dd744
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4dd857
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.004066d8
lea eax, [ebp - 0x14]
call fcn.004d2f28
push dword [ebp - 0x14]
push 0x4dd874
push 0x4dd890
lea eax, [ebp - 4]
mov edx, 3
call fcn.00406b7c
mov eax, dword [ebp - 4]
call fcn.0046fd24
test al, al
je 0x4dd834
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4d5870]
call fcn.004d5934
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
call fcn.004d2ea4
movzx eax, ax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4dd8b4
call fcn.004d35d4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0048d800
test al, al
je 0x4dd81c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x5c]
test al, al
je 0x4dd81c
push esi
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
jmp 0x4dd82d
push esi
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov eax, ebx
call fcn.004043a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd85e
lea eax, [ebp - 0x14]
call fcn.004066c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004066d0
ret
Function at 0x4dd8c0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4dd9cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x18]
call fcn.004d2f28
push dword [ebp - 0x18]
push 0x4dd9ec
push 0x4dda08
lea eax, [ebp - 4]
mov edx, 3
call fcn.00406b7c
mov eax, dword [ebp - 4]
call fcn.0046fd24
test al, al
je 0x4dd9a9
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4d5870]
call fcn.004d5934
mov esi, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
call fcn.004d2ea4
movzx eax, ax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x4dda2c
call fcn.004d35d4
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0048d800
test al, al
je 0x4dd991
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x5c]
test al, al
je 0x4dd991
push ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov byte [ebp - 0x11], al
jmp 0x4dd9a2
push ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov byte [ebp - 0x11], al
mov eax, esi
call fcn.004043a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd9d3
lea eax, [ebp - 0x18]
call fcn.004066c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004066d0
ret

Function at 0x4dfe4c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004039d0
ret

Function at 0x4e0a0c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
test dl, dl
je 0x4e0a21
add esp, 0xfffffff0
call fcn.004047d8
mov ebx, edx
mov edi, eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x10]
mov dword [edi + 4], eax
mov esi, eax
shl esi, 4
lea esi, [esi + esi*2]
mov dword [edi + 8], esi
mov eax, esi
call fcn.0040303c
mov dword [edi + 0xc], eax
mov eax, dword [edi + 8]
call fcn.0040303c
mov esi, eax
mov dword [edi + 0x10], esi
push 0
mov eax, dword [edi + 8]
push eax
push esi
push 8
call sub.NTdll.dll_NtQuerySystemInformation
mov eax, dword [edi + 8]
push eax
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [edi + 0xc]
push eax
call sub.kernel32.dll_RtlMoveMemory
mov eax, edi
test bl, bl
je 0x4e0a8a
call fcn.00404830
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret