joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aa7e1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x646410], 0
jne 0x4aa7be
push 0x657d10
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x4aa7b7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x646410], 0
jne 0x4aa79f
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404bd0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00409240
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4aa7f8
call fcn.0040aca8
mov eax, dword [ebp - 0xc]
call fcn.00404a44
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4aa720
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404bd0
jmp 0x4aa757
lea eax, [ebp - 8]
mov edx, 0x4aa818
call fcn.0040460c
xor eax, eax
push ebp
push 0x4aa74d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0047f5ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aa757
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x646410], eax
cmp dword [0x646410], 0
jne 0x4aa78a
mov ecx, dword [0x655afc]
mov dl, 1
mov eax, dword [0x408468]
call fcn.0040e60c
call fcn.00403ef0
push 0x4aa824
mov eax, dword [0x646410]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x657d28], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa7be
push 0x657d10
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa7e8
lea eax, [ebp - 0x18]
call fcn.00404574
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404598
ret
Function at 0x4b61ec
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x4b6227
cmp dword [ebx + 0x5c], 0
je 0x4b6227
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.004ae3d8
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x4b6372
cmp dword [ebx + 0x7c], 0
jne 0x4b624d
mov dl, 1
mov eax, dword [0x41d170]
call fcn.00403670
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x4b634b
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x4b6378]
push eax
mov al, byte [0x4b637c]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x655b40]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x4976e0]
call fcn.00499730
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4b6344
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004ae3d8
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.004ae3d8
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x4abc94]
call fcn.00405d2c
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x4b6317
mov edx, dword [0x655f90]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x4b6328
cmp eax, 0x1007
jne 0x4b6324
mov byte [ebx + 0x74], 0x18
jmp 0x4b6328
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6372
mov eax, dword [ebp - 4]
call fcn.004036a0
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.004ae3d8
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b70e4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4b7109
cmp dword [esp + 4], 5
jb 0x4b7109
mov al, 1
jmp 0x4b710b
xor eax, eax
add esp, 0x94
ret
Function at 0x4d2d3c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4d2d44
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d2f36
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4d2f4c
mov eax, esi
call fcn.004d08c4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045c8
lea ecx, [ebp - 0x10]
mov edx, 0x4d2f60
mov eax, esi
call fcn.004d08c4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045c8
lea ecx, [ebp - 0x14]
mov edx, 0x4d2f78
mov eax, esi
call fcn.004d08c4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045c8
lea ecx, [ebp - 0x18]
mov edx, 0x4d2f94
mov eax, esi
call fcn.004d08c4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045c8
lea ecx, [ebp - 0x1c]
mov edx, 0x4d2fb0
mov eax, esi
call fcn.004d08c4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045c8
lea ecx, [ebp - 0x24]
mov edx, 0x4d2fc8
mov eax, esi
call fcn.004d08c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040956c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409ae4
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4d2fe0
mov eax, esi
call fcn.004d08c4
mov eax, dword [ebp - 0x28]
call fcn.004cd920
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4d2ff0
mov eax, esi
call fcn.004d08c4
mov eax, dword [ebp - 0x2c]
call fcn.004cd920
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4d3008
mov eax, esi
call fcn.004d08c4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409ae4
inc eax
je 0x4d2ed9
lea ecx, [ebp - 0x34]
mov edx, 0x4d3008
mov eax, esi
call fcn.004d08c4
mov eax, dword [ebp - 0x34]
call fcn.00409aa8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040bab8
fstp qword [ebp - 0x3c]
wait
call fcn.0040bf2c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4d2ef4
lea ecx, [ebp - 0x40]
mov edx, 0x4d3008
mov eax, esi
call fcn.004d08c4
mov eax, dword [ebp - 0x40]
call fcn.004cd920
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4d3018
mov eax, esi
call fcn.004d08c4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004045c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2f3d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404598
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404598
ret
Function at 0x4e30d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4e3132
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004e30c8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004cbe5c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004cba5c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3139
lea eax, [ebp - 4]
call fcn.00404574
ret

Function at 0x4e6660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x4e677e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404844
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jle 0x4e66ab
mov eax, dword [ebp - 0xc]
and eax, 0x80000001
jns 0x4e66a7
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x4e66b5
mov ebx, 0x4e6790
jmp 0x4e6760
mov eax, dword [ebp - 4]
call fcn.004e65ec
and eax, 0xff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, 2
sar eax, 1
jns 0x4e66d2
adc eax, 0
mov dword [ebp - 0xc], eax
mov esi, 3
mov edi, dword [ebp - 0xc]
dec edi
test edi, edi
jl 0x4e6751
inc edi
mov dword [ebp - 8], 0
mov ebx, 0x658120
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x1c]
call fcn.00402e00
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov cl, 2
call fcn.00402dd0
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x14]
call fcn.004047e8
mov eax, dword [ebp - 0x14]
call fcn.004e65ec
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
xor al, byte [edx + 0x646f4c]
mov byte [ebx], al
add esi, 2
inc dword [ebp - 8]
inc ebx
dec edi
jne 0x4e66ef
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x658120], 0
mov ebx, 0x658120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6785
lea eax, [ebp - 0x14]
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404574
ret
Function at 0x4e67fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x4e68b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404844
mov ebx, eax
cmp ebx, 0x100
jle 0x4e6843
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004045c8
jmp 0x4e6892
call fcn.00402c04
mov eax, pe_nt_image_headers32
sub eax, ebx
call fcn.00402f3c
mov dword [ebp - 8], eax
mov al, byte [ebp - 8]
mov edx, esi
call fcn.004e6794
mov edi, ebx
dec edi
test edi, edi
jl 0x4e6892
inc edi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [ebp - 8]
add edx, ebx
xor al, byte [edx + 0x646f4c]
lea edx, [ebp - 0xc]
call fcn.004e6794
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040484c
inc ebx
dec edi
jne 0x4e686b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e68b7
lea eax, [ebp - 0xc]
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404574
ret

Function at 0x4f0258
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4f0286
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.004047f4
jmp 0x4f028d
mov eax, ebx
call fcn.00404574
add esp, 0x18
pop ebx
ret

Function at 0x4f0294
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00404574
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4f02ee
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4f02e2
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040a7b8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4f02d3
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f0d54
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
xor edx, edx
push ebp
push 0x4f0e15
push dword fs:[edx]
mov dword fs:[edx], esp
dec eax
je 0x4f0d80
sub eax, 2
je 0x4f0d9f
dec eax
je 0x4f0dbe
sub eax, 2
je 0x4f0ddd
jmp 0x4f0dfa
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x4f0e2c
call fcn.00404890
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
jmp 0x4f0dfa
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, 0x4f0e40
call fcn.00404890
mov eax, dword [ebp - 8]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
jmp 0x4f0dfa
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x4f0e54
call fcn.00404890
mov eax, dword [ebp - 0xc]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
jmp 0x4f0dfa
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 0x4f0e64
call fcn.00404890
mov eax, dword [ebp - 0x10]
call fcn.00404a44
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0e1c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404598
ret

Function at 0x4f151c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4f153c
mov eax, dword [0x655d48]
mov eax, dword [eax]
call fcn.004746e0
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
jg 0x4f1529
pop esi
pop ebx
ret
Function at 0x4f1708
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x4f1810
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a44
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4f17f2
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00404bd0
mov eax, dword [ebp - 0x24]
call fcn.00404a44
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4f17f2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x6470d8]
push eax
mov eax, dword [ebp - 0x24]
call fcn.00404a44
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f17f2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x4f1824
mov eax, dword [ebp - 0x24]
call fcn.00404a44
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f17f2
cmp dword [ebp - 0x14], 0x34
jb 0x4f17f2
push 1
push 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.00405708
push edx
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1817
lea eax, [ebp - 0x24]
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404574
ret

Function at 0x4f1828
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047f4
add esp, 0x108
pop ebx
ret

Function at 0x4f1854
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4f1882
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.004047f4
jmp 0x4f1889
mov eax, ebx
call fcn.00404574
add esp, 0x18
pop ebx
ret

Function at 0x4f1890
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00404574
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4f18ea
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4f18de
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040a7b8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4f18cf
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f18f8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0xff
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
cmp dword [esp], 0
jbe 0x4f192b
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0xff
call fcn.004047f4
jmp 0x4f1932
mov eax, ebx
call fcn.00404574
add esp, 0x104
pop ebx
ret

Function at 0x4f1b80
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x4f1b34
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f1dfc
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404a34
xor eax, eax
push ebp
push 0x4f1ee1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x198]
push eax
mov dl, 2
mov al, 2
call fcn.00407d84
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4f1ecb
xor eax, eax
push ebp
push 0x4f1ec4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4f1e6b
call fcn.00403f9c
jmp 0x4f1ecb
mov word [ebp - 0x1a8], 2
mov eax, dword [ebp - 4]
call fcn.00404a44
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1a4], eax
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x1a6], ax
push 0x10
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.wsock32.dll_bind
inc eax
je 0x4f1eab
mov byte [ebp - 5], 1
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1ecb
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1ee8
lea eax, [ebp - 4]
call fcn.00404574
ret
Function at 0x4f1f84
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x658250
test esi, esi
jne 0x4f1f9e
xor eax, eax
jmp 0x4f20a0
cmp dword [ebp], 0
jne 0x4f1fa9
call fcn.004f1f14
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4f2079
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4f1fb5
test edi, edi
jbe 0x4f209b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4f207d
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f2b80
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.ntdll.dll_RtlGetVersion
test eax, eax
jne 0x4f2bd3
cmp dword [esp + 4], 6
jne 0x4f2bad
cmp dword [esp + 8], 2
jne 0x4f2bad
mov ebx, 1
cmp dword [esp + 4], 6
jne 0x4f2bc0
cmp dword [esp + 8], 3
jne 0x4f2bc0
mov ebx, 2
cmp dword [esp + 4], 0xa
jne 0x4f2bd3
cmp dword [esp + 8], 0
jne 0x4f2bd3
mov ebx, 3
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x4f2dc8
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
call fcn.004f2be0
cmp al, 7
jb 0x4f2e72
push 0x4f2e84
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f2e6b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f2e94
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
mov ebx, eax
test esi, esi
je 0x4f2e1d
cmp ebx, 0xffffffff
setne al
mov byte [esi], al
cmp ebx, 0xffffffff
je 0x4f2e4d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 5
push ebx
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test al, al
je 0x4f2e44
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040477c
jmp 0x4f2e54
mov eax, edi
call fcn.00404574
jmp 0x4f2e54
mov eax, edi
call fcn.00404574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2e7b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov edx, edi
mov eax, esi
call fcn.004f29bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f38d4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407db8
ret