joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5044
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor edi, edi
push ebp
push 0x4c51a4
push dword fs:[edi]
mov dword fs:[edi], esp
mov dword [ebp - 0x10], 0x4c5014
mov eax, 0x64
lea edx, [ebp - 0x84]
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx]
mov byte [edx], cl
inc dword [ebp - 0x10]
inc edx
dec eax
jne 0x4c5086
push 0x4c51b8
push 0x4c51c8
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x18c], eax
mov eax, esi
call fcn.00409af0
mov ecx, eax
test ecx, ecx
jl 0x4c50cf
inc ecx
xor eax, eax
lea edx, [ebp - 0x188]
mov bl, byte [esi + eax]
mov byte [edx], bl
inc eax
inc edx
dec ecx
jne 0x4c50c5
mov eax, esi
call fcn.00409af0
mov byte [ebp + eax - 0x188], 0
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x16c
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4c5108
call fcn.0040e448
lea eax, [ebp - 0x18]
push eax
push 0x16c
lea eax, [ebp - 0x18c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
jne 0x4c512e
call fcn.0040e448
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x108
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x4c5159
call fcn.0040e448
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeThread
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c51ab
cmp dword [ebp - 0x14], 0
je 0x4c51a3
push 0x8000
push 0x16c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFreeEx
ret
Function at 0x4c51d8
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [esi], 0xffffffff
xor ecx, ecx
push ebp
push 0x4c5321
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 0xc], 0x4c5028
mov edx, 0x64
lea eax, [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov cl, byte [ecx]
mov byte [eax], cl
inc dword [ebp - 0xc]
inc eax
dec edx
jne 0x4c5214
push 0x4c5334
push 0x4c5340
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], ebx
push 0x4c5350
push 0x4c535c
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x84], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x74
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c528d
call fcn.0040e448
lea eax, [ebp - 0x14]
push eax
push 0x74
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
jne 0x4c52b0
call fcn.0040e448
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x4c52d9
call fcn.0040e448
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeThread
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5328
cmp dword [ebp - 0x10], 0
je 0x4c5320
push 0x8000
push 0x16c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFreeEx
ret
Function at 0x4c7298
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4c736d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x34]
call fcn.00404f14
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebx + 0x40], esi
inc esi
je 0x4c72d6
lea eax, [ebx + 0x38]
mov edx, dword [ebx + 0x34]
call fcn.00404aa8
jmp 0x4c7333
mov eax, dword [ebx + 0x34]
call fcn.00404f14
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c7319
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x70], eax
cmp word [ebx + 0x5a], 0
je 0x4c7352
lea eax, [ebp - 8]
mov ecx, dword [ebx + 0x34]
mov edx, 0x4c7384
call fcn.00404d60
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
jmp 0x4c7352
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 0x40], eax
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.00404c4c
push dword [ebx + 0x40]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0xc]
call fcn.00409d20
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x3c]
call fcn.00404aa8
mov byte [ebx + 0x74], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7374
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404a78
ret
Function at 0x4c87dc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4c87e5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4c8989
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c8b24
xor eax, eax
push ebp
push 0x4c8967
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4c8834
call fcn.004044f8
jmp 0x4c896e
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4c88f6
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4c8884
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4c8884
lea eax, [ebp - 0x10]
call fcn.004c85ac
push dword [ebp - 0x10]
push 0x4c89a4
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404dd4
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4c88b9
lea eax, [ebp - 0x18]
call fcn.004c85ac
push dword [ebp - 0x18]
push 0x4c89a4
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404dd4
mov eax, dword [ebp - 0x14]
call fcn.00404f14
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4c8951
lea eax, [ebp - 0x20]
call fcn.004c85ac
push dword [ebp - 0x20]
push 0x4c89a4
push ebx
push 0x4c89b0
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404dd4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004c87ac
jmp 0x4c8951
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4c8918
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4c8918
push ebx
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4c892e
mov eax, ebx
call fcn.00404f14
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4c8951
lea eax, [ebp - 0x24]
mov ecx, 0x4c89b0
mov edx, ebx
call fcn.00404d60
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004c87ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c896e
mov eax, dword [ebp - 4]
call fcn.004c8b30
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8990
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404a78
ret
Function at 0x4d312c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004d303c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d31d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004d3220
test al, al
jne 0x4d31be
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004d3260
test al, al
jne 0x4d31b7
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004d305c
mov ebx, eax
test ebx, ebx
je 0x4d31ab
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4d31a4
mov dword [ebp - 8], 2
jmp 0x4d31ab
mov dword [ebp - 8], 3
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d3020
jmp 0x4d31be
mov dword [ebp - 8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d31de
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004d304c
ret

Function at 0x4d31e8
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, eax
xor ebx, ebx
test edx, edx
jbe 0x4d3217
mov eax, esi
call fcn.004d305c
mov edi, eax
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4d320e
mov ebx, dword [esp + 4]
mov edx, edi
mov eax, esi
call fcn.004d3020
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x4d4354
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d4467
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 0x4d4480
call fcn.004d423c
cmp dword [ebp - 4], 0
je 0x4d443f
mov eax, ebx
call fcn.0044b43c
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], 1
lea eax, [ebp - 0x2c]
mov ecx, 0x4d4494
mov edx, dword [ebp - 4]
call fcn.00404d60
mov eax, dword [ebp - 0x2c]
call fcn.00404f14
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 8]
mov ecx, 0x4d44a0
mov edx, dword [ebp - 4]
call fcn.00404d60
lea eax, [ebp - 0x30]
mov ecx, 0x4d4494
mov edx, dword [ebp - 8]
call fcn.00404d60
mov eax, dword [ebp - 0x30]
call fcn.00404f14
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x48
xor eax, eax
push ebp
push 0x4d4435
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x4d442b
mov dl, 1
mov eax, dword [0x4d2fc8]
call fcn.00403c3c
mov ebx, eax
mov edx, 0x4d44c8
mov eax, ebx
call fcn.004d306c
mov eax, ebx
call fcn.00403c6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d443f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d446e
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404a78
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret
Function at 0x4d44d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d45d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4d2fc8]
call fcn.00403c3c
mov ebx, eax
mov edx, 0x4d45e4
mov eax, ebx
call fcn.004d312c
mov eax, ebx
call fcn.00403c6c
lea eax, [ebp - 4]
mov edx, 0x4d45f4
call fcn.00404aec
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004d423c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00404aec
cmp dword [ebp - 4], 0
je 0x4d45af
mov eax, esi
call fcn.0044b43c
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], 1
lea eax, [ebp - 0x30]
mov ecx, 0x4d4630
mov edx, dword [ebp - 4]
call fcn.00404d60
mov eax, dword [ebp - 0x30]
call fcn.00404f14
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 8]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404f74
lea eax, [ebp - 0x34]
mov ecx, 0x4d4630
mov edx, dword [ebp - 8]
call fcn.00404d60
mov eax, dword [ebp - 0x34]
call fcn.00404f14
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x48
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d45de
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404a78
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret
Function at 0x4d4ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
xor eax, eax
push ebp
push 0x4d4c4b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.004beef0
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004bef10
mov ebx, eax
jmp 0x4d4c1d
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404cc4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004099b4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408f94
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408f94
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404e60
je 0x4d4bf4
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404cc4
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408f94
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408f94
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404e60
jne 0x4d4c0e
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004bef30
mov ebx, eax
test ebx, ebx
jne 0x4d4b4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4c52
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404a78
lea eax, [ebp - 4]
call fcn.00404a54
ret
Function at 0x4d4d0c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
xor eax, eax
push ebp
push 0x4d4eee
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x110]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x110]
call fcn.00409d20
mov edx, dword [ebp - 4]
mov eax, 0x4d4f04
call fcn.00405058
mov ebx, eax
test ebx, ebx
je 0x4d4dfc
push 0x4d4f10
lea eax, [ebp - 0x114]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404f74
push dword [ebp - 0x114]
push 0x4d4f1c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404dd4
push 0x4d4f10
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d14
mov ecx, eax
sub ecx, ebx
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.00404f74
push dword [ebp - 0x118]
push 0x4d4f1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404dd4
jmp 0x4d4e0f
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404aec
lea eax, [ebp - 0xc]
call fcn.00404a54
mov dl, 1
mov eax, dword [0x417b0c]
call fcn.00403c3c
mov ebx, eax
lea eax, [ebp - 0x11c]
mov ecx, 0x4d4f30
mov edx, dword [ebp - 0x10]
call fcn.00404d60
mov edx, dword [ebp - 0x11c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
cmp dword [ebp - 8], 0
je 0x4d4e52
mov ecx, dword [ebp - 8]
mov edx, 0x19
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x20]
cmp dword [ebp - 0xc], 0
je 0x4d4e67
mov ecx, dword [ebp - 0xc]
mov edx, 0x1a
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x20]
lea eax, [ebp - 0x120]
mov ecx, 0x4d4f30
mov edx, dword [ebp - 0x10]
call fcn.00404d60
mov edx, dword [ebp - 0x120]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, ebx
call fcn.00403c6c
push 0
push 0
push 0
lea eax, [ebp - 0x124]
mov ecx, 0x4d4f30
mov edx, dword [ebp - 0x10]
call fcn.00404d60
mov eax, dword [ebp - 0x124]
call fcn.00404f14
push eax
push 0x4d4f40
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4ef5
lea eax, [ebp - 0x124]
mov edx, 5
call fcn.00404a78
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a78
ret
Function at 0x4d4f64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xfffffefc
mov byte [esp], dl
mov ebx, eax
lea eax, [esp + 1]
push eax
call sub.user32.dll_GetKeyboardState
xor eax, eax
mov al, bl
cmp byte [esp + eax + 1], 0
setne al
xor al, byte [esp]
je 0x4d4fc9
mov eax, dword [0x4e6fdc]
cmp dword [eax], 2
je 0x4d4f9a
cmp bl, 0x90
je 0x4d4fb4
push 0
push 1
push 0x45
push ebx
call sub.user32.dll_keybd_event
push 0
push 3
push 0x45
push ebx
call sub.user32.dll_keybd_event
jmp 0x4d4fc9
mov al, byte [esp]
xor edx, edx
mov dl, bl
mov byte [esp + edx + 1], al
lea eax, [esp + 1]
push eax
call sub.user32.dll_SetKeyboardState
add esp, 0x104
pop ebx
ret

Function at 0x4d51f0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x4d5209
push 9
push esi
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x4d5219
mov bl, 1
jmp 0x4d5306
mov eax, dword [0x4e6fdc]
cmp dword [eax], 2
jne 0x4d522d
mov eax, dword [0x4e6c28]
cmp dword [eax], 4
jg 0x4d5261
mov eax, dword [0x4e6fdc]
cmp dword [eax], 1
jne 0x4d52f0
mov eax, dword [0x4e6c28]
cmp dword [eax], 4
jg 0x4d5261
mov eax, dword [0x4e6c28]
cmp dword [eax], 4
jne 0x4d52f0
mov eax, dword [0x4e6e78]
cmp dword [eax], 0
jle 0x4d52f0
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x4d52a8
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x4d52fc
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
jmp 0x4d52fc
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d5310
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00409d20
add esp, 0x100
pop ebx
ret
Function at 0x4d533c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4d53db
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x4d539f
dec ecx
jne 0x4d53d7
cmp eax, 4
jg 0x4d5372
mov al, 5
jmp 0x4d53dd
cmp eax, 5
jne 0x4d537f
test edx, edx
jne 0x4d537f
mov al, 6
jmp 0x4d53dd
cmp eax, 5
jne 0x4d538d
cmp edx, 1
jne 0x4d538d
mov al, 7
jmp 0x4d53dd
cmp eax, 5
jne 0x4d539b
cmp edx, 2
jne 0x4d539b
mov al, 8
jmp 0x4d53dd
xor eax, eax
jmp 0x4d53dd
cmp eax, 4
jne 0x4d53ac
test edx, edx
jne 0x4d53ac
mov al, 1
jmp 0x4d53dd
cmp eax, 4
jne 0x4d53c5
cmp edx, 0xa
jne 0x4d53c5
cmp byte [esp + 0x15], 0x41
jne 0x4d53c1
mov al, 3
jmp 0x4d53dd
mov al, 2
jmp 0x4d53dd
cmp eax, 4
jne 0x4d53d3
cmp edx, 0x5a
jne 0x4d53d3
mov al, 4
jmp 0x4d53dd
xor eax, eax
jmp 0x4d53dd
xor eax, eax
jmp 0x4d53dd
xor eax, eax
add esp, 0x94
ret

Function at 0x4d5864
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe28
mov edi, eax
lea eax, [esp + 0x48]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, edi
call fcn.00404a54
push 0x40
lea eax, [esp + 0xc]
push eax
call sub.wsock32.dll_gethostname
lea eax, [esp + 8]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [esp], eax
cmp dword [esp], 0
je 0x4d58d1
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
xor ebx, ebx
jmp 0x4d58c1
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.00409d20
inc ebx
mov eax, dword [esp + 4]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x4d58b2
call sub.wsock32.dll_WSACleanup
add esp, 0x1d8
pop edi
pop esi
pop ebx
ret

Function at 0x4d58dc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d5949
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00407c7c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00404cc4
mov eax, dword [ebp - 0x18]
mov edx, ebx
call fcn.0040920c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5950
lea eax, [ebp - 0x18]
call fcn.00404a54
ret