joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475a48
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x475ab2
mov eax, ebx
call fcn.00477ea0
test al, al
jne 0x475ab2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404cf0
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x475a9f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x475abf
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c54
jmp 0x475abf
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c54
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x476fa0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47700e
mov eax, esi
call fcn.0045ec30
test al, al
je 0x47700e
mov eax, dword [ebx + 0x84]
call fcn.0045e890
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47700e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x477002
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045e890
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004566c8
jmp 0x47700e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00476ddc
pop esi
pop ebx
ret
Function at 0x494bb0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
cmp dword [ebp + 8], 0
je 0x494c34
mov edx, dword [ebx + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 8]
push ecx
push str.CREATE_TABLE___w_.__w_node__nodeno_INTEGER_PRIMARY_KEY__data_BLOB__CREATE_TABLE___w_.__w_rowid__rowid_INTEGER_PRIMARY_KEY__nodeno_INTEGER__CREATE_TABLE___w_.__w_parent__nodeno_INTEGER_PRIMARY_KEY__parentnode_INTEGER__INSERT_INTO__q._q_node_VALUES_1__zeroblob__d__
call fcn.004dd8f8
add esp, 0x28
mov edi, eax
test edi, edi
jne 0x494c10
mov eax, 7
jmp 0x494ceb
push 0
push 0
xor ecx, ecx
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004b19b0
mov esi, eax
mov eax, edi
call fcn.004de03c
test esi, esi
je 0x494c34
mov eax, esi
jmp 0x494ceb
lea edx, [ebx + 0x234]
lea ecx, [ebx + 0x238]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
lea ecx, [ebx + 0x23c]
lea eax, [ebx + 0x240]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
lea edx, [ebx + 0x244]
lea ecx, [ebx + 0x248]
mov dword [ebp - 0x24], edx
lea eax, [ebx + 0x24c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
lea edx, [ebx + 0x250]
add ebx, 0x254
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
xor eax, eax
lea edx, [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov edi, 0x5d1ee0
jmp 0x494cdf
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004dd8f8
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x494cc9
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push edx
push 0
or ecx, 0xffffffff
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004996c4
mov esi, eax
jmp 0x494cce
mov esi, 7
mov eax, ebx
call fcn.004de03c
inc dword [ebp - 0xc]
add dword [ebp - 0x10], 4
add edi, 4
cmp dword [ebp - 0xc], 9
jge 0x494ce9
test esi, esi
je 0x494c97
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x494d44
Capabilities:
Reference sql statements

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov edi, eax
test ecx, ecx
je 0x494d9b
xor eax, eax
mov dword [esp], eax
mov edx, dword [ebx + 0x20]
push edx
push str.PRAGMA__Q.page_size
call fcn.004dd8f8
add esp, 8
mov esi, eax
mov ecx, esp
mov edx, esi
mov eax, edi
call fcn.00494cf4
mov edi, eax
test edi, edi
jne 0x494dc0
mov eax, dword [esp]
add eax, 0xffffffc0
mov dword [ebx + 0x10], eax
mov edx, dword [ebx + 0x18]
mov ecx, edx
shl edx, 4
add edx, ecx
lea edx, [edx + edx*2]
add edx, 4
cmp eax, edx
jle 0x494dc0
mov dword [ebx + 0x10], edx
jmp 0x494dc0
mov ecx, dword [ebx + 0x24]
push ecx
mov eax, dword [ebx + 0x20]
push eax
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.004dd8f8
add esp, 0xc
mov esi, eax
lea ecx, [ebx + 0x10]
mov edx, esi
mov eax, edi
call fcn.00494cf4
mov edi, eax
mov eax, esi
call fcn.004de03c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b9d60
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov esi, edx
mov edi, eax
test esi, esi
jne 0x4b9d75
xor eax, eax
jmp 0x4b9e4b
mov edx, 0x4c
mov eax, edi
call fcn.004de27c
mov ebx, eax
test ebx, ebx
jne 0x4b9d8e
xor eax, eax
jmp 0x4b9e4b
mov ecx, ebp
mov edx, dword [esi]
mov eax, edi
call fcn.004b9a7c
mov dword [ebx], eax
mov ecx, ebp
mov edx, dword [esi + 8]
mov eax, edi
call fcn.004b9b70
mov dword [ebx + 8], eax
mov ecx, ebp
mov edx, dword [esi + 0xc]
mov eax, edi
call fcn.004b9a74
mov dword [ebx + 0xc], eax
mov ecx, ebp
mov edx, dword [esi + 0x10]
mov eax, edi
call fcn.004b9a7c
mov dword [ebx + 0x10], eax
mov ecx, ebp
mov edx, dword [esi + 0x14]
mov eax, edi
call fcn.004b9a74
mov dword [ebx + 0x14], eax
mov ecx, ebp
mov edx, dword [esi + 0x18]
mov eax, edi
call fcn.004b9a7c
mov dword [ebx + 0x18], eax
mov eax, edi
mov dl, byte [esi + 4]
mov ecx, ebp
mov byte [ebx + 4], dl
mov edx, dword [esi + 0x1c]
call fcn.004b9d60
mov dword [ebx + 0x1c], eax
mov ecx, ebp
mov edx, dword [esi + 0x28]
mov eax, edi
call fcn.004b9a74
mov dword [ebx + 0x28], eax
mov ecx, ebp
mov edx, dword [esi + 0x2c]
mov eax, edi
call fcn.004b9a74
mov dword [ebx + 0x2c], eax
xor ecx, ecx
mov dword [ebx + 0x30], ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov ax, word [esi + 6]
and ax, 0xfff7
xor edx, edx
mov word [ebx + 6], ax
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x3c], 0xffffffff
mov dword [ebx + 0x40], 0xffffffff
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bf3a4
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov dword [esp], eax
mov eax, dword [esp]
mov edx, dword [eax + 0x3c]
mov eax, dword [edx]
call fcn.004d4914
mov dword [esp + 0x18], eax
xor ebx, ebx
mov edx, dword [esp]
mov eax, dword [esp]
mov ebp, dword [edx + 0x40]
xor edx, edx
mov dl, byte [eax + 5]
mov dword [esp + 8], edx
mov ecx, dword [esp]
movzx eax, word [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp]
movzx ecx, word [edx + 0x10]
mov dword [esp + 0x14], ecx
mov eax, dword [esp]
mov edx, dword [eax + 0x3c]
mov ecx, dword [edx + 0x28]
xor edx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov bl, byte [ebp + eax + 5]
mov eax, dword [esp + 8]
shl ebx, 8
mov dl, byte [ebp + eax + 6]
or ebx, edx
mov eax, dword [esp + 0x18]
sub ecx, ebx
add eax, ebx
lea edx, [ebx + ebp]
call fcn.00478458
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
add eax, eax
xor ecx, ecx
add eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0xc]
add edx, 0xfffffffc
mov dword [esp + 0x20], edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x14]
jge 0x4bf4e2
mov edi, dword [esp + 4]
xor eax, eax
add edi, edi
add edi, dword [esp + 0x10]
add edi, ebp
movzx esi, byte [edi]
shl esi, 8
mov al, byte [edi + 1]
or esi, eax
cmp esi, dword [esp + 0x1c]
jl 0x4bf477
cmp esi, dword [esp + 0x20]
jle 0x4bf486
mov eax, 0x452
call fcn.004afc70
jmp 0x4bf540
mov edx, dword [esp + 0x18]
mov eax, dword [esp]
add edx, esi
call fcn.004bf28c
movzx eax, ax
sub ebx, eax
cmp ebx, dword [esp + 0x1c]
jl 0x4bf4a8
lea edx, [eax + esi]
cmp edx, dword [esp + 0xc]
jle 0x4bf4b7
mov eax, 0x45e
call fcn.004afc70
jmp 0x4bf540
lea ecx, [ebx + ebp]
mov edx, dword [esp + 0x18]
xchg ecx, eax
add edx, esi
call fcn.00478458
mov edx, ebx
sar edx, 8
mov byte [edi], dl
mov byte [edi + 1], bl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, dword [esp + 0x14]
jl 0x4bf452
mov eax, dword [esp + 8]
mov edx, ebx
sar edx, 8
mov esi, ebx
mov byte [ebp + eax + 5], dl
mov ecx, dword [esp + 8]
mov byte [ebp + ecx + 6], bl
mov eax, dword [esp + 8]
mov byte [ebp + eax + 1], 0
mov edx, dword [esp + 8]
mov byte [ebp + edx + 2], 0
mov ecx, dword [esp + 8]
mov byte [ebp + ecx + 7], 0
sub esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add eax, ebp
xor edx, edx
mov ecx, esi
call fcn.00478478
mov edi, dword [esp]
movzx eax, word [edi + 0xe]
cmp esi, eax
je 0x4bf53e
mov eax, 0x46f
call fcn.004afc70
jmp 0x4bf540
xor eax, eax
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d4c44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ebp
add esp, 0xffffffec
mov eax, dword [ebx + 0x3c]
xor ebp, ebp
mov esi, edx
cmp dword [eax], 0
jne 0x4d4c67
mov ecx, dword [ebx + 0x78]
mov edx, eax
mov eax, ebx
call fcn.004d47d8
mov ebp, eax
test ebp, ebp
jne 0x4d4d6b
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x24]
jbe 0x4d4d6b
mov eax, dword [ebx + 0x18]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x80]
cdq
call fcn.004781d0
mov dword [esp], eax
mov dword [esp + 4], edx
mov ecx, esp
mov edx, 5
mov eax, dword [ebx + 0x3c]
call fcn.004ded3c
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x24], ecx
jmp 0x4d4d6b
mov edi, dword [esi + 0xc]
cmp edi, dword [ebx + 0x18]
ja 0x4d4d68
test byte [esi + 0x14], 0x20
jne 0x4d4d68
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
mov eax, edi
dec eax
xor edx, edx
call fcn.004781d0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [esi + 0xc], 1
jne 0x4d4ced
mov eax, esi
call fcn.004d4274
cmp dword [ebx + 0xa4], 0
jne 0x4d4cfe
mov edx, dword [esi]
mov dword [esp + 0x10], edx
jmp 0x4d4d1f
push 6
mov ecx, edi
mov edx, dword [esi]
mov eax, dword [ebx + 0xb0]
call dword [ebx + 0xa4]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4d4d1f
mov eax, 7
jmp 0x4d4d79
push dword [esp + 0xc]
push dword [esp + 0xc]
mov ecx, dword [ebx + 0x80]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x3c]
call fcn.004decec
mov ebp, eax
cmp edi, 1
jne 0x4d4d54
mov edx, dword [esp + 0x10]
add edx, 0x18
lea eax, [ebx + 0x64]
mov ecx, 0x10
call fcn.00478458
cmp edi, dword [ebx + 0x20]
jbe 0x4d4d5c
mov dword [ebx + 0x20], edi
mov ecx, dword [esi]
mov edx, edi
mov eax, dword [ebx + 0x58]
call fcn.004d0c38
mov esi, dword [esi + 8]
test ebp, ebp
jne 0x4d4d77
test esi, esi
jne 0x4d4caf
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d7cf4
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
jle 0x4d7d15
mov ebx, ecx
shl ebx, 3
xor ecx, ebx
xor ebx, ebx
mov bl, byte [eax]
inc eax
movzx ebx, byte [ebx + 0x5da744]
xor ecx, ebx
dec edx
test edx, edx
jg 0x4d7cfb
mov eax, ecx
pop ebx
ret
Function at 0x4df644
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push esi
push edi
mov edi, dword [ebx + 0x20]
xor esi, esi
test edi, edi
je 0x4df680
mov eax, dword [ebx + 0x20]
cdq
push edx
push eax
mov eax, dword [ebx + 0x20]
cdq
push edx
push eax
mov eax, edi
cdq
add eax, dword [ebp + 8]
adc edx, dword [ebp + 0xc]
sub eax, 1
sbb edx, 0
call fcn.004780c0
call fcn.004781d0
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, ebx
call fcn.004df424
test eax, eax
je 0x4df6ac
push 0x3cc
mov edx, str.winTruncate1
mov ecx, dword [ebx + 0x1c]
mov eax, 0x60a
call fcn.004df324
mov esi, eax
jmp 0x4df6da
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x4df6da
call sub.kernel32.dll_GetLastError
mov dword [ebx + 0x10], eax
push 0x3cf
mov edx, str.winTruncate2
mov ecx, dword [ebx + 0x1c]
mov eax, 0x60a
call fcn.004df324
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4df71c
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
lea eax, [esp + 4]
mov dword [esp], edx
push eax
mov edx, dword [ebx + 8]
push edx
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x4df763
call sub.kernel32.dll_GetLastError
mov edi, eax
test eax, eax
je 0x4df763
mov dword [ebx + 0x10], edi
push 0x41f
mov edx, str.winFileSize
mov ecx, dword [ebx + 0x1c]
mov eax, 0x70a
call fcn.004df324
jmp 0x4df787
mov eax, dword [esp + 4]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, esi
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ecx, dword [esp]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4e033c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbec
mov edi, edx
mov ebx, eax
mov eax, dword [0x5cfb78]
test eax, eax
je 0x4e0370
push eax
push 0x5dac0a
lea edx, [esp + 8]
push edx
push 0xe6
call fcn.004dd958
add esp, 0x10
jmp 0x4e0419
call fcn.004df03c
test eax, eax
je 0x4e03ca
lea ecx, [esp + 0x108]
push ecx
push 0xe6
call sub.kernel32.dll_GetTempPathW
lea eax, [esp + 0x108]
call fcn.004df0d8
mov esi, eax
test esi, esi
je 0x4e03be
push esi
push 0x5dac0a
lea eax, [esp + 8]
push eax
push 0xe6
call fcn.004dd958
add esp, 0x10
mov eax, esi
call fcn.00478350
jmp 0x4e0419
mov eax, 7
jmp 0x4e04ac
lea edx, [esp + 0x310]
push edx
push 0xe6
call sub.kernel32.dll_GetTempPathA
lea eax, [esp + 0x310]
call fcn.004df200
mov esi, eax
test esi, esi
je 0x4e040f
push esi
push 0x5dac0a
lea eax, [esp + 8]
push eax
push 0xe6
call fcn.004dd958
add esp, 0x10
mov eax, esi
call fcn.00478350
jmp 0x4e0419
mov eax, 7
jmp 0x4e04ac
mov eax, esp
call fcn.004d809c
mov esi, eax
mov eax, str.etilqs_
call fcn.004d809c
add esi, eax
add esi, 0x11
cmp ebx, esi
jg 0x4e043c
mov eax, 1
jmp 0x4e04ac
mov eax, esp
call fcn.004d809c
mov ecx, eax
lea eax, [esp + ecx - 1]
jmp 0x4e044d
dec ecx
dec eax
test ecx, ecx
jbe 0x4e0456
cmp byte [eax], 0x5c
je 0x4e044b
mov byte [esp + ecx], 0
push esp
push str._setilqs_
push edi
add ebx, 0xffffffef
push ebx
call fcn.004dd958
add esp, 0x10
mov eax, edi
call fcn.004d809c
mov esi, eax
mov eax, 0xf
mov edx, esi
add edx, edi
call fcn.004da608
xor ecx, ecx
lea ebx, [edi + esi]
xor eax, eax
mov ebp, 0x3e
mov al, byte [ebx]
xor edx, edx
div ebp
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebx], al
inc ecx
inc ebx
inc esi
cmp ecx, 0xf
jb 0x4e0489
mov byte [edi + esi], 0
xor eax, eax
add esp, 0x414
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e06b0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
xor edx, edx
mov dword [esp], edx
mov eax, edi
call fcn.004e031c
mov ebx, eax
test ebx, ebx
jne 0x4e06d2
mov eax, 7
jmp 0x4e0778
call fcn.004df03c
test eax, eax
je 0x4e0713
mov esi, 1
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4e0702
push ebx
call sub.kernel32.dll_DeleteFileW
mov esi, eax
test eax, eax
jne 0x4e0702
mov eax, esp
call fcn.004df3b4
test eax, eax
jne 0x4e06e0
test esi, esi
je 0x4e070a
xor edx, edx
jmp 0x4e070f
mov edx, 1
mov esi, edx
jmp 0x4e0749
mov esi, 1
push ebx
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4e073a
push ebx
call sub.kernel32.dll_DeleteFileA
mov esi, eax
test eax, eax
jne 0x4e073a
mov eax, esp
call fcn.004df3b4
test eax, eax
jne 0x4e0718
test esi, esi
je 0x4e0742
xor edx, edx
jmp 0x4e0747
mov edx, 1
mov esi, edx
test esi, esi
je 0x4e0767
push 0x971
mov edx, str.winDelete
mov ecx, edi
mov eax, 0xa0a
call fcn.004df324
mov esi, eax
jmp 0x4e076f
mov eax, dword [esp]
call fcn.004df3f8
mov eax, ebx
call fcn.00478350
mov eax, esi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4e09a0
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef0
mov dword [esp], 0x200
xor ebx, ebx
lea ecx, [esp + 8]
push ecx
mov ecx, 0x104
call fcn.004e0890
test eax, eax
jne 0x4e0a60
lea eax, [esp + 8]
call fcn.004e031c
mov esi, eax
test esi, esi
je 0x4e0a55
call fcn.004df03c
test eax, eax
je 0x4e0a1d
mov eax, esi
jmp 0x4e09f7
movzx edx, dx
cmp edx, 0x5c
jne 0x4e09f4
mov word [eax], 0
jmp 0x4e09ff
add eax, 2
mov dx, word [eax]
test dx, dx
jne 0x4e09e5
lea eax, [esp + 4]
push eax
lea ecx, [esp + 8]
push ecx
lea edi, [esp + 8]
push edi
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetDiskFreeSpaceW
mov ebx, eax
jmp 0x4e0a4e
mov eax, esi
jmp 0x4e0a2c
cmp dl, 0x5c
jne 0x4e0a2b
mov byte [eax], 0
jmp 0x4e0a32
inc eax
mov dl, byte [eax]
test dl, dl
jne 0x4e0a21
lea ecx, [esp + 4]
push ecx
lea edi, [esp + 8]
push edi
lea eax, [esp + 8]
push eax
lea edx, [esp + 0x10]
push edx
push esi
call sub.kernel32.dll_GetDiskFreeSpaceA
mov ebx, eax
mov eax, esi
call fcn.00478350
test ebx, ebx
jne 0x4e0a60
mov dword [esp], 0x200
mov eax, dword [esp]
add esp, 0x110
pop edi
pop esi
pop ebx
ret
Function at 0x4e58a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
lea eax, [ebp - 0xf8]
call fcn.004e5a08
lea ecx, [ebp - 0xf8]
mov edx, edi
mov eax, esi
call fcn.004e5a18
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x1a4]
mov ecx, 0xac
call fcn.00478458
lea ecx, [ebp - 0x1a4]
mov edx, dword [ebp + 0x14]
mov eax, ebx
call fcn.004e5a88
mov eax, dword [ebp + 8]
xor edx, edx
dec eax
shr eax, 5
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x4e59fc
lea eax, [ebp - 0x4c]
mov ecx, 0x20
xor edx, edx
call fcn.00478478
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.00478458
mov eax, dword [ebp - 4]
mov ebx, 4
inc eax
mov edx, eax
mov ecx, eax
shr edx, 0x18
shr ecx, 0x10
mov byte [ebp - 0x2c], dl
shr eax, 8
mov byte [ebp - 0x2b], cl
mov byte [ebp - 0x2a], al
xor edx, edx
mov al, byte [ebp - 4]
inc eax
mov byte [ebp - 0x29], al
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x4e59c2
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.004e5a88
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, 0x20
call fcn.004e5b18
xor ebx, ebx
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x2c]
mov cl, byte [eax]
xor byte [edx], cl
inc ebx
inc edx
inc eax
cmp ebx, 0x20
jb 0x4e5995
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.00478458
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
jb 0x4e596a
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
shl ebx, 5
mov eax, dword [ebp + 0xc]
lea edx, [eax + ebx]
lea eax, [ebp - 0x4c]
jmp 0x4e59e2
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc ebx
inc dword [ebp - 8]
inc edx
cmp dword [ebp - 8], 0x20
jae 0x4e59ed
cmp ebx, dword [ebp + 8]
jb 0x4e59d8
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x4e5912
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4e5a88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
push ecx
mov dword [esp], eax
mov eax, dword [ebx + 0xa8]
mov esi, edx
cmp eax, 0xffffffff
je 0x4e5b02
cmp eax, 0x40
jbe 0x4e5ab7
lea edx, [ebx + 0x40]
mov eax, ebx
call fcn.004e6d10
mov dword [ebx + 0xa8], 0x20
mov ecx, 0x40
mov eax, dword [ebx + 0xa8]
sub ecx, eax
add eax, ebx
xor edx, edx
call fcn.00478478
xor edx, edx
mov eax, ebx
xor dword [eax], 0x36363636
inc edx
add eax, 4
cmp edx, 0x10
jb 0x4e5ad1
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.004e6cf4
mov ecx, edi
mov edx, 0x40
mov eax, ebx
call fcn.004e6b04
mov dword [ebx + 0xa8], 0xffffffff
test esi, esi
je 0x4e5b13
lea ecx, [ebx + 0x40]
mov edx, esi
mov eax, dword [esp]
call fcn.004e6b04
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4e5b18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
cmp dword [ebx + 0xa8], 0xffffffff
je 0x4e5b39
mov ecx, ebx
xor edx, edx
xor eax, eax
call fcn.004e5a88
lea edx, [ebx + 0x40]
lea eax, [esp + 4]
call fcn.004e6d10
xor eax, eax
mov edx, ebx
xor dword [edx], 0x6a6a6a6a
inc eax
add edx, 4
cmp eax, 0x10
jb 0x4e5b49
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.004e6cf4
mov ecx, edi
mov edx, 0x40
mov eax, ebx
call fcn.004e6b04
mov ecx, edi
lea eax, [esp + 4]
mov edx, 0x20
call fcn.004e6b04
mov edx, edi
lea eax, [esp + 4]
call fcn.004e6d10
xor eax, eax
mov edx, dword [esp]
mov ecx, edx
lea edx, [esp + 4]
cmp esi, eax
jbe 0x4e5ba5
mov bl, byte [edx]
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp esi, eax
ja 0x4e5b9a
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x4e6cf4
Capabilities:
Hash data using sha256

Disassembly:
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax], edx
mov edx, 0x5dfe50
add eax, 8
mov ecx, 0x20
call fcn.00478458
ret
Function at 0x4ef51c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x50], eax
xor edx, edx
mov dword [ebp - 0x54], edx
Function at 0x5021a8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4085c0]
call fcn.004059b0
xor eax, eax
push ebp
push 0x502349
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5f06dc], 0
jne 0x502203
mov ecx, dword [0x603f44]
mov dl, 1
mov eax, dword [0x408af0]
call fcn.0040e350
call fcn.00404578
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004034c0
mov eax, ebx
call fcn.004055cc
mov dword [ebp - 0x24], eax
mov esi, 0x502358
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406d04
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004055dc
test eax, eax
jle 0x5022ec
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x5022d8
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404e80
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x50227e
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404e98
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x502294
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404e98
mov eax, dword [ebp - 0x54]
call fcn.004050a0
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404e80
mov eax, dword [ebp - 0x58]
call fcn.004050a0
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x5022da
xor eax, eax
test al, al
je 0x5022e5
mov ebx, 0x15
jmp 0x5022f1
mov ebx, 0x10
jmp 0x5022f1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x5f06dc]
call fcn.00502028
mov eax, dword [ebp - 4]
call fcn.00502028
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406d1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502350
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404c24
lea eax, [ebp - 0xc]
mov edx, dword [0x4085c0]
call fcn.00405a80
ret

Function at 0x516028
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, byte [0x516064]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x51603f
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x51604e
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x51605d
or bl, 2
mov eax, ebx
pop ebx
ret