joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9bf8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4a9c29
dec al
je 0x4a9c65
dec al
je 0x4a9ca9
dec al
je 0x4a9d14
jmp 0x4a9d9e
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a9d9e
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a9c39
jmp 0x4a9d9e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a9d9e
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a9c75
jmp 0x4a9d9e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a9d9e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a9cd7
xor ebp, ebp
jmp 0x4a9ce8
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a9cf1
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a9cb9
jmp 0x4a9d9e
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a9d9e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a9d6c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a76b0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a9d28
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4adb44
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4adc32
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
push 0x4adc48
mov eax, dword [0x4c0854]
mov eax, dword [eax]
push dword [eax + 0x57c]
push 0x4adc5c
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404938
push dword [ebp - 0x10c]
push 0x4adc70
push 0x4adc7c
lea eax, [ebp - 0x110]
call fcn.004b23c4
push dword [ebp - 0x110]
push 0x4adc70
lea eax, [ebp - 0x114]
call fcn.004adad4
push dword [ebp - 0x114]
lea eax, [ebp - 0x108]
mov edx, 9
call fcn.00404a48
mov edx, dword [ebp - 0x108]
mov eax, dword [ebx + 0x340]
call fcn.0043fe8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adc39
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.004046ec
ret
Function at 0x4afa08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4afa10
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4afba1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x4c0908]
mov eax, dword [eax]
call fcn.00460430
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409820
lea eax, [ebp - 0x14]
mov edx, 0x4afbb8
call fcn.00404990
mov eax, dword [ebp - 0x14]
call fcn.00409684
test al, al
je 0x4afaa0
lea edx, [ebp - 0x20]
mov eax, dword [0x4c0908]
mov eax, dword [eax]
call fcn.00460430
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409820
lea eax, [ebp - 0x1c]
mov edx, 0x4afbb8
call fcn.00404990
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x168]
call fcn.004259d8
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402b0c
mov eax, dword [ebp - 0x24]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov eax, esi
call fcn.004027ac
mov edi, eax
push edi
push esi
push 0
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402b0c
mov eax, dword [ebp - 0x28]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4afbc4
push edi
call sub.version.dll_VerQueryValueA
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00409268
push dword [ebp - 0x30]
push 0x4afbd0
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00409268
push dword [ebp - 0x34]
push 0x4afbd0
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.00409268
push dword [ebp - 0x38]
push 0x4afbd0
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409268
push dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00404a48
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, 0xff
call fcn.00404964
mov edx, esi
mov eax, edi
call fcn.004027cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afba8
lea eax, [ebp - 0x3c]
mov edx, 0xb
call fcn.004046ec
ret
Function at 0x4b0ff8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b107e
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x14], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
call fcn.00404b88
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 0x3c4]
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b1068
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1085
lea eax, [ebp - 4]
call fcn.004046c8
ret

Function at 0x4b1090
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00403114
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
mov eax, dword [ebx + 0x3c4]
push eax
call sub.wsock32.dll_recvfrom
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b10dd
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
jmp 0x4b10ef
push dword [ebp - 0x10]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.004048c0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4b1134
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
mov eax, dword [ebp - 8]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b11cc
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404b88
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x4b11af
push 4
mov eax, dword [ebp - 4]
call fcn.00404b88
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x4b11a9
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4b11a3
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b11d3
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046ec
ret
Function at 0x4b15c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b164f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.00409bd8
mov ebx, eax
lea eax, [ebp - 4]
push eax
push esi
mov eax, dword [0x4c0908]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4b161c
mov eax, edi
mov edx, ebx
call fcn.004048c0
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov eax, ebx
call fcn.00409c24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1656
lea eax, [ebp - 8]
call fcn.004060d0
ret

Function at 0x4b1754
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, esp
mov edx, 0x94
call fcn.0040756c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, ebx
mov edx, 0x4b1848
call fcn.0040471c
cmp dword [esp + 0x10], 2
jne 0x4b17e5
mov eax, dword [esp + 4]
sub eax, 3
je 0x4b179d
dec eax
je 0x4b17ae
dec eax
je 0x4b17bc
jmp 0x4b1837
mov eax, ebx
mov edx, 0x4b1860
call fcn.0040471c
jmp 0x4b1837
mov eax, ebx
mov edx, 0x4b1878
call fcn.0040471c
jmp 0x4b1837
mov eax, dword [esp + 8]
sub eax, 1
jb 0x4b17c9
je 0x4b17d7
jmp 0x4b1837
mov eax, ebx
mov edx, 0x4b1890
call fcn.0040471c
jmp 0x4b1837
mov eax, ebx
mov edx, 0x4b18a8
call fcn.0040471c
jmp 0x4b1837
cmp dword [esp + 4], 4
jne 0x4b1801
cmp dword [esp + 8], 0
jne 0x4b1801
mov eax, ebx
mov edx, 0x4b18bc
call fcn.0040471c
jmp 0x4b1837
cmp dword [esp + 4], 4
jne 0x4b181d
cmp dword [esp + 8], 0xa
jne 0x4b181d
mov eax, ebx
mov edx, 0x4b18d0
call fcn.0040471c
jmp 0x4b1837
cmp dword [esp + 4], 4
jne 0x4b1837
cmp dword [esp + 8], 0x5a
jne 0x4b1837
mov eax, ebx
mov edx, 0x4b18e4
call fcn.0040471c
add esp, 0x94
pop ebx
ret
Function at 0x4b2298
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [0x4c3148]
cmp byte [eax + 0x573], 2
je 0x4b238e
xor eax, eax
push ebp
push 0x4b22ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4b23a0
mov eax, dword [0x4c3148]
call fcn.004b28f0
mov ebx, 0xa
push 0x32
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x4b22d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b22f6
xor eax, eax
push ebp
push 0x4b2318
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c3148]
call fcn.004bae08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b2322
lea eax, [ebp - 8]
push eax
push 0xf00ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4b238e
lea eax, [ebp - 0x18]
push eax
push 0x4b23b0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x4b238e
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b23c4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe0c
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b24cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x4b24e4
call fcn.0040471c
xor edx, edx
push ebp
push 0x4b24b0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1d4]
push eax
push 2
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4b242e
call fcn.0040412c
jmp 0x4b24b7
mov eax, dword [eax + 0xc]
mov ebx, dword [eax]
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 0x1f0], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 0x1e8], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x1e4], eax
mov byte [ebp - 0x1e0], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 0x1d8], 0
lea edx, [ebp - 0x1f4]
mov ecx, 3
mov eax, 0x4b24f4
call fcn.0040a0b4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040471c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b24b7
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b24d4
lea eax, [ebp - 4]
call fcn.004046c8
ret
Function at 0x4b2cd0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0xff
mov eax, dword [ebp - 8]
call fcn.004027ac
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b2d32
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x4b2d12
mov eax, 0x4b2d40
mov dword [ebp - 4], eax
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2d39
mov eax, dword [ebp - 4]
call fcn.004027cc
ret

Function at 0x4b2d6c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4b2d74
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b2e91
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402b0c
mov eax, dword [ebp - 0x14]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov eax, esi
call fcn.004027ac
mov edi, eax
push edi
push esi
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402b0c
mov eax, dword [ebp - 0x18]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b2ea0
push edi
call sub.version.dll_VerQueryValueA
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409268
push dword [ebp - 0x20]
push 0x4b2eac
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00409268
push dword [ebp - 0x24]
push 0x4b2eac
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.00409268
push dword [ebp - 0x28]
push 0x4b2eac
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00409268
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404a48
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov ecx, 0xff
call fcn.00404964
mov edx, esi
mov eax, edi
call fcn.004027cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2e98
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.004046ec
ret
Function at 0x4b3fc4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4b4132
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00407a94
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00407ab4
jmp 0x4b40fe
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404938
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004098a8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408bc4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408bc4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404ad4
je 0x4b40de
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404938
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408bc4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408bc4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404ad4
jne 0x4b40f5
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.00407ad4
test eax, eax
jne 0x4b403f
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4139
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004046ec
lea eax, [ebp - 4]
call fcn.004046c8
ret

Function at 0x4b4144
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], eax
xor eax, eax
push ebp
push 0x4b423a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00407a94
mov ebx, eax
mov dword [ebp - 0x128], 0x128
lea edx, [ebp - 0x128]
mov eax, ebx
call fcn.00407ab4
jmp 0x4b4212
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404938
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004098a8
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00408c00
mov edx, dword [ebp - 0x12c]
mov eax, dword [0x4c3148]
mov eax, dword [eax + 0x5b4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x4b4205
push 0
mov eax, dword [ebp - 0x120]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
lea edx, [ebp - 0x128]
mov eax, ebx
call fcn.00407ad4
test eax, eax
jne 0x4b419a
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4241
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.004046ec
ret
Function at 0x4b6bd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4b6e1f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.BillDll.dll_bnLockEvent
test eax, eax
je 0x4b6e04
mov eax, dword [0x4c0b58]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x4b6e04
mov eax, dword [ebp + 8]
cmp byte [eax + 0x3d1], 0
je 0x4b6c2f
mov eax, 0x4b6e38
call fcn.004b3fc4
mov eax, 0x4b6e38
call fcn.004b3fc4
mov eax, dword [0x4c0b58]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
xor edx, edx
call fcn.00430998
push 0xffffffffffffffff
call sub.carddll.dll_OpenKeyB
mov eax, dword [0x4c0b58]
mov eax, dword [eax]
mov byte [eax + 0x3a0], 1
mov eax, dword [0x4c0b58]
mov eax, dword [eax]
xor edx, edx
call fcn.00459374
mov eax, dword [0x4c0b18]
mov eax, dword [eax]
call fcn.0045d8dc
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4c0b18]
mov eax, dword [eax]
call fcn.0045d8e8
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004179fc
mov eax, dword [ebp + 8]
cmp byte [eax + 0x3d9], 0
je 0x4b6cce
mov edx, 0x208
mov eax, dword [ebp + 8]
call fcn.0043f618
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x74]
mov ecx, 0x32
mov edx, 3
call fcn.0043eb00
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x300]
mov dl, 1
call fcn.00451f44
jmp 0x4b6cfa
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x74]
xor ecx, ecx
mov edx, 3
call fcn.0043eb00
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x300]
xor edx, edx
call fcn.00451f44
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0043f618
mov eax, dword [ebp + 8]
call fcn.0045c888
call fcn.0040b0b0
mov eax, dword [ebp + 8]
fstp qword [eax + 0x5a8]
wait
call fcn.004b655c
lea edx, [ebp - 0x18]
mov eax, dword [0x4c0908]
mov eax, dword [eax]
call fcn.00460430
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409854
lea eax, [ebp - 0x14]
mov edx, 0x4b6e48
call fcn.00404990
mov eax, dword [ebp - 0x14]
call fcn.00409684
test al, al
je 0x4b6d55
push 1
push 0x4b6e58
call sub.kernel32.dll_WinExec
xor eax, eax
push ebp
push 0x4b6d95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x558], 0
je 0x4b6d8b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x558]
call fcn.004629a0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x558]
call fcn.0046284c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6d9f
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_ClipCursor
mov dl, 1
mov eax, dword [0x433d44]
call fcn.00433eb0
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00433f8c
mov cl, 1
mov edx, 0x4b6e6c
mov eax, ebx
call fcn.00433ff4
mov edx, 0x4b6eb0
mov eax, ebx
call fcn.00434330
test al, al
je 0x4b6dec
mov edx, 0x4b6eb0
mov eax, ebx
call fcn.00434118
mov eax, ebx
call fcn.00433f5c
mov eax, ebx
call fcn.004038f4
mov eax, dword [ebp + 8]
mov byte [eax + 0x3da], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6e26
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004046ec
ret