joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464f3c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x464fdb
cmp dword [ebx + 0x94], 0
jne 0x464fd5
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x464ec4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x464fd5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x464f9b
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x464fd5
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041cae0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x464faa
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4651f4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4cbca0]
cmp dword [eax + 0x30], 0
je 0x465351
test bl, bl
jne 0x4652a2
cmp dword [esi + 0x9c], 0
jne 0x465297
mov eax, esi
call fcn.00467b34
push eax
push 0x465120
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x465268
mov eax, dword [0x4cbca0]
call fcn.00468214
test al, al
je 0x465268
mov eax, dword [0x4cbcc4]
call fcn.00406998
mov edi, eax
cmp edi, 0
jl 0x465268
push 0
mov eax, dword [0x4cbcc4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x465252
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x465297
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041cae0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x465277
inc dword [esi + 0x9c]
jmp 0x465351
cmp dword [esi + 0x9c], 0
jle 0x465351
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x465351
cmp dword [esi + 0x44], 0
je 0x4652fd
mov eax, dword [0x4cbca0]
call fcn.00468214
test al, al
je 0x4652fd
mov eax, dword [0x4cbcc4]
call fcn.00406998
mov edi, eax
cmp edi, 0
jl 0x4652fd
push 5
mov eax, dword [0x4cbcc4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4652e7
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46532c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041cae0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46530c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4cbcc4
mov ecx, 1
mov edx, dword [0x465100]
call fcn.00406b4c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x465e38
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x465ea2
mov eax, ebx
call fcn.00468214
test al, al
jne 0x465ea2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004055e4
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x465e8f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x465eaf
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405548
jmp 0x465eaf
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405548
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x467338
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4673a6
mov eax, esi
call fcn.0044fc4c
test al, al
je 0x4673a6
mov eax, dword [ebx + 0x84]
call fcn.0044f8ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4673a6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46739a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044f8ac
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004476e4
jmp 0x4673a6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00467174
pop esi
pop ebx
ret
Function at 0x4687f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x410748]
call fcn.0040601c
xor eax, eax
push ebp
push 0x468991
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c1aa4], 0
jne 0x46884b
mov ecx, dword [0x4c61c0]
mov dl, 1
mov eax, dword [0x408b0c]
call fcn.0040e4d8
call fcn.00404dbc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a38
mov eax, ebx
call fcn.00405e6c
mov dword [ebp - 0x24], eax
mov esi, 0x4689a0
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040723c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405e7c
test eax, eax
jle 0x468934
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x468920
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405764
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4688c6
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.0040577c
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4688dc
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.0040577c
mov eax, dword [ebp - 0x54]
call fcn.00405984
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405764
mov eax, dword [ebp - 0x58]
call fcn.00405984
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x468922
xor eax, eax
test al, al
je 0x46892d
mov ebx, 0x15
jmp 0x468939
mov ebx, 0x10
jmp 0x468939
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4c1aa4]
call fcn.00468670
mov eax, dword [ebp - 4]
call fcn.00468670
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468998
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405518
lea eax, [ebp - 0xc]
mov edx, dword [0x410748]
call fcn.004060ec
ret
Function at 0x470840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4708af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004054f4
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jbe 0x47088f
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00405764
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4708b6
lea eax, [ebp - 4]
call fcn.004054f4
ret

Function at 0x470ecc
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x4c1d34]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x470f04
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x470f1c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x470f15
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403a38
xor edx, edx
mov eax, 0x4c1f34
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x470f83
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x470f3a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4711c4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4711dd
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4711d6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4711ef
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4711e8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.00470dbc
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x471209
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.00470ecc
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x471291
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4712af
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.00470e4c
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4712d9
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4712f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x471309
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x471302
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x47131d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00470cbc
test bl, bl
jne 0x4713f7
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4cbd38
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x471355
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x47136a
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004711c4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x47139d
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x47134a
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4713c1
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4713d3
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4713e8
jmp 0x4714b8
cmp bl, 1
jne 0x4714b8
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4cbd92
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x471417
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x47142c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004711c4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x47145f
sub ebx, 6
inc dword [ebp - 8]
jne 0x47140c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x471487
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x471499
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4714ae
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00470d3c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x48fce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x48fd3a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0048fcd0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0048d490
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0048cfa8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fd41
lea eax, [ebp - 4]
call fcn.004054f4
ret
Function at 0x4ad984
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp bl, 0x90
jne 0x4ad9d9
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x4ad9c4
and byte [ebp - 0x72], 0xfe
jmp 0x4ad9c8
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x4ada60
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x4ada60
mov eax, ebx
movzx eax, al
bt dword [0x4c5960], eax
jae 0x4ada2e
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004ad938
pop ecx
cmp byte [ebp - 1], 0
je 0x4ada5b
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004ad938
pop ecx
jmp 0x4ada5b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004ad938
pop ecx
cmp byte [ebp - 1], 0
je 0x4ada5b
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004ad938
pop ecx
dec si
jne 0x4ad9ee
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ada68
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
movzx edx, dl
bt dword [0x4c5960], edx
jae 0x4ada9c
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.004ad938
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.004ad938
pop ecx
pop ebx
pop ebp
ret
Function at 0x4b3184
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403a38
ret

Function at 0x4ba9a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4bab70
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c6774]
cmp dword [eax], 0
je 0x4bab45
call sub.user32.dll_GetForegroundWindow
mov esi, eax
mov eax, dword [0x4cdd54]
call fcn.0044f8ac
push eax
call sub.user32.dll_SetForegroundWindow
lea eax, [ebp - 4]
call fcn.0040723c
push eax
lea ecx, [ebp - 8]
mov eax, dword [0x4cdd54]
mov eax, dword [eax + 0x374]
mov edx, 0xcb
call fcn.0046cd58
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1b0]
call fcn.0040734c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xec]
call fcn.0040734c
push 0x4bab88
lea edx, [ebp - 0x10]
mov eax, dword [0x4cdd54]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x2c]
call fcn.0040a1bc
push dword [ebp - 0x10]
push 0x4bab98
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405888
mov eax, dword [ebp - 0xc]
call fcn.00405984
xor edx, edx
call fcn.004adcdc
mov dl, 1
mov eax, dword [0x439224]
call fcn.00404518
mov ebx, eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004394a8
mov edx, dword [ebp - 0x14]
mov eax, 0x4cdd74
call fcn.00405548
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov edx, dword [0x4c6774]
mov edx, dword [edx]
mov eax, ebx
call fcn.00439528
mov eax, 0x4bab9c
xor edx, edx
call fcn.004adcdc
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, ebx
call fcn.00404548
push 0x4bab88
lea edx, [ebp - 0x1c]
mov eax, dword [0x4cdd54]
mov eax, dword [eax + 0x388]
mov eax, dword [eax + 0x30]
call fcn.0040a1bc
push dword [ebp - 0x1c]
push 0x4bab98
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405888
mov eax, dword [ebp - 0x18]
call fcn.00405984
xor edx, edx
call fcn.004adcdc
mov al, 0x20
call fcn.004ba980
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4bab2f
cmp eax, 0x3e8
jbe 0x4bab31
jmp 0x4bab3f
jg 0x4bab3f
mov eax, dword [0x4c6628]
mov eax, dword [eax]
call fcn.00466294
jmp 0x4bab0c
push esi
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bab77
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00405518
lea eax, [ebp - 8]
call fcn.0040723c
lea eax, [ebp - 4]
call fcn.0040723c
ret
Function at 0x4bc97c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4bcb2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c64d8]
mov eax, dword [eax]
call fcn.0040a6fc
test al, al
je 0x4bc9ce
mov ebx, dword [0x4c64d8]
mov ebx, dword [ebx]
mov dword [ebp - 0x1d4], ebx
mov eax, dword [ebp - 0x1d4]
call fcn.00405984
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [0x4c64d8]
mov edx, dword [edx]
lea eax, [ebp - 0x1d0]
call fcn.00403794
lea eax, [ebp - 0x1d0]
call fcn.00403524
call fcn.004030ec
push 0x4bcb44
mov eax, dword [0x4c66e0]
push dword [eax]
push 0x4bcb8c
push 0x4bcb9c
push 0x4bcba8
push 0x4bcbb4
push 0x4bcb9c
push 0x4bcba8
push 0x4bcbd0
push 0x4bcb9c
push 0x4bcba8
push 0x4bcbe8
push 0x4bcb9c
push 0x4bcba8
push 0x4bcc08
push 0x4bcb9c
push 0x4bcba8
push 0x4bcc24
push 0x4bcb9c
push 0x4bcba8
push 0x4bcc44
push 0x4bcb9c
push 0x4bcba8
push 0x4bcc60
push 0x4bcb9c
push 0x4bcba8
push 0x4bcc80
push 0x4bcb9c
push 0x4bcba8
push 0x4bcca0
push 0x4bcb9c
push 0x4bcba8
push 0x4bccc0
push 0x4bcb9c
push 0x4bcba8
push 0x4bcce4
push 0x4bcb9c
push 0x4bcba8
push 0x4bcd00
push 0x4bcb9c
push 0x4bcba8
push 0x4bcd20
push 0x4bcb9c
push 0x4bcba8
push 0x4bcd34
push 0x4bcb9c
push 0x4bcba8
push 0x4bcd88
lea eax, [ebp - 4]
mov edx, 0x30
call fcn.00405888
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00405ca4
call fcn.00403e8c
call fcn.004030ec
lea eax, [ebp - 0x1d0]
call fcn.0040385c
call fcn.004030ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcb35
lea eax, [ebp - 4]
call fcn.004054f4
ret
Function at 0x4bce1c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4bce24
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405974
xor eax, eax
push ebp
push 0x4bd054
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.0040337c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040a904
mov eax, dword [ebp - 0x14]
mov ecx, 3
mov edx, 1
call fcn.004059ec
mov eax, dword [0x4c6268]
cmp byte [eax], 6
je 0x4bce8b
mov eax, dword [0x4c6268]
cmp byte [eax], 7
jne 0x4bceb0
lea eax, [ebp - 0x20]
call fcn.00470910
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040a904
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, 0x4bd06c
call fcn.0040580c
jmp 0x4bceca
push dword [ebp - 0xc]
push 0x4bd080
push 0x4bd06c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405888
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41ac7c]
call fcn.0041fa80
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bcf0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x36c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004951a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bcf36
mov esi, dword [0x4c6248]
mov esi, dword [esi]
mov edx, dword [0x4c6248]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, 0x4bd0b4
call fcn.0040580c
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
call fcn.00405984
push eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
call fcn.00405984
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [0x4c6248]
mov edx, dword [edx]
mov eax, dword [ebp - 0x10]
call fcn.004bcd98
test al, al
je 0x4bcfbe
mov edx, dword [0x4c6248]
mov edx, dword [edx]
lea eax, [ebp - 0x30]
mov ecx, 0x4bd0b4
call fcn.0040580c
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
call fcn.00405984
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4bd001
mov edx, dword [0x4c6248]
mov edx, dword [edx]
lea eax, [ebp - 0x34]
mov ecx, 0x4bd0b4
call fcn.0040580c
mov esi, dword [ebp - 0x34]
mov edi, dword [0x4c6248]
mov edi, dword [edi]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
call fcn.00405984
push eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
call fcn.00405984
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 0x10]
call fcn.00404548
mov eax, dword [ebp - 8]
call fcn.00405984
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd05b
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00405518
lea eax, [ebp - 0x24]
call fcn.004054f4
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405518
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405518
ret