joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d34d4
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.004045b8
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4d361c
mov edx, 0x4d3620
mov eax, ebx
call fcn.004d2f20
test al, al
je 0x4d3611
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407bfc
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x53e21c]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4d3630
mov eax, ebx
call fcn.004d313c
mov ebx, eax
test ebx, ebx
je 0x4d3611
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4d363c
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4d3650
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4d3664
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4d35ce
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4d35ce
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4d35e3
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4d360b
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x4d38c4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4d3aeb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x53e23c], eax
xor eax, eax
mov dword [0x548388], eax
xor eax, eax
mov dword [0x54838c], eax
xor eax, eax
mov dword [0x548390], eax
xor eax, eax
mov dword [0x548394], eax
xor eax, eax
mov dword [0x548384], eax
xor eax, eax
mov dword [0x548398], eax
xor eax, eax
mov dword [0x54839c], eax
xor eax, eax
mov dword [0x5483a0], eax
xor eax, eax
mov dword [0x5483a4], eax
cmp dword [0x53e240], 0
je 0x4d3acd
push 0x4d3af8
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548388], eax
push 0x4d3b00
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x54838c], eax
push 0x4d3b08
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548390], eax
push 0x4d3b10
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548394], eax
push 0x4d3b18
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548384], eax
push 0x4d3b20
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x548398], eax
push 0x4d3b30
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x54839c], eax
push 0x4d3b3c
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5483a0], eax
push 0x4d3b4c
mov eax, dword [0x53e240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5483a4], eax
cmp dword [0x548388], 0
je 0x4d3acd
cmp dword [0x54838c], 0
je 0x4d3acd
cmp dword [0x548390], 0
je 0x4d3acd
cmp dword [0x548394], 0
je 0x4d3acd
cmp dword [0x548384], 0
je 0x4d3acd
cmp dword [0x53e244], 0xffffffff
jne 0x4d3a69
push 0
push 1
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4d3b68
call fcn.004048d8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e90
mov eax, dword [ebp - 4]
mov edx, 0x4d3b7c
call fcn.0046d740
mov dword [0x53e244], eax
cmp dword [0x53e244], 2
jge 0x4d3a81
push 0x58
push 0x6f401
call dword [0x548394]
jmp 0x4d3a95
cmp dword [0x53e244], 2
jne 0x4d3a95
push 0x51a7b0e
call dword [0x54838c]
mov dword [0x53e23c], 1
cmp dword [0x548398], 0
je 0x4d3acd
cmp dword [0x54839c], 0
je 0x4d3acd
cmp dword [0x5483a0], 0
je 0x4d3acd
cmp dword [0x5483a4], 0
je 0x4d3acd
mov dword [0x53e23c], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3af2
lea eax, [ebp - 8]
call fcn.004045b8
lea eax, [ebp - 4]
call fcn.00404cf0
ret
Function at 0x4d58b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0x4d5978
push 0xffffffffffffffff
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d596e
xor eax, eax
push ebp
push 0x4d5967
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa7e
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d5950
xor eax, eax
push ebp
push 0x4d5949
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0xa7e
call fcn.00403098
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, 0xa7e
call fcn.00402974
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5950
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d596e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8cd8
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4d8ce0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4d8ee6
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo_1
cmp eax, 0x6f
jne 0x4d8ebb
mov eax, dword [ebp - 0x14]
call fcn.00408d98
mov edi, eax
mov ebx, edi
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo_1
test eax, eax
jne 0x4d8eb4
test ebx, ebx
je 0x4d8eb4
lea esi, [ebx + 0x1ac]
lea eax, [ebx + 0x1d4]
mov dword [ebp - 0x10], eax
test esi, esi
je 0x4d8eaa
lea eax, [ebp - 0x20]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x20]
mov edx, 0x4d8efc
call fcn.004049d0
je 0x4d8eaa
lea eax, [ebp - 0x24]
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x24]
mov edx, 0x4d8f0c
call fcn.004049d0
je 0x4d8eaa
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x28]
mov edx, 0x4d8efc
call fcn.004049d0
je 0x4d8eaa
mov al, byte [0x4d8f1c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
lea edx, [ebx + 8]
mov ecx, 0x104
call fcn.00404820
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4d8f28
mov eax, 0x4d8f3c
call fcn.0040d9ec
lea ecx, [ebp - 0x18]
mov edx, 0x4d8fbc
mov eax, dword [ebp - 0x1c]
call fcn.0046c538
cmp dword [ebp - 0x18], 0
je 0x4d8eaa
cmp byte [ebp - 1], 0
je 0x4d8e25
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
jmp 0x4d8eb4
mov eax, 0x5498ac
mov edx, dword [ebp - 0x18]
call fcn.0040460c
mov eax, 0x5498b0
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404820
mov eax, 0x5498b4
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.00404820
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0xc]
mov edx, 0x4d8fcc
call fcn.004049d0
je 0x4d8eb4
mov eax, 0x5498b8
mov edx, dword [ebp - 0xc]
call fcn.0040460c
lea eax, [ebp - 0x30]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x30]
mov ecx, dword [0x5498b8]
mov edx, 0x4d8fdc
call fcn.0046dba4
jmp 0x4d8eb4
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4d8d3e
mov eax, edi
call fcn.004027dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8eed
lea eax, [ebp - 0x30]
call fcn.00404cf0
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4d8fe4
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4d9122
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004045b8
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x4d910c
mov eax, dword [ebp - 0x10]
call fcn.00408d98
mov edi, eax
mov esi, edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4d9105
test esi, esi
je 0x4d9105
mov ebx, dword [esi + 0x10]
cmp dword [ebp - 8], 2
jne 0x4d90ac
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.Ntdll.dll_RtlIpv4StringToAddressA
test ebx, ebx
je 0x4d90fa
mov eax, dword [ebx + 0xc]
cmp word [eax], 2
jne 0x4d90a3
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x2c]
jne 0x4d90a3
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.004715a0
jmp 0x4d9105
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d9085
jmp 0x4d90fa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.Ntdll.dll_RtlIpv6StringToAddressA
test ebx, ebx
je 0x4d90fa
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x17
jne 0x4d90f3
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0xc]
add eax, 8
mov ecx, 0x10
call fcn.00471e90
test eax, eax
jne 0x4d90f3
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.004715a0
jmp 0x4d9105
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d90c6
mov esi, dword [esi + 8]
test esi, esi
jne 0x4d9060
mov eax, edi
call fcn.004027dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9129
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4d9870
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d99d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53f320], 0x7d9
cmp si, 2
jne 0x4d98ca
lea eax, [ebp - 0x20]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d99ec
call fcn.0046da74
jmp 0x4d98f6
cmp si, 8
je 0x4d98d6
cmp si, 1
jne 0x4d98f6
lea eax, [ebp - 0x24]
mov edx, dword [0x5408e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d99fc
call fcn.0046da74
cmp dword [ebp - 0xc], 0
je 0x4d9911
push 1
lea eax, [ebp - 0xc]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d99a9
test si, 2
jne 0x4d9926
test si, 1
jne 0x4d9926
test si, 8
je 0x4d998f
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d998f
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004ab8a8
mov eax, dword [ebp - 0x28]
call fcn.00404a84
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d9997
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x53f320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d99db
lea eax, [ebp - 0x28]
call fcn.004045b8
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4da748
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov dword [0x53f320], 0x7e1
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403098
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
mov ax, word [ebp + 8]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4da7c2
cmp byte [ebp - 1], 0
je 0x4da7c0
push 0x64
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4da7c9
mov bl, 1
xor eax, eax
mov dword [0x53f320], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4db514
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x53f320], 0x7e9
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4db54b
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404820
jmp 0x4db552
mov eax, ebx
call fcn.004045b8
xor eax, eax
mov dword [0x53f320], eax
add esp, 0x108
pop ebx
ret

Function at 0x4db564
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x53f320], 0x7ea
push 0
push 7
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4db59b
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404820
jmp 0x4db5a2
mov eax, ebx
call fcn.004045b8
xor eax, eax
mov dword [0x53f320], eax
add esp, 0x108
pop ebx
ret
Function at 0x4e0268
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4e03a9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x549888], 0
je 0x4e0359
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov edi, eax
mov edx, dword [0x54987c]
mov eax, 0x4e03c0
call fcn.00404bc8
test eax, eax
jle 0x4e02e1
push 0x4e03cc
push dword [0x54987c]
push 0x4e03d8
push dword [0x549880]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e030e
push 0x4e03e4
push dword [0x54987c]
push 0x4e03c0
push dword [0x549880]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x540c9c]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4e03f4
call fcn.004048d8
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x549884]
call fcn.00404a84
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a84
push eax
push 0x4e0400
mov eax, esi
call fcn.0045de44
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e038e
push 1
mov eax, dword [0x549884]
call fcn.00404a84
push eax
mov eax, dword [0x549880]
call fcn.00404a84
push eax
mov eax, dword [0x54987c]
call fcn.00404a84
push eax
push 0x4e0400
mov eax, esi
call fcn.0045de44
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e03b0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045dc
ret
Function at 0x4e8cf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e8e07
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53f320], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004ab8a8
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x549464
mov ecx, 0x105
call fcn.00404820
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.004048d8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e90
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046e0d4
mov ebx, eax
test ebx, ebx
je 0x4e8dd0
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.004037ac
mov eax, 0xc8
call fcn.004d91e4
push 1
push 0x4e8e14
push 0x4e8e20
push dword [ebp - 4]
push 0x4e8e30
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040494c
mov eax, dword [ebp - 0x14]
call fcn.00404a84
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004ab8a8
mov eax, dword [ebp - 0x18]
call fcn.00404a84
push eax
push 0x4e8e34
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x53f320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8e0e
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x10]
call fcn.00404cf0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045dc
ret

Function at 0x4e94d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e95d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53f320], 0x80d
call sub.user32.dll_GetForegroundWindow
mov dword [ebx], eax
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4e957a
lea edx, [ebp - 4]
lea eax, [ebp - 0x88]
call fcn.00409f74
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e9555
lea edx, [ebp - 8]
lea eax, [ebp - 0x88]
call fcn.00409f74
jmp 0x4e955d
lea eax, [ebp - 8]
call fcn.004045b8
push dword [ebp - 4]
push 0x4e95f0
push dword [ebp - 8]
push 0x4e95fc
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040494c
xor esi, esi
mov edi, 0x53fb98
cmp esi, 3
jl 0x4e9597
mov edx, dword [ebp - 4]
mov eax, dword [edi]
call fcn.00404bc8
test eax, eax
setg bl
jmp 0x4e95a4
mov eax, dword [edi]
mov edx, dword [ebp - 4]
call fcn.004049d0
sete bl
test bl, bl
jne 0x4e95ba
inc esi
add edi, 4
cmp esi, 4
jne 0x4e9581
xor ebx, ebx
xor eax, eax
mov dword [0x53f320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e95dc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4ebb8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ebcef
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x549578], 0
jbe 0x4ebc02
mov ax, word [0x53f378]
cmp ax, word [0x549578]
jb 0x4ebc02
mov eax, dword [0x53f338]
mov dword [0x53f368], eax
mov eax, dword [0x53f33c]
mov dword [0x53f36c], eax
mov word [0x53f378], 0
mov eax, dword [ebx + 0x314]
call fcn.0047cb70
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004ef400
mov dl, 1
mov ax, 2
call fcn.004d9870
jmp 0x4ebcd9
cmp word [0x54957a], 0
jbe 0x4ebc70
mov ax, word [0x53f378]
cmp ax, word [0x54957a]
jb 0x4ebc70
mov eax, dword [0x53f338]
mov dword [0x53f368], eax
mov eax, dword [0x53f33c]
mov dword [0x53f36c], eax
mov word [0x53f378], 0
cmp dword [0x54957c], 0
je 0x4ebc70
lea eax, [ebp - 4]
mov ecx, dword [0x54957c]
mov edx, 0x4ebd04
call fcn.004048d8
lea eax, [ebp - 4]
call fcn.004db5b4
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
cmp word [0x549580], 0
jbe 0x4ebcd9
mov ax, word [0x53f378]
cmp ax, word [0x549580]
jb 0x4ebcd9
mov eax, dword [0x53f338]
mov dword [0x53f368], eax
mov eax, dword [0x53f33c]
mov dword [0x53f36c], eax
mov word [0x53f378], 0
cmp dword [0x549584], 0
je 0x4ebcd9
lea eax, [ebp - 4]
mov edx, dword [0x549584]
call fcn.00404650
lea eax, [ebp - 4]
call fcn.004db5b4
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebcf6
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4f1e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4f1fd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x53f320], 0x82d
cmp byte [0x53f3cc], 0
jne 0x4f1e82
cmp byte [0x53f3d0], 0
jne 0x4f1e82
mov eax, dword [0x5495d8]
call fcn.0046dd44
test al, al
je 0x4f1e82
push 1
push 0x4f1fe4
push 0x4f1fe8
mov eax, dword [0x5495d8]
call fcn.00404a84
push eax
push 0x4f1fec
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5495cc]
call fcn.0046dd44
test al, al
je 0x4f1fb4
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1580]
call fcn.004b1984
mov dword [0x53f3f4], eax
mov eax, dword [0x53f3f4]
mov edx, dword [0x4b1580]
call fcn.0040395c
add eax, 0x30
push eax
lea edx, [ebp - 4]
mov eax, 0x10e
call fcn.004ab8a8
mov edx, dword [ebp - 4]
pop eax
call fcn.0040460c
mov eax, dword [0x53f3f4]
mov edx, dword [0x4b1580]
call fcn.0040395c
mov byte [eax + 0x34], 0
mov eax, dword [0x53f3f4]
call fcn.0041f638
cmp dword [0x5495a4], 0
jne 0x4f1f0d
lea eax, [ebp - 8]
call fcn.00471448
mov edx, dword [ebp - 8]
mov eax, 0x5495a4
call fcn.0040460c
cmp dword [0x5495a4], 0
je 0x4f1f65
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1580]
call fcn.004b1984
mov dword [0x53f3f8], eax
mov eax, dword [0x53f3f8]
mov edx, dword [0x4b1580]
call fcn.0040395c
add eax, 0x30
mov edx, dword [0x5495a4]
call fcn.0040460c
mov eax, dword [0x53f3f8]
mov edx, dword [0x4b1580]
call fcn.0040395c
mov byte [eax + 0x34], 1
mov eax, dword [0x53f3f8]
call fcn.0041f638
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1580]
call fcn.004b1984
mov dword [0x53f3fc], eax
mov eax, dword [0x53f3fc]
mov edx, dword [0x4b1580]
call fcn.0040395c
add eax, 0x30
mov edx, dword [0x54959c]
call fcn.0040460c
mov eax, dword [0x53f3fc]
mov edx, dword [0x4b1580]
call fcn.0040395c
mov byte [eax + 0x34], 2
mov eax, dword [0x53f3fc]
call fcn.0041f638
xor eax, eax
mov dword [0x53f320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1fdd
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4f2704
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4f27f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414568]
call fcn.0040377c
mov edi, eax
push edi
push 0x4f2264
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4f27da
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416e84
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4f27d2
lea eax, [ebp - 4]
call fcn.00404adc
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409e38
test eax, eax
jne 0x4f27d2
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416e84
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f27b6
cmp eax, 0xffffffff
je 0x4f27d2
cmp dword [ebp - 0xc], 0
je 0x4f27d2
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4f2751
mov eax, edi
call fcn.004037ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f27fe
lea eax, [ebp - 4]
call fcn.004045b8
ret

Function at 0x4f2808
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f2821
cmp eax, 0xffffffff
je 0x4f2835
test ebx, ebx
je 0x4f2835
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret