joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a030
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46a047
add esp, 0xfffffff0
call fcn.00403d6c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e4cc
mov eax, dword [0x4dd3fc]
cmp word [eax + 2], 0
jne 0x46a06f
mov eax, dword [0x4dd3fc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046b7b0
mov eax, dword [0x4dd4f8]
cmp word [eax + 2], 0
jne 0x46a089
mov eax, dword [0x4dd4f8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046b9a8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4160b4]
call fcn.00403a18
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4160b4]
call fcn.00403a18
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x420b18]
call fcn.00428f74
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46a210
mov eax, dword [0x4dd2d8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429344
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46bf58
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4dd2d8]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d4f0
test eax, eax
je 0x46a17e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004095b8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d518
test eax, eax
je 0x46a192
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404aac
mov eax, dword [0x4dd128]
cmp byte [eax], 0
jne 0x46a1c6
mov eax, ebx
call fcn.0046a338
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0046c134
mov eax, ebx
call fcn.0046caf8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46a206
call fcn.00403dc4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a5b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4debec]
cmp dword [eax + 0x30], 0
je 0x46a662
cmp dword [ebx + 0x94], 0
jne 0x46a65c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46a548
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46a65c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46a622
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46a65c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041851c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46a631
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46b1c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46b1f9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040492c
jmp 0x46b206
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404890
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46c310
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46c351
mov eax, esi
call fcn.00451914
test al, al
je 0x46c351
mov eax, dword [ebx + 0x84]
call fcn.00451610
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46c351
push 0
mov eax, dword [ebx + 0x84]
call fcn.00451610
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46d010
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41563c]
call fcn.004051d4
xor eax, eax
push ebp
push 0x46d154
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d9fe0], 0
jne 0x46d063
mov ecx, dword [0x4dd144]
mov dl, 1
mov eax, dword [0x407cd0]
call fcn.0040c6c8
call fcn.004041d4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004032d0
mov eax, ebx
call fcn.004050a4
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46d164
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406208
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050b4
test eax, eax
jle 0x46d0fb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x46d0f4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404ac4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404aac
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b7c
test eax, eax
jne 0x46d0f4
mov ebx, 0x15
jmp 0x46d100
mov ebx, 0x10
jmp 0x46d100
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4d9fe0]
call fcn.0046cf68
mov eax, dword [ebp - 8]
call fcn.0046cf68
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d15b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404860
lea eax, [ebp - 0x10]
mov edx, dword [0x41563c]
call fcn.004052a4
ret
Function at 0x47515c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, ecx
mov dword [ebp - 8], eax
dec edx
mov eax, edx
shl eax, 2
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x4751c9
xor eax, eax
push ebp
push 0x4751c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4751c9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x477b48
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x477ceb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [ebx + 0x72], 0
je 0x477b73
mov edx, ebx
mov eax, dword [ebx + 0x74]
call dword [ebx + 0x70]
cmp byte [ebx + 0x34], 1
jne 0x477cc1
push 0
lea edx, [ebp - 4]
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
call fcn.0046b1c4
mov eax, dword [ebp - 4]
call fcn.00404cfc
push eax
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0x88
push 0xffffffffffffffec
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [0x4df068]
call fcn.00451610
mov esi, eax
lea edx, [ebp - 8]
mov eax, 2
call fcn.00402b98
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00408e94
mov edi, eax
lea edx, [ebp - 0xc]
mov eax, 2
call fcn.00402b98
mov eax, dword [ebp - 0xc]
or edx, 0xffffffff
call fcn.00408e94
inc eax
je 0x477cc1
push 0xfffffffffffffff0
push edi
call sub.user32.dll_GetWindowLongA
or eax, 0x8000000
or eax, 0x40000000
push eax
push 0xfffffffffffffff0
push esi
call sub.user32.dll_SetWindowLongA
push 0xffffffffffffffec
push edi
call sub.user32.dll_GetWindowLongA
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
push edi
push esi
call sub.user32.dll_SetParent
xor edx, edx
mov eax, dword [0x4df068]
call fcn.00465b54
cmp byte [ebx + 0x31], 1
jne 0x477c74
mov eax, dword [0x4dd6a0]
mov eax, dword [eax]
call fcn.004690e8
mov edx, eax
mov eax, dword [0x4df068]
call fcn.0044a4fc
mov eax, dword [0x4dd6a0]
mov eax, dword [eax]
call fcn.004690dc
mov edx, eax
mov eax, dword [0x4df068]
call fcn.0044a520
mov eax, dword [0x4df068]
mov ecx, dword [eax + 0x48]
mov edx, 0x98
mov eax, dword [0x4df068]
call fcn.004510e8
mov edx, 0x98
mov eax, dword [0x4df068]
call fcn.0044a4fc
mov edx, 0x70
mov eax, dword [0x4df068]
call fcn.0044a520
xor edx, edx
mov eax, dword [0x4df068]
call fcn.0044a4d4
xor edx, edx
mov eax, dword [0x4df068]
call fcn.0044a4b0
cmp word [ebx + 0x52], 0
je 0x477cd0
mov edx, ebx
mov eax, dword [ebx + 0x54]
call dword [ebx + 0x50]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477cf2
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404860
ret
Function at 0x477d04
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x477de0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [ebx + 0x7a], 0
je 0x477d2f
mov edx, ebx
mov eax, dword [ebx + 0x7c]
call dword [ebx + 0x78]
cmp byte [ebx + 0x35], 1
jne 0x477db4
push 0
lea edx, [ebp - 8]
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
call fcn.0046b1c4
mov eax, dword [ebp - 8]
call fcn.00404cfc
push eax
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebx + 0x40], 0
je 0x477d71
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x61
call sub.user32.dll_SystemParametersInfoA
cmp byte [ebx + 0x42], 0
je 0x477d7e
push 0
call sub.user32.dll_ShowCursor
cmp byte [ebx + 0x31], 0
je 0x477d90
mov dl, 2
mov eax, dword [0x4df068]
call fcn.00465c6c
cmp byte [ebx + 0x32], 0
je 0x477da2
xor edx, edx
mov eax, dword [0x4df068]
call fcn.004654f4
cmp byte [ebx + 0x33], 0
je 0x477db4
mov dl, 3
mov eax, dword [0x4df068]
call fcn.004657f0
mov eax, ebx
call fcn.004786fc
cmp word [ebx + 0x5a], 0
je 0x477dca
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477de7
lea eax, [ebp - 8]
call fcn.0040483c
ret
Function at 0x4780a0
Capabilities:
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x478222
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [ebx + 0x8a], 0
je 0x4780d5
mov edx, ebx
mov eax, dword [ebx + 0x8c]
call dword [ebx + 0x88]
cmp byte [ebx + 0x41], 1
jne 0x4781e6
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
call fcn.0046b1c4
mov eax, dword [ebp - 0xc]
call fcn.00404cfc
push eax
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, dword [0x4df068]
call fcn.00465c6c
push 0x88
push 0xffffffffffffffec
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
lea edx, [ebp - 0x10]
mov eax, 2
call fcn.00402b98
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.0040899c
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00404e88
push 0x104
mov eax, dword [ebp - 4]
call fcn.00404cfc
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 4]
xchg edx, eax
call fcn.00404e88
mov eax, dword [ebp - 4]
call fcn.00404afc
test eax, eax
jle 0x478195
mov eax, dword [ebp - 4]
call fcn.00404afc
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x478195
lea eax, [ebp - 4]
mov edx, 0x478238
call fcn.00404b04
lea eax, [ebp - 0x14]
mov ecx, 0x478244
mov edx, dword [ebp - 4]
call fcn.00404b48
mov eax, dword [ebp - 0x14]
call fcn.00404cfc
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4781e6
push 0x47824c
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
test edi, edi
je 0x4781e0
push 0
push 0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00408e94
push eax
push 0x478260
call edi
push esi
call sub.KERNEL32.DLL_FreeLibrary
cmp word [ebx + 0x6a], 0
je 0x4781f5
mov edx, ebx
mov eax, dword [ebx + 0x6c]
call dword [ebx + 0x68]
cmp byte [ebx + 0x41], 1
jne 0x478207
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
call fcn.0046b79c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478229
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404860
ret
Function at 0x478268
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x478437
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov edi, eax
cmp byte [esi + 0x42], 1
jne 0x47829b
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402b98
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040899c
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, 1
call fcn.00404d9c
mov eax, dword [ebp - 0x14]
call fcn.00404afc
mov ecx, eax
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404d9c
mov eax, dword [ebp - 0x14]
mov edx, 0x478450
call fcn.00404c48
je 0x4782f4
mov byte [ebp - 1], 1
jmp 0x47841c
mov dl, 1
mov eax, dword [0x4349d0]
call fcn.00434b3c
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00434c18
xor ecx, ecx
mov edx, 0x47845c
mov eax, ebx
call fcn.00434d5c
test al, al
jne 0x478329
mov byte [ebp - 1], 1
jmp 0x478415
mov edx, 0x47847c
mov eax, ebx
call fcn.00435100
test al, al
jne 0x478342
mov byte [ebp - 1], 1
jmp 0x478415
mov edx, 0x47847c
mov eax, ebx
call fcn.00434fd0
test eax, eax
jne 0x47835b
mov byte [ebp - 1], 1
jmp 0x478415
lea eax, [ebp - 0x10]
mov edx, 0x104
call fcn.00404e88
push 0x104
mov eax, dword [ebp - 0x10]
call fcn.00404cfc
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 0x10]
xchg edx, eax
call fcn.00404e88
mov eax, dword [ebp - 0x10]
call fcn.00404afc
test eax, eax
jle 0x4783af
mov eax, dword [ebp - 0x10]
call fcn.00404afc
mov edx, dword [ebp - 0x10]
cmp byte [edx + eax - 1], 0x5c
je 0x4783af
lea eax, [ebp - 0x10]
mov edx, 0x47849c
call fcn.00404b04
lea eax, [ebp - 0x1c]
mov ecx, 0x4784a8
mov edx, dword [ebp - 0x10]
call fcn.00404b48
mov eax, dword [ebp - 0x1c]
call fcn.00404cfc
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4783dc
mov byte [ebp - 1], 1
jmp 0x478415
push 0x4784b8
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0xc], eax
push edi
call dword [ebp - 0xc]
test al, al
je 0x4783fb
mov byte [ebp - 1], 1
jmp 0x47840c
mov byte [ebp - 1], 0
cmp byte [esi + 0x42], 1
jne 0x47840c
push 0
call sub.user32.dll_ShowCursor
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
mov eax, ebx
call fcn.00403a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47843e
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404860
ret
Function at 0x487a1c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x487a4a
mov eax, ebx
call fcn.004884d0
cmp dword [ebx + 0x40], 0
je 0x487a43
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x487abb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x487aad
cmp dword [ebx + 8], 0
je 0x487a6c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x487a7e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x487aad
cmp dword [ebx + 8], 0
je 0x487a5f
cmp eax, 3
je 0x487a91
dec eax
jne 0x487a5f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x487a5f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x487a5f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x487ad9
cmp dword [ebx + 0x14], 0xcc
je 0x487ad9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00487ae4
pop ebx
ret

Function at 0x4a383c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc94
push ebx
xor ecx, ecx
mov dword [ebp - 0x368], ecx
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cec
xor eax, eax
push ebp
push 0x4a39af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20d]
mov edx, dword [ebp - 4]
call fcn.00409614
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004029d4
lea eax, [ebp - 0x30d]
mov edx, dword [ebp - 0xc]
call fcn.00409614
lea eax, [ebp - 0x354]
xor ecx, ecx
mov edx, 0x44
call fcn.004032d0
mov dword [ebp - 0x354], 0x44
mov dword [ebp - 0x328], 1
mov word [ebp - 0x324], bx
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x30d]
push eax
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x20d]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4a394b
mov dword [ebp - 8], 0xffffffff
push 0
lea edx, [ebp - 0x368]
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
call fcn.0046b1c4
mov eax, dword [ebp - 0x368]
call fcn.00404cfc
push eax
call sub.KERNEL32.DLL_GetLastError
lea edx, [ebp - 0x36c]
call fcn.0040bdd4
mov eax, dword [ebp - 0x36c]
call fcn.00404cfc
push eax
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_MessageBoxA
jmp 0x4a3981
push 0xffffffffffffffff
mov eax, dword [ebp - 0x364]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x364]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
mov eax, dword [ebp - 0x364]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x360]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a39b6
lea eax, [ebp - 0x36c]
mov edx, 2
call fcn.00404860
lea eax, [ebp - 0xc]
call fcn.0040483c
lea eax, [ebp - 4]
call fcn.0040483c
ret
Function at 0x4a8ac8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4a8af6
mov eax, ebx
call fcn.004a956c
cmp dword [ebx + 0x3c], 0
je 0x4a8aef
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4a8b67
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4a8b59
cmp dword [ebx + 8], 0
je 0x4a8b18
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4a8b2a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a8b59
cmp dword [ebx + 8], 0
je 0x4a8b0b
cmp eax, 3
je 0x4a8b3d
dec eax
jne 0x4a8b0b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a8b0b
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4a8b0b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4a8b85
cmp dword [ebx + 0x10], 0xcc
je 0x4a8b85
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a8b90
pop ebx
ret

Function at 0x4b2f94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x4df2a4
test esi, esi
jne 0x4b2fae
xor eax, eax
jmp 0x4b30b0
cmp dword [ebp], 0
jne 0x4b2fb9
call fcn.004b2f24
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4b3089
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4b2fc5
test edi, edi
jbe 0x4b30ab
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4b308d
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c2564
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x4c2611
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x4c25c3
dec ecx
jne 0x4c260a
cmp eax, 4
jg 0x4c259d
mov eax, dword [0x4dd084]
jmp 0x4c2616
cmp eax, 5
jne 0x4c25ad
test edx, edx
jne 0x4c25ad
mov eax, dword [0x4dd088]
jmp 0x4c2616
cmp eax, 5
jne 0x4c25bc
dec edx
jne 0x4c25bc
mov eax, dword [0x4dd08c]
jmp 0x4c2616
mov eax, dword [0x4dd070]
jmp 0x4c2616
cmp eax, 4
jne 0x4c25d3
test edx, edx
jne 0x4c25d3
mov eax, dword [0x4dd074]
jmp 0x4c2616
cmp eax, 4
jne 0x4c25f2
cmp edx, 0xa
jne 0x4c25f2
cmp byte [esp + 0x15], 0x41
jne 0x4c25eb
mov eax, dword [0x4dd07c]
jmp 0x4c2616
mov eax, dword [0x4dd078]
jmp 0x4c2616
cmp eax, 4
jne 0x4c2603
cmp edx, 0x5a
jne 0x4c2603
mov eax, dword [0x4dd080]
jmp 0x4c2616
mov eax, dword [0x4dd070]
jmp 0x4c2616
mov eax, dword [0x4dd070]
jmp 0x4c2616
mov eax, dword [0x4dd070]
add esp, 0x94
ret