joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5c4c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4c5c9d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4c5c84
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4c5c74
jmp 0x4c5c9d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4c5c85
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d4ac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4d4af8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4d4ad6
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4d4ae5
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4d4af4
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4d87d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d883f
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.00404f5c
push edi
mov eax, dword [ebp - 8]
call fcn.00404dd0
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8846
lea eax, [ebp - 8]
call fcn.00404910
ret

Function at 0x4dcf74
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4dcffe
xor edx, edx
push ebp
push 0x4dcfdf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dcffe
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4de330
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dc0
mov eax, dword [ebp - 8]
call fcn.00404dc0
xor eax, eax
push ebp
push 0x4de44d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00404dd0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x4de45c
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404dd0
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4de432
xor eax, eax
push ebp
push 0x4de42b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4de40b
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4de40f
xor eax, eax
jmp 0x4de411
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de432
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de454
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404934
ret
Function at 0x4de464
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dc0
mov eax, dword [ebp - 8]
call fcn.00404dc0
mov eax, dword [ebp - 0xc]
call fcn.00404dc0
mov eax, dword [ebp + 0xc]
call fcn.00404dc0
xor eax, eax
push ebp
push 0x4de5d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00404dd0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x4de5e4
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404dd0
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4de5b0
xor edx, edx
push ebp
push 0x4de5a9
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00404dd0
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404dd0
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00404dd0
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x4de592
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4de589
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4de58d
xor eax, eax
jmp 0x4de58f
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de5b0
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de5da
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404934
lea eax, [ebp + 0xc]
call fcn.00404910
ret
Function at 0x4de5ec
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x4de6b4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4de6b8
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x4de6b4
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4de6ab
xor eax, eax
push ebp
push 0x4de6a4
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de6ab
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4de8ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4deac0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402834
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4de92a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x4de914
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de931
mov eax, dword [ebp - 8]
call fcn.00402854
ret

Function at 0x4dfdd4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00403250
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x4dfe0e
cmp byte [ebp - 0xa], 0x31
jne 0x4dfe0c
mov bl, 1
jmp 0x4dfe0e
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e144c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00466c80
test al, al
je 0x4e1505
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x4e14e3
cmp word [esi + 0x5da], 0
je 0x4e149d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x4e14ba
cmp dword [ebp - 4], 0
jbe 0x4e14b6
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4e14ba
xor ebx, ebx
jmp 0x4e14bc
mov bl, 1
test bl, bl
jne 0x4e1505
mov eax, dword [0x515c1c]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x4e1505
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.0047fec8
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x4e1505
cmp byte [esi + 0x584], 0
jne 0x4e1505
mov edx, 0xfffffdf3
mov eax, esi
call fcn.00485700
cmp eax, 4
jne 0x4e147a
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f47f8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404dc0
xor eax, eax
push ebp
push 0x4f4860
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x1505
mov eax, dword [ebp - 4]
call fcn.00404bd0
test eax, eax
jle 0x4f4844
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov esi, ebx
shl esi, 5
add ebx, esi
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4f482d
and ebx, 0x7fffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4867
lea eax, [ebp - 4]
call fcn.00404910
ret
Function at 0x50308c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x503139
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, 0x50314c
call fcn.004049a8
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404dd0
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x10
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x503119
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
jmp 0x503123
mov eax, 0x503168
call fcn.00435b54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503140
lea eax, [ebp - 0x18]
call fcn.00404910
ret

Function at 0x5047ec
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
test ebx, ebx
js 0x50480d
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x504806
mov edx, esp
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5048e0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [esi + ebx + 0xc], bl
inc ebx
cmp ebx, 0x100
jne 0x504824
xor edi, edi
xor ebx, ebx
lea eax, [ecx + 1]
push eax
mov eax, ebx
pop edx
push ecx
mov ecx, edx
cdq
idiv ecx
pop ecx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
movzx eax, byte [eax + edx]
xor edx, edx
mov dl, byte [esi + ebx + 0xc]
add edi, edx
add eax, edi
and eax, 0xff
mov edi, eax
xor eax, eax
mov al, byte [esi + ebx + 0xc]
mov dword [ebp - 8], eax
mov al, byte [esi + edi + 0xc]
mov byte [esi + ebx + 0xc], al
mov al, byte [ebp - 8]
mov byte [esi + edi + 0xc], al
inc ebx
cmp ebx, 0x100
jne 0x504835
lea eax, [ebp - 0x10]
call fcn.00404910
xor ebx, ebx
push dword [ebp - 0x10]
lea edx, [ebp - 0x14]
xor eax, eax
mov al, byte [esi + ebx + 0xc]
call fcn.00409838
push dword [ebp - 0x14]
push 0x5048fc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404c90
inc ebx
cmp ebx, 0x100
jne 0x50488c
xor eax, eax
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5048e7
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404934
ret
Function at 0x50ae04
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dc0
xor eax, eax
push ebp
push 0x50af35
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004d64a0
mov ebx, eax
test ebx, ebx
je 0x50af0f
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.004d64c0
jmp 0x50aefb
lea edx, [ebp - 0x138]
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480684
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409e74
push dword [ebp - 0x134]
push 0x50af4c
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404b80
push dword [ebp - 0x13c]
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.00404c90
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 4]
call fcn.00404d1c
jne 0x50aeee
mov eax, dword [ebp - 0x124]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.004d64e0
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x50ae69
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50af3c
lea eax, [ebp - 0x13c]
mov edx, 4
call fcn.00404934
lea eax, [ebp - 4]
call fcn.00404910
ret
Function at 0x50af50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x50af58
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x50b199
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402b68
test eax, eax
jle 0x50aff6
lea edx, [ebp - 0xc]
mov eax, 1
call fcn.00402bc8
mov eax, dword [ebp - 0xc]
call fcn.00409d74
test al, al
je 0x50aff6
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.00402bc8
mov eax, dword [ebp - 0x10]
call fcn.0050ae04
push 0x30
push 0x50b1a8
push 0x50b1b0
push 0
call sub.user32.dll_MessageBoxA_1
push 0xbb8
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402bc8
mov eax, dword [ebp - 0x14]
call fcn.00409da8
push 0x34
push 0x50b1a8
push 0x50b1cc
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x50aff6
call fcn.0050bce8
lea edx, [ebp - 0x1c]
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480684
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00409e74
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x50b1f0
call fcn.00404c1c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x43ae90]
call fcn.0043af40
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x50b20c
mov edx, 0x50b21c
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov eax, ebx
call fcn.00403afc
lea edx, [ebp - 0x28]
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480684
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00409e74
push dword [ebp - 0x24]
push 0x50b234
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404c90
mov eax, dword [ebp - 0x20]
call fcn.00409d74
test al, al
je 0x50b17e
lea edx, [ebp - 0x34]
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480684
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00409e74
push dword [ebp - 0x30]
push 0x50b234
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404c90
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x38]
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480684
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00404d1c
je 0x50b17e
push 1
push 0
push 0x50b240
lea edx, [ebp - 0x40]
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480684
push dword [ebp - 0x40]
push 0x50b240
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404c90
mov eax, dword [ebp - 0x3c]
call fcn.00404dd0
push eax
lea edx, [ebp - 0x4c]
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480684
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00409e74
push dword [ebp - 0x48]
push 0x50b234
push dword [ebp - 8]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00404c90
mov eax, dword [ebp - 0x44]
call fcn.00404dd0
push eax
push 0x50b244
mov eax, dword [0x517178]
call fcn.0046697c
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 4]
call fcn.00409da8
mov eax, dword [0x515c1c]
mov eax, dword [eax]
call fcn.00480160
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b1a0
lea eax, [ebp - 0x4c]
mov edx, 0x13
call fcn.00404934
ret
Function at 0x50bf2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50c027
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.user32.dll_GetClientRect
push 0
call sub.user32.dll_GetSystemMetrics
lea edx, [ebp - 4]
call fcn.00409838
push 1
call sub.user32.dll_GetSystemMetrics
lea edx, [ebp - 8]
call fcn.00409838
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x11c]
call fcn.0040a1e4
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 0x14]
call fcn.00409838
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 4]
call fcn.00404d1c
jne 0x50bffa
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x10]
call fcn.00409838
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.00404d1c
jne 0x50bffa
mov edx, dword [ebp - 0xc]
mov eax, 0x50c040
call fcn.00404f14
dec eax
jge 0x50bffa
mov bl, 1
jmp 0x50bffc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c02e
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.00404934
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404934
ret
Function at 0x50f03c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
mov byte [ebp - 1], 0
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x94], 5
jbe 0x50f0f0
xor eax, eax
push ebp
push 0x50f0e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43bddc]
call fcn.0043bf48
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0043bfe8
xor ecx, ecx
mov edx, 0x50f104
mov eax, ebx
call fcn.0043c12c
mov edx, 0x50f148
mov eax, ebx
call fcn.0043c658
test al, al
je 0x50f0c5
mov edx, 0x50f148
mov eax, ebx
call fcn.0043c54c
mov esi, eax
jmp 0x50f0c7
xor esi, esi
mov eax, ebx
call fcn.0043bfb8
mov eax, ebx
call fcn.00403afc
dec esi
jne 0x50f0dc
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50f0f0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1018520
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x1018542
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1018549
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1018538
mov eax, 1
add ebx, ebx
jne 0x101855b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1018550
jne 0x101856c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1018550
xor ecx, ecx
sub eax, 3
jb 0x1018580
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10185f2
mov ebp, eax
add ebx, ebx
jne 0x101858b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1018598
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10185bc
inc ecx
add ebx, ebx
jne 0x10185a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x101859d
jne 0x10185b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101859d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10185dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10185cd
jmp 0x101853e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10185dc
add edi, ecx
jmp 0x101853e
pop esi
mov edi, esi
mov ecx, 0x5a5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10185fa
cmp byte [edi], 5
jne 0x10185fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x10185ff
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x1018677
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18b40]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18c58]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x101862c
mov ecx, edi
jns 0x101865b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18c5c]
or eax, eax
je 0x1018671
mov dword [ebx], eax
add ebx, 4
jmp 0x1018649
call dword [esi + 0x18c60]
popal
jmp 0x1008697
Function at 0x40e410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x440080]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xf8004c66
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0xf22153fe
je 0x40e482
jmp 0x40e44a
mov eax, dword [ebp - 0x20]
sub eax, 0xf8004c66
je 0x40e462
jmp 0x40e45d
jmp 0x40e4c5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push eax
mov edx, esp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
mov dword [ebp - 0x14], 0xf22153fe
jmp 0x40e4c5
mov edx, dword [ebp - 0x10]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x64
sub byte [edi], 0x88
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x40e494
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00428eb0
lea esp, [ebp - 4]
pop edi
pop ebp
ret
jmp 0x40e434
Function at 0x42977b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4297ba
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4297ba
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4297ba
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4297ba
cmp dword [ecx + 0x74], 0xe
jbe 0x4297ba
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret