joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4690ac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4692a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00425a54
test al, al
je 0x46928a
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 1
jne 0x46928a
mov eax, dword [ebp - 4]
dec dword [eax + 0x2e8]
mov eax, dword [0x504230]
mov eax, dword [eax]
mov ax, word [eax + 0x38]
mov word [ebp - 6], ax
mov eax, dword [0x504230]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00431148
xor eax, eax
push ebp
push 0x469283
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
call fcn.0044b114
mov eax, dword [ebp - 4]
call fcn.00467fb0
mov eax, dword [0x504110]
mov eax, dword [eax]
call fcn.00432528
mov eax, dword [ebp - 4]
call fcn.00469f04
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x2f8], esi
xor edi, edi
mov eax, edi
cmp eax, 0x1f
ja 0x46915f
bt esi, eax
jae 0x46922b
mov ebx, edi
add bl, 0x41
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403dcc
lea eax, [ebp - 0x10]
mov edx, 0x4692b8
call fcn.00403eac
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00468374
test al, al
je 0x46922b
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403dcc
lea eax, [ebp - 0x10]
mov edx, 0x4692b8
call fcn.00403eac
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0046895c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e4], 0
je 0x4691dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.0044acd4
jmp 0x46922b
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403dcc
lea eax, [ebp - 0x10]
mov edx, 0x4692b8
call fcn.00403eac
mov eax, dword [ebp - 0x10]
call fcn.00404068
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
sub eax, 3
jb 0x46920b
sub eax, 2
jne 0x469220
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.0044acd4
jmp 0x46922b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00468e50
inc edi
cmp edi, 0x1a
jne 0x469155
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46928a
mov eax, dword [ebp - 4]
inc dword [eax + 0x2e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
call fcn.0044b184
mov eax, dword [ebp - 4]
call fcn.0044c348
test eax, eax
je 0x469272
mov eax, dword [ebp - 4]
call fcn.0044c348
call fcn.0044a894
mov eax, dword [0x504230]
mov eax, dword [eax]
mov dx, word [ebp - 6]
call fcn.00431148
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4692a7
lea eax, [ebp - 0x10]
call fcn.00403c28
ret
Function at 0x469a7c
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x16c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404058
xor eax, eax
push ebp
push 0x469c19
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004674f4
push 0x4201
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404068
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00402a44
mov edx, eax
lea eax, [ebp - 0x16c]
call fcn.00403dcc
lea eax, [ebp - 0x16c]
mov edx, 0x469c30
call fcn.00403eac
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 8]
call fcn.004699d4
pop ecx
test al, al
je 0x469b2e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x134]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0044ad78
mov dword [esi], eax
jmp 0x469b45
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x134]
xor ecx, ecx
xor edx, edx
call fcn.0044acf0
mov dword [esi], eax
lea eax, [ebp - 0x16c]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00403dcc
lea eax, [ebp - 0x16c]
mov edx, 0x469c30
call fcn.00403eac
mov eax, dword [ebp - 0x16c]
call fcn.00404068
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x469bb5
mov eax, dword [ebp - 4]
mov bl, byte [eax]
mov eax, ebx
call fcn.00402a44
and eax, 0xff
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
lea edx, [edx + eax*4 + 0x150]
lea ecx, [ebp - 0x16c]
mov eax, ebx
call fcn.00467898
mov edx, dword [ebp - 0x16c]
mov eax, dword [esi]
call fcn.00449dd4
jmp 0x469bd8
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00403e54
mov edx, dword [ebp - 0x16c]
mov eax, dword [esi]
call fcn.00449dd4
push edi
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00467b8c
mov edx, dword [esi]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x164]
call fcn.00468110
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469c20
lea eax, [ebp - 0x16c]
call fcn.00403c28
lea eax, [ebp - 4]
call fcn.00403c28
ret
Function at 0x469c34
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x469e42
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
dec dword [eax + 0x2e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
call fcn.0044b114
xor eax, eax
push ebp
push 0x469e25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00469f04
mov esi, eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov edx, ebx
cmp edx, 0x1f
ja 0x469c98
bt dword [eax + 0x2f8], edx
jae 0x469cf4
mov eax, ebx
cmp eax, 0x1f
ja 0x469ca4
bt esi, eax
jb 0x469cf4
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00403dcc
lea eax, [ebp - 0x14]
mov edx, 0x469e5c
call fcn.00403eac
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004695dc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x469cf4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00469734
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
mov edx, dword [ebp - 0xc]
call fcn.0044ac80
mov byte [ebp - 0xd], 1
inc ebx
cmp ebx, 0x1a
jne 0x469c87
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x469d06
bt esi, eax
jae 0x469dc3
mov eax, dword [ebp - 4]
mov edx, ebx
cmp edx, 0x1f
ja 0x469d1d
bt dword [eax + 0x2f8], edx
jb 0x469dc3
push ebp
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00403dcc
lea eax, [ebp - 0x14]
mov edx, 0x469e5c
call fcn.00403eac
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
xor ecx, ecx
call fcn.00469a7c
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e4], 0
je 0x469d6d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.0044acd4
jmp 0x469dbf
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00403dcc
lea eax, [ebp - 0x14]
mov edx, 0x469e5c
call fcn.00403eac
mov eax, dword [ebp - 0x14]
call fcn.00404068
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
sub eax, 3
jb 0x469d9f
sub eax, 2
jne 0x469db4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.0044acd4
jmp 0x469dbf
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00468e50
mov byte [ebp - 0xd], 1
inc ebx
cmp ebx, 0x1a
jne 0x469cfc
mov eax, dword [ebp - 4]
mov dword [eax + 0x2f8], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469e2c
mov eax, dword [ebp - 4]
inc dword [eax + 0x2e8]
mov al, byte [ebp - 0xd]
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x134]
call fcn.0044b184
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x50]
cmp byte [ebp - 0xd], 0
je 0x469e24
mov eax, dword [ebp - 4]
call fcn.0044c348
mov edx, eax
mov eax, dword [ebp - 4]
mov bx, 0xffd7
call fcn.004031b0
ret
Function at 0x469f04
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46a068
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46a04b
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetLogicalDrives
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x469f4e
bt dword [ebp - 4], eax
jae case.0x469f85.1
lea eax, [ebp - 0xc]
mov edx, ebx
add dl, 0x41
call fcn.00403dcc
lea eax, [ebp - 0xc]
mov edx, 0x46a080
call fcn.00403eac
mov eax, dword [ebp - 0xc]
call fcn.00404068
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 6
ja case.0x469f85.1
jmp dword [eax*4 + 0x469f8c]
test byte [esi + 0x2fc], 1
jne case.0x469f85.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x469f85.1
btr dword [ebp - 4], eax
jmp case.0x469f85.1
test byte [esi + 0x2fc], 2
jne case.0x469f85.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x469f85.1
btr dword [ebp - 4], eax
jmp case.0x469f85.1
test byte [esi + 0x2fc], 4
jne case.0x469f85.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x469f85.1
btr dword [ebp - 4], eax
jmp case.0x469f85.1
test byte [esi + 0x2fc], 8
jne case.0x469f85.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x469f85.1
btr dword [ebp - 4], eax
jmp case.0x469f85.1
test byte [esi + 0x2fc], 0x10
jne case.0x469f85.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x469f85.1
btr dword [ebp - 4], eax
jmp case.0x469f85.1
test byte [esi + 0x2fc], 0x20
jne case.0x469f85.1
mov eax, ebx
cmp eax, 0x1f
ja case.0x469f85.1
btr dword [ebp - 4], eax
inc ebx
cmp ebx, 0x1a
jne 0x469f43
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a052
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
Function at 0x479580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x479718
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004794ac
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
jmp 0x4795b5
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x4795ca
mov eax, ebx
mov edx, dword [0x42b47c]
call fcn.0040314c
test al, al
je 0x4795b2
test ebx, ebx
jne 0x4795ef
lea edx, [ebp - 8]
mov eax, dword [0x5041ec]
call fcn.00404ed8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x477428]
call fcn.0040960c
call fcn.00403680
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004793fc
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
xor eax, eax
push ebp
push 0x4796c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
mov dl, 1
mov eax, dword [0x4792bc]
call fcn.004777d4
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], esi
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x4c], 1
setne al
mov byte [esi + 0xc], al
mov ecx, esi
mov dl, 1
mov eax, dword [0x477278]
call fcn.00477a88
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], edi
mov edx, 0x503ea4
mov eax, edi
call fcn.00477c10
test al, al
jne 0x4796a7
lea edx, [ebp - 8]
mov eax, dword [0x503f3c]
call fcn.00404ed8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
push 0
lea edx, [ebp - 0x14]
mov eax, dword [0x504144]
call fcn.00404ed8
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x477428]
call fcn.00409640
call fcn.00403680
mov eax, dword [ebp - 4]
mov byte [eax + 0x44], 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00479790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4796d9
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.004793fc
mov eax, dword [ebp - 4]
mov byte [eax + 0x25], 1
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov eax, dword [ebp - 4]
call fcn.00479774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47971f
lea eax, [ebp - 0x14]
call fcn.00403c28
lea eax, [ebp - 8]
call fcn.00403c28
ret
Function at 0x47e118
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
jne 0x47e349
mov eax, dword [ebp - 4]
cmp dword [eax + 0xcc], 0
je 0x47e349
mov eax, dword [ebp - 4]
mov byte [eax + 0xe0], 0
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 8], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
mov dl, 6
call fcn.0041ca14
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
call fcn.004258bc
push eax
call sub.user32.dll_ShowWindow
push 0
call sub.user32.dll_SetActiveWindow
push 0x64
call sub.KERNEL32.DLL_Sleep
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xcc0020
push 0
push 0
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
call fcn.0041ba88
call fcn.004176d4
push eax
call sub.gdi32.dll_BitBlt
push esi
push 0
call sub.user32.dll_ReleaseDC
dec ebx
test ebx, ebx
jl 0x47e333
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
mov edx, dword [ebp - 0x14]
call fcn.0041bbf0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x47e327
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
xor eax, eax
push ebp
push 0x47e311
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
call fcn.004069f4
and eax, 0xff
mov edx, dword [ebp - 4]
movzx esi, byte [edx + 0xc8]
mov edx, 0x64
sub edx, esi
imul edx
mov ebx, dword [ebp - 0x10]
lea ebx, [ebx + ebx*2]
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + ebx + 2]
imul edx, esi
add eax, edx
mov ecx, 0x64
cdq
idiv ecx
mov edx, dword [ebp - 0xc]
mov byte [edx + ebx + 2], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
call fcn.004069f8
and eax, 0xff
mov edx, dword [ebp - 4]
movzx esi, byte [edx + 0xc8]
mov edx, 0x64
sub edx, esi
imul edx
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + ebx + 1]
imul edx, esi
add eax, edx
mov ecx, 0x64
cdq
idiv ecx
mov edx, dword [ebp - 0xc]
mov byte [edx + ebx + 1], al
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
call fcn.004069fc
and eax, 0xff
mov edx, dword [ebp - 4]
movzx esi, byte [edx + 0xc8]
mov edx, 0x64
sub edx, esi
imul edx
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + ebx]
imul edx, esi
add eax, edx
mov ecx, 0x64
cdq
idiv ecx
mov edx, dword [ebp - 0xc]
mov byte [edx + ebx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e31b
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x47e22f
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x47e204
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
call fcn.004258bc
push eax
call sub.user32.dll_ShowWindow
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404058
xor eax, eax
push ebp
push 0x48909e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402c98
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x41
mov word [ebp - 0x18], bx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404068
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
neg eax
sbb eax, eax
neg eax
cmp al, 1
jne 0x489086
mov ebx, dword [ebp - 0x58]
jmp 0x489088
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4890a5
lea eax, [ebp - 4]
call fcn.00403c28
ret

Function at 0x48dfac
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48e0e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48e048
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004026f8
mov dword [ebp - 8], eax
push 0xff
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [0x52d330], eax
cmp dword [0x52d330], 0
jne 0x48e01d
push 0x7000001
call sub.wsock32.dll_htonl
mov dword [ebp - 0xc], eax
jmp 0x48e02c
mov eax, dword [0x52d330]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e04f
cmp dword [ebp - 8], 0
je 0x48e047
mov eax, dword [ebp - 8]
call fcn.00402710
ret
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x8ccba6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x8cc92e
and edx, edx
and esi, esi
call fcn.008ccbdc
and edx, esi
add esi, 1
xor dword [edi], eax
add esi, edx
and edx, esi
sub esi, esi
inc edi
add edx, esi
add edx, 0xe5578b8f
cmp edi, ecx
jne fcn.008ccba6
or esi, esi
sub esi, edx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x61c35e18
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4b450372
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4452dd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44530b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x445329
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00445247
jmp 0x445329
mov eax, dword [esi + 0x14]
test eax, eax
je 0x445329
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00445247
test edi, edi
mov eax, edi
jne 0x445313
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56f64c]
test ecx, ecx
je 0x4453dc
jmp 0x4452dc
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x5ab370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5ab38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x5d4074
push ecx
mov edi, eax
call fcn.005bf198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5ab3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.005bf02e
push esi
call fcn.005befb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret