joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488500
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4886ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x48868c
mov dl, 1
mov eax, dword [0x41c8b8]
call fcn.00404080
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404f34
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x48867b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00474618
test al, al
je 0x48866e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4886bc
lea eax, [ebp - 0x254]
call fcn.0040d2c0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48866e
xor eax, eax
push ebp
push 0x488667
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4886f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x488650
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004051b4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x488650
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004051b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48866e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x488571
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0042189c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4886b2
lea eax, [ebp - 0x260]
call fcn.00404f34
ret

Function at 0x48903c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x59fde8]
cmp byte [eax + 0xa5], 0
jne 0x4890ad
cmp dword [0x59fe00], 0
jne 0x48906e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x488ff8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x59fe00], eax
cmp dword [0x59fdfc], 0
jne 0x489089
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x59fdfc], eax
cmp dword [0x59fe04], 0
jne 0x4890ad
push esp
push 0
push 0
push 0x488f9c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x59fe04], eax
pop edx
ret
Function at 0x489770
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x59fde8]
cmp dword [eax + 0x30], 0
je 0x48981a
cmp dword [ebx + 0x94], 0
jne 0x489814
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x489700
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x489814
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4897da
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x489814
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041ecd4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4897e9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48a378
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x48a3ad
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405024
jmp 0x48a3ba
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f88
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x48b55c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x48b59d
mov eax, esi
call fcn.0046fb9c
test al, al
je 0x48b59d
mov eax, dword [ebx + 0x84]
call fcn.0046f898
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48b59d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0046f898
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x48c310
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x48c337
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48c4d2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x48c4bf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x48c386
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x48c37c
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x48c4a4
mov edx, dword [ebp - 4]
test al, 8
je 0x48c402
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x48c3e7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0046789c
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x48c424
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0046789c
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0046789c
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x10
je 0x48c482
mov byte [ebp - 0x34], 1
mov edx, dword [ebp - 4]
or eax, 0x1e
and eax, 0xfffffffe
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x48c24c
push ebx
call sub.user32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x48c4a4
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x48c24c
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c4c6
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48c884
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x48c93b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x48c94c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48c925
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x48c964
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp esi, 2
je 0x48c925
test esi, esi
jne 0x48c8fc
cmp dword [ebp - 8], 1
je 0x48c900
xor ebx, ebx
jmp 0x48c925
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, 0x20
call fcn.004051b4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.0040390c
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x48c925
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c942
lea eax, [ebp - 0x34]
call fcn.00404f34
ret

Function at 0x48d38c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48d476
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x59c260]
cmp dword [eax], 5
jl 0x48d3bc
mov eax, dword [0x59c730]
cmp dword [eax], 2
je 0x48d3c5
mov byte [ebp - 1], 1
jmp 0x48d460
mov byte [ebp - 1], 0
push 0x48d490
push ebx
push 0x48d4bc
lea eax, [ebp - 8]
mov edx, 3
call fcn.004052c4
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48d460
xor edx, edx
push ebp
push 0x48d459
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x18], 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x48d437
cmp word [ebp - 0x14], 0
jne 0x48d43e
cmp eax, 0xea
jne 0x48d442
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d460
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d47d
lea eax, [ebp - 8]
call fcn.00404f34
ret
Function at 0x48d548
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x48d5d0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x1004
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x48d5b8
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.004051b4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.004062e4
mov ebx, eax
cmp dword [ebp - 4], 0
jne 0x48d5b4
push ebx
call sub.kernel32.dll_IsValidCodePage
test eax, eax
jne 0x48d5ba
xor ebx, ebx
jmp 0x48d5ba
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d5d7
lea eax, [ebp - 0x18]
call fcn.00404f34
ret

Function at 0x48e2d4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
mov ebx, eax
shl ebx, 0x10
test ebx, ebx
je 0x48e314
push 0x100
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextA
test eax, eax
jle 0x48e314
mov eax, esi
mov edx, esp
mov ecx, 0x100
call fcn.004051b4
jmp 0x48e320
mov eax, esi
mov edx, 0x48e334
call fcn.00404f88
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x49f274
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046fb9c
test al, al
je 0x49f3c9
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046f898
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetUpdateRect
test eax, eax
je 0x49f2e0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_EqualRect
test eax, eax
je 0x49f2e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0049c378
jmp 0x49f3c9
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49f3b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0x14]
push edi
mov esi, dword [ebp - 0x18]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
mov ebx, dword [ebp - 0xc]
push ebx
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push ebx
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f3be
cmp dword [ebp - 0xc], 0
je 0x49f39a
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x49f3a9
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7b08
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4a7b8c
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 0xa]
push eax
push 0x1004
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xa]
mov ecx, 6
call fcn.004051b4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040c408
push 1
lea edx, [ebp - 4]
push edx
push 1
lea edx, [ebp - 1]
push edx
push 4
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7b93
lea eax, [ebp - 0x10]
call fcn.00404f34
ret

Function at 0x4a90f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00405204
mov edx, eax
mov eax, ebp
call fcn.00405590
mov eax, dword [esp]
call fcn.00405204
mov edi, eax
test edi, edi
jle 0x4a9154
mov ebx, 1
mov eax, ebp
call fcn.0040545c
mov edx, dword [esp]
mov dl, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x4a9120
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a915c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.00405204
mov edx, eax
mov eax, dword [esp]
call fcn.00405590
mov eax, edi
call fcn.00405204
mov ebp, eax
test ebp, ebp
jle 0x4a91bb
mov ebx, 1
mov eax, dword [esp]
call fcn.0040545c
mov dl, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x4a918b
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4af648
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4af680]
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4af65e
or bl, 2
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4af66d
or bl, 4
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4af67c
or bl, 1
mov eax, ebx
pop ebx
ret
Function at 0x4b949c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x4b953a
xor eax, eax
push ebp
push 0x4b9530
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.004b93f4
test al, al
jne 0x4b94e0
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
je 0x4b94ea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b953a
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
call fcn.004b9340
mov dword [ebp - 0xc], eax
mov edx, 0xf8
mov eax, dword [ebp - 0xc]
call fcn.004b93f4
test al, al
jne 0x4b9516
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x4b9520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b953a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b953a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b97c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [0x59c730]
cmp dword [eax], 2
jne 0x4b9844
test esi, esi
je 0x4b97e0
test ebx, ebx
jne 0x4b97e4
xor eax, eax
jmp 0x4b984d
mov edx, esi
mov eax, ebx
call fcn.004b934c
test al, al
je 0x4b9833
test edi, edi
je 0x4b9806
push esp
push edi
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4b9833
mov eax, ebx
call fcn.004b9790
test al, al
je 0x4b9823
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4b9833
push esp
push 4
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4b984d
mov edx, esi
mov eax, ebx
call fcn.004b934c
xor al, 1
jmp 0x4b984d
mov edx, esi
mov eax, ebx
call fcn.004b969c
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b9aa8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 8]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x4b9c9a
cmp dword [ebp + 8], 0
je 0x4b9c9a
cmp dword [ebp - 0xc], 0
je 0x4b9c9a
test ebx, ebx
je 0x4b9c9a
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_IsBadCodePtr
test eax, eax
jne 0x4b9c9a
mov eax, dword [ebp - 4]
call fcn.004b95b8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b9c9a
mov eax, dword [ebp - 0xc]
call fcn.00405404
push eax
call sub.kernel32.dll_GetModuleHandleA_2
mov edx, ebx
call fcn.004b9994
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4b9c9a
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x3c]
jbe 0x4b9c8d
mov edx, dword [ebp - 0x14]
mov dl, byte [edx]
cmp dl, byte [0x59b314]
jne 0x4b9c8d
inc eax
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
jmp 0x4b9c8d
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.004b9340
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
call fcn.00405404
mov edx, eax
mov eax, dword [ebp - 0x20]
call fcn.0040cd20
test eax, eax
jne 0x4b9c89
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 4]
call fcn.004b9340
mov dword [ebp - 0x1c], eax
jmp 0x4b9c7d
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [esi]
mov edi, dword [eax]
mov ebx, dword [ebp - 0x14]
cmp edi, ebx
je 0x4b9bcb
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3c]
jbe 0x4b9bcb
mov al, byte [edi]
cmp al, byte [0x59b314]
jne 0x4b9bcb
mov eax, dword [esi]
mov eax, dword [eax]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp ebx, dword [eax]
jne 0x4b9c79
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, dword [ebp + 8]
je 0x4b9c9a
xor eax, eax
push ebp
push 0x4b9c60
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x40
mov edx, 4
mov eax, dword [esi]
call fcn.004b97c4
test al, al
jne 0x4b9c12
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b9c9a
lea eax, [ebp + 8]
mov ecx, 0x40
mov edx, 4
call fcn.004b97c4
test al, al
jne 0x4b9c32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b9c9a
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
jne 0x4b9c56
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
xchg dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b9c71
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x4b9c9a
add dword [ebp - 0x1c], 4
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jne 0x4b9ba1
add dword [ebp - 0x18], 0x14
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xc], 0
jne 0x4b9b60
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bd71c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4bd724
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
xor eax, eax
push ebp
push 0x4bd88e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405204
test eax, eax
jne 0x4bd79a
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405590
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 4]
call fcn.00405404
lea edx, [ebp - 0x24]
call fcn.0040ce40
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004bd6a0
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.00404fcc
mov eax, dword [0x59c63c]
cmp byte [eax], 0
je 0x4bd832
lea eax, [ebp - 0x1c]
push eax
call sub.ole32.dll_CoCreateGuid
lea eax, [ebp - 8]
mov edx, 0x27
call fcn.00405c70
mov eax, dword [ebp - 8]
call fcn.00405908
push eax
mov eax, dword [ebp - 8]
call fcn.004058f8
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.ole32.dll_StringFromGUID2
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004051cc
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bca4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.00404fcc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405204
mov ecx, eax
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00405464
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405250
mov eax, dword [ebp - 0x2c]
mov edx, ebx
call fcn.00410c38
jmp 0x4bd85b
mov eax, ebx
mov edx, 0x105
call fcn.00405590
mov eax, dword [ebx]
call fcn.00405404
push eax
push 0
push 0x4bd89c
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
call sub.kernel32.dll_GetTempFileNameA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd895
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00404f58
lea eax, [ebp - 0xc]
call fcn.00404f34
lea eax, [ebp - 8]
call fcn.0040571c
lea eax, [ebp - 4]
call fcn.00404f34
ret