joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464a84
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x464c2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x464c10
mov dl, 1
mov eax, dword [0x417be8]
call fcn.00403b9c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404aac
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x464bff
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00456a68
test al, al
je 0x464bf2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x464c40
lea eax, [ebp - 0x254]
call fcn.0040ac2c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x464bf2
xor eax, eax
push ebp
push 0x464beb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x464c78
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x464bd4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d2c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x464bd4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464bf2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x464af5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041c93c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464c36
lea eax, [ebp - 0x260]
call fcn.00404aac
ret

Function at 0x4655a8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4e258c]
cmp byte [eax + 0xad], 0
jne 0x465619
cmp dword [0x4e25a4], 0
jne 0x4655da
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x465564
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4e25a4], eax
cmp dword [0x4e25a0], 0
jne 0x4655f5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4e25a0], eax
cmp dword [0x4e25a8], 0
jne 0x465619
push esp
push 0
push 0
push 0x465508
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4e25a8], eax
pop edx
ret
Function at 0x46581c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x465833
add esp, 0xfffffff0
call fcn.00403ef0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421268
mov eax, dword [0x4de7e8]
cmp word [eax + 2], 0
jne 0x46585b
mov eax, dword [0x4de7e8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004672e4
mov eax, dword [0x4de92c]
cmp word [eax + 2], 0
jne 0x465875
mov eax, dword [0x4de92c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004674f0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41757c]
call fcn.00403b9c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41757c]
call fcn.00403b9c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41757c]
call fcn.00403b9c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x425f94]
call fcn.0042ddf8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x465a2c
mov eax, dword [0x4de668]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e1cc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x467bc0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4de668]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ea90
test eax, eax
je 0x46597c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a234
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040eac4
test eax, eax
je 0x465990
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404d2c
mov byte [ebx + 0xd4], 0
push ebx
push 0x466e2c
call fcn.004223e4
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4de438]
cmp byte [eax], 0
jne 0x4659e1
mov eax, ebx
call fcn.00465b70
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00467d9c
mov eax, ebx
call fcn.004688fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x465a21
call fcn.00403f48
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465df0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4e258c]
cmp dword [eax + 0x30], 0
je 0x465e9a
cmp dword [ebx + 0x94], 0
jne 0x465e94
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x465d80
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x465e94
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x465e5a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x465e94
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419ebc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x465e69
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x466bb4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x466be9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b9c
jmp 0x466bf6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404b00
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x467f80
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x467fee
mov eax, esi
call fcn.004516e0
test al, al
je 0x467fee
mov eax, dword [ebx + 0x84]
call fcn.00451340
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x467fee
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x467fe2
push 0
mov eax, dword [ebx + 0x84]
call fcn.00451340
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00449728
jmp 0x467fee
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00467dbc
pop esi
pop ebx
ret
Function at 0x46b5bc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407cf0]
call fcn.00405630
xor eax, eax
push ebp
push 0x46b75d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d08e4], 0
jne 0x46b617
mov ecx, dword [0x4de45c]
mov dl, 1
mov eax, dword [0x4083f4]
call fcn.0040dc1c
call fcn.00404440
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403488
mov eax, ebx
call fcn.00405438
mov dword [ebp - 0x24], eax
mov esi, 0x46b76c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406790
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405448
test eax, eax
jle 0x46b700
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46b6ec
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404d2c
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x46b692
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404d44
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x46b6a8
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404d44
mov eax, dword [ebp - 0x54]
call fcn.00404f80
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404d2c
mov eax, dword [ebp - 0x58]
call fcn.00404f80
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x46b6ee
xor eax, eax
test al, al
je 0x46b6f9
mov ebx, 0x15
jmp 0x46b705
mov ebx, 0x10
jmp 0x46b705
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4d08e4]
call fcn.0046b440
mov eax, dword [ebp - 4]
call fcn.0046b440
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004067a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b764
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404ad0
lea eax, [ebp - 0xc]
mov edx, dword [0x407cf0]
call fcn.00405700
ret
Function at 0x4783a8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47840f
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 4]
call fcn.00405208
push edi
mov eax, dword [ebp - 4]
call fcn.00404f80
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478416
lea eax, [ebp - 4]
call fcn.00404aac
ret
Function at 0x4b13d8
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4e3620], 0
jne 0x4b13fb
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4b134c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4e3620], eax
ret

Function at 0x4b6f94
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f70
xor eax, eax
push ebp
push 0x4b70c2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4b70ac
xor eax, eax
push ebp
push 0x4b70a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404f80
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp dword [ebp - 0x10], 0
jne 0x4b7029
call sub.kernel32.dll_GetLastError
cmp eax, 0x424
jne 0x4b7029
mov ecx, 0x4b70dc
mov dl, 1
mov eax, dword [0x4083f4]
call fcn.0040db60
cmp dword [ebp - 0x10], 0
je 0x4b708e
xor eax, eax
push ebp
push 0x4b7087
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x4b7070
call sub.kernel32.dll_GetLastError
cmp eax, 0x420
jne 0x4b7070
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b708e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b70ac
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b70c9
lea eax, [ebp - 4]
call fcn.00404aac
ret
Function at 0x4b7104
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f70
xor eax, eax
push ebp
push 0x4b71f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4b71de
xor eax, eax
push ebp
push 0x4b71d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404f80
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4b71c0
xor eax, eax
push ebp
push 0x4b71b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b71c0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b71de
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b71fb
lea eax, [ebp - 4]
call fcn.00404aac
ret

Function at 0x4b763c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f70
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4b77a4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00468c70
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00468c90
mov ebx, eax
jmp 0x4b7776
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404d2c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a0c8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0040919c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.0040919c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404ecc
je 0x4b7756
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404d2c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.0040919c
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.0040919c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404ecc
jne 0x4b776b
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00468cb0
mov ebx, eax
test ebx, ebx
jne 0x4b76b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b77ab
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404ad0
lea eax, [ebp - 4]
call fcn.00404aac
ret
Function at 0x4b78d4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x21
mov eax, dword [0x4de8f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040a420
add esp, 0x104
pop ebx
ret

Function at 0x4b7914
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f70
xor eax, eax
push ebp
push 0x4b797f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403488
mov dword [ebp - 0x1e], 3
mov eax, dword [ebp - 4]
call fcn.00404f80
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x10
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7986
lea eax, [ebp - 4]
call fcn.00404aac
ret

Function at 0x4b801c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f70
xor eax, eax
push ebp
push 0x4b8116
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x8b8db8], 1
jne 0x4b806b
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [0x8b8db8], 0
jne 0x4b80fb
xor eax, eax
push ebp
push 0x4b80f1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4b809b
lea edx, [ebp - 4]
mov eax, dword [0x4de8f0]
mov eax, dword [eax]
call fcn.004678d8
push 5
push 0
lea edx, [ebp - 8]
mov eax, 1
call fcn.0040317c
mov eax, dword [ebp - 8]
call fcn.00404f80
push eax
mov eax, dword [ebp - 4]
call fcn.00404f80
push eax
push 0x4b8124
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x3e8
call fcn.004b7f94
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b811d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ad0
ret

Function at 0x4c594c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push 0x4c598c
call sub.kernel32.dll_LoadLibraryA
test eax, eax
jbe 0x4c5969
push 0x4c5998
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4c5989
push esp
push 0x40
push 3
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov ecx, 3
mov eax, 0x4c59ac
call fcn.00402f80
pop edx
pop ebx
ret
Function at 0x4c5c44
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f70
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4c5dac
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00468c70
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00468c90
mov ebx, eax
jmp 0x4c5d7e
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404d2c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a0c8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0040919c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.0040919c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404ecc
je 0x4c5d5e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404d2c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.0040919c
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.0040919c
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404ecc
jne 0x4c5d73
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00468cb0
mov ebx, eax
test ebx, ebx
jne 0x4c5cbf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5db3
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404ad0
lea eax, [ebp - 4]
call fcn.00404aac
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x16305ca2
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x70064a03
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x406e3730
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..7LWLf
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x23a35256
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219