joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473330
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x473347
add esp, 0xfffffff0
call fcn.00403f64
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422bd8
mov eax, dword [0x4c3568]
cmp word [eax + 2], 0
jne 0x47336f
mov eax, dword [0x4c3568]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00474ab0
mov eax, dword [0x4c36e4]
cmp word [eax + 2], 0
jne 0x473389
mov eax, dword [0x4c36e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00474ca8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x419854]
call fcn.00403c10
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x419854]
call fcn.00403c10
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x42522c]
call fcn.0042cf10
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x473510
mov eax, dword [0x4c339c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042d2e0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x475258
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4c339c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e06c
test eax, eax
je 0x47347e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409f2c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e094
test eax, eax
je 0x473492
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404ca4
mov eax, dword [0x4c30e0]
cmp byte [eax], 0
jne 0x4734c6
mov eax, ebx
call fcn.00473638
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00475434
mov eax, ebx
call fcn.00475df8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x473506
call fcn.00403fbc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4738b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4c4bf0]
cmp dword [eax + 0x30], 0
je 0x473962
cmp dword [ebx + 0x94], 0
jne 0x47395c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x473848
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47395c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x473922
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x47395c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bf30
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x473931
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4744c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4744f9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b24
jmp 0x474506
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404a88
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x475610
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x475651
mov eax, esi
call fcn.0045b6f4
test al, al
je 0x475651
mov eax, dword [ebx + 0x84]
call fcn.0045b3f0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x475651
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045b3f0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x47989c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x479925
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4c4c34
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x47990f
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c964
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x47993c
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4c37ac]
mov dl, 1
mov eax, dword [0x478c00]
call fcn.0040d294
call fcn.004043cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47992c
lea eax, [ebp - 0x1c]
call fcn.00404a34
ret
Function at 0x479ff0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00479f14
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403e3c
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x47a054
call fcn.004797e4
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x47a046
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403e3c
pop esi
pop ebx
ret

Function at 0x47a120
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00404ef4
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.004032b8
test ebx, ebx
je 0x47a16b
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x47a248
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47a279
mov ecx, dword [0x4c3940]
mov dl, 1
mov eax, dword [0x478c00]
call fcn.0040d258
call fcn.004043cc
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x47a2a6
mov ecx, dword [0x4c354c]
mov dl, 1
mov eax, dword [0x478c00]
call fcn.0040d258
call fcn.004043cc
xor eax, eax
push ebp
push 0x47a327
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403e3c
cmp byte [ebp + 8], 0
je 0x47a301
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047a1b0
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00479f70
jmp 0x47a31d
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00479ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47a344
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47a50c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00479d98
xor eax, eax
push ebp
push 0x47a67d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x47a667
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x47a557
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47a561
call fcn.00404478
jmp 0x47a684
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e780
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x47a65c
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x47a60f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x47a5fc
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403e3c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0047a4c4
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x47a690]
cmp dl, byte [eax + 0x28]
je 0x47a663
call fcn.0040d170
jmp 0x47a663
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e7a0
jmp 0x47a663
cmp ecx, ebx
jge 0x47a62b
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e7a0
jmp 0x47a561
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e780
cmp edx, dword [esp + 4]
jne 0x47a64b
cmp eax, dword [esp]
pop edx
pop eax
jne 0x47a561
push ebp
call fcn.0047a4c4
pop ecx
jmp 0x47a663
push ebp
call fcn.0047a4c4
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a684
mov eax, dword [ebp - 4]
call fcn.00479da4
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47a6d8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47a822
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00479d98
xor eax, eax
push ebp
push 0x47a805
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x47a73d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47a73d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x47a7ef
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47a750
call fcn.00404478
jmp 0x47a80c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47a7ef
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47a7ef
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403e3c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47a7ef
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c964
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47a83c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4c37ac]
mov dl, 1
mov eax, dword [0x478c00]
call fcn.0040d294
call fcn.004043cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a80c
mov eax, dword [ebp - 4]
call fcn.00479da4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a829
lea eax, [ebp - 0x28]
call fcn.00404a34
ret
Function at 0x48dfb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48dfb8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48e1aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48e1c0
mov eax, esi
call fcn.0048bd40
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404a88
lea ecx, [ebp - 0x10]
mov edx, 0x48e1d4
mov eax, esi
call fcn.0048bd40
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404a88
lea ecx, [ebp - 0x14]
mov edx, 0x48e1ec
mov eax, esi
call fcn.0048bd40
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404a88
lea ecx, [ebp - 0x18]
mov edx, 0x48e208
mov eax, esi
call fcn.0048bd40
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404a88
lea ecx, [ebp - 0x1c]
mov edx, 0x48e224
mov eax, esi
call fcn.0048bd40
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404a88
lea ecx, [ebp - 0x24]
mov edx, 0x48e23c
mov eax, esi
call fcn.0048bd40
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004093b8
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409900
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x48e254
mov eax, esi
call fcn.0048bd40
mov eax, dword [ebp - 0x28]
call fcn.0048ae58
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x48e264
mov eax, esi
call fcn.0048bd40
mov eax, dword [ebp - 0x2c]
call fcn.0048ae58
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48e27c
mov eax, esi
call fcn.0048bd40
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409900
inc eax
je 0x48e14d
lea ecx, [ebp - 0x34]
mov edx, 0x48e27c
mov eax, esi
call fcn.0048bd40
mov eax, dword [ebp - 0x34]
call fcn.004098c4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aed8
fstp qword [ebp - 0x3c]
wait
call fcn.0040b34c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48e168
lea ecx, [ebp - 0x40]
mov edx, 0x48e27c
mov eax, esi
call fcn.0048bd40
mov eax, dword [ebp - 0x40]
call fcn.0048ae58
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48e28c
mov eax, esi
call fcn.0048bd40
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404a88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e1b1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404a58
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404a58
ret
Function at 0x49a448
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49a4a2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0049a438
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004899c8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004895c8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a4a9
lea eax, [ebp - 4]
call fcn.00404a34
ret

Function at 0x4a756c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
mov eax, ebx
call fcn.00404a34
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 0x800
call fcn.004032b8
mov dword [esp], 0xffffffff
push esp
push 0x20019
push 0
push 0x4a7608
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4a75f4
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x4a7620
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4a75f4
cmp dword [esp + 4], 1
jne 0x4a75f4
mov eax, ebx
lea edx, [esp + 0xc]
call fcn.00404c2c
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x80c
pop ebx
ret

Function at 0x4a99d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ee4
xor eax, eax
push ebp
push 0x4a9ab0
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409b0c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a9a9a
xor esi, esi
lea edx, [ebp - 0x4a]
mov ecx, 0x40
mov eax, ebx
call fcn.00409b90
cmp eax, 0x40
jne 0x4a9a93
cmp word [ebp - 0x4a], 0x5a4d
jne 0x4a9a93
xor ecx, ecx
mov edx, dword [ebp - 0xe]
mov eax, ebx
call fcn.00409be8
cmp eax, dword [ebp - 0xe]
jne 0x4a9a93
lea edx, [ebp - 8]
mov ecx, 4
mov eax, ebx
call fcn.00409b90
cmp eax, 4
jne 0x4a9a93
cmp dword [ebp - 8], 0x4550
jne 0x4a9a93
lea edx, [ebp - 0xa]
mov ecx, 2
mov eax, ebx
call fcn.00409b90
cmp eax, 2
jne 0x4a9a93
mov ax, word [ebp - 0xa]
sub ax, 0x14c
je 0x4a9a87
sub ax, 0xb4
je 0x4a9a8e
sub ax, 0x84
je 0x4a9a8e
sub ax, 0x83e0
je 0x4a9a8e
jmp 0x4a9a93
mov esi, 0x20
jmp 0x4a9a93
mov esi, 0x40
mov eax, ebx
call fcn.00409c2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9ab7
lea eax, [ebp - 4]
call fcn.00404a34
ret

Function at 0x4b633c
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x4b718c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ee4
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4b72ef
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0047bfa4
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.0047bfc4
jmp 0x4b72c1
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404ca4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409d9c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409168
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409168
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404e40
je 0x4b72a3
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404ca4
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409168
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409168
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404e40
jne 0x4b72b8
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.0047bfe4
test eax, eax
jne 0x4b7204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b72f6
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404a58
lea eax, [ebp - 4]
call fcn.00404a34
ret
Function at 0x4011e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401234
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401230
lea ebx, [ebx]
cmp esi, eax
jae 0x401234
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401220
cmp esi, eax
jb 0x40123a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401290
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0xc]
mov ebp, dword [esp + 0x18]
mov edi, ebx
nop
mov ecx, dword [edi + 0x30]
mov esi, dword [0x43408c]
push ecx
call fcn.00411f1a
movzx ecx, word [eax]
add esp, 4
test ecx, ecx
je 0x4012e3
lea esp, [esp]
mov edx, esi
shl edx, 5
add eax, 2
add edx, ecx
movzx ecx, word [eax]
add esi, edx
test ecx, ecx
jne 0x4012d0
cmp esi, ebp
je 0x4012f5
mov edi, dword [edi]
cmp edi, ebx
jne 0x4012b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x401300
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x204
mov eax, dword [0x434cb8]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
mov edi, dword [esp + 0x224]
xor esi, esi
xor ecx, ecx
mov eax, ecx
cdq
idiv edi
mov byte [esp + ecx + 0x10], cl
inc ecx
cmp ecx, 0x100
mov al, byte [edx + ebx]
mov byte [esp + ecx + 0x10f], al
jl 0x401331
xor eax, eax
nop
mov cl, byte [esp + eax + 0x10]
movzx edx, byte [esp + eax + 0x110]
movzx edi, cl
add edx, esi
add edi, edx
mov esi, edi
and esi, 0x800000ff
jns 0x401375
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], cl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x100
jl 0x401350
mov edx, dword [esp + 0x21c]
xor esi, esi
test edx, edx
jle 0x401404
mov edi, dword [esp + 0x218]
mov ecx, ebp
sub edi, ebp
mov ebp, edx
inc eax
and eax, 0x800000ff
jns 0x4013b2
dec eax
or eax, 0xffffff00
inc eax
movzx edx, byte [esp + eax + 0x10]
add esi, edx
and esi, 0x800000ff
jns 0x4013c9
dec esi
or esi, 0xffffff00
inc esi
mov bl, byte [esp + eax + 0x10]
mov dl, byte [esp + esi + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + eax + 0x10], dl
movzx ebx, byte [esp + esi + 0x10]
movzx edx, dl
add edx, ebx
and edx, 0x800000ff
jns 0x4013f3
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [edi + ecx]
inc ecx
sub ebp, 1
mov byte [ecx - 1], dl
jne 0x4013a3
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00411915
add esp, 0x204
ret