joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d366c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.004045b8
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4d37b4
mov edx, 0x4d37b8
mov eax, ebx
call fcn.004d30b8
test al, al
je 0x4d37a9
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407bfc
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x53f21c]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4d37c8
mov eax, ebx
call fcn.004d32d4
mov ebx, eax
test ebx, ebx
je 0x4d37a9
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4d37d4
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4d37e8
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4d37fc
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4d3766
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4d3766
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4d377b
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4d37a3
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x4d3a5c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4d3c83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x53f23c], eax
xor eax, eax
mov dword [0x549388], eax
xor eax, eax
mov dword [0x54938c], eax
xor eax, eax
mov dword [0x549390], eax
xor eax, eax
mov dword [0x549394], eax
xor eax, eax
mov dword [0x549384], eax
xor eax, eax
mov dword [0x549398], eax
xor eax, eax
mov dword [0x54939c], eax
xor eax, eax
mov dword [0x5493a0], eax
xor eax, eax
mov dword [0x5493a4], eax
cmp dword [0x53f240], 0
je 0x4d3c65
push 0x4d3c90
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549388], eax
push 0x4d3c98
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x54938c], eax
push 0x4d3ca0
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549390], eax
push 0x4d3ca8
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549394], eax
push 0x4d3cb0
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549384], eax
push 0x4d3cb8
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x549398], eax
push 0x4d3cc8
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x54939c], eax
push 0x4d3cd4
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5493a0], eax
push 0x4d3ce4
mov eax, dword [0x53f240]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5493a4], eax
cmp dword [0x549388], 0
je 0x4d3c65
cmp dword [0x54938c], 0
je 0x4d3c65
cmp dword [0x549390], 0
je 0x4d3c65
cmp dword [0x549394], 0
je 0x4d3c65
cmp dword [0x549384], 0
je 0x4d3c65
cmp dword [0x53f244], 0xffffffff
jne 0x4d3c01
push 0
push 1
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4d3d00
call fcn.004048d8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e90
mov eax, dword [ebp - 4]
mov edx, 0x4d3d14
call fcn.0046d7d8
mov dword [0x53f244], eax
cmp dword [0x53f244], 2
jge 0x4d3c19
push 0x58
push 0x6f401
call dword [0x549394]
jmp 0x4d3c2d
cmp dword [0x53f244], 2
jne 0x4d3c2d
push 0x51a7b0e
call dword [0x54938c]
mov dword [0x53f23c], 1
cmp dword [0x549398], 0
je 0x4d3c65
cmp dword [0x54939c], 0
je 0x4d3c65
cmp dword [0x5493a0], 0
je 0x4d3c65
cmp dword [0x5493a4], 0
je 0x4d3c65
mov dword [0x53f23c], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3c8a
lea eax, [ebp - 8]
call fcn.004045b8
lea eax, [ebp - 4]
call fcn.00404cf0
ret
Function at 0x4d5a48
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0x4d5b10
push 0xffffffffffffffff
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d5b06
xor eax, eax
push ebp
push 0x4d5aff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa7e
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d5ae8
xor eax, eax
push ebp
push 0x4d5ae1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0xa7e
call fcn.00403098
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, 0xa7e
call fcn.00402974
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5ae8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5b06
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d8e80
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4d8e88
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4d908e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo_1
cmp eax, 0x6f
jne 0x4d9063
mov eax, dword [ebp - 0x14]
call fcn.00408d98
mov edi, eax
mov ebx, edi
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo_1
test eax, eax
jne 0x4d905c
test ebx, ebx
je 0x4d905c
lea esi, [ebx + 0x1ac]
lea eax, [ebx + 0x1d4]
mov dword [ebp - 0x10], eax
test esi, esi
je 0x4d9052
lea eax, [ebp - 0x20]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x20]
mov edx, 0x4d90a4
call fcn.004049d0
je 0x4d9052
lea eax, [ebp - 0x24]
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x24]
mov edx, 0x4d90b4
call fcn.004049d0
je 0x4d9052
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0x28]
mov edx, 0x4d90a4
call fcn.004049d0
je 0x4d9052
mov al, byte [0x4d90c4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
lea edx, [ebx + 8]
mov ecx, 0x104
call fcn.00404820
mov ecx, dword [ebp - 0x2c]
mov edx, 0x4d90d0
mov eax, 0x4d90e4
call fcn.0040da60
lea ecx, [ebp - 0x18]
mov edx, 0x4d9164
mov eax, dword [ebp - 0x1c]
call fcn.0046c5d0
cmp dword [ebp - 0x18], 0
je 0x4d9052
cmp byte [ebp - 1], 0
je 0x4d8fcd
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
jmp 0x4d905c
mov eax, 0x54a8b0
mov edx, dword [ebp - 0x18]
call fcn.0040460c
mov eax, 0x54a8b4
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404820
mov eax, 0x54a8b8
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.00404820
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add edx, 4
mov ecx, 0x10
call fcn.00404820
mov eax, dword [ebp - 0xc]
mov edx, 0x4d9174
call fcn.004049d0
je 0x4d905c
mov eax, 0x54a8bc
mov edx, dword [ebp - 0xc]
call fcn.0040460c
lea eax, [ebp - 0x30]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x30]
mov ecx, dword [0x54a8bc]
mov edx, 0x4d9184
call fcn.0046dc3c
jmp 0x4d905c
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4d8ee6
mov eax, edi
call fcn.004027dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9095
lea eax, [ebp - 0x30]
call fcn.00404cf0
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4d918c
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4d92ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004045b8
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x4d92b4
mov eax, dword [ebp - 0x10]
call fcn.00408d98
mov edi, eax
mov esi, edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0x1e
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4d92ad
test esi, esi
je 0x4d92ad
mov ebx, dword [esi + 0x10]
cmp dword [ebp - 8], 2
jne 0x4d9254
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.Ntdll.dll_RtlIpv4StringToAddressA
test ebx, ebx
je 0x4d92a2
mov eax, dword [ebx + 0xc]
cmp word [eax], 2
jne 0x4d924b
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x2c]
jne 0x4d924b
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.00471638
jmp 0x4d92ad
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d922d
jmp 0x4d92a2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.Ntdll.dll_RtlIpv6StringToAddressA
test ebx, ebx
je 0x4d92a2
mov eax, dword [ebx + 0xc]
cmp word [eax], 0x17
jne 0x4d929b
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0xc]
add eax, 8
mov ecx, 0x10
call fcn.00471f28
test eax, eax
jne 0x4d929b
mov edx, dword [ebp - 0xc]
lea eax, [esi + 0x2c]
call fcn.00471638
jmp 0x4d92ad
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d926e
mov esi, dword [esi + 8]
test esi, esi
jne 0x4d9208
mov eax, edi
call fcn.004027dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d92d1
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4d9a18
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d9b7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540320], 0x7d9
cmp si, 2
jne 0x4d9a72
lea eax, [ebp - 0x20]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d9b94
call fcn.0046db0c
jmp 0x4d9a9e
cmp si, 8
je 0x4d9a7e
cmp si, 1
jne 0x4d9a9e
lea eax, [ebp - 0x24]
mov edx, dword [0x5418e8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d9ba4
call fcn.0046db0c
cmp dword [ebp - 0xc], 0
je 0x4d9ab9
push 1
lea eax, [ebp - 0xc]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d9b51
test si, 2
jne 0x4d9ace
test si, 1
jne 0x4d9ace
test si, 8
je 0x4d9b37
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d9b37
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004ab980
mov eax, dword [ebp - 0x28]
call fcn.00404a84
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d9b3f
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9b83
lea eax, [ebp - 0x28]
call fcn.004045b8
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404d08
lea eax, [ebp - 0xc]
call fcn.004045b8
ret
Function at 0x4da8f0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov dword [0x540320], 0x7e1
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403098
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
mov ax, word [ebp + 8]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4da96a
cmp byte [ebp - 1], 0
je 0x4da968
push 0x64
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4da971
mov bl, 1
xor eax, eax
mov dword [0x540320], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e03d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4e0515
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x54a88c], 0
je 0x4e04c5
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov edi, eax
mov edx, dword [0x54a880]
mov eax, 0x4e052c
call fcn.00404bc8
test eax, eax
jle 0x4e044d
push 0x4e0538
push dword [0x54a880]
push 0x4e0544
push dword [0x54a884]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4e047a
push 0x4e0550
push dword [0x54a880]
push 0x4e052c
push dword [0x54a884]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040494c
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x541c9c]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4e0560
call fcn.004048d8
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x54a888]
call fcn.00404a84
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a84
push eax
push 0x4e056c
mov eax, esi
call fcn.0045deb8
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e04fa
push 1
mov eax, dword [0x54a888]
call fcn.00404a84
push eax
mov eax, dword [0x54a884]
call fcn.00404a84
push eax
mov eax, dword [0x54a880]
call fcn.00404a84
push eax
push 0x4e056c
mov eax, esi
call fcn.0045deb8
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e051c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045dc
ret
Function at 0x4e944c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e9563
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540320], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004ab980
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x54a464
mov ecx, 0x105
call fcn.00404820
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.004048d8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e90
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046e16c
mov ebx, eax
test ebx, ebx
je 0x4e952c
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.004037ac
mov eax, 0xc8
call fcn.004d938c
push 1
push 0x4e9570
push 0x4e957c
push dword [ebp - 4]
push 0x4e958c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040494c
mov eax, dword [ebp - 0x14]
call fcn.00404a84
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004ab980
mov eax, dword [ebp - 0x18]
call fcn.00404a84
push eax
push 0x4e9590
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e956a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004045dc
lea eax, [ebp - 0x10]
call fcn.00404cf0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045dc
ret

Function at 0x4e9c34
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e9d31
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540320], 0x80d
call sub.user32.dll_GetForegroundWindow
mov dword [ebx], eax
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4e9cd6
lea edx, [ebp - 4]
lea eax, [ebp - 0x88]
call fcn.00409fe8
push 0x7f
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e9cb1
lea edx, [ebp - 8]
lea eax, [ebp - 0x88]
call fcn.00409fe8
jmp 0x4e9cb9
lea eax, [ebp - 8]
call fcn.004045b8
push dword [ebp - 4]
push 0x4e9d4c
push dword [ebp - 8]
push 0x4e9d58
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040494c
xor esi, esi
mov edi, 0x540b98
cmp esi, 3
jl 0x4e9cf3
mov edx, dword [ebp - 4]
mov eax, dword [edi]
call fcn.00404bc8
test eax, eax
setg bl
jmp 0x4e9d00
mov eax, dword [edi]
mov edx, dword [ebp - 4]
call fcn.004049d0
sete bl
test bl, bl
jne 0x4e9d16
inc esi
add edi, 4
cmp esi, 4
jne 0x4e9cdd
xor ebx, ebx
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9d38
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4ec2e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ec44b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x54a578], 0
jbe 0x4ec35e
mov ax, word [0x540378]
cmp ax, word [0x54a578]
jb 0x4ec35e
mov eax, dword [0x540338]
mov dword [0x540368], eax
mov eax, dword [0x54033c]
mov dword [0x54036c], eax
mov word [0x540378], 0
mov eax, dword [ebx + 0x314]
call fcn.0047cc48
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004efcd0
mov dl, 1
mov ax, 2
call fcn.004d9a18
jmp 0x4ec435
cmp word [0x54a57a], 0
jbe 0x4ec3cc
mov ax, word [0x540378]
cmp ax, word [0x54a57a]
jb 0x4ec3cc
mov eax, dword [0x540338]
mov dword [0x540368], eax
mov eax, dword [0x54033c]
mov dword [0x54036c], eax
mov word [0x540378], 0
cmp dword [0x54a57c], 0
je 0x4ec3cc
lea eax, [ebp - 4]
mov ecx, dword [0x54a57c]
mov edx, 0x4ec460
call fcn.004048d8
lea eax, [ebp - 4]
call fcn.004db6bc
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
cmp word [0x54a580], 0
jbe 0x4ec435
mov ax, word [0x540378]
cmp ax, word [0x54a580]
jb 0x4ec435
mov eax, dword [0x540338]
mov dword [0x540368], eax
mov eax, dword [0x54033c]
mov dword [0x54036c], eax
mov word [0x540378], 0
cmp dword [0x54a584], 0
je 0x4ec435
lea eax, [ebp - 4]
mov edx, dword [0x54a584]
call fcn.00404650
lea eax, [ebp - 4]
call fcn.004db6bc
push 0
lea eax, [ebp - 4]
call fcn.00404adc
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec452
lea eax, [ebp - 4]
call fcn.004045b8
ret
Function at 0x4f26f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4f28a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540320], 0x82d
cmp byte [0x5403cc], 0
jne 0x4f2752
cmp byte [0x5403d0], 0
jne 0x4f2752
mov eax, dword [0x54a5d8]
call fcn.0046dddc
test al, al
je 0x4f2752
push 1
push 0x4f28b4
push 0x4f28b8
mov eax, dword [0x54a5d8]
call fcn.00404a84
push eax
push 0x4f28bc
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x54a5cc]
call fcn.0046dddc
test al, al
je 0x4f2884
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1658]
call fcn.004b1a5c
mov dword [0x5403f4], eax
mov eax, dword [0x5403f4]
mov edx, dword [0x4b1658]
call fcn.0040395c
add eax, 0x30
push eax
lea edx, [ebp - 4]
mov eax, 0x10e
call fcn.004ab980
mov edx, dword [ebp - 4]
pop eax
call fcn.0040460c
mov eax, dword [0x5403f4]
mov edx, dword [0x4b1658]
call fcn.0040395c
mov byte [eax + 0x34], 0
mov eax, dword [0x5403f4]
call fcn.0041f6ac
cmp dword [0x54a5a4], 0
jne 0x4f27dd
lea eax, [ebp - 8]
call fcn.004714e0
mov edx, dword [ebp - 8]
mov eax, 0x54a5a4
call fcn.0040460c
cmp dword [0x54a5a4], 0
je 0x4f2835
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1658]
call fcn.004b1a5c
mov dword [0x5403f8], eax
mov eax, dword [0x5403f8]
mov edx, dword [0x4b1658]
call fcn.0040395c
add eax, 0x30
mov edx, dword [0x54a5a4]
call fcn.0040460c
mov eax, dword [0x5403f8]
mov edx, dword [0x4b1658]
call fcn.0040395c
mov byte [eax + 0x34], 1
mov eax, dword [0x5403f8]
call fcn.0041f6ac
mov cl, 1
mov dl, 1
mov eax, dword [0x4b1658]
call fcn.004b1a5c
mov dword [0x5403fc], eax
mov eax, dword [0x5403fc]
mov edx, dword [0x4b1658]
call fcn.0040395c
add eax, 0x30
mov edx, dword [0x54a59c]
call fcn.0040460c
mov eax, dword [0x5403fc]
mov edx, dword [0x4b1658]
call fcn.0040395c
mov byte [eax + 0x34], 2
mov eax, dword [0x5403fc]
call fcn.0041f6ac
xor eax, eax
mov dword [0x540320], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f28ad
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045dc
ret
Function at 0x4f2fd4
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
push ebp
push 0x4f30c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4145dc]
call fcn.0040377c
mov edi, eax
push edi
push 0x4f2b34
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4f30aa
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416ef8
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4f30a2
lea eax, [ebp - 4]
call fcn.00404adc
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409eac
test eax, eax
jne 0x4f30a2
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416ef8
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f3086
cmp eax, 0xffffffff
je 0x4f30a2
cmp dword [ebp - 0xc], 0
je 0x4f30a2
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4f3021
mov eax, edi
call fcn.004037ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f30ce
lea eax, [ebp - 4]
call fcn.004045b8
ret

Function at 0x4f30d8
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4f30f1
cmp eax, 0xffffffff
je 0x4f3105
test ebx, ebx
je 0x4f3105
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret