joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f110
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 1
jmp 0x48f1b3
xor edx, edx
mov eax, dword [ebx + 0x38]
call fcn.004729b0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax + 8]
mov eax, dword [ebp - 8]
sub edi, dword [eax + 4]
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.ws2_32.dll_send
mov esi, eax
cmp esi, 0xffffffff
je 0x48f1c0
mov eax, dword [ebp - 8]
add dword [eax + 4], esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 8]
sete byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
je 0x48f1c0
xor edx, edx
mov eax, dword [ebx + 0x38]
call fcn.004728e8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00402bb0
mov edx, 0xc
mov eax, dword [ebp - 8]
call fcn.00402bb0
jmp 0x48f1b3
mov eax, dword [ebx + 0x38]
cmp dword [eax + 8], 0
jg 0x48f124
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f6e4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41657c]
call fcn.0040563c
xor eax, eax
push ebp
push 0x48f828
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c41f8], 0
jne 0x48f737
mov ecx, dword [0x4c4e6c]
mov dl, 1
mov eax, dword [0x4083c4]
call fcn.0040d410
call fcn.004045e8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004036cc
mov eax, ebx
call fcn.00405508
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48f838
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004067ec
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405518
test eax, eax
jle 0x48f7cf
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48f7c8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404ee0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404ec8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004092b0
test eax, eax
jne 0x48f7c8
mov ebx, 0x15
jmp 0x48f7d4
mov ebx, 0x10
jmp 0x48f7d4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4c41f8]
call fcn.0048f63c
mov eax, dword [ebp - 8]
call fcn.0048f63c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f82f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404c7c
lea eax, [ebp - 0x10]
mov edx, dword [0x41657c]
call fcn.0040570c
ret
Function at 0x493004
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.00492aa4
test byte [ebx + 0x23d], 4
jne 0x493099
mov edx, esp
mov eax, ebx
call fcn.004410c8
push esp
mov eax, ebx
call fcn.00447dec
push eax
push 0
mov eax, ebx
test eax, eax
je 0x493039
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x49306a
mov ecx, dword [0x4c50ac]
mov dl, 1
mov eax, dword [0x48f2fc]
call fcn.0040d410
call fcn.004045e8
mov eax, ebx
call fcn.004935d8
cmp byte [ebx + 0x57], 0
jne 0x4930a0
mov eax, ebx
call fcn.00447ff0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4930a0
push 0
mov eax, ebx
call fcn.00447ff0
push eax
call sub.user32.dll_ShowWindow
jmp 0x4930a0
mov eax, ebx
call fcn.00444ec8
add esp, 0x10
pop ebx
ret

Function at 0x497e84
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x497eeb
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.004052a4
push edi
mov eax, dword [ebp - 8]
call fcn.00405118
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497ef2
lea eax, [ebp - 8]
call fcn.00404c58
ret

Function at 0x49c62c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49c6b6
xor edx, edx
push ebp
push 0x49c697
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c6b6
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a0558
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a0586
mov eax, ebx
call fcn.004a100c
cmp dword [ebx + 0x40], 0
je 0x4a057f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a05f7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a05e9
cmp dword [ebx + 8], 0
je 0x4a05a8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a05ba
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a05e9
cmp dword [ebx + 8], 0
je 0x4a059b
cmp eax, 3
je 0x4a05cd
dec eax
jne 0x4a059b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a059b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a059b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a0615
cmp dword [ebx + 0x14], 0xcc
je 0x4a0615
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a0620
pop ebx
ret

Function at 0x4b0e1c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405108
mov eax, dword [ebp - 8]
call fcn.00405108
xor eax, eax
push ebp
push 0x4b0f39
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00405118
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x4b0f48
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405118
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b0f1e
xor eax, eax
push ebp
push 0x4b0f17
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4b0ef7
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4b0efb
xor eax, eax
jmp 0x4b0efd
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0f1e
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0f40
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c7c
ret
Function at 0x4b0f50
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405108
mov eax, dword [ebp - 8]
call fcn.00405108
mov eax, dword [ebp - 0xc]
call fcn.00405108
mov eax, dword [ebp + 0xc]
call fcn.00405108
xor eax, eax
push ebp
push 0x4b10c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x2c], 0x14
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], 2
mov eax, dword [ebp - 8]
call fcn.00405118
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 3
mov eax, 0x4b10d8
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405118
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4b10a1
xor eax, eax
push ebp
push 0x4b109a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00405118
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405118
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00405118
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b1083
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4b107a
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4b107e
xor eax, eax
jmp 0x4b1080
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b10a1
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b10cb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c7c
lea eax, [ebp + 0xc]
call fcn.00404c58
ret
Function at 0x4b10e0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x4b11a8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4b11ac
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x4b11a8
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b119f
xor eax, eax
push ebp
push 0x4b1198
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b119f
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b13a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b15bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402b80
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b1421
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x4b140b
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00404e50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1428
mov eax, dword [ebp - 8]
call fcn.00402bb0
ret

Function at 0x4b28d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004036cc
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x4b290e
cmp byte [ebp - 0xa], 0x31
jne 0x4b290c
mov bl, 1
jmp 0x4b290e
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004482f4
test al, al
je 0x4b4009
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x4b3fe7
cmp word [esi + 0x5da], 0
je 0x4b3fa1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x4b3fbe
cmp dword [ebp - 4], 0
jbe 0x4b3fba
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4b3fbe
xor ebx, ebx
jmp 0x4b3fc0
mov bl, 1
test bl, bl
jne 0x4b4009
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x4b4009
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
call fcn.00460f84
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x4b4009
cmp byte [esi + 0x584], 0
jne 0x4b4009
mov edx, 0xfffffdf3
mov eax, esi
call fcn.00493410
cmp eax, 4
jne 0x4b3f7e
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6c64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6e4b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.004036cc
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea edx, [ebp - 0x68]
mov eax, dword [0x4c51f8]
mov eax, dword [eax]
call fcn.00461800
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0xc]
call fcn.00409e5c
lea eax, [ebp - 0x10]
mov ecx, 0x4b6e64
mov edx, dword [ebp - 0xc]
call fcn.00404f64
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4c5044]
mov eax, dword [eax]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0xb
mov dword [ebp - 0xa8], esi
mov byte [ebp - 0xa4], 0xb
mov dword [ebp - 0xa0], edi
mov byte [ebp - 0x9c], 0xb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0xb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x8c], 0xb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
mov byte [ebp - 0x84], 0xb
mov eax, ebx
call fcn.00447ff0
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x7c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
mov eax, dword [ebx + 0x26ac]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0
lea edx, [ebp - 0xb0]
mov ecx, 8
mov eax, 0x4b6e7c
call fcn.0040a87c
push dword [ebp - 0x10]
push 0x4b6ea0
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 8]
call fcn.004628e4
push dword [ebp - 0xb4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404fd8
mov eax, 0x14
call fcn.00402b80
mov esi, eax
mov eax, dword [ebx + 0x26ac]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405118
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405118
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4b6e0b
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [esi], eax
mov edx, esi
mov eax, dword [ebx + 0x26b0]
call fcn.00419400
jmp 0x4b6e17
mov edx, 0x14
mov eax, esi
call fcn.00402bb0
inc dword [ebx + 0x26ac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6e52
lea eax, [ebp - 0xb4]
call fcn.00404c58
lea eax, [ebp - 0x68]
call fcn.00404c58
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404c7c
ret
Function at 0x4b8dd4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov eax, dword [0x4c4ec8]
mov eax, dword [eax]
mov eax, dword [eax + 0x26b0]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x4b8e6a
mov eax, dword [0x4c4ec8]
mov eax, dword [eax]
mov eax, dword [eax + 0x26b0]
mov edx, ebx
call fcn.0041955c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 8]
test esi, esi
jbe 0x4b8e64
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4b8e64
mov word [ebp - 0x23], 0xd
mov dword [ebp - 0x21], edi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1d], eax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x19], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xf
lea eax, [ebp - 0x23]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
push eax
call sub.user32.dll_SendMessageA
dec ebx
cmp ebx, 0xffffffff
jne 0x4b8df8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4bab20
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0x4babc4
push 0
push 0xf001f
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x4c84a8], eax
cmp dword [0x4c84a8], 0
jne 0x4bab94
push 0x4babc4
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x4c84a8], eax
push 0
push 0
push 0
push 6
mov eax, dword [0x4c84a8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x4c84ac], eax
cmp dword [0x4c84ac], 0
jne 0x4bab89
mov eax, dword [0x4c84a8]
push eax
call sub.kernel32.dll_CloseHandle_1
pop ebp
ret
mov eax, dword [0x4c84ac]
xor edx, edx
mov dword [eax], edx
jmp 0x4babc0
push 0
push 0
push 0
push 6
mov eax, dword [0x4c84a8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x4c84ac], eax
cmp dword [0x4c84ac], 0
jne 0x4babc0
mov eax, dword [0x4c84a8]
push eax
call sub.kernel32.dll_CloseHandle_1
pop ebp
ret
Function at 0x7eeeeb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07dba2c
jmp 0x7eee52
mov byte [esp], dh
mov byte [esp + 1], cl
mov word [esp], ax
mov dword [esp], eax
jmp 0x7eedab
push dword [esp + 3]
jmp 0x7eedda
push bx
mov byte [esp], dh
push word [esp]
ja 0x7eed77
push dword [esp + 3]
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x7eedbc
push edx
push si
lea esp, [esp + 2]
mov dword [esp], ecx
pushal
mov dword [esp + 0x1c], edx
jmp 0x7eed8d
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esp
jmp 0x7eedea
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esp
mov dword [esp + 0x14], ebp
push ecx
lea esp, [esp + 1]
jmp 0x7eee0f
mov word [esp + 5], ax
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x7eeebe
pushfd
mov dword [esp], ebx
lea esp, [esp + 3]
mov dword [esp + 0x14], esi
pushfd
push eax
jmp 0x7eedf5
btc edi, ecx
jmp 0x7eee76
bsf ebp, esi
je 0x7eee3c
btc edi, ecx
mov dl, ah
cpuid
jmp 0x7eee7a
rdtsc
mov bl, byte [esp]
lea esi, reloc.WINMM.dll_midiStreamStop
ror bh, cl
jmp 0x7eee80
mov dl, ah
cpuid
mov edi, dword [esp + 0x2c]
jmp 0x7eee60
jno 0x7eee96
jo 0x7eee96
movsd dword es:[edi], dword [esi]
cmp al, 0xd2
mov ch, 0x44
adc dword [ebp + reloc.WINMM.dll_midiStreamStop], 0xe24b28b8
sbb eax, 0x348d7f6c
and al, 0xf
lahf
invalid
lea esi, [esp]
setg ah
call 0x7eeea2
inc esi
not eax
add cx, 0x8fa9
jmp 0x7eeec4
pushfd
jmp 0x7ee033
js 0x7eeeda
jns 0x7eeeda
and eax, 0x8f7c1585
or dh, byte [esi + esi - 0x74c13c5c]
cmpsd dword [esi], dword es:[edi]
into
pop ecx
mov eax, 0xec81f29b
mov esp, 0x8b000000
in al, dx
sub esp, 0xbc
mov ebp, esp
mov dx, bp
call 0x7eeeeb
in eax, dx
jmp 0x7eef29
call fcn.007ef6c5
mov ax, bx
bsr ax, bx
sub esp, 0x10
jmp 0x7ef44b
mov bl, cl
lea ebx, [edx + 0x6d]
mov ecx, edi
mov ebx, 0x9d6202b6
bsf bx, bp
jle 0x7eeeed
not dl
mov edx, dword [esp]
jmp 0x7eeef2
xchg al, dh
mov bh, byte [esp]
lea esi, [esi + 0x5d]
btc ax, sp
sub esp, 0x15
xchg bx, ax
jmp 0x7ef39f
jns 0x7ef3f1
mov edx, dword [esp]
lea edx, [edx*4]
call fcn.007ef36d
xchg ebx, eax
neg dl
xchg byte [esp + 0xf], bl
lea esp, [esp + 1]
xchg dword [esp + 0x14], esi
call fcn.007ef3d6
js 0x3d076cd6
mov dword [reloc.WINMM.dll_midiStreamStop], eax
lahf
aam 0x47
out dx, al
stc
fadd dword [edi - 0x3f6cf03d]
xchg dword [esp], esi
mov dx, 0xbca4
bswap ebx
bsr eax, ecx
jmp 0x7ef36f
mov edx, dword [esp]
lea edx, [edx*4]
sub edi, 0x3f292ff1
mov ebx, 0x4f06068d
push esi
jmp 0x7ef40d
neg bl
js 0x7ef432
bsr ebx, ecx
jmp 0x7ef435
bsr ebx, ecx
lea esp, [esp + 4]
jmp 0x7ef47c
mov ax, 0x3442
lea esp, [esp + 0x10]
add edi, 0x4bbdca33
bswap ebx
neg eax
jmp 0x7ef38d
bswap ebx
mov ah, byte [esp]
xchg bh, dl
mov dx, si
jmp 0x7ef4ee
dec edi
bswap eax
mov edx, 0x4b171188
and bx, sp
jns 0x7ef462
js 0x7ef4a9
mov dx, si
jmp 0x7ef4ee
not bx
jmp 0x7ef4d8
bswap ebx
mov ah, byte [esp]
xchg bh, dl
jmp 0x7ef48b
rdtsc
stc
call fcn.007ef51f
xchg edi, eax
pop es
xchg edi, eax
add dword [esi + reloc.WINMM.dll_midiStreamStop], edi
mov eax, 0x8184150b
out dx, eax
cmp edi, dword [ebp - 0x48]
cmp ah, byte [esi + 0xf]
mov esp, 0x66967ed1
not ebx
sub edi, 0x3ab87d3b
bsf dx, cx
jle 0x7ef490
not bx
rdtsc
stc
jmp 0x7ef4db