joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472ffc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
cmp dword [0x527580], 0
je 0x47311e
xor eax, eax
xor esi, esi
mov dword [0x527580], eax
mov eax, 0x527584
xor ebx, ebx
xor edx, edx
mov ecx, 0x1f
mov dl, byte [eax]
inc eax
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc ebx
cmp ebx, 0xe
jl 0x47301d
xor ebx, ebx
mov ecx, 0x52f46c
mov eax, ebx
xor edx, edx
test al, 1
je 0x47304f
mov edi, eax
shr edi, 1
xor edi, esi
jmp 0x473053
mov edi, eax
shr edi, 1
mov eax, edi
inc edx
cmp edx, 8
jl 0x473043
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jl 0x47303f
xor ebx, ebx
mov esi, 0x52f46c
mov eax, dword [esi]
mov ecx, eax
mov edx, eax
shr ecx, 8
shr edx, 0x18
and ecx, 0xff00
add edx, ecx
mov ecx, eax
and ecx, 0xff00
shl ecx, 8
add edx, ecx
mov ecx, eax
and ecx, 0xff
shl ecx, 0x18
add edx, ecx
lea ecx, [esi + 0x400]
mov dword [esi + 0x1000], edx
mov edx, 1
mov edi, eax
and edi, 0xff
shr eax, 8
mov edi, dword [edi*4 + 0x52f46c]
xor edi, eax
mov eax, edi
mov ebp, eax
mov edi, eax
shr ebp, 8
mov dword [ecx], eax
shr edi, 0x18
and ebp, 0xff00
add edi, ebp
mov ebp, eax
and ebp, 0xff00
shl ebp, 8
add edi, ebp
mov ebp, eax
and ebp, 0xff
shl ebp, 0x18
add edi, ebp
mov dword [ecx + 0x1000], edi
inc edx
add ecx, 0x400
cmp edx, 4
jl 0x4730af
inc ebx
add esi, 4
cmp ebx, 0x100
jl 0x473070
xor eax, eax
mov dword [0x52757c], eax
jmp 0x473127
cmp dword [0x52757c], 0
jne 0x47311e
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x479400
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov al, 1
cmp byte [0x528340], 0
jne 0x479428
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
mov byte [0x528340], 1
add esp, 0x190
ret

Function at 0x479444
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00406f24
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00404bdc
test ebx, ebx
je 0x479493
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x479864
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4799df
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x24], 0
jne 0x4799c4
call fcn.00479400
push 0
mov eax, dword [ebx + 0x1c]
push eax
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x28], esi
inc esi
jne 0x4798d3
push 0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x10]
call fcn.00416bf4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea ecx, [ebp - 0xc]
mov edx, 0x4799f8
mov eax, ebx
call fcn.004794a4
mov word [ebx + 4], 2
mov edx, dword [ebx + 0x14]
mov eax, ebx
call fcn.00479444
mov dword [ebx + 8], eax
movzx eax, word [ebx + 0x18]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 6], ax
push 0
push 0
push 0
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebx + 4]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x479955
push 0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x14]
call fcn.00416bf4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea ecx, [ebp - 0xc]
mov edx, 0x479a1c
mov eax, ebx
call fcn.004794a4
cmp dword [ebx + 0x28], 0xffffffff
setne al
mov byte [ebx + 0x24], al
lea eax, [ebp - 0x18]
push eax
movzx eax, byte [ebx + 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebx + 9]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, byte [ebx + 0xa]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, byte [ebx + 0xb]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
movzx eax, word [ebx + 0x18]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x40]
mov ecx, 4
mov eax, 0x479a40
call fcn.004138fc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x2c]
mov ecx, 0
call fcn.004078c8
lea eax, [ebx + 0x30]
call fcn.004066e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4799e6
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040766c
ret
Function at 0x479a88
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x479b25
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp byte [ebx + 0x24], 0
je 0x479b0f
push 0
mov eax, dword [ebp - 4]
push eax
push edx
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x479b07
call sub.wsock32.dll_WSAGetLastError
mov edi, eax
cmp edi, 0x2733
je 0x479b07
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test edi, edi
je 0x479b07
push 0
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.00416bf4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea ecx, [ebp - 0xc]
mov edx, 0x479b44
mov eax, ebx
call fcn.004794a4
lea eax, [ebx + 0x30]
call fcn.004066e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479b2c
lea eax, [ebp - 0x10]
call fcn.00407664
ret

Function at 0x479c6c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x479d23
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jne 0x479cb2
cmp byte [ebx + 0x24], 0
je 0x479cb2
lea eax, [ebp - 4]
push eax
push 0x4004667f
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x479d0d
cmp byte [ebx + 0x24], 0
je 0x479d0d
push 0
push esi
push edi
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x479d0d
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2733
je 0x479d0d
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test esi, esi
je 0x479d0d
push 0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00416bf4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea ecx, [ebp - 0xc]
mov edx, 0x479d40
mov eax, ebx
call fcn.004794a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479d2a
lea eax, [ebp - 0x10]
call fcn.00407664
ret
Function at 0x479d58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x479e55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004066e0
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.00479c6c
mov ebx, eax
test ebx, ebx
jbe 0x479e37
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, ebx
call fcn.00407208
mov eax, dword [ebp - 4]
test eax, eax
je 0x479dc2
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x479dc2
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004068fc
mov ebx, eax
test ebx, ebx
je 0x479dcd
sub ebx, 4
mov ebx, dword [ebx]
mov edx, dword [ebp - 4]
mov ecx, ebx
mov eax, esi
call fcn.00479c6c
mov edx, eax
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.00407208
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406b08
mov eax, dword [ebp - 8]
lea eax, [esi + 0x2c]
mov edx, dword [ebp - 4]
call fcn.00406b08
lea eax, [esi + 0x30]
mov edx, dword [ebp - 4]
call fcn.00406b08
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.00479c6c
mov ebx, eax
push 1
call sub.kernel32.dll_Sleep_1
test ebx, ebx
ja 0x479e37
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x3e8
jbe 0x479e10
test ebx, ebx
jne 0x479d81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479e5c
lea eax, [ebp - 4]
call fcn.004066e0
ret

Function at 0x479e64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
mov edx, ebx
mov eax, esi
call fcn.00479d58
cmp dword [ebx], 0
jne 0x479e87
push 1
call sub.kernel32.dll_Sleep_1
cmp dword [ebx], 0
jne 0x479e98
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, dword [esi + 0x20]
jb 0x479e72
pop edi
pop esi
pop ebx
ret

Function at 0x47ada0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x47ae32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47ae40]
mov dword [ebp - 7], eax
mov ax, word [0x47ae44]
mov word [ebp - 3], ax
mov al, byte [0x47ae46]
mov byte [ebp - 1], al
push 6
lea eax, [ebp - 7]
push eax
push 0x1004
push 0x400
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x2c]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040786c
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00412354
push 2
lea edx, [ebp - 0x27]
push edx
push eax
call sub.gdi32.dll_TranslateCharsetInfo
mov ebx, dword [ebp - 0x27]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ae39
lea eax, [ebp - 0x2c]
call fcn.00407664
ret
Function at 0x47b424
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov ebx, edx
add ebx, ebx
add ebx, ebx
add ebx, eax
mov eax, ebx
call fcn.00409064
test eax, eax
je 0x47b465
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov dword [ebx], esi
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
push 4
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop esi
pop ebx
ret

Function at 0x47b624
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00404500
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x47bc88
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov eax, dword [0x531d00]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x47bccb
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x531d00]
call fcn.00431984
mov ebx, eax
mov eax, dword [esp]
cmp eax, dword [ebx]
jne 0x47bcc7
mov eax, dword [ebx + 4]
jmp 0x47bd8f
inc edi
dec esi
jne 0x47bcaa
mov edi, dword [esp]
mov ebx, edi
xor esi, esi
mov edx, ebp
mov eax, ebx
call fcn.0047b834
test al, al
jne 0x47bce3
mov byte [ebp], 1
movzx eax, byte [ebp]
add esi, eax
movzx eax, byte [ebp]
add ebx, eax
cmp esi, 5
jb 0x47bcd2
mov edx, esi
mov eax, edi
call fcn.0047ba20
add eax, 5
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
call fcn.00404214
mov ebp, eax
mov eax, 0x14
call fcn.00404214
mov ebx, eax
mov eax, dword [esp]
mov dword [ebx], eax
mov dword [ebx + 4], ebp
mov eax, dword [esp + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], esi
mov eax, esi
call fcn.00404214
mov dword [ebx + 0xc], eax
mov edx, dword [ebx + 0xc]
mov eax, edi
mov ecx, esi
call fcn.00404500
mov edx, ebx
mov eax, dword [0x531d00]
call fcn.004317c4
lea eax, [esp + 0xc]
push eax
push 0x40
mov eax, dword [esp + 0x10]
push eax
push ebp
call sub.kernel32.dll_VirtualProtect
mov edx, ebp
mov eax, edi
mov ecx, esi
call fcn.00404500
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.0047badc
lea edx, [esi + edi]
lea eax, [esi + ebp]
call fcn.0047b664
mov edx, dword [esp + 4]
mov eax, edi
call fcn.0047b664
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47c080
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.0044657c
test al, al
je 0x47c0c4
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x47c0c4
cmp dword [eax + 0x3c], 0
je 0x47c0c4
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.0044657c
test al, al
je 0x47c0c2
cmp dword [esi], 0x4550
je 0x47c0c4
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x47f6f0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
push 0
call fcn.00406a58
add esp, 0x104
pop ebx
ret

Function at 0x4818d4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
push 0
call fcn.00406a58
add esp, 0x104
pop ebx
ret

Function at 0x48190c
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
push 0
call fcn.00406a58
add esp, 0x104
pop ebx
ret

Function at 0x482538
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482694
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call fcn.0047f5f4
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.004122e8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.004122e8
mov edx, dword [ebp - 0xc]
pop eax
call fcn.00407a98
mov eax, dword [ebp - 8]
call fcn.00407700
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
test ebx, ebx
je 0x482679
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x4825da
cmp esi, 4
jne 0x4825da
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x482679
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x48265b
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.0047f5f4
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.004122e8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.004122e8
mov edx, dword [ebp - 0x14]
pop eax
call fcn.00407a98
mov eax, dword [ebp - 0x10]
call fcn.00407700
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48269b
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040766c
ret
Function at 0x483d6c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x483e81
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x531e78], bl
mov eax, 0x531e7c
mov edx, esi
call fcn.00406734
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
movzx edx, bl
mov eax, dword [0x47d7f4]
call fcn.004246f0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
call fcn.00404328
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x28]
mov eax, 8
call fcn.004122e8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x20]
mov ecx, 2
mov eax, 0x483e9c
call fcn.004138fc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.004078c8
mov eax, dword [ebp - 4]
call fcn.00406f24
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp byte [0x5284f0], 0
jne 0x483e2c
mov eax, ebx
add al, 0xfd
sub al, 7
jb 0x483e56
cmp dword [0x532718], 0
je 0x483e56
add bl, 0xfb
sub bl, 5
jae 0x483e56
push 0x242010
push 0x483f04
mov eax, esi
call fcn.00406f24
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483e88
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040766c
lea eax, [ebp - 8]
call fcn.00407664
lea eax, [ebp - 4]
call fcn.004066e0
ret

Function at 0x48424c
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x484214
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x48434c
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x48436f
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, esp
push eax
push 0x4842b8
call sub.user32.dll_EnumWindows
movzx edx, byte [esp + 4]
mov eax, edx
pop ecx
pop edx
ret

Function at 0x4843ec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0x80000001
lea eax, [esp + 0x18]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.0042f590
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x484374
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x484451
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.0042f590
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x4844d4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f14
xor eax, eax
push ebp
push 0x484619
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x484603
mov eax, dword [ebp - 4]
test eax, eax
je 0x48451d
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x48451d
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004068fc
test eax, eax
je 0x484526
sub eax, 4
mov eax, dword [eax]
lea ebx, [eax + 1]
push 0
call sub.user32.dll_OpenClipboard
xor edx, edx
push ebp
push 0x4845fc
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4845e2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4845c4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x484593
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x484593
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004068fc
mov edx, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00404500
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4845cb
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484620
lea eax, [ebp - 4]
call fcn.004066e0
ret

Function at 0x484628
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4846fd
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x4846d2
cmp byte [0x5284e8], 0
je 0x484676
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0x5c]
mov ecx, 0
call fcn.00406a08
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.0044609c
jmp 0x48468a
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00406a08
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00404bdc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x531e68]
call fcn.00406f24
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406f24
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484704
lea eax, [ebp - 0x5c]
call fcn.004066e0
lea eax, [ebp - 4]
call fcn.004066e0
ret
Function at 0x484894
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x529950]
movzx edx, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x47d95c]
call fcn.00484708
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x484965
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00484780
test al, al
je 0x48494f
cmp word [ebp - 4], 0x5a4d
jne 0x48494f
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.004352b4
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00484780
test al, al
je 0x48494f
cmp dword [ebp - 8], 0
je 0x48494f
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004352b4
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00484780
test al, al
je 0x48494f
cmp dword [ebp - 0xc], 0x4550
jne 0x48494f
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00484780
test al, al
je 0x48494f
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48496c
mov eax, dword [ebp - 0x10]
call fcn.00405374
ret