joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491528
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x491618
call fcn.004cce34
call fcn.0048dc7c
mov eax, dword [0x4d8a88]
cmp dword [eax], 0
jne 0x49155e
mov eax, dword [0x4d8a88]
mov dword [eax], 1
jmp 0x4915fe
mov eax, dword [0x4d8a88]
cmp dword [eax], 1
jne 0x491578
mov eax, dword [0x4d8a88]
mov dword [eax], 2
jmp 0x4915fe
mov eax, dword [0x4d8a88]
cmp dword [eax], 2
jne 0x49158f
mov eax, dword [0x4d8a88]
mov dword [eax], 8
jmp 0x4915fe
mov eax, dword [0x4d8a88]
cmp dword [eax], 3
jne 0x4915a4
mov eax, dword [0x4d8a88]
xor edx, edx
mov dword [eax], edx
jmp 0x4915fe
mov eax, dword [0x4d8a88]
cmp dword [eax], 4
jne 0x4915bb
mov eax, dword [0x4d8a88]
mov dword [eax], 5
jmp 0x4915fe
mov eax, dword [0x4d8a88]
cmp dword [eax], 5
jne 0x4915d2
mov eax, dword [0x4d8a88]
mov dword [eax], 6
jmp 0x4915fe
mov eax, dword [0x4d8a88]
cmp dword [eax], 6
jne 0x4915e9
mov eax, dword [0x4d8a88]
mov dword [eax], 0xc
jmp 0x4915fe
mov eax, dword [0x4d8a88]
cmp dword [eax], 7
jne 0x4915fe
mov eax, dword [0x4d8a88]
mov dword [eax], 4
push 0
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
call sub.user32.dll_ExitWindowsEx
mov eax, dword [0x4d8af0]
mov byte [eax], 1
pop ebp
ret

Function at 0x493d58
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x493e13
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402f54
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
mov ecx, 9
mov edx, 0x493e20
call fcn.004cce34
lea eax, [ebp - 4]
mov edx, dword [0x4d8c28]
mov edx, dword [edx]
call fcn.00405b44
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
mov ecx, 9
mov edx, 0x493e24
call fcn.004cce34
lea eax, [ebp - 8]
mov edx, dword [0x4d8c28]
mov edx, dword [edx]
call fcn.00405b44
push 0
mov eax, dword [ebp - 8]
call fcn.00405f70
push eax
mov eax, dword [ebp - 4]
call fcn.00405f70
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x493df0
mov edx, dword [ebp - 4]
mov eax, 0x134
call fcn.00457e90
mov eax, dword [0x4d8af0]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493e1a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405ad0
ret
Function at 0x499ae0
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x499c10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x499c1c
call fcn.004cce34
mov eax, dword [0x4d88d8]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x499be5
push 7
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x499b76
push 1
call sub.user32.dll_GetClipboardData
mov edx, dword [0x4d89ac]
mov dword [edx], eax
mov eax, dword [0x4d89ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x4d89d8]
mov dword [edx], eax
lea edx, [ebp - 4]
mov eax, dword [0x4d89d8]
mov eax, dword [eax]
call fcn.0040a99c
mov edx, dword [ebp - 4]
mov ecx, dword [0x4d8c28]
mov ecx, dword [ecx]
mov eax, dword [0x4d8c28]
call fcn.00405dbc
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x499b8c
sub ebx, 4
mov ebx, dword [ebx]
add ebx, 0xa
push ebx
push 0x2042
call sub.kernel32.dll_GlobalAlloc
mov edx, dword [0x4d89ac]
mov dword [edx], eax
mov eax, dword [0x4d89ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x4d89d8]
mov dword [edx], eax
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
mov edx, eax
mov eax, dword [0x4d89d8]
mov eax, dword [eax]
call fcn.0040a764
mov eax, dword [0x4d89ac]
mov eax, dword [eax]
push eax
push 1
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
mov eax, dword [0x4d89ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [0x4d8af0]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499c17
lea eax, [ebp - 4]
call fcn.00405aac
ret

Function at 0x49ace0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x49ace9
mov eax, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
mov ecx, 9
mov edx, 0x49ad44
call fcn.004cce34
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x8000]
call fcn.0040a764
push 1
lea eax, [ebp - 0x8000]
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4d8af0]
mov byte [eax], 1
mov esp, ebp
pop ebp
ret

Function at 0x49ad48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x49ad51
mov eax, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
mov ecx, 9
mov edx, 0x49adb4
call fcn.004cce34
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x8000]
call fcn.0040a764
push 1
lea eax, [ebp - 0x8000]
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4d8af0]
mov byte [eax], 1
mov eax, dword [0x4d908c]
mov byte [eax], 1
mov esp, ebp
pop ebp
ret
Function at 0x49ce60
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x49ce69
mov eax, dword [ebp - 4]
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49d084
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045914c
mov eax, dword [0x4d8c78]
cmp byte [eax], 0
je 0x49cead
mov edx, 0x49d09c
mov eax, 0xdd
call fcn.00457e90
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
mov ecx, 9
mov edx, 0x49d0a4
call fcn.004cce34
lea eax, [ebp - 4]
mov edx, dword [0x4d8c28]
mov edx, dword [edx]
call fcn.00405b44
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x49d0a4
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov dword [ebp - 0x8028], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x49d0a8
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov dword [ebp - 0x8024], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x49d0a4
call fcn.004cce34
mov ebx, dword [0x4d8a88]
mov ebx, dword [ebx]
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x49d0ac
call fcn.004cce34
mov esi, dword [0x4d8a88]
mov esi, dword [esi]
mov eax, dword [ebp - 4]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x8004]
call fcn.0040a764
mov eax, dword [0x4d8dd4]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov edx, dword [0x4d8880]
mov dword [edx], eax
push esi
push ebx
mov eax, dword [0x4d8dd4]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov edx, dword [0x4d8928]
mov dword [edx], eax
mov eax, dword [0x4d8928]
mov eax, dword [eax]
push eax
mov eax, dword [0x4d8880]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_SelectObject
mov edx, dword [0x4d8d04]
mov dword [edx], eax
mov eax, dword [0x4d8ecc]
mov eax, dword [eax]
mov edx, dword [0x4d88d8]
cmp eax, dword [edx]
jne 0x49cfe1
mov eax, dword [0x4d8ecc]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetDC
push eax
call sub.gdi32.dll_SwapBuffers
mov eax, dword [0x4d8ecc]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetDC
mov edi, eax
jmp 0x49cfe9
mov edi, dword [0x4d8c3c]
mov edi, dword [edi]
xor eax, eax
call fcn.00428304
push eax
mov eax, dword [ebp - 0x8024]
push eax
mov eax, dword [ebp - 0x8028]
push eax
push edi
push esi
push ebx
push 0
push 0
mov eax, dword [0x4d8880]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_BitBlt
mov edx, dword [0x4d8928]
mov edx, dword [edx]
lea eax, [ebp - 0x8004]
call fcn.00425b28
test eax, eax
jne 0x49d037
mov edx, dword [ebp - 4]
mov eax, 0xe5
call fcn.004584b4
mov eax, dword [0x4d8d04]
mov eax, dword [eax]
push eax
mov eax, dword [0x4d8880]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [0x4d8928]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x4d8880]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [0x4d8af0]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d08b
lea eax, [ebp - 4]
call fcn.00405aac
ret
Function at 0x4a0d90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x4a0eaa
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402f54
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a8], eax
mov eax, dword [0x4d8e14]
mov eax, dword [eax]
cmp byte [eax], 0x23
jne 0x4a0e17
mov eax, dword [0x4d8e14]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4a0dd8
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [0x4d8e14]
push eax
mov eax, dword [0x4d8e14]
mov eax, dword [eax]
mov ecx, ebx
mov edx, 2
call fcn.00405fd0
mov eax, dword [0x4d8a94]
cmp byte [eax], 0
jne 0x4a0e17
lea edx, [ebp - 0xc]
mov eax, dword [0x4d8e14]
mov eax, dword [eax]
call fcn.00409b18
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4d8e14]
call fcn.00405b00
mov eax, dword [ebp + 8]
add eax, 0xfffffe60
xor ecx, ecx
mov edx, 0x4a0eb8
call fcn.004cce34
mov eax, dword [0x4d8a88]
cmp dword [eax], 1
jl 0x4a0e49
mov eax, dword [0x4d8a88]
cmp dword [eax], 0x63
jg 0x4a0e49
mov eax, dword [0x4d8ca0]
cmp byte [eax], 1
jne 0x4a0e5b
lea eax, [ebp - 4]
mov edx, dword [0x4d8c28]
mov edx, dword [edx]
call fcn.00405b44
jmp 0x4a0e76
lea eax, [ebp - 4]
mov edx, dword [0x4d8a88]
mov edx, dword [edx]
mov ecx, dword [0x4d8d30]
mov edx, dword [ecx + edx*4]
mov edx, dword [edx]
call fcn.00405b44
mov eax, dword [ebp - 4]
call fcn.00405f70
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [0x4d8af0]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0eb1
lea eax, [ebp - 0xc]
call fcn.00405aac
lea eax, [ebp - 4]
call fcn.00405aac
ret
Function at 0x4a9fc0
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4a9fc9
mov eax, dword [ebp - 4]
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8168], ebx
mov dword [ebp - 0x8164], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f60
mov eax, dword [ebp - 8]
call fcn.00405f60
xor eax, eax
push ebp
push 0x4aa1d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00405aac
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
push 0x4aa1e8
call sub.wininet.dll_InternetOpenA
mov esi, eax
test esi, esi
jne 0x4aa049
mov edx, dword [ebp - 4]
mov eax, 0x15e
call fcn.00457e90
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405f70
push eax
push esi
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
test ebx, ebx
jne 0x4aa076
mov edx, dword [ebp - 4]
mov eax, 0x15f
call fcn.00457e90
cmp dword [ebp - 8], 0
jbe 0x4aa0c1
mov edi, dword [0x4d8ed4]
movzx edi, byte [edi]
mov eax, dword [0x4d8ed4]
mov byte [eax], 2
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x8160]
call fcn.004036dc
mov edx, 1
lea eax, [ebp - 0x8160]
call fcn.00403f4c
call fcn.00402f54
test eax, eax
jle 0x4aa0c1
mov edx, dword [ebp - 8]
mov eax, 0x12d
call fcn.00457e90
lea eax, [ebp - 0x14]
push eax
push 0x8000
lea eax, [ebp - 0x8014]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x14], 0
jbe 0x4aa162
lea eax, [ebp - 0x8164]
lea edx, [ebp - 0x8014]
mov ecx, 0x8000
call fcn.00405d1c
mov edx, dword [ebp - 0x8164]
lea eax, [ebp - 0xc]
call fcn.00405d78
cmp dword [ebp - 8], 0
jbe 0x4aa139
push 0
lea edx, [ebp - 0x8014]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x8160]
call fcn.00403864
call fcn.00402f54
test eax, eax
jle 0x4aa0c1
mov edx, dword [ebp - 8]
mov eax, 0x12f
call fcn.00457e90
jmp 0x4aa0c1
lea eax, [ebp - 0x8168]
lea edx, [ebp - 0x8014]
mov ecx, 0x8000
call fcn.00405d1c
mov edx, dword [ebp - 0x8168]
lea eax, [ebp - 0xc]
call fcn.00405d78
jmp 0x4aa0c1
cmp dword [ebp - 8], 0
jbe 0x4aa196
lea eax, [ebp - 0x8160]
call fcn.00403884
call fcn.00402f54
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00409c84
mov eax, edi
mov edx, dword [0x4d8ed4]
mov byte [edx], al
push ebx
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa1df
lea eax, [ebp - 0x8168]
mov edx, 2
call fcn.00405ad0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405ad0
ret
Function at 0x4aa2a4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
mov byte [ebp - 2], bl
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
mov edx, eax
cmp byte [ebp - 1], 0
je 0x4aa2cb
mov eax, 2
jmp 0x4aa2cd
xor eax, eax
push 0
push eax
mov eax, dword [0x4d9014]
or dl, byte [eax]
push edx
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_keybd_event
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b3cc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
xor ecx, ecx
mov edx, 0x4b3d24
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test eax, 0x8000
jle 0x4b3d04
mov eax, dword [0x4d8a88]
mov dword [eax], 1
jmp 0x4b3d0d
mov eax, dword [0x4d8a88]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4d8ca0]
mov byte [eax], 2
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a9], 1
pop ebp
ret
Function at 0x4ba1dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4ba1e5
mov eax, dword [ebp - 4]
add esp, 0xfffffffc
xor eax, eax
mov dword [ebp - 0x10008], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ba354
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
mov ecx, 9
mov edx, 0x4ba360
call fcn.004cce34
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x8004]
call fcn.0040a764
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
mov ecx, 1
mov edx, 0x4ba360
call fcn.004cce34
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x10008]
call fcn.00405ca4
mov edx, dword [ebp - 0x10008]
lea eax, [ebp - 0x10004]
call fcn.0040a7d0
lea eax, [ebp - 4]
mov edx, dword [0x4d8c28]
mov edx, dword [edx]
call fcn.00405b44
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
xor ecx, ecx
mov edx, 0x4ba364
call fcn.004cce34
mov eax, dword [0x4d8a88]
cmp dword [eax], 0
jl 0x4ba2b7
mov eax, dword [0x4d8a88]
cmp dword [eax], 9
jle 0x4ba2c0
mov eax, dword [0x4d8a88]
xor edx, edx
mov dword [eax], edx
cmp dword [ebp - 4], 0
jbe 0x4ba2f7
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
push 0
push 0
lea eax, [ebp - 0x8004]
push eax
lea eax, [ebp - 0x10004]
push eax
mov eax, dword [0x4d88d8]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x4d8a88]
mov dword [edx], eax
jmp 0x4ba321
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
push 0
push 0
lea eax, [ebp - 0x8004]
push eax
push 0
mov eax, dword [0x4d88d8]
mov eax, dword [eax]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x4d8a88]
mov dword [edx], eax
mov eax, dword [0x4d8ca0]
mov byte [eax], 3
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba35b
lea eax, [ebp - 0x10008]
call fcn.00405aac
lea eax, [ebp - 4]
call fcn.00405aac
ret

Function at 0x4be8c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
mov ecx, 1
mov edx, 0x4be980
call fcn.004cce34
mov eax, dword [0x4d8ed8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4be8fc
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x7fff
jne 0x4be966
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4be919
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jle 0x4be966
mov esi, 1
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
movzx eax, byte [eax + esi - 1]
mov ebx, eax
and bl, 0xc0
and al, 0x3f
mov edx, 0x8000
sub edx, esi
mov ecx, dword [0x4d8ed8]
mov ecx, dword [ecx]
movzx edx, byte [ecx + edx - 1]
xor bl, dl
and bl, 0xc0
or al, bl
mov ebx, eax
mov eax, dword [0x4d8c28]
call fcn.00405fc8
mov byte [eax + esi - 1], bl
inc esi
dec edi
jne 0x4be924
mov eax, dword [0x4d8ca0]
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a9], 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4bed10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4bed19
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
xor ecx, ecx
mov edx, 0x4bede4
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
mov ecx, 1
mov edx, 0x4bede8
call fcn.004cce34
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
mov dword [ebp - 0x800c], eax
mov eax, dword [ebp - 0x800c]
test eax, eax
je 0x4bed7c
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov edx, esi
test edx, edx
jbe 0x4beda3
mov ecx, 1
lea eax, [ebp - 0x8008]
mov ebx, dword [0x4d8c28]
mov ebx, dword [ebx]
movzx ebx, byte [ebx + ecx - 1]
mov byte [eax], bl
inc ecx
inc eax
dec edx
jne 0x4bed8f
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x8008]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [0x4d8a88]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [0x4d8ca0]
mov byte [eax], 2
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a9], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bedec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4bedf5
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
xor ecx, ecx
mov edx, 0x4beecc
call fcn.004cce34
mov esi, dword [0x4d8a88]
mov esi, dword [esi]
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
xor ecx, ecx
mov edx, 0x4beed0
call fcn.004cce34
call fcn.00457708
mov ebx, eax
mov eax, dword [0x4d8a88]
cmp ebx, dword [eax]
jle 0x4bee4d
mov ebx, dword [0x4d8a88]
mov ebx, dword [ebx]
xor edi, edi
test ebx, ebx
jle 0x4bee6d
push 0
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x8004]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4bee6d
mov edi, ebx
test edi, edi
jle 0x4beea6
mov eax, dword [0x4d8c28]
mov edx, edi
call fcn.004061f8
mov esi, edi
test esi, esi
jbe 0x4beeb0
mov edi, 1
lea ebx, [ebp - 0x8004]
mov eax, dword [0x4d8c28]
call fcn.00405fc8
movzx edx, byte [ebx]
mov byte [eax + edi - 1], dl
inc edi
inc ebx
dec esi
jne 0x4bee8e
jmp 0x4beeb0
mov eax, dword [0x4d8c28]
call fcn.00405aac
mov eax, dword [0x4d8ca0]
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a9], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf0e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4bf0e9
mov eax, dword [ebp - 4]
xor eax, eax
mov dword [ebp - 0x10004], eax
xor eax, eax
push ebp
push 0x4bf1b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
add eax, 0xfffffe58
mov ecx, 1
mov edx, 0x4bf1bc
call fcn.004cce34
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x8000]
call fcn.0040a764
push 0x8000
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x8000]
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jbe 0x4bf17b
lea edx, [ebp - 0x10004]
lea eax, [ebp - 0x10000]
call fcn.0040a99c
mov edx, dword [ebp - 0x10004]
mov eax, dword [0x4d8c28]
call fcn.00405b00
jmp 0x4bf185
mov eax, dword [0x4d8c28]
call fcn.00405aac
mov eax, dword [0x4d8ca0]
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf1b7
lea eax, [ebp - 0x10004]
call fcn.00405aac
ret

Function at 0x4c2c60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4c2c69
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
add ebx, 0xfffffe58
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c2dd0
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, ebx
mov ecx, 1
mov edx, 0x4c2dd0
call fcn.004cce34
mov eax, dword [0x4d8c28]
mov eax, dword [eax]
call fcn.00405f70
mov edx, eax
lea eax, [ebp - 0x8000]
call fcn.0040a764
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c2dd0
call fcn.004cce34
mov esi, dword [0x4d8a88]
mov esi, dword [esi]
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c2dd0
call fcn.004cce34
mov edi, dword [0x4d8a88]
mov edi, dword [edi]
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c2dd0
call fcn.004cce34
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1b0], eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c2dd4
call fcn.004cce34
mov ebx, dword [0x4d8a88]
movzx ebx, word [ebx]
push 0x424e88
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov edx, 0x4c2dd8
mov eax, dword [0x4dc7f4]
call fcn.0040860c
mov edx, dword [0x4d8a88]
mov dword [edx], eax
lea eax, [ebp - 0x8000]
push eax
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
push 4
movsx eax, bx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1b0]
push eax
push edi
push esi
push 0
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowPos
push 1
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4d895c]
cmp byte [eax], 0
je 0x4c2db4
push 1
mov eax, dword [0x4d8f94]
mov eax, dword [eax]
push eax
push 0x30
mov eax, dword [0x4d8a88]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x4d8ca0]
mov byte [eax], 2
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a9], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret