joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48aedc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x48aee5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov edi, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48b0e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00405a0c
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.0048a8ac
lea eax, [ebp - 4]
call fcn.0040647c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x48b0be
inc ebx
mov eax, ebx
call fcn.00403010
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x48b0b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
push ebx
push 0
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, edi
call fcn.0048a8ac
mov eax, dword [ebp - 0x1c]
call fcn.00405a98
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
jne 0x48af8f
call fcn.00404914
jmp 0x48b0be
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x48b0f4
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
jne 0x48afb8
call fcn.00404914
jmp 0x48b0be
cmp dword [ebp - 0x18], 0
jne 0x48afc8
call fcn.00404914
jmp 0x48b0be
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
shr eax, 0x10
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040c088
push dword [ebp - 0x20]
push 0x48b104
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040c088
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.00405fc4
cmp byte [ebp - 5], 0
je 0x48b052
cmp byte [ebp + 0xc], 0
je 0x48b0a1
push dword [esi]
push 0x48b104
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
shr eax, 0x10
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.0040c088
push dword [ebp - 0x28]
mov eax, esi
mov edx, 3
call fcn.00405fc4
jmp 0x48b0a1
push dword [esi]
push 0x48b104
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
shr eax, 0x10
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0040c088
push dword [ebp - 0x2c]
push 0x48b104
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0040c088
push dword [ebp - 0x30]
mov eax, esi
mov edx, 5
call fcn.00405fc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b0be
mov eax, dword [ebp - 0x14]
call fcn.0040302c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b0e8
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00405a04
lea eax, [ebp - 4]
call fcn.004059fc
ret
Function at 0x48b418
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48b5a2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 8], eax
lea edx, [ebp - 0x60]
mov eax, edi
call fcn.0040b78c
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x5c]
mov edx, 0x48b5c0
call fcn.004916c0
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 4]
call fcn.0048a150
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0040b78c
cmp dword [ebp - 4], 0
jne 0x48b4a6
cmp dword [ebp - 8], 0
je 0x48b57a
lea eax, [ebp - 0x58]
push eax
call sub.kernel32.dll_GetStartupInfoW
movzx eax, word [ebp - 0x14]
mov word [ebp - 0x28], ax
cmp dword [ebp - 4], 0
jne 0x48b4d4
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00405a60
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405a60
jmp 0x48b512
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040c97c
push 0x48b5c0
push dword [ebp - 4]
push 0x48b5d0
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00405fc4
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0040b78c
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 4]
call fcn.00405a60
lea eax, [ebp - 4]
call fcn.0040647c
lea eax, [ebp - 0xc]
call fcn.0040647c
push esi
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405a98
push eax
push 0
push 0x4000220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x48b57a
cmp byte [ebp + 0xc], 0
je 0x48b57a
jmp 0x48b569
mov eax, 1
call fcn.00483ca8
push 2
mov eax, dword [esi]
push eax
call sub.user32.dll_WaitForInputIdle
cmp eax, 0x102
je 0x48b55f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b5a9
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00405a04
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405a04
ret
Function at 0x48ba64
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
call fcn.004059f4
mov eax, dword [ebp - 8]
call fcn.004059f4
xor eax, eax
push ebp
push 0x48bbb9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
test edi, edi
je 0x48baaa
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
movzx eax, byte [ebp + 0x24]
push eax
movzx eax, byte [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0048b5f4
test al, al
je 0x48bb9e
test edi, edi
je 0x48bae3
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov bl, 2
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jle 0x48bb19
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, esi
cdq
push edx
push eax
call fcn.004835d4
fstp qword [ebp - 0x38]
wait
jmp 0x48bb7a
call fcn.0040e45c
fstp qword [ebp - 0x38]
wait
jmp 0x48bb7a
cmp dword [ebp - 0x20], 0
jne 0x48bb97
cmp dword [ebp - 0x1c], 0
jne 0x48bb97
push 0x64
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, 1
call fcn.00483ca8
push 0x64
call sub.kernel32.dll_Sleep_1
test esi, esi
jle 0x48bb7a
call fcn.0040e45c
fcomp qword [ebp - 0x38]
wait
fnstsw ax
sahf
jbe 0x48bb7a
mov bl, 1
cmp byte [ebp + 0x18], 0
je 0x48bb97
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x64
call sub.kernel32.dll_Sleep_1
jmp 0x48bb97
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcessTimes
test eax, eax
jne 0x48bb24
push 0x64
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bbc0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a04
ret
Function at 0x48be5c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48bf1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.0048aec4
test al, al
je 0x48bf07
xor ebx, ebx
cmp byte [ebp - 9], 0
je 0x48be9e
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0048362c
lea ecx, [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0048a8ac
mov eax, dword [ebp - 4]
call fcn.0040c5c8
test al, 0x18
jne 0x48bf07
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.0040c5dc
xor eax, eax
push ebp
push 0x48bef0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48bf07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bf24
lea eax, [ebp - 4]
call fcn.004059fc
ret

Function at 0x48c318
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1010], edx
mov dword [ebp - 0x100c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48c421
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00405a0c
mov word [ebp - 0x1006], 0
push 0x800
lea eax, [ebp - 0x1006]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x48c396
cmp ebx, 0x800
jg 0x48c396
lea eax, [ebp - 0x100c]
lea edx, [ebp - 0x1006]
call fcn.00405bb8
mov eax, dword [ebp - 0x100c]
mov edx, esi
call fcn.0048a200
jmp 0x48c403
test ebx, ebx
jle 0x48c403
inc ebx
mov eax, ebx
add eax, eax
call fcn.00403010
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c3fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov word [eax], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x48c3e6
lea eax, [ebp - 0x1010]
mov edx, dword [ebp - 4]
call fcn.00405bb8
mov eax, dword [ebp - 0x1010]
mov edx, esi
call fcn.0048a200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c403
mov eax, dword [ebp - 4]
call fcn.0040302c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c428
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.00405a04
ret
Function at 0x48c430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1010], edx
mov dword [ebp - 0x100c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48c539
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00405a0c
mov word [ebp - 0x1006], 0
lea eax, [ebp - 0x1006]
push eax
push 0x800
call sub.kernel32.dll_GetTempPathW
mov ebx, eax
test ebx, ebx
jle 0x48c4ae
cmp ebx, 0x800
jg 0x48c4ae
lea eax, [ebp - 0x100c]
lea edx, [ebp - 0x1006]
call fcn.00405bb8
mov eax, dword [ebp - 0x100c]
mov edx, esi
call fcn.0048a200
jmp 0x48c51b
test ebx, ebx
jle 0x48c51b
inc ebx
mov eax, ebx
add eax, eax
call fcn.00403010
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c514
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov word [eax], 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x48c4fe
lea eax, [ebp - 0x1010]
mov edx, dword [ebp - 4]
call fcn.00405bb8
mov eax, dword [ebp - 0x1010]
mov edx, esi
call fcn.0048a200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c51b
mov eax, dword [ebp - 4]
call fcn.0040302c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c540
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.00405a04
ret

Function at 0x48c5fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x48c663
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0048a300
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
xor edx, edx
call fcn.0048a8ac
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48c642
test al, 0x10
jne 0x48c646
xor ebx, ebx
jmp 0x48c648
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c66a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a04
ret

Function at 0x48c870
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48c911
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x48c8fb
lea edx, [ebp - 4]
mov eax, esi
call fcn.0048a474
mov word [ebp - 0x92], 0
xor eax, eax
push ebp
push 0x48c8ef
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x92]
push eax
mov eax, dword [ebp - 4]
call fcn.00405a98
push eax
call sub.kernel32.dll_GetVolumeInformationW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48c8fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c918
lea eax, [ebp - 4]
call fcn.004059fc
ret
Function at 0x4944b0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, edx
mov esi, eax
test bl, bl
jne 0x4944cc
mov eax, esi
call fcn.004948f8
test al, al
jne 0x4945eb
call fcn.00494424
test al, al
je 0x4945eb
call fcn.004943f4
mov ebx, eax
test ebx, ebx
je 0x4945eb
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendNotifyMessageW
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 3
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x49453f
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x494549
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x494529
mov dword [esp + 0x10], 0x103
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4945b5
cmp dword [esp + 0x10], 0x103
jne 0x4945b5
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 3
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x49459c
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x4945b5
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4945b5
cmp dword [esp + 0x10], 0x103
je 0x494586
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4945c9
cmp dword [esp + 0x10], 0x103
jne 0x4945eb
mov eax, dword [esp]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4945e4
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push 0xa
call sub.kernel32.dll_Sleep_1
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x4944f3
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, edx
mov esi, eax
test bl, bl
jne 0x4944cc
mov eax, esi
call fcn.004948f8
test al, al
jne 0x4945eb
call fcn.00494424
test al, al
je 0x4945eb
call fcn.004943f4
mov ebx, eax
test ebx, ebx
je 0x4945eb
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendNotifyMessageW
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 3
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x49453f
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x494549
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x494529
mov dword [esp + 0x10], 0x103
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4945b5
cmp dword [esp + 0x10], 0x103
jne 0x4945b5
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 3
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x49459c
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x4945b5
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4945b5
cmp dword [esp + 0x10], 0x103
je 0x494586
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4945c9
cmp dword [esp + 0x10], 0x103
jne 0x4945eb
mov eax, dword [esp]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4945e4
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push 0xa
call sub.kernel32.dll_Sleep_1
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x4946b8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
mov eax, ebx
call fcn.004948f8
test al, al
jne 0x4947ed
call fcn.00494628
test al, al
je 0x4947ed
call fcn.004945f4
mov ebx, eax
test ebx, ebx
je 0x4947ed
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendNotifyMessageW
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 2
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x494741
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x49474b
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x49472b
mov dword [esp + 0x10], 0x103
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4947b7
cmp dword [esp + 0x10], 0x103
jne 0x4947b7
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 2
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x49479e
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x4947b7
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4947b7
cmp dword [esp + 0x10], 0x103
je 0x494788
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4947cb
cmp dword [esp + 0x10], 0x103
jne 0x4947ed
mov eax, dword [esp]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4947e6
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push 0xa
call sub.kernel32.dll_Sleep_1
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x4946f5
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
mov eax, ebx
call fcn.004948f8
test al, al
jne 0x4947ed
call fcn.00494628
test al, al
je 0x4947ed
call fcn.004945f4
mov ebx, eax
test ebx, ebx
je 0x4947ed
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendNotifyMessageW
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 2
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x494741
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x49474b
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x49472b
mov dword [esp + 0x10], 0x103
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4947b7
cmp dword [esp + 0x10], 0x103
jne 0x4947b7
call fcn.0040e45c
add esp, 0xfffffff8
fstp qword [esp]
wait
push 0
push 2
call fcn.004835d4
fstp qword [esp + 8]
wait
jmp 0x49479e
push 0xa
call sub.kernel32.dll_Sleep_1
call fcn.0040e45c
fcomp qword [esp + 8]
wait
fnstsw ax
sahf
ja 0x4947b7
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4947b7
cmp dword [esp + 0x10], 0x103
je 0x494788
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4947cb
cmp dword [esp + 0x10], 0x103
jne 0x4947ed
mov eax, dword [esp]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4947e6
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push 0xa
call sub.kernel32.dll_Sleep_1
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x4948f8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff4
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0
mov eax, esp
push eax
push 0x4947f4
call sub.user32.dll_EnumWindows
movzx eax, byte [esp + 8]
add esp, 0xc
ret
Function at 0x49c64c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4d5248
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x49c66e
shr eax, 1
xor eax, 0xedb88320
jmp 0x49c670
shr eax, 1
dec edx
jne 0x49c65c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49c655
mov byte [0x4d5648], 1
pop esi
pop ebx
ret

Function at 0x49c68c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4d5648], 0
jne 0x49c6a3
call fcn.0049c64c
mov eax, edi
dec eax
test eax, eax
jl 0x49c6cb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d5248]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x49c6ad
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49f0e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x49f182.0
jmp dword [ecx*4 + 0x49f11b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x49f14d
sub dl, 8
je 0x49f15c
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ed90
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ede8
jmp case.0x49f182.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x49f182.0
movzx ecx, byte [ecx + 0x49f189]
jmp dword [ecx*4 + 0x49f19a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ee94
jmp case.0x49f182.0
cmp dl, 3
jne 0x49f1c7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49eeec
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49eea8
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ef30
jmp case.0x49f182.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x49f1f2
sub dl, 8
je 0x49f1fe
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49ef5c
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49efc8
jmp case.0x49f182.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x49f21d
sub dl, 8
je 0x49f229
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49f084
jmp case.0x49f182.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x49f0ac
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x49f2cb
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0049e294
test eax, eax
je 0x49f2cb
mov eax, ebx
call fcn.0049f2d4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x49f264
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8