joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475164
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov ebx, ecx
xor eax, eax
push ebp
push 0x47537d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax], 5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dl, byte [ebp + 0x10]
mov byte [eax + 1], dl
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 2], 0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00463aa0
mov eax, dword [ebp - 8]
call fcn.00405034
test eax, eax
jle 0x47523c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 4
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 4], 0x10
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov edx, ebx
mov eax, dword [0x4720a8]
call fcn.004721ac
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47522a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x475214
push 4
push 0x10
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00472148
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.00463468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475231
lea eax, [ebp - 4]
call fcn.0040f850
ret
mov eax, dword [0x4f502c]
mov eax, dword [eax]
mov edx, ebx
call fcn.0046b8d8
test al, al
je 0x4752be
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 1
mov edx, ebx
mov eax, dword [0x4720a8]
call fcn.004721ac
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4752ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x475296
push 4
push 4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00472148
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.00463468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4752b3
lea eax, [ebp - 4]
call fcn.0040f850
ret
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 3
mov eax, ebx
call fcn.00405034
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov byte [edx + 4], al
mov eax, dword [ebp + 8]
mov dword [eax], 5
mov eax, ebx
call fcn.00405034
test eax, eax
jle 0x475311
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov eax, ebx
call fcn.00405034
push eax
lea ecx, [ebp - 0x14]
mov dl, 1
mov eax, ebx
call fcn.00464940
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.00463468
mov eax, ebx
call fcn.00405034
mov edx, dword [ebp + 8]
add dword [edx], eax
mov eax, dword [0x4f502c]
mov eax, dword [eax]
mov dx, word [ebp + 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 2
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00464b00
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.00463468
mov eax, dword [ebp + 8]
add dword [eax], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475384
lea eax, [ebp - 0x18]
mov edx, dword [0x462e30]
mov ecx, 4
call fcn.00405a9c
lea eax, [ebp - 8]
call fcn.00404d64
ret
Function at 0x4a2db8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4a2dd5
add esp, 0xfffffff0
call fcn.0040418c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4a2f71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004995c4
test al, al
jne 0x4a2e12
mov ecx, 0x4a2fa4
mov dl, 1
mov eax, dword [0x48dcc0]
call fcn.0040dbd0
call fcn.004046b8
xor eax, eax
push ebp
push 0x4a2e3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00498070
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00497f5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2e5e
mov eax, dword [ebp - 0x10]
mov edx, 0x4a2fe0
call fcn.00405768
je 0x4a2e7b
mov eax, esi
mov edx, 0x4a2fe0
call fcn.00405768
jne 0x4a2e9f
mov eax, edi
mov edx, 0x4a2ff0
call fcn.00405768
je 0x4a2e9f
mov ecx, 0x4a2fc8
mov dl, 1
mov eax, dword [0x48df68]
call fcn.0040dbd0
call fcn.004046b8
mov eax, edi
xor edx, edx
call fcn.00405768
jne 0x4a2ecc
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00405768
je 0x4a2ecc
mov ecx, 0x4a2fc8
mov dl, 1
mov eax, dword [0x48df68]
call fcn.0040dbd0
call fcn.004046b8
mov eax, dword [ebp - 0x10]
mov edx, 0x4a3030
call fcn.00405768
jne 0x4a2eff
mov eax, edi
mov edx, 0x4a303c
call fcn.00405768
je 0x4a2eff
mov ecx, 0x4a2fc8
mov dl, 1
mov eax, dword [0x48df68]
call fcn.0040dbd0
call fcn.004046b8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004a0ea8
lea eax, [ebx + 4]
mov edx, esi
call fcn.004054f8
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004054f8
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004054f8
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004054f8
lea eax, [ebx + 8]
call fcn.004054bc
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x4a3088]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2f78
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004054d4
ret
Function at 0x4a486c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4a4889
add esp, 0xfffffff0
call fcn.0040418c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4a4a24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004995c4
test al, al
jne 0x4a48c6
mov ecx, 0x4a4a58
mov dl, 1
mov eax, dword [0x48dcc0]
call fcn.0040dbd0
call fcn.004046b8
xor eax, eax
push ebp
push 0x4a48f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00498070
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00497f5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4912
mov eax, edi
xor edx, edx
call fcn.00405768
jne 0x4a493f
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00405768
je 0x4a493f
mov ecx, 0x4a4a7c
mov dl, 1
mov eax, dword [0x48df68]
call fcn.0040dbd0
call fcn.004046b8
mov eax, dword [ebp - 0x10]
mov edx, 0x4a4a94
call fcn.00405768
jne 0x4a4972
mov eax, edi
mov edx, 0x4a4aa0
call fcn.00405768
je 0x4a4972
mov ecx, 0x4a4a7c
mov dl, 1
mov eax, dword [0x48df68]
call fcn.0040dbd0
call fcn.004046b8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004a0ea8
lea eax, [ebx + 4]
mov edx, esi
call fcn.004054f8
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004054f8
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004054f8
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004054f8
lea eax, [ebx + 8]
call fcn.004054bc
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x41b23c]
call fcn.00403e14
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x41b23c]
call fcn.00403e14
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x41b23c]
call fcn.00403e14
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x4a4aec]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x490ce4]
call fcn.004a0100
mov dword [ebx + 0x3c], eax
mov ax, word [0x4a4af0]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4a2b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004054d4
ret
Function at 0x4a7480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4a74a2
add esp, 0xfffffff0
call fcn.0040418c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4a760d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004995c4
test al, al
jne 0x4a74df
mov ecx, 0x4a7640
mov dl, 1
mov eax, dword [0x48dcc0]
call fcn.0040dbd0
call fcn.004046b8
push dword [0x4f46e8]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x4f46e8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0xc]
call fcn.0049a09c
test al, al
jne 0x4a75b1
push dword [0x4f46e4]
push dword [ebp + 8]
push dword [0x4f46e4]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0x14]
call fcn.0049a09c
test al, al
jne 0x4a75b1
push dword [0x4f46e8]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x4f46e8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0x18]
call fcn.0049a1b4
test al, al
jne 0x4a75b1
push dword [0x4f46e4]
push edi
push dword [0x4f46e4]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0x20]
call fcn.0049a1b4
test al, al
jne 0x4a75b1
mov ecx, 0x4a7640
mov dl, 1
mov eax, dword [0x48dcc0]
call fcn.0040dbd0
call fcn.004046b8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004a0ea8
lea eax, [ebx + 4]
mov edx, esi
call fcn.004054f8
lea eax, [ebx + 8]
call fcn.004054bc
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.004054f8
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.004054f8
mov byte [ebx + 0xc], 0xc
mov ax, word [0x4a765c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7614
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004054d4
ret

Function at 0x4dc110
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dc18b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4dc172
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404fe4
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0040967c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc192
lea eax, [ebp - 0x104]
call fcn.00404d64
ret
Function at 0x4ee3fc
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1d8], ecx
mov dword [ebp - 0x1dc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405224
mov eax, dword [ebp - 8]
call fcn.00405224
xor eax, eax
push ebp
push 0x4ee585
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ee550
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409dbc
mov ebx, eax
test ebx, ebx
jle 0x4ee46b
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
mov eax, ebx
call fcn.00409ed0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d4]
call fcn.0040345c
mov eax, dword [ebp - 4]
call fcn.00409f40
test al, al
jne 0x4ee497
lea eax, [ebp - 0x1d4]
call fcn.004031ec
call fcn.00402e14
jmp 0x4ee4d1
lea eax, [ebp - 0x1d4]
call fcn.004031e0
call fcn.00402e14
cmp esi, 0x4c4b40
jle 0x4ee4c1
lea eax, [ebp - 0x1d4]
call fcn.004031ec
call fcn.00402e14
jmp 0x4ee4d1
lea eax, [ebp - 0x1d4]
call fcn.004031f8
call fcn.00402e14
call fcn.0040bd74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x1dc]
mov eax, 0x4ee59c
call fcn.0040ca1c
push dword [ebp - 0x1dc]
push 0x4ee5bc
push dword [ebp - 8]
lea eax, [ebp - 0x1d8]
mov edx, 3
call fcn.004050f4
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d4]
call fcn.00405450
call fcn.004038d0
call fcn.00402e14
lea eax, [ebp - 0x1d4]
call fcn.0040350c
call fcn.00402e14
lea eax, [ebp - 0x1d4]
call fcn.00403524
call fcn.00402e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ee55a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee58c
lea eax, [ebp - 0x1dc]
mov edx, 2
call fcn.00404d88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d88
ret
Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x43b63b
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
sub edx, edx
add edx, edx
add ebx, 0x32e9f839
call fcn.0043b674
sub ebx, ebx
sub edx, ebx
xor dword [eax], esi
dec ebx
or edx, ebx
dec ebx
inc eax
sub edx, ebx
cmp eax, edi
jne fcn.0043b63b
add edx, 0xfedf5722
add edx, ebx
mov ebx, 0xfe8d9041
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x14e45ef0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x1e4c73a1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x9c
push 0
push 0x4a7db0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4a7db4], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4a7db0], eax
mov eax, str.DownloadFile
mov dword [0x4a7df4], eax
call fcn.00419c70
call fcn.0041915b
call fcn.00418ec0
call fcn.00417d20
call fcn.00415e54
call fcn.004155e0
call fcn.00414bc0
call fcn.00413bc1
call fcn.004133d7
call fcn.00413313
call fcn.00413026
call fcn.00412884
call fcn.004122ae
call fcn.00411d2d
call fcn.00410870
call fcn.0040ee11
call fcn.0040b791
call fcn.0040b1b7
call fcn.0040afac
call fcn.00408d30
call fcn.00408b2e
call fcn.00408a10
push dword [0x4a7e44]
call fcn.00413c72
push 7
push 0x48b06c
lea eax, [0x4a7e44]
push eax
push 0xc
call fcn.00413be0
mov edx, 0x48ad94
lea ecx, [0x4a7dd0]
call fcn.00408008
mov edx, str.ERROR
lea ecx, [0x4a7ddc]
call fcn.00408008
push 0x4a7e2c
push 0x48b054
push 8
push 3
push 4
call fcn.0041304f
push 0x4a7e34
push 0x48b054
push 8
push 3
push 4
call fcn.0041304f
push 0x4a7e3c
push 0x48b054
push 8
push 0x1f
push 4
call fcn.0041304f
push edx
call fcn.00419cc0
pop edx
push eax
call fcn.00405750
push 0x4a7e00
call fcn.00419d00
call fcn.004061c1
call fcn.00404a45
call fcn.00406979
push 0
call fcn.0040119c
call fcn.00419ca0
push dword [0x4a7db0]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess

Function at 0x406676
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov edx, 0x8e
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40667c
call fcn.00419dd0
mov edx, dword [esp + 0x240]
lea ecx, [esp]
call fcn.00408000
push edx
call fcn.00419cc0
pop edx
push eax
push edx
call fcn.00419cc0
pop edx
push eax
push dword [esp + 8]
call fcn.004104e0
lea eax, [esp + 4]
push eax
call fcn.00419d00
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x4067b0
lea ebp, [esp + 8]
mov dword [ebp], 0x22c
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32FirstW
and eax, eax
je 0x4067a7
push edx
call fcn.00419cc0
pop edx
push eax
push edx
call fcn.00419cc0
pop edx
push eax
push dword [esp + 8]
call fcn.004184c0
call fcn.00419ec0
push edx
call fcn.00419cc0
pop edx
push eax
push edx
call fcn.00419cc0
pop edx
push eax
push edx
call fcn.00419cc0
pop edx
push eax
push edx
call fcn.00419cc0
pop edx
push eax
push 0x104
lea ebp, [esp + 0x20]
lea eax, [ebp + 0x24]
push eax
call fcn.004190a0
call fcn.004081b2
add dword [esp], edx
call fcn.004184c0
call fcn.004081d0
mov edx, eax
pop ecx
push ecx
call fcn.004081d0
mov ecx, eax
call fcn.004081e0
je 0x406784
lea ebp, [esp + 8]
push dword [ebp + 8]
pop eax
mov dword [esp + 0x234], eax
jmp 0x4067a7
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32NextW
and eax, eax
je 0x40679a
xor eax, eax
jmp 0x40679f
mov eax, 1
and eax, eax
je 0x4066ff
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 0x234]
jmp 0x4067bb
push dword [esp]
call fcn.00419e90
add esp, 0x238
pop ebp
ret 4
Function at 0x408a68
Capabilities:
Suspend thread

Disassembly:
push dword [esp + 4]
call fcn.00408a1c
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret 4

Function at 0x408a7b
Capabilities:
Resume thread

Disassembly:
push dword [esp + 4]
call fcn.00408a1c
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret 4

Function at 0x408a8e
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x408b26
push edi
push 0x4a874c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4a7e7c]
test edi, edi
je 0x408afa
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x408af3
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x4a7e7c
call fcn.00419bf2
pop ecx
pop ecx
jmp 0x408af5
mov edi, dword [edi]
test edi, edi
jne 0x408aca
pop ebx
mov eax, dword [0x4a4718]
mov esi, eax
inc eax
push 0x10
push 0x4a7e7c
mov dword [0x4a4718], eax
call fcn.00419c32
pop ecx
pop ecx
push 0x4a874c
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x408c4f
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x408ca4
push dword [esp + 0x10]
push 0x408bce
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4a7e80]
test esi, esi
je 0x408cfd
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x408c9c
cmp byte [esi + 0x10], 0
je 0x408c9c
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x408c78
jmp 0x408cfd
mov esi, dword [0x4a7e80]
test esi, esi
je 0x408cfd
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x408cf6
cmp byte [esi + 0x11], 0
je 0x408cd2
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x408ce9
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x4a7e80
call fcn.00419bf2
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x408cb1
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4093f2
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x4a8770]
call fcn.00419352
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x4094f2
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x409448
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x409440
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x409488
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x4094ca
push 0x22
pop edx
cmp cx, dx
je 0x40947a
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x40946a
xor ecx, ecx
cmp word [eax], cx
je 0x4094ca
mov ecx, eax
add eax, 2
jmp 0x4094cc
test dx, dx
je 0x4094d2
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x40947a
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x4094c0
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x4094ca
cmp cx, dx
je 0x4094bd
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4094ad
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x409492
jmp 0x40947a
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x4094d4
xor edx, edx
cmp dword [ebp], ebx
jne 0x4094dd
test edi, edi
jne 0x4094fa
test edx, edx
je 0x4094e2
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x409436
test edi, edi
jne 0x40950b
mov eax, ebx
jmp 0x40950f
test esi, esi
je 0x40950b
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x40950f
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x409cac
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x409d0b
cmp word [esi], di
je 0x409d0b
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00440100
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.004403b0
add esp, 0x10
test eax, eax
jne 0x409d0a
push 0x24
push 8
push dword [0x4a7db0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10