joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473a40
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x473bb8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00473d3c
mov esi, eax
test esi, esi
je 0x473a9e
inc dword [ebp - 0x14]
test ebx, ebx
jne 0x473a9e
mov eax, dword [edi + 0x38]
mov eax, dword [eax + 0x38]
mov edx, esi
call fcn.0042d620
cmp dword [ebp - 0x18], 0
jle 0x473af9
mov dword [ebp - 0x10], esi
inc ebx
mov eax, dword [ebp - 8]
call fcn.00405bb4
cmp ebx, eax
jl 0x473ae8
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4739f8]
call fcn.00405d70
add esp, 4
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x473a1c]
call fcn.00405d70
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [eax + ebx*4], edx
jmp 0x473b31
test ebx, ebx
jle 0x473b31
mov eax, dword [ebp - 8]
dec dword [eax + ebx*4]
jmp 0x473b10
dec ebx
test ebx, ebx
jle 0x473b10
mov eax, dword [ebp - 8]
dec dword [eax + ebx*4]
mov eax, dword [ebp - 8]
cmp dword [eax + ebx*4], 0
jne 0x473b1d
test ebx, ebx
jg 0x473b05
test ebx, ebx
jne 0x473b28
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x473b31
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x64
cdq
idiv ecx
test edx, edx
jne 0x473b52
mov eax, dword [ebp - 4]
call fcn.0041e7c4
push edx
push eax
mov eax, dword [edi + 0x38]
call fcn.0046f128
test esi, esi
jne 0x473a73
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x473bd0
call fcn.0040a2d0
mov eax, dword [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, edi
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473bbf
lea eax, [ebp - 0x1c]
call fcn.00404930
lea eax, [ebp - 0xc]
mov edx, dword [0x473a1c]
call fcn.00405e90
lea eax, [ebp - 8]
mov edx, dword [0x4739f8]
call fcn.00405e90
ret
Function at 0x485744
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48574c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48593e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x485954
mov eax, esi
call fcn.004834d4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404984
lea ecx, [ebp - 0x10]
mov edx, 0x485968
mov eax, esi
call fcn.004834d4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404984
lea ecx, [ebp - 0x14]
mov edx, 0x485980
mov eax, esi
call fcn.004834d4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404984
lea ecx, [ebp - 0x18]
mov edx, 0x48599c
mov eax, esi
call fcn.004834d4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404984
lea ecx, [ebp - 0x1c]
mov edx, 0x4859b8
mov eax, esi
call fcn.004834d4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404984
lea ecx, [ebp - 0x24]
mov edx, 0x4859d0
mov eax, esi
call fcn.004834d4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408f70
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409350
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4859e8
mov eax, esi
call fcn.004834d4
mov eax, dword [ebp - 0x28]
call fcn.0047a51c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4859f8
mov eax, esi
call fcn.004834d4
mov eax, dword [ebp - 0x2c]
call fcn.0047a51c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x485a10
mov eax, esi
call fcn.004834d4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409350
inc eax
je 0x4858e1
lea ecx, [ebp - 0x34]
mov edx, 0x485a10
mov eax, esi
call fcn.004834d4
mov eax, dword [ebp - 0x34]
call fcn.00409314
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ad7c
fstp qword [ebp - 0x3c]
wait
call fcn.0040b0e0
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4858fc
lea ecx, [ebp - 0x40]
mov edx, 0x485a10
mov eax, esi
call fcn.004834d4
mov eax, dword [ebp - 0x40]
call fcn.0047a51c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x485a20
mov eax, esi
call fcn.004834d4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485945
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404954
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404954
ret
Function at 0x491dac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x491e06
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00491d9c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00478eb8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00478ab8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491e0d
lea eax, [ebp - 4]
call fcn.00404930
ret

Function at 0x4955b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4956ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041ccdc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x49562c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x49562c
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408d20
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x4d12fc]
mov ebx, dword [ebx]
mov eax, 0x495700
call ebx
dec eax
jne 0x49562c
mov ebx, 1
jmp 0x49562e
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x4956cf
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0048d0b0
test al, al
jne 0x4956c3
mov eax, dword [ebp - 4]
call fcn.004955a4
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404984
xor edx, edx
push ebp
push 0x4956b1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x4956a7
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.004959c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4956c3
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x495646
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4956f1
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404954
ret
Function at 0x4b4040
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b406e
mov eax, ebx
call fcn.004b4af4
cmp dword [ebx + 0x40], 0
je 0x4b4067
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b40df
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b40d1
cmp dword [ebx + 8], 0
je 0x4b4090
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b40a2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b40d1
cmp dword [ebx + 8], 0
je 0x4b4083
cmp eax, 3
je 0x4b40b5
dec eax
jne 0x4b4083
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b4083
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b4083
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b40fd
cmp dword [ebx + 0x14], 0xcc
je 0x4b40fd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b4108
pop ebx
ret

Function at 0x4c6c18
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x237], 0
je 0x4c6c4a
movzx eax, word [ebx + 0x232]
push eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2c0]
push eax
movzx eax, word [ebx + 0x230]
push eax
call sub.kernel32.dll_MulDiv
mov esi, eax
jmp 0x4c6c51
movzx esi, word [ebx + 0x230]
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2c0], eax
cmp byte [ebx + 0x235], 0
je 0x4c6c8f
mov al, byte [ebx + 0x234]
xor edx, edx
mov dl, al
cmp esi, edx
jge 0x4c6c84
mov edx, esi
push edx
mov edx, eax
pop eax
sub dl, al
mov eax, ebx
call fcn.004c5b38
jmp 0x4c6cba
xor edx, edx
mov eax, ebx
call fcn.004c5b38
jmp 0x4c6cba
mov al, byte [ebx + 0x234]
xor edx, edx
mov dl, al
mov ecx, 0x64
sub ecx, esi
cmp edx, ecx
jge 0x4c6cb1
mov edx, esi
add dl, al
mov eax, ebx
call fcn.004c5b38
jmp 0x4c6cba
mov dl, 0x64
mov eax, ebx
call fcn.004c5b38
cmp byte [ebx + 0x235], 0
je 0x4c6ccc
cmp byte [ebx + 0x234], 0
jne 0x4c6ce3
cmp byte [ebx + 0x235], 0
jne 0x4c6cde
cmp byte [ebx + 0x234], 0x64
jne 0x4c6ce3
xor eax, eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret
Function at 0x4c7358
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404de0
mov eax, dword [ebp - 8]
call fcn.00404de0
xor eax, eax
push ebp
push 0x4c7469
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c7437
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004097ac
test al, al
jne 0x4c73e6
push dword [0x4d3328]
push 0x4c7484
push dword [0x4d3318]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404cb0
push 0
mov eax, dword [ebp - 4]
call fcn.00404df0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404df0
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x14]
call fcn.004ca160
mov eax, dword [ebp - 0x14]
call fcn.00404bf0
test eax, eax
jle 0x4c7414
push 0x4c7490
push dword [ebp - 0x14]
push 0x4c749c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00404c3c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004c88c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c7441
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7470
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404954
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404954
ret
Function at 0x4c8420
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x40
push 0
push 0
dec ecx
jne 0x4c8428
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404de0
xor eax, eax
push ebp
push 0x4c8692
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1dc]
xor eax, eax
call fcn.00402bec
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
call fcn.00409984
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 8]
mov ecx, 0x4c86a8
call fcn.00404c3c
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1d4]
call fcn.00402fa8
lea eax, [ebp - 0x1d4]
call fcn.00402d44
call fcn.00402954
mov edx, 0x4c86c0
lea eax, [ebp - 0x1d4]
call fcn.0040500c
call fcn.00403510
call fcn.00402954
push 0x4c86d0
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.00402bec
push dword [ebp - 0x1e4]
push 0x4c86e0
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.00404cb0
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1d4]
call fcn.0040500c
call fcn.00403510
call fcn.00402954
push 0x4c86ec
lea edx, [ebp - 0x1ec]
xor eax, eax
call fcn.00402bec
push dword [ebp - 0x1ec]
push 0x4c86e0
push 0x4c8700
lea eax, [ebp - 0x1e8]
mov edx, 4
call fcn.00404cb0
mov edx, dword [ebp - 0x1e8]
lea eax, [ebp - 0x1d4]
call fcn.0040500c
call fcn.00403510
call fcn.00402954
push 0x4c8714
push dword [ebp - 4]
push 0x4c8724
lea edx, [ebp - 0x1f4]
xor eax, eax
call fcn.00402bec
push dword [ebp - 0x1f4]
push 0x4c86e0
lea eax, [ebp - 0x1f0]
mov edx, 5
call fcn.00404cb0
mov edx, dword [ebp - 0x1f0]
lea eax, [ebp - 0x1d4]
call fcn.0040500c
call fcn.00403510
call fcn.00402954
push 0x4c86d0
push dword [ebp - 4]
push 0x4c86e0
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.00404cb0
mov edx, dword [ebp - 0x1f8]
lea eax, [ebp - 0x1d4]
call fcn.0040500c
call fcn.00403510
call fcn.00402954
mov edx, 0x4c8730
lea eax, [ebp - 0x1d4]
call fcn.0040500c
call fcn.00403510
call fcn.00402954
push 0x4c86e0
lea edx, [ebp - 0x200]
xor eax, eax
call fcn.00402bec
push dword [ebp - 0x200]
push 0x4c86e0
lea eax, [ebp - 0x1fc]
mov edx, 3
call fcn.00404cb0
mov edx, dword [ebp - 0x1fc]
lea eax, [ebp - 0x1d4]
call fcn.0040500c
call fcn.00403510
call fcn.00402954
lea eax, [ebp - 0x1d4]
call fcn.00403070
call fcn.00402954
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404df0
push eax
push 0x4c8740
mov eax, dword [0x4d17c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8699
lea eax, [ebp - 0x200]
mov edx, 0xb
call fcn.00404954
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404954
ret
Function at 0x4c8748
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc9c
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404de0
xor eax, eax
push ebp
push 0x4c885c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c8837
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20d]
mov edx, dword [ebp - 4]
call fcn.00409c8c
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004029c8
lea eax, [ebp - 0x30d]
mov edx, dword [ebp - 0xc]
call fcn.00409c8c
lea eax, [ebp - 0x354]
xor ecx, ecx
mov edx, 0x44
call fcn.00403214
mov dword [ebp - 0x354], 0x44
mov dword [ebp - 0x328], 1
mov word [ebp - 0x324], bx
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x20d]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4c880b
xor eax, eax
mov dword [ebp - 8], eax
call fcn.00404358
jmp 0x4c883e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x364]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c883e
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8863
lea eax, [ebp - 0xc]
call fcn.00404930
lea eax, [ebp - 4]
call fcn.00404930
ret

Function at 0x4c966c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffff54
lea eax, [esp + 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4c971f
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4c971f
mov eax, dword [esp + 0x18]
dec eax
je 0x4c9713
dec eax
jne 0x4c971f
lea eax, [esp + 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xa0]
push eax
push 0x4c9728
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4c9705
mov dword [esp + 0xa8], 2
mov dword [esp + 0x9c], 1
push esp
push 0
push 0
lea eax, [esp + 0xa8]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0xffff
push 2
call sub.user32.dll_ExitWindowsEx
jmp 0x4c971f
push 0xffff
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0xac
ret
Function at 0x4ca348
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404de0
mov eax, dword [ebp - 8]
call fcn.00404de0
mov eax, dword [ebp - 0xc]
call fcn.00404de0
xor eax, eax
push ebp
push 0x4ca3c1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 0xc]
call fcn.00404df0
push eax
mov eax, dword [ebp - 8]
call fcn.00404df0
push eax
mov eax, dword [ebp - 4]
call fcn.00404df0
push eax
push 0x4ca3cc
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca3c8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404954
ret

Function at 0x4ca440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404de0
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ca5ae
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004644a0
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004644c0
jmp 0x4ca57a
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404ba0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409a0c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408d20
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408d20
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404d3c
je 0x4ca55a
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404ba0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408d20
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408d20
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404d3c
jne 0x4ca571
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004644e0
test eax, eax
jne 0x4ca4bb
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca5b5
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404954
lea eax, [ebp - 4]
call fcn.00404930
ret
Function at 0x4cb6f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [0x4d17c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, ebx
call fcn.004cb5d4
mov cl, 1
mov dl, 1
mov eax, dword [0x4cb488]
call fcn.004cb824
mov esi, eax
mov dword [ebx + 0x338], esi
mov byte [esi + 0xf], 1
mov eax, dword [esi + 0x40]
mov edx, dword [ebx + 0x328]
call fcn.0041b848
mov eax, dword [ebx + 0x338]
mov eax, dword [eax + 0x40]
mov edx, dword [ebx + 0x30c]
call fcn.0041b848
mov eax, dword [ebx + 0x338]
mov eax, dword [eax + 0x40]
mov edx, dword [ebx + 0x314]
call fcn.0041b848
mov eax, dword [ebx + 0x338]
mov eax, dword [eax + 0x40]
mov edx, dword [ebx + 0x318]
call fcn.0041b848
mov eax, dword [ebx + 0x338]
call fcn.00422be0
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, ebx
call fcn.004cb8d0
pop esi
pop ebx
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4adc31cd
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7d7515ac
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408e84
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3ecf239a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3ccb5d62
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219