joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4965b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x526b8c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x438], 0x209
xor eax, eax
mov word [ebp - 0x428], ax
push 0x410
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.004df000
add esp, 0xc
push 0x208
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x428]
push eax
call fcn.0049a560
add esp, 0xc
lea ecx, [ebp - 0x42c]
push ecx
push 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4967b1
lea edx, [ebp - 0x43c]
push edx
push 1
push 2
push 0
push 0
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4967b1
lea ecx, [ebp - 0x430]
push ecx
push 0x50dbc8
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4967b1
mov dword [ebp - 0x444], 0
xor edx, edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x440], 0x20
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea edx, [ebp - 0x444]
push edx
push 0x19
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x4967b1
mov dword [ebp - 0x4a0], 0
xor ecx, ecx
mov dword [ebp - 0x49c], ecx
mov dword [ebp - 0x498], ecx
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x490], 0
push 0x40
push 0
lea edx, [ebp - 0x48c]
push edx
call fcn.004df000
add esp, 0xc
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x4a0], 0
je 0x49679b
mov ecx, dword [ebp - 0x4a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x49c], 0
je 0x4967b1
mov edx, dword [ebp - 0x49c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x430], 0
je 0x4967c7
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x43c], 0
je 0x4967dd
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x42c], 0
je 0x4967f3
mov edx, dword [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 1], 0
cmp dword [ebp - 0x434], 1
jne 0x496804
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004def73
mov esp, ebp
pop ebp
ret
Function at 0x49b410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 0x1000
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret 4

Function at 0x49b500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x49b512
jmp 0x49b531
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x49b5f0
push 0
push 0
call fcn.004e33a7
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x49d2e0
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x526b8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004df000
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
add ecx, 0xc
call fcn.0041b6a0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 8], eax
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
push 0x49d560
push 0
push 0
call fcn.004e33a7
add esp, 0x18
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x214]
cmp dword [edx + 4], 0
je 0x49d39f
mov eax, dword [ebp - 0x214]
cmp dword [eax + 8], 0
je 0x49d39f
mov dword [ebp - 0x218], 1
jmp 0x49d3a9
mov dword [ebp - 0x218], 0
mov al, byte [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004def73
mov esp, ebp
pop ebp
ret

Function at 0x49d3c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x49d3e3
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x49d42e
push 0x2710
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x49d417
push 0x15f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x49d44e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x49d800
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x526b8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
call fcn.0041b940
movzx eax, al
test eax, eax
jne 0x49d82e
cmp dword [ebp + 0x10], 0
je 0x49d82e
cmp dword [ebp + 0x14], 0
jne 0x49d83e
mov ecx, dword [ebp + 8]
call fcn.0041b5c0
mov eax, dword [ebp + 8]
jmp 0x49d922
lea ecx, [ebp - 0x20]
call fcn.0041b5c0
xor ecx, ecx
mov word [ebp - 0x228], cx
push 0x206
push 0
lea edx, [ebp - 0x226]
push edx
call fcn.004df000
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push 0
push 0x50e378
mov ecx, dword [ebp + 0xc]
call fcn.0041c900
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x49d90b
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffff
je 0x49d90b
mov dword [ebp - 0x230], 0
push 0
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49d8fe
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp - 0x230]
jne 0x49d8fe
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0041b6a0
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041b620
lea ecx, [ebp - 0x20]
call fcn.0041b650
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004def73
mov esp, ebp
pop ebp
ret
Function at 0x4a5ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jne 0x4a5f03
xor al, al
jmp 0x4a5fd7
mov byte [ebp - 5], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4a5fb5
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a5fa4
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
push 0x52b834
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call fcn.004e329b
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x4a5fa4
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a5fa4
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jne 0x4a5fa4
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
movzx ecx, byte [ebp - 5]
test ecx, ecx
jne 0x4a5fd4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a5e20
add esp, 0xc
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4ad530
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov eax, dword [0x526b8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x57c], ecx
push 0x11c
push 0
lea eax, [ebp - 0x540]
push eax
call fcn.004df000
add esp, 0xc
mov dword [ebp - 0x540], 0x11c
push 0x11c
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004df000
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx], 0x11c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 5
jne 0x4ad5be
mov ecx, dword [ebp - 0x57c]
call fcn.004ad750
test eax, eax
je 0x4ad5be
mov edx, dword [ebp - 0x57c]
mov dword [edx + 4], 0
mov eax, 1
jmp 0x4ad73a
lea eax, [ebp - 0x540]
push eax
mov ecx, dword [ebp - 0x57c]
call fcn.004ad850
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0xa
mov eax, dword [ebp + 8]
add edx, dword [eax + 8]
mov dword [ebp - 0x41c], edx
mov ecx, dword [ebp - 0x53c]
imul ecx, ecx, 0xa
add ecx, dword [ebp - 0x538]
mov dword [ebp - 0x420], ecx
mov edx, dword [ebp - 0x420]
cmp edx, dword [ebp - 0x41c]
jle 0x4ad62c
push 0x11c
lea eax, [ebp - 0x540]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004e28d0
add esp, 0xc
mov edx, dword [ebp - 0x420]
mov dword [ebp - 0x41c], edx
xor eax, eax
mov word [ebp - 0x418], ax
push 0x40e
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004df000
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp - 0x57c]
call fcn.004ad7a0
test eax, eax
jl 0x4ad728
lea eax, [ebp - 0x574]
push eax
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp - 0x57c]
call fcn.004ad8a0
test eax, eax
je 0x4ad728
mov edx, dword [ebp - 0x564]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
imul eax, eax, 0xa
mov ecx, dword [ebp - 0x564]
and ecx, 0xffff
movzx edx, cx
add eax, edx
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x578]
jge 0x4ad714
mov ecx, dword [ebp - 0x564]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x564]
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x560]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x57c]
mov dword [ecx + 4], 1
jmp 0x4ad721
mov edx, dword [ebp - 0x57c]
mov dword [edx + 4], 0
mov eax, 1
jmp 0x4ad73a
mov eax, dword [ebp - 0x57c]
mov dword [eax + 4], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004def73
mov esp, ebp
pop ebp
ret 4
Function at 0x4ad8a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ad95c
push 0x10
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ad952
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ad952
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ad948
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004dfd0e
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ad948
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004e28d0
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x4ad9b1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x513d50
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4ad9a5
mov esi, dword [ebp - 0x20]
mov ecx, 0xd
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004df07a
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4b3a50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x4b3a90
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x4b3a7f
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4b3a8b
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4b3be0
lea ecx, [ebp - 0x10]
call fcn.00444640
lea ecx, [ebp - 0x20]
call fcn.00444640
lea ecx, [ebp - 0x10]
call fcn.00444640
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x20]
call fcn.00444640
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x10]
call fcn.00446920
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x10]
call fcn.00446910
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x20]
call fcn.00446920
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.00446920
sub esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x20]
call fcn.00446910
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.00446910
sub esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
push 0
push 0x14
lea edx, [ebp - 0x10]
push edx
call fcn.004460e0
add esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
jne 0x4b3b98
mov dword [ebp - 0x2c], 1
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4b3b67
mov edx, dword [ebp - 0x2c]
or edx, 4
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4b3be0
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4b3be0
push 1
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xfffffffffffffffe
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b59c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0
je 0x4b5a25
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x14]
push eax
push 0x4b5980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b5a1e
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x4b5a31
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esp, ebp
pop ebp
ret

Function at 0x4b5c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x14
call fcn.004df108
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b5cbd
mov ecx, dword [ebp - 0x18]
call fcn.004b5c00
mov dword [ebp - 0x1c], eax
jmp 0x4b5cc4
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b5d4d
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
call fcn.0048dbd0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0041bb30
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0x4b5ba0
call fcn.004e4979
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4b5d45
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4b5d33
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp 0x4b5d45
lea ecx, [ebp - 0xc]
call fcn.0046b680
mov edx, dword [ebp - 8]
mov dword [edx + 8], 1
lea ecx, [ebp - 0xc]
call fcn.004b7a30
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b5d80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x14
call fcn.004df108
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b5dad
mov ecx, dword [ebp - 0x18]
call fcn.004b7730
mov dword [ebp - 0x1c], eax
jmp 0x4b5db4
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b5e47
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
call fcn.0048dbd0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0041bb30
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0041bb30
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x4b5ba0
call fcn.004e4979
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4b5e3f
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4b5e2d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
jmp 0x4b5e3f
lea ecx, [ebp - 0xc]
call fcn.0046b680
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 1
lea ecx, [ebp - 0xc]
call fcn.004b7a30
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4dd129
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x52b7fc], 0
push esi
jne 0x4dd09c
call fcn.004dcfc2
test eax, eax
je 0x4dd0df
mov eax, dword [0x52b7fc]
cmp eax, 1
jne 0x4dd0bd
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4dd0df
pop esi
ret
push eax
call dword [0x52b804]
test eax, eax
jne 0x4dd127
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4dd0e3
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x52b7fc]
call dword [0x52b804]
mov edi, eax
test edi, edi
je 0x4dd108
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4dd124
mov edi, esi
add esi, 0xff0
push edi
push dword [0x52b7fc]
call dword [0x52b800]
add edi, 0x10
cmp edi, esi
jb 0x4dd110
mov eax, edi
pop edi
pop esi
ret
jmp 0x4dd089

Function at 0x4def73
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x526b8c]
jne 0x4def7d
repz ret
jmp fcn.004e8bb3
Function at 0x4f7337
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004ea38c
and dword [ebp - 4], 0
cmp dword [0x52c5e0], 0
mov ebx, eax
jne 0x4f73e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4f7499
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4f7499
push eax
call fcn.004ea31a
mov dword [esp], 0x512a80
push edi
mov dword [0x52c5e0], eax
call esi
push eax
call fcn.004ea31a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x52c5e4], eax
call esi
push eax
call fcn.004ea31a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x52c5e8], eax
call esi
push eax
call fcn.004ea31a
pop ecx
mov dword [0x52c5f0], eax
test eax, eax
je 0x4f73e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004ea31a
pop ecx
mov dword [0x52c5ec], eax
mov eax, dword [0x52c5ec]
cmp eax, ebx
je 0x4f7440
cmp dword [0x52c5f0], ebx
je 0x4f7440
push eax
call fcn.004ea395
push dword [0x52c5f0]
mov esi, eax
call fcn.004ea395
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4f7440
test edi, edi
je 0x4f7440
call esi
test eax, eax
je 0x4f7437
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4f7437
test byte [ebp - 0xc], 1
jne 0x4f7440
or dword [ebp + 0x10], 0x200000
jmp 0x4f7479
mov eax, dword [0x52c5e4]
cmp eax, ebx
je 0x4f7479
push eax
call fcn.004ea395
pop ecx
test eax, eax
je 0x4f7479
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4f7479
mov eax, dword [0x52c5e8]
cmp eax, ebx
je 0x4f7479
push eax
call fcn.004ea395
pop ecx
test eax, eax
je 0x4f7479
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x52c5e0]
call fcn.004ea395
pop ecx
test eax, eax
je 0x4f7499
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4f749b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret