joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8170
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b82f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x4b82d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004b75b0
mov edx, 0x4b8314
mov eax, 0x80000001
call fcn.00461ef8
test al, al
je 0x4b82c7
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b83d4
mov edx, 0x4b83fc
mov eax, 0x80000001
call fcn.0046195c
lea eax, [ebp - 4]
push eax
mov ecx, 0x4b846c
mov edx, 0x4b848c
mov eax, 0x80000001
call fcn.0046195c
cmp dword [ebp - 4], 0
jne 0x4b824a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408d14
je 0x4b824a
mov eax, dword [ebp - 8]
mov edx, 0x4b84c8
call fcn.00408d14
je 0x4b824a
mov eax, dword [ebp - 8]
mov edx, 0x4b8524
call fcn.00408d14
je 0x4b824a
mov eax, dword [ebp - 8]
mov edx, 0x4b8580
call fcn.00408d14
jne 0x4b8232
cmp byte [ebx + 0xc], 0
jne 0x4b824a
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x4b846c
mov edx, 0x4b848c
mov eax, 0x80000001
call fcn.004617d4
mov eax, dword [ebp - 8]
mov edx, 0x4b84c8
call fcn.00408d14
je 0x4b82c7
cmp byte [ebx + 0xd], 0
jne 0x4b827d
push 0x4b84c8
mov ecx, 0x4b83d4
mov edx, 0x4b83fc
mov eax, 0x80000001
call fcn.004617d4
mov byte [ebp - 9], al
jmp 0x4b82c7
mov dl, 1
mov eax, 0x4b84c8
call fcn.004b6ce4
test al, al
je 0x4b82ac
push 0x4b84c8
mov ecx, 0x4b83d4
mov edx, 0x4b83fc
mov eax, 0x80000001
call fcn.004617d4
mov byte [ebp - 9], 1
jmp 0x4b82c7
push 0x4b85d0
call sub.kernel32.dll_OutputDebugStringW
mov cl, 1
mov edx, 0x4b84c8
mov eax, ebx
call fcn.004b6cfc
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b82db
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b82fd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b4c
ret

Function at 0x4ba3ac
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407bd0
xor eax, eax
push ebp
push 0x4ba484
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ba45f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4ba494
call sub.kernel32.dll_OutputDebugStringW
cmp dword [ebp - 4], 0
je 0x4ba44e
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4ba4b8
call fcn.00408bdc
mov edx, dword [ebp - 8]
mov eax, 0x80000001
call fcn.00461ef8
test al, al
je 0x4ba44e
cmp byte [ebx + 0xd], 0
jne 0x4ba434
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4ba52c
mov edx, 0x4ba554
mov eax, 0x80000001
call fcn.004617d4
jmp 0x4ba44e
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004b6ce4
test al, al
jne 0x4ba44e
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004b6cfc
mov eax, ebx
call fcn.004b89d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ba469
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba48b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b4c
ret
Function at 0x4d6080
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov ebx, eax
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call fcn.004814b0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call fcn.004814b0
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
lea eax, [esp + 0x18]
push eax
call fcn.004814b0
lea eax, [esp + 8]
call fcn.0040d11c
mov esi, eax
mov eax, dword [ebx + 4]
call fcn.00486764
sub esi, eax
sub esi, 0xa
lea eax, [esp + 8]
call fcn.0040d124
mov edi, eax
mov eax, dword [ebx + 4]
call fcn.004867a8
sub edi, eax
sub edi, 0xa
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
sub edx, eax
sar edx, 1
jns 0x4d610c
adc edx, 0
add edx, eax
mov dword [esp], edx
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
sub ebp, eax
sar ebp, 1
jns 0x4d6122
adc ebp, 0
add ebp, eax
mov dword [esp + 4], ebp
push 0
push 0x4d61fc
call sub.user32.dll_FindWindowW
test eax, eax
jbe 0x4d61e6
lea edx, [esp + 0x18]
push edx
push eax
call sub.user32.dll_GetWindowRect
lea eax, [esp + 0x18]
call fcn.0040d11c
mov esi, eax
lea eax, [esp + 0x18]
call fcn.0040d124
cmp esi, eax
jle 0x4d61a3
cmp ebp, dword [esp + 0x24]
jge 0x4d6189
mov eax, dword [ebx + 4]
call fcn.00486764
mov esi, dword [esp + 0x10]
sub esi, eax
sub esi, 0xa
mov eax, dword [ebx + 4]
call fcn.004867a8
mov edi, dword [esp + 0x1c]
sub edi, eax
sub edi, 0xa
jmp 0x4d61e6
mov eax, dword [ebx + 4]
call fcn.00486764
mov esi, dword [esp + 0x10]
sub esi, eax
sub esi, 0xa
mov edi, dword [esp + 0x24]
add edi, 0xa
jmp 0x4d61e6
mov eax, dword [esp + 0x20]
cmp eax, dword [esp]
jge 0x4d61c4
mov esi, eax
add esi, 0xa
mov eax, dword [ebx + 4]
call fcn.004867a8
mov edi, dword [esp + 0x14]
sub edi, eax
sub edi, 0xa
jmp 0x4d61e6
mov eax, dword [ebx + 4]
call fcn.00486764
mov esi, dword [esp + 0x18]
sub esi, eax
sub esi, 0xa
mov eax, dword [ebx + 4]
call fcn.004867a8
mov edi, dword [esp + 0x14]
sub edi, eax
sub edi, 0xa
mov ecx, edi
mov edx, esi
mov eax, dword [ebx + 4]
call fcn.004895d8
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e5c5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e5e54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
jne 0x4e5c96
mov eax, dword [ebx + 0xc]
mov dword [eax + 0x5db], 7
jmp 0x4e5e39
mov eax, dword [ebx + 0x4c]
call fcn.004e777c
mov esi, eax
mov dword [ebx + 0x50], esi
mov edx, esi
mov eax, dword [ebx + 0x4c]
call fcn.004e7750
xor edx, edx
push ebp
push 0x4e5e32
push dword fs:[edx]
mov dword fs:[edx], esp
movzx eax, byte [0x4e5e64]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, 0x4e5e74
mov eax, 0x4e5ebc
call fcn.0047d328
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x50]
mov ecx, dword [edx + 8]
mov edx, 0x4e5ee0
call fcn.00425110
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.00485af8
lea ecx, [ebp - 0x10]
mov edx, 0x4e5f00
mov eax, 0x4e5f1c
call fcn.0047d328
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x14]
call fcn.00485af8
mov eax, dword [ebx + 0x14]
call fcn.0048632c
lea ecx, [ebp - 0x14]
mov edx, 0x4e5f48
mov eax, 0x4e5f64
call fcn.0047d328
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x18]
call fcn.00485af8
mov eax, dword [ebx + 0x18]
mov dl, 1
call fcn.00484bd8
mov eax, dword [ebx + 0x18]
call fcn.0048632c
mov eax, dword [ebx + 0x1c]
call fcn.00486374
mov eax, dword [ebx + 0x20]
call fcn.00486374
mov eax, dword [ebx + 0x14]
call fcn.0048632c
lea ecx, [ebp - 0x18]
mov edx, 0x4e5f90
mov eax, 0x4e5fd0
call fcn.0047d328
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
call fcn.00485af8
mov eax, dword [ebx + 0x24]
call fcn.0048632c
mov eax, dword [ebx + 0x50]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x28]
call fcn.00485af8
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x2e]
call fcn.004867c4
mov eax, dword [ebx + 0x28]
call fcn.0048632c
lea ecx, [ebp - 4]
mov edx, 0x4e6000
mov eax, 0x4e6090
call fcn.0047d328
movzx eax, byte [0x4e60ac]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax + 8]
mov edx, 0x4e5ee0
mov eax, dword [ebp - 4]
call fcn.00425110
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00407f14
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebp - 4]
call fcn.00485af8
mov eax, dword [ebx + 0x2c]
call fcn.0048632c
lea ecx, [ebp - 0x20]
mov edx, 0x4e60bc
mov eax, 0x4e61e4
call fcn.0047d328
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebx + 0x30]
call fcn.0048632c
mov eax, dword [ebx + 0xc]
call fcn.00486358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5e39
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5e5b
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00407b4c
ret
Function at 0x4eab4c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebx], 0
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4eab76
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4eac34
call fcn.004cb890
mov dword [ebp - 8], eax
jmp 0x4eab89
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4eaca4
call fcn.004cb890
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4eac16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004cc7a8
test al, al
je 0x4eabc9
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x4eabc9
mov eax, dword [ebp - 8]
call fcn.00405f00
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4ead14
call fcn.004cb890
mov dword [ebp - 8], eax
jmp 0x4eabcc
mov byte [ebx], 1
mov eax, dword [ebp - 8]
call fcn.004cc7a8
test al, al
je 0x4eabf3
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4eabea
mov dword [ebp - 4], 0xffffffff
jmp 0x4eac00
mov dword [ebp - 4], 1
jmp 0x4eac00
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004ccc58
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eac1d
mov eax, dword [ebp - 8]
call fcn.00405f00
ret

Function at 0x4ead54
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4eae0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0x4eae28
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0041dd58
push dword [ebp - 0x10]
push 0x4eae78
push 0x4eaea8
push 0x4eaec0
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00408c64
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004cb890
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4eadeb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004cc7a8
test al, al
jne 0x4eadd5
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eadf2
mov eax, dword [ebp - 8]
call fcn.00405f00
ret
Function at 0x4ec904
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ecad0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ecaa3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x4ecaec
mov edx, 0x4ecb04
mov eax, 0x80000001
call fcn.0046195c
mov eax, dword [ebp - 4]
mov edx, 0x4ecb40
call fcn.00408d14
sete bl
lea eax, [ebp - 4]
push eax
mov ecx, 0x4ecb50
mov edx, 0x4ecb04
mov eax, 0x80000001
call fcn.0046195c
mov eax, dword [ebp - 4]
mov edx, 0x4ecb40
call fcn.00408d14
sete byte [ebp - 9]
lea eax, [ebp - 8]
mov edx, 0x4ecb68
call fcn.00407f14
mov eax, ebx
or al, byte [ebp - 9]
je 0x4eca5f
xor eax, eax
call fcn.0047b7c4
push 0x4ecba0
mov eax, dword [0x50ac18]
push dword [eax]
push 0x4ecbb0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00408c64
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x4ecbd0
mov eax, 0x80000001
call fcn.004617d4
xor eax, eax
push ebp
push 0x4eca58
push dword fs:[eax]
mov dword fs:[eax], esp
or edx, 0xffffffff
mov eax, 0x4ecc3c
call fcn.0045e98c
mov esi, eax
test esi, esi
jle 0x4eca01
mov eax, 0x4ecc3c
call fcn.004da4c8
test al, al
je 0x4eca01
xor esi, esi
test esi, esi
jg 0x4eca4a
movzx edx, byte [ebp - 9]
mov eax, ebx
call fcn.004ece48
mov ecx, dword [ebp - 8]
mov edx, 0x4ecbd0
mov eax, 0x80000001
call fcn.00461f68
mov ecx, 0x4ecaec
mov edx, 0x4ecb04
mov eax, 0x80000001
call fcn.00461f68
mov ecx, 0x4ecb50
mov edx, 0x4ecb04
mov eax, 0x80000001
call fcn.00461f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eca99
ret
mov ecx, dword [ebp - 8]
mov edx, 0x4ecbd0
mov eax, 0x80000001
call fcn.00461f68
mov ecx, 0x4ecaec
mov edx, 0x4ecb04
mov eax, 0x80000001
call fcn.00461f68
mov ecx, 0x4ecb50
mov edx, 0x4ecb04
mov eax, 0x80000001
call fcn.00461f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ecaad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecad7
lea eax, [ebp - 0x10]
call fcn.00407aec
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b4c
ret
Function at 0x4f4b54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4f4b69
add esp, 0xfffffff0
call fcn.00406470
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f4d5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], cl
mov dl, 1
mov eax, dword [0x4b6250]
call fcn.004b6f50
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x4f4214]
call fcn.004f4434
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], ebx
mov eax, ebx
call fcn.004f4520
mov eax, dword [ebp - 4]
fstp qword [eax + 0x40]
wait
push 0
mov ecx, 0x4f4d94
mov dl, 1
mov eax, dword [0x4d4bbc]
call fcn.004d4e60
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x4f4db0
call sub.user32.dll_RegisterWindowMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], ebx
mov eax, ebx
call fcn.0045f078
push 0x4f4dd0
call sub.user32.dll_RegisterWindowMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
mov eax, ebx
call fcn.0045f078
mov eax, 0x4f4e04
call fcn.00483660
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
mov eax, ebx
xor edx, edx
call fcn.00485990
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, 0x4f4e2c
call fcn.004865c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00484c24
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [ebx + 0x46c], eax
mov dword [ebx + 0x468], 0x4f606c
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
push 0x4f5e1c
push 0
push 1
push 0
lea ecx, [ebp - 8]
mov eax, ebx
mov edx, 1
call fcn.00482710
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push 0
push 0
push 0
push 0
mov edx, 0x4f4e5c
mov eax, esi
movzx ecx, word [0x4f4e5c]
call fcn.00482e4c
push 0
push 0
push 0
push 0
mov edx, 0x4f4e5c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4f4e5c]
call fcn.00482e4c
push 0
push 0
push 0
push 0
mov edx, 0x4f4e5c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4f4e60]
call fcn.00482e4c
push 0
push 0
push 0
push 0
mov edx, 0x4f4e5c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4f4e5c]
call fcn.00482e4c
mov eax, dword [ebp - 4]
mov byte [eax + 0x31], 0
push 0x4f4e64
mov eax, dword [0x50dc50]
push eax
call sub.user32.dll_LoadIconW
push eax
push 0x414
push 0x4f4e04
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x31]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00484c24
mov ecx, eax
mov dl, 1
mov eax, dword [0x49a5c4]
call fcn.0049a66c
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x38], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f4d66
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4f4d7e
call fcn.004064c8
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4f6688
Capabilities:
Check for time delay via gettickcount
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4f68a3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4f687e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x4f68c0
mov edx, 0x4f68e8
mov eax, 0x80000001
call fcn.0046195c
mov eax, dword [ebp - 4]
mov edx, 0x4f6958
call fcn.00408d14
jne 0x4f6735
push 0x4f69b4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
mov ecx, 0x4f69c4
mov edx, 0x4f69ec
mov esi, dword [eax]
call dword [esi + 0x80]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0041d498
mov eax, dword [ebp - 8]
mov edx, 0x4f69b4
call fcn.00408d14
jne 0x4f672b
mov dl, 1
mov eax, dword [0x4aa898]
call fcn.004ad340
mov edx, dword [0x50ab20]
mov dword [edx], eax
jmp 0x4f6735
push 0x4f69fc
call sub.kernel32.dll_OutputDebugStringW
xor edi, edi
lea edx, [ebp - 0x10]
mov eax, 2
call fcn.0048223c
cmp dword [ebp - 0x10], 0
je 0x4f6763
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.0048223c
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.0041df90
mov edi, eax
mov esi, 0xea60
movzx edx, byte [ebx + 0x30]
mov ecx, edi
mov eax, ebx
call fcn.004f4f1c
push 0
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
mov ecx, 0x4f6a3c
mov edx, 0x4f69ec
mov edi, dword [eax]
call dword [edi + 0xc]
test eax, eax
jle 0x4f67b5
push 0
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
mov ecx, 0x4f6a3c
mov edx, 0x4f69ec
mov edi, dword [eax]
call dword [edi + 0x10]
mov cl, 1
mov dl, 1
mov eax, dword [0x4d5008]
call fcn.004d65b4
call fcn.004b5b50
mov eax, dword [ebx + 8]
xor edx, edx
mov dword [eax + 0x5db], edx
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x4f6864
mov eax, dword [ebx + 0x14]
xor edx, edx
call fcn.004d4e2c
test al, al
jne 0x4f6874
mov eax, dword [ebx + 8]
call fcn.00486940
test al, al
jne 0x4f67e3
push 0x32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WaitForSingleObject
call sub.kernel32.dll_GetTickCount_1
cmp esi, eax
jae 0x4f6819
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
add esi, 0x493e0
mov eax, ebx
call fcn.004f64ec
cmp dword [ebx + 0x34], 0
jbe 0x4f6841
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x1388
jle 0x4f6841
xor eax, eax
mov dword [ebx + 0x34], eax
mov edx, dword [ebx + 0x38]
mov eax, ebx
call fcn.004f52ec
fld qword [ebx + 0x40]
fcomp dword [0x4f6a50]
wait
fnstsw ax
sahf
jbe 0x4f6864
mov eax, dword [ebx + 0x3c]
call fcn.004f4820
mov eax, dword [ebx + 0x3c]
call fcn.004f4790
fstp qword [ebx + 0x40]
wait
mov eax, dword [ebx + 8]
cmp dword [eax + 0x5db], 0
je 0x4f67d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f68aa
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00407b4c
ret
Function at 0x617d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x508015
lea edi, [esi - 0x107015]
push edi
or ebp, 0xffffffff
jmp 0x617da2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x617da9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x617d98
mov eax, 1
add ebx, ebx
jne 0x617dbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x617dcc
jne 0x617deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x617deb
dec eax
add ebx, ebx
jne 0x617dd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x617db0
add ebx, ebx
jne 0x617de7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x617e3d
xor ecx, ecx
sub eax, 3
jb 0x617e03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x617e72
sar eax, 1
mov ebp, eax
jmp 0x617e0e
add ebx, ebx
jne 0x617e0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x617ddc
inc ecx
add ebx, ebx
jne 0x617e1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x617ddc
add ebx, ebx
jne 0x617e29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x617e1e
jne 0x617e3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x617e1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x617e5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x617e4e
jmp 0x617d9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x617e5c
add edi, ecx
jmp 0x617d9e
pop esi
mov edi, esi
mov ecx, 0x3e95
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x617e7a
cmp byte [edi], 0x15
jne 0x617e7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x617e7f
lea edi, [esi + 0x211000]
mov eax, dword [edi]
or eax, eax
je 0x617eee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x223718]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x223740]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x617eac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x223748]
or eax, eax
je 0x617ee8
mov dword [ebx], eax
add ebx, 4
jmp 0x617ec9
call dword [esi + 0x223744]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x617f1f
cmp al, 0xef
ja 0x617f12
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x617ef4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x617f01
mov ebp, dword [esi + 0x22374c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x617f53
sub esp, 0xffffff80
jmp 0x45d600
Function at 0x40219f
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4586e4
call fcn.004485c4
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.004121e9
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [edi + 0x14]
lea esi, [edi + 0x1c]
mov dword [eax], 0x465fb4
mov dword [esi], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], ecx
mov byte [ebp - 4], 3
mov dword [edi + 0x28], ecx
push 1
push eax
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], 0x64
mov dword [edi + 0x34], ecx
call fcn.004151f9
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x410519
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x45b317
call fcn.004485c4
sub esp, 0x60
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
cmp byte [esi + 0x1c4], bl
mov dword [ebp - 0x10], esp
je 0x4105d2
push 0x465cf2
lea ecx, [ebp - 0x24]
call fcn.00439a70
lea eax, [ebp - 0x24]
push eax
push str.mobileUrl
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 0x220]
mov byte [ebp - 4], 1
call fcn.0043ca60
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0043b640
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.0043bff0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.0043bff0
cmp dword [ebp - 0x3c], ebx
je 0x4105bd
lea ecx, [ebp - 0x50]
call fcn.00425c8d
cmp al, bl
jne 0x4105bd
cmp dword [ebp - 0x38], 0x10
mov eax, dword [ebp - 0x4c]
jae 0x4105ac
lea eax, [ebp - 0x4c]
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 3
pop edi
mov eax, esi
call fcn.0040f41e
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.00417a85
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x418397
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0xc
Function at 0x4193ab
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov esi, str._windir_SysWOW64
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3c
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0xf2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
and eax, 0x20
pop edi
add eax, 0x20
pop esi
leave
ret