joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449c9c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x449cd1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403b9c
jmp 0x449cdb
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403b08
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44ab90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x44abc8
mov eax, esi
call fcn.00432524
test al, al
je 0x44abc8
mov eax, dword [ebx + 0x74]
call fcn.00432228
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44abc8
push 0
mov eax, dword [ebx + 0x74]
call fcn.00432228
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x450c94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004508f8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403ef8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x450cf2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fa798]
mov dl, 1
mov eax, dword [0x4507f0]
call fcn.0040b6f0
call fcn.00403584
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x450cfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403ef8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x450d54
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4fa990]
mov dl, 1
mov eax, dword [0x4507f0]
call fcn.0040b6f0
call fcn.00403584
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00450928
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x451a44
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451b80
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x451b98
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.00453130
mov eax, dword [ebp - 4]
call fcn.004529c0
xor edx, edx
push ebp
push 0x451b63
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x451b02
test si, si
jne 0x451ab4
mov eax, dword [ebp - 8]
call fcn.00408b7c
mov esi, eax
cmp esi, 0xffff
jbe 0x451ab4
call fcn.00402d2c
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x451b02
cmp eax, 0xffffffff
jle 0x451ae3
sub ebx, eax
jmp 0x451af2
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.00453064
test ebx, ebx
je 0x451b02
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x451ab7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x451b4d
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x451bb0
mov dl, 1
mov eax, dword [0x45102c]
call fcn.0040b5f8
call fcn.00403584
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x451b4d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451b6a
mov eax, dword [ebp - 4]
call fcn.00452a18
ret
Function at 0x45209c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403ee8
xor eax, eax
push ebp
push 0x452259
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x452270
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.00453130
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x40f214]
call fcn.00412ba0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4521e9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x4521ad
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, 0x10000
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 4]
mov esi, eax
mov ebx, esi
push 0
push ebx
mov eax, esi
sub eax, ebx
cmp eax, 0x10000
jbe 0x452131
call fcn.00402d2c
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 0x24]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x4521ad
cmp eax, 0xffffffff
jle 0x45217e
sub ebx, eax
mov edx, dword [ebp - 4]
add dword [edx + 0x10084], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x100c2], 0
je 0x45218d
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x100c4]
call dword [edi + 0x100c0]
jmp 0x45218d
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.00453064
mov eax, dword [0x4fa814]
mov eax, dword [eax]
call fcn.00449f44
test ebx, ebx
je 0x4521ad
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45211e
mov eax, dword [ebp - 0xc]
call fcn.00412918
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.00412934
cmp ebx, eax
je 0x4521d3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x4520f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4521f0
mov eax, dword [ebp - 0xc]
call fcn.00402dec
ret
Function at 0x452298
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403ee8
xor eax, eax
push ebp
push 0x45246e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x452484
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.00453130
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call fcn.004529c0
xor eax, eax
push ebp
push 0x452449
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x40f214]
call fcn.00412ba0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4523e1
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4523bb
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x45237f
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004129a4
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x452377
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x100bc]
call dword [esi + 0x100b8]
mov eax, dword [ebp - 4]
call fcn.004529c0
cmp ebx, 0xffffffff
jne 0x4523ab
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], esi
cmp esi, 0x2749
je 0x4523cb
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.00453064
test ebx, ebx
je 0x4523cb
mov eax, dword [0x4fa814]
mov eax, dword [eax]
call fcn.00449f44
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45231b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4523e8
mov eax, dword [ebp - 0xc]
call fcn.00402dec
ret
Function at 0x4524ac
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452680
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x452698
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.00453130
mov eax, esi
call fcn.00403ab4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call fcn.004529c0
xor eax, eax
push ebp
push 0x452663
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4525de
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
je 0x452602
cmp ebx, 1
jle 0x4525a8
mov eax, dword [esi]
call fcn.00403d34
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, ebx
mov eax, esi
call fcn.00404068
mov eax, esi
call fcn.00403f04
mov edx, dword [ebp - 8]
inc edx
dec edx
cmp edx, dword [eax - 4]
jb 0x452564
call fcn.00402d2c
inc edx
lea edx, [eax + edx - 1]
mov eax, dword [ebp - 4]
add eax, 0x24
mov ecx, ebx
call fcn.00402810
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x45259e
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100bc]
call dword [ebx + 0x100b8]
mov eax, dword [ebp - 4]
call fcn.004529c0
jmp 0x4525d2
inc ebx
jne 0x4525d2
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], ebx
cmp ebx, 0x2749
je 0x452602
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.00453064
mov eax, dword [0x4fa814]
mov eax, dword [eax]
call fcn.00449f44
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x452602
cmp edi, 0xffffffff
je 0x45250b
mov eax, dword [esi]
call fcn.00403d34
cmp edi, eax
jg 0x45250b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45264d
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x4526b0
mov dl, 1
mov eax, dword [0x45102c]
call fcn.0040b5f8
call fcn.00403584
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x45264d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45266a
mov eax, dword [ebp - 4]
call fcn.00452a18
ret
Function at 0x452f6c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x453038
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x45304c
mov dl, 4
mov eax, ebx
call fcn.00453130
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x453022
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x453014
test byte [ebx + 0x20], 8
jne 0x452fd1
cmp word [ebx + 0x1004a], 0
je 0x452fd1
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x453022
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x452ff4
call fcn.00402d2c
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x453022
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.00453064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45303f
lea eax, [ebp - 4]
call fcn.00403ab4
ret

Function at 0x4531d8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x453214
mov dl, 8
mov eax, ebx
call fcn.00453130
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x453206
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x457378
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x45739d
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x457396
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45752b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp dword [ebp + 8], 0
jne 0x457467
test esi, esi
jle 0x4573e8
lea edx, [ebp - 0x10]
mov eax, 0x456ab8
call fcn.00405a30
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4077e4]
call fcn.0040b5f8
call fcn.00403584
jmp 0x45745d
cmp word [ebx + 0xa3a], 0
jne 0x457415
lea edx, [ebp - 0x14]
mov eax, 0x456ab8
call fcn.00405a30
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4077e4]
call fcn.0040b5f8
call fcn.00403584
jmp 0x45745d
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 9]
mov eax, dword [ebx + 0xa3c]
call dword [ebx + 0xa38]
cmp byte [ebp - 9], 0
jne 0x45745c
lea edx, [ebp - 0x18]
mov eax, 0x456ab8
call fcn.00405a30
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x4077e4]
call fcn.0040b5f8
call fcn.00403584
jmp 0x45745d
inc esi
cmp dword [ebp + 8], 0
je 0x4573c1
mov byte [ebx + 0x864], 0
mov eax, ebx
call fcn.004571a4
cmp dword [ebx + 0x83c], 0
jne 0x45749f
lea edx, [ebp - 0x1c]
mov eax, 0x456ab0
call fcn.00405a30
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x456ac0]
call fcn.0040b5f8
call fcn.00403584
lea edx, [ebp - 0x20]
mov eax, 0x456a90
call fcn.00405a30
mov ecx, dword [ebp - 0x20]
mov dl, 2
mov eax, ebx
call fcn.004576c4
mov word [ebx + 0x838], 2
mov ax, word [ebx + 0x830]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x83a], ax
mov eax, 0x10
push eax
lea eax, [ebx + 0x838]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0xa40]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0xa22], 0
je 0x457510
mov edx, ebx
mov eax, dword [ebx + 0xa24]
call dword [ebx + 0xa20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457532
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403ad8
ret
Function at 0x457784
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x457858
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x800
lea eax, [ebx + 0x24]
push eax
mov eax, dword [ebx + 0xa40]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x828], eax
cmp word [ebx + 0xa1a], 0
je 0x457842
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x45786c
call fcn.004092ac
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x828]
mov edx, ebx
mov eax, dword [ebx + 0xa1c]
call dword [ebx + 0xa18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45785f
lea eax, [ebp - 8]
call fcn.00403ab4
ret

Function at 0x4578d4
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 2
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
pop edx
ret

Function at 0x457a1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x457a25
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ee8
xor eax, eax
push ebp
push 0x457b2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004089c4
test al, al
je 0x457b07
xor ecx, ecx
push ebp
push 0x457afd
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x40f214]
call fcn.00412ba0
mov dword [ebp - 0x10], eax
jmp 0x457ad5
lea edx, [ebp - 0x2010]
mov ecx, 0x2000
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, eax
test edx, edx
jle 0x457ad5
lea eax, [ebp - 0x2010]
mov ecx, dword [ebp - 0xc]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ebx
mov bl, byte [eax]
xor ebx, dword [ebp - 0xc]
and ebx, 0xff
xor ecx, dword [ebx*4 + 0x4f8770]
mov dword [ebp - 0xc], ecx
inc eax
dec edx
jne 0x457aae
mov eax, dword [ebp - 0x10]
call fcn.00412918
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.00412934
cmp ebx, eax
jne 0x457a8f
mov eax, dword [ebp - 0x10]
call fcn.00402dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x457b07
mov eax, dword [ebp - 0xc]
xor eax, 0x38259662
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
not dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457b36
lea eax, [ebp - 4]
call fcn.00403ab4
ret
Function at 0x457d28
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffcc
mov ebx, eax
call sub.kernel32.dll_GetCurrentProcess
push esp
push 0x28
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x457dac
push 0x457dc0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 2
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
add eax, 4
push eax
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
add ebx, 4
push ebx
call sub.user32.dll_ExitWindowsEx
add esp, 0x34
pop ebx
ret
Function at 0x45ad7c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x45adaa
mov eax, ebx
call fcn.0045b820
cmp dword [ebx + 0x3c], 0
je 0x45ada3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x45ae1b
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x45ae0d
cmp dword [ebx + 8], 0
je 0x45adcc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x45adde
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45ae0d
cmp dword [ebx + 8], 0
je 0x45adbf
cmp eax, 3
je 0x45adf1
dec eax
jne 0x45adbf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45adbf
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x45adbf
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x45ae39
cmp dword [ebx + 0x10], 0xcc
je 0x45ae39
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045ae44
pop ebx
ret

Function at 0x471ec8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x471ef2
cmp dword [ebx + 0x64], 0
jne 0x471ef2
cmp dword [ebx + 0x6c], 0
jne 0x471ef2
mov esi, edi
jmp 0x471f80
cmp esi, 0xffffffff
jne 0x471efd
dec esi
jmp 0x471f80
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x471f80
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.00471530
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x471f48
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x471f4d
mov word [edx], 0
dec eax
test eax, eax
jne 0x471f2e
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x471f74
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x471f79
mov word [edx], 0
dec eax
test eax, eax
jne 0x471f5a
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x471fde
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.00471c50
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x471fc9
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x471fde
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x471ed2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47d240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x47d255
add esp, 0xfffffff0
call fcn.0040312c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403ee8
xor eax, eax
push ebp
push 0x47d31b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00478e04
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0040f9f0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x28], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0040f9f0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0040f9f0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x38], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0040f9f0
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0040fa08
push esi
lea edi, [esi + 0x44]
lea esi, [ebp - 0x1c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d322
lea eax, [ebp - 4]
call fcn.00403ab4
ret

Function at 0x48e468
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48e540
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fc9d0], 0
jne 0x48e524
lea eax, [ebp - 4]
mov edx, 0x48e558
call fcn.00403b4c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403ef8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x48e524
mov eax, ebx
call fcn.004026f8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48e51d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48e507
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x48e568
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48e507
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4fc9d0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e524
mov eax, dword [ebp - 0xc]
call fcn.00402710
ret
mov ebx, dword [0x4fc9d0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e547
lea eax, [ebp - 4]
call fcn.00403ab4
ret