joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb7e8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4cba0f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x52ede8], eax
xor eax, eax
mov dword [0x5370b0], eax
xor eax, eax
mov dword [0x5370b4], eax
xor eax, eax
mov dword [0x5370b8], eax
xor eax, eax
mov dword [0x5370bc], eax
xor eax, eax
mov dword [0x5370ac], eax
xor eax, eax
mov dword [0x5370c0], eax
xor eax, eax
mov dword [0x5370c4], eax
xor eax, eax
mov dword [0x5370c8], eax
xor eax, eax
mov dword [0x5370cc], eax
cmp dword [0x52edec], 0
je 0x4cb9f1
push 0x4cba1c
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370b0], eax
push 0x4cba24
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370b4], eax
push 0x4cba2c
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370b8], eax
push 0x4cba34
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370bc], eax
push 0x4cba3c
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370ac], eax
push 0x4cba44
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370c0], eax
push 0x4cba54
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370c4], eax
push 0x4cba60
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370c8], eax
push 0x4cba70
mov eax, dword [0x52edec]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370cc], eax
cmp dword [0x5370b0], 0
je 0x4cb9f1
cmp dword [0x5370b4], 0
je 0x4cb9f1
cmp dword [0x5370b8], 0
je 0x4cb9f1
cmp dword [0x5370bc], 0
je 0x4cb9f1
cmp dword [0x5370ac], 0
je 0x4cb9f1
cmp dword [0x52edf0], 0xffffffff
jne 0x4cb98d
push 0
push 1
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4cba8c
call fcn.00404860
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 4]
mov edx, 0x4cbaa0
call fcn.0046be04
mov dword [0x52edf0], eax
cmp dword [0x52edf0], 2
jge 0x4cb9a5
push 0x58
push 0x6f401
call dword [0x5370bc]
jmp 0x4cb9b9
cmp dword [0x52edf0], 2
jne 0x4cb9b9
push 0x51a7b0e
call dword [0x5370b4]
mov dword [0x52ede8], 1
cmp dword [0x5370c0], 0
je 0x4cb9f1
cmp dword [0x5370c4], 0
je 0x4cb9f1
cmp dword [0x5370c8], 0
je 0x4cb9f1
cmp dword [0x5370cc], 0
je 0x4cb9f1
mov dword [0x52ede8], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cba16
lea eax, [ebp - 8]
call fcn.0040455c
lea eax, [ebp - 4]
call fcn.00404c78
ret
Function at 0x4d115c
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d12c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed8], 0x7d9
cmp si, 2
jne 0x4d11b6
lea eax, [ebp - 0x20]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d12d8
call fcn.0046c138
jmp 0x4d11e2
cmp si, 8
je 0x4d11c2
cmp si, 1
jne 0x4d11e2
lea eax, [ebp - 0x24]
mov edx, dword [0x5314fc]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d12e8
call fcn.0046c138
cmp dword [ebp - 0xc], 0
je 0x4d11fd
push 1
lea eax, [ebp - 0xc]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d1295
test si, 2
jne 0x4d1212
test si, 1
jne 0x4d1212
test si, 8
je 0x4d127b
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d127b
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004a8230
mov eax, dword [ebp - 0x28]
call fcn.00404a0c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d1283
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x52fed8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d12c7
lea eax, [ebp - 0x28]
call fcn.0040455c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0xc]
call fcn.0040455c
ret

Function at 0x4d1db8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x52fed8], 0x7e9
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d1def
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d1df6
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x52fed8], eax
add esp, 0x108
pop ebx
ret

Function at 0x4d1e08
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x52fed8], 0x7ea
push 0
push 0x18
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d1e3f
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d1e46
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x52fed8], eax
add esp, 0x108
pop ebx
ret
Function at 0x4d4804
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d4945
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5384f0], 0
je 0x4d48f5
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov edi, eax
mov edx, dword [0x5384e4]
mov eax, 0x4d495c
call fcn.00404b50
test eax, eax
jle 0x4d487d
push 0x4d4968
push dword [0x5384e4]
push 0x4d4974
push dword [0x5384e8]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d48aa
push 0x4d4980
push dword [0x5384e4]
push 0x4d495c
push dword [0x5384e8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4d4990
call fcn.00404860
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x5384ec]
call fcn.00404a0c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a0c
push eax
push 0x4d499c
mov eax, esi
call fcn.0045ca88
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d492a
push 1
mov eax, dword [0x5384ec]
call fcn.00404a0c
push eax
mov eax, dword [0x5384e8]
call fcn.00404a0c
push eax
mov eax, dword [0x5384e4]
call fcn.00404a0c
push eax
push 0x4d499c
mov eax, esi
call fcn.0045ca88
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d494c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret
Function at 0x4db31c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4db433
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed8], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004a8230
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x53819c
mov ecx, 0x105
call fcn.004047c4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00404860
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046c798
mov ebx, eax
test ebx, ebx
je 0x4db3fc
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00403750
mov eax, 0xc8
call fcn.004d0e6c
push 1
push 0x4db440
push 0x4db44c
push dword [ebp - 4]
push 0x4db45c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x14]
call fcn.00404a0c
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004a8230
mov eax, dword [ebp - 0x18]
call fcn.00404a0c
push eax
push 0x4db460
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x52fed8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db43a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x10]
call fcn.00404c78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret

Function at 0x4dd1c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dd322
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x5382ac], 0
jbe 0x4dd235
mov ax, word [0x52ff10]
cmp ax, word [0x5382ac]
jb 0x4dd235
mov eax, dword [0x52fee0]
mov dword [0x52ff00], eax
mov eax, dword [0x52fee4]
mov dword [0x52ff04], eax
mov word [0x52ff10], 0
mov eax, dword [0x53715c]
call fcn.004a09ac
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004e0d8c
mov dl, 1
mov ax, 2
call fcn.004d115c
jmp 0x4dd30c
cmp word [0x5382ae], 0
jbe 0x4dd2a3
mov ax, word [0x52ff10]
cmp ax, word [0x5382ae]
jb 0x4dd2a3
mov eax, dword [0x52fee0]
mov dword [0x52ff00], eax
mov eax, dword [0x52fee4]
mov dword [0x52ff04], eax
mov word [0x52ff10], 0
cmp dword [0x5382b0], 0
je 0x4dd2a3
lea eax, [ebp - 4]
mov ecx, dword [0x5382b0]
mov edx, 0x4dd338
call fcn.00404860
lea eax, [ebp - 4]
call fcn.004d1fb8
push 1
lea eax, [ebp - 4]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
cmp word [0x5382b4], 0
jbe 0x4dd30c
mov ax, word [0x52ff10]
cmp ax, word [0x5382b4]
jb 0x4dd30c
mov eax, dword [0x52fee0]
mov dword [0x52ff00], eax
mov eax, dword [0x52fee4]
mov dword [0x52ff04], eax
mov word [0x52ff10], 0
cmp dword [0x5382b8], 0
je 0x4dd30c
lea eax, [ebp - 4]
mov edx, dword [0x5382b8]
call fcn.004045f4
lea eax, [ebp - 4]
call fcn.004d1fb8
push 1
lea eax, [ebp - 4]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd329
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4e0300
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e0423
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed8], 0x821
mov dl, 1
mov eax, dword [0x422194]
call fcn.00428798
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push esi
mov eax, ebx
call fcn.00428d60
xor ecx, ecx
xor edx, edx
call fcn.00423bc4
lea edx, [ebp - 8]
mov eax, 0x105
call fcn.004a8230
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x5382a4]
call fcn.00404860
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, ebx
call fcn.00403750
lea edx, [ebp - 0xc]
mov eax, 0x106
call fcn.004a8230
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0xb0
call fcn.004a8230
mov eax, dword [ebp - 0x10]
mov ecx, 0x4e0438
pop edx
call fcn.0046ae0c
lea edx, [ebp - 0x14]
mov eax, 0x107
call fcn.004a8230
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0xb0
call fcn.004a8230
mov eax, dword [ebp - 0x18]
mov ecx, 0x4e0444
pop edx
call fcn.0046ae0c
push 3
lea eax, [ebp - 4]
call fcn.00404a64
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
mov dword [0x52fed8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e042a
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404580
ret
Function at 0x4e35e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e35f0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4e37f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00408d5c
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x20]
call fcn.00404e18
mov eax, dword [0x5382fc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e37b2
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5382fc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x4e380c
call fcn.00404b50
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404a6c
mov eax, dword [ebp - 0x1c]
call fcn.004093d0
mov dword [0x5385b8], eax
cmp dword [0x5385b8], 4
je 0x4e37a6
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 1
call fcn.00404aac
mov eax, dword [ebp - 0x10]
mov edx, 0x4e3818
call fcn.00404958
jne 0x4e36bf
mov byte [0x53060c], 1
jmp 0x4e36c6
mov byte [0x53060c], 0
cmp byte [0x53060c], 0
je 0x4e3763
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.004045f4
mov ebx, 1
jmp 0x4e370f
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ebx - 1]
cmp al, 0x61
jb 0x4e36fa
mov edx, dword [ebp - 0x18]
cmp al, 0x7a
ja 0x4e36fa
inc ebx
jmp 0x4e370f
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x400
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00404a6c
jmp 0x4e371b
mov eax, dword [ebp - 0x18]
call fcn.00404814
cmp ebx, eax
jl 0x4e36e5
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4e382c
call fcn.00404860
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x14]
call fcn.00405ac4
mov ebx, eax
cmp dword [ebp - 0x14], 0
jne 0x4e3763
cmp ebx, 0x3e8
jbe 0x4e3763
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
jae 0x4e3763
call sub.kernel32.dll_GetTickCount
sub eax, 0x30d40
cmp ebx, eax
jbe 0x4e3763
mov byte [ebp - 5], 1
jmp 0x4e37b2
cmp byte [0x53060c], 0
je 0x4e377f
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00404958
jne 0x4e377f
mov byte [ebp - 5], 1
jmp 0x4e37b2
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00404e18
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0040514c
test eax, eax
jle 0x4e37a6
mov byte [0x53060c], 0
mov byte [ebp - 5], 1
jmp 0x4e37b2
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x4e3649
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e37f9
lea eax, [ebp - 0x30]
call fcn.0040455c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x10]
call fcn.0040455c
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4e3d60
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4e3e53
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edi, eax
push edi
push 0x4e38e8
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4e3e36
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416d5c
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e3e2e
lea eax, [ebp - 4]
call fcn.00404a64
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409d20
test eax, eax
jne 0x4e3e2e
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416d5c
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e3e12
cmp eax, 0xffffffff
je 0x4e3e2e
cmp dword [ebp - 0xc], 0
je 0x4e3e2e
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4e3dad
mov eax, edi
call fcn.00403750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3e5a
lea eax, [ebp - 4]
call fcn.0040455c
ret

Function at 0x4e3e64
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e3e7d
cmp eax, 0xffffffff
je 0x4e3e91
test ebx, ebx
je 0x4e3e91
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret
Function at 0x4e9a64
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebp, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov esi, eax
push esi
push 0x4e9a4c
call sub.user32.dll_EnumWindows
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x4e9ae4
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.00416d5c
cmp ebp, eax
je 0x4e9ae0
push 0x50
lea eax, [esp + 0xc]
push eax
mov edx, ebx
mov eax, esi
call fcn.00416d5c
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4e9ae0
lea eax, [esp + 8]
mov edx, dword [esp]
call fcn.00409d20
test eax, eax
jne 0x4e9ae0
mov edx, ebx
mov eax, esi
call fcn.00416d5c
mov dword [esp + 4], eax
jmp 0x4e9ae4
inc ebx
dec edi
jne 0x4e9a9a
mov eax, esi
call fcn.00403750
mov eax, dword [esp + 4]
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e9b60
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
xor edx, edx
mov dword [ebp - 0x88], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e9be5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x21
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x83]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4e9bcc
lea eax, [ebp - 0x83]
call fcn.00409c20
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.004047b8
mov eax, dword [ebp - 0x88]
mov edx, ebx
call fcn.00408d5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9bec
lea eax, [ebp - 0x88]
call fcn.0040455c
ret
Function at 0x100973a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 0x400
push esi
mov dword [ebp - 4], 1
call fcn.010096ae
test eax, eax
je 0x1009780
push 2
lea eax, [ebp - 4]
push eax
push 0x20001009
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push dword [ebp - 4]
call fcn.010096f8
test eax, eax
mov eax, dword [ebp + 8]
je 0x100977d
or dword [eax], 0x20
jmp 0x1009780
or dword [eax], 0x10
pop esi
leave
ret 4

Function at 0x401960
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0x4d
mov eax, dword [ebp - 8]
push eax
call dword [0x40b1e8]
mov dword [0x40af50], 0x44
push 0x12
push 0x3b
call fcn.00401030
add esp, 8
mov dword [0x40ac30], 0x1003f
push 0x25
push 0x64
call fcn.00401090
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.004017e0
add esp, 4
push 0x6d
push 0x5a
call fcn.00401060
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4019cd
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [0x40ac0c]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x401a4e
push 0x4d
push 0x30
call dword [0x40af40]
mov edx, dword [0x40b1d8]
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x28
add ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0xf8]
mov dword [0x40ac08], edx
push 0x46
push 0x2c
push 0
call dword [0x40ac1c]
push 0
mov eax, dword [0x40ac08]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [0x40ac08]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [0x40ac0c]
mov edx, dword [ecx + 0x34]
mov eax, dword [0x40ac08]
add edx, dword [eax + 0xc]
push edx
mov ecx, dword [0x40abf8]
push ecx
call dword [0x40afac]
jmp 0x4019c4
push 2
push 0x56
call dword [0x40af40]
call fcn.004018e0
push 0x54
push 0xf
push 0
call dword [0x40ac1c]
mov esp, ebp
pop ebp
ret
Function at 0x5826dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x5826f5
mov esi, edi
mov edi, eax
jmp 0x5826f7
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x582707
mov eax, ebx
jmp 0x582711
push eax
push ebx
call fcn.005694ac
add esp, 8
test eax, eax
jne 0x582719
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x582737
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x582720
cmp eax, dword [esi + 4]
jge 0x58274e
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x58273c
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x582771
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x58276e
sub eax, 1
test eax, eax
jg 0x58275e
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x5e611c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], ecx
mov edx, esi
dec ebx
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp - 8]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 0xc]
sub esi, edx
test ebx, ebx
jg 0x5e6151
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5e658c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 0xc]
dec ebx
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
test ebx, ebx
jg 0x5e65be
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret