joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a6b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x53dc18]
cmp dword [eax + 0x30], 0
je 0x48a762
cmp dword [ebx + 0x94], 0
jne 0x48a75c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x48a648
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x48a75c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x48a722
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x48a75c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b028
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x48a731
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48b2c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x48b2f9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045c4
jmp 0x48b306
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404528
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x48c410
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x48c451
mov eax, esi
call fcn.0047173c
test al, al
je 0x48c451
mov eax, dword [ebx + 0x84]
call fcn.00471438
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48c451
push 0
mov eax, dword [ebx + 0x84]
call fcn.00471438
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x48f23c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x48f2d0
push 0
mov eax, ebx
call fcn.00404994
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x48f2ab
mov eax, esi
call fcn.00404794
inc eax
push eax
mov eax, esi
call fcn.00404994
push eax
push 1
push 0
mov eax, edi
call fcn.00404994
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x48f2c6
mov ecx, dword [0x53bf3c]
mov dl, 1
mov eax, dword [0x48d860]
call fcn.0040ce78
call fcn.00403e8c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x48f324
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417cb4]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x48f468
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x53a328], 0
jne 0x48f377
mov ecx, dword [0x53bbf4]
mov dl, 1
mov eax, dword [0x407e28]
call fcn.0040ce78
call fcn.00403e8c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402fd0
mov eax, ebx
call fcn.00404d60
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48f478
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004061c4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d70
test eax, eax
jle 0x48f40f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48f408
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040475c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404744
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408cf8
test eax, eax
jne 0x48f408
mov ebx, 0x15
jmp 0x48f414
mov ebx, 0x10
jmp 0x48f414
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x53a328]
call fcn.0048f1cc
mov eax, dword [ebp - 8]
call fcn.0048f1cc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004061dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f46f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044f8
lea eax, [ebp - 0x10]
mov edx, dword [0x417cb4]
call fcn.00405094
ret

Function at 0x499d1c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x499d4a
mov eax, ebx
call fcn.0049a7d0
cmp dword [ebx + 0x40], 0
je 0x499d43
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x499dbb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x499dad
cmp dword [ebx + 8], 0
je 0x499d6c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x499d7e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x499dad
cmp dword [ebx + 8], 0
je 0x499d5f
cmp eax, 3
je 0x499d91
dec eax
jne 0x499d5f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x499d5f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x499d5f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x499dd9
cmp dword [ebx + 0x14], 0xcc
je 0x499dd9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00499de4
pop ebx
ret
Function at 0x4ac14c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ac2bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ac298
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004046bc
lea eax, [ebp - 0x118]
mov edx, 0x4ac2d4
call fcn.0040479c
mov eax, dword [ebp - 0x118]
call fcn.00404994
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4ac20a
lea eax, [ebp - 0x111]
call fcn.00409bb0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004045c4
jmp 0x4ac211
mov eax, esi
call fcn.004044d4
cmp bl, 0x61
jae 0x4ac232
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040dc54
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404528
jmp 0x4ac24c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040dbc8
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404528
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4ac2e0
call fcn.0040a28c
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac29f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4b3380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4b3556
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x4b353d
mov eax, dword [edi + 0x30]
call fcn.00404794
test eax, eax
jne 0x4b33d6
mov eax, dword [edi + 0x34]
call fcn.00404794
test eax, eax
jne 0x4b33d6
mov eax, edi
call fcn.004b35f4
jmp 0x4b353d
cmp dword [edi + 0xa0], 0
jne 0x4b340d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00409c48
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x53e008]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x4b3444
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00409c48
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x53e008]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004b3634
mov ebx, eax
test bl, bl
jne 0x4b34f2
mov eax, dword [edi + 0x30]
call fcn.00404794
test eax, eax
jne 0x4b347c
mov eax, dword [edi + 0xc0]
call fcn.00404794
test eax, eax
je 0x4b34f2
mov eax, dword [edi + 0xc0]
call fcn.00404794
test eax, eax
je 0x4b349e
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00409c48
jmp 0x4b34ca
push dword [edi + 0x30]
push 0x4b3570
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404854
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00409c48
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4b34f2
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004b3634
mov ebx, eax
test bl, bl
jne 0x4b34ff
mov eax, edi
call fcn.004b35f4
jmp 0x4b353d
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4b350e
mov dword [edi + 0xa8], eax
jmp 0x4b3518
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.004b36ac
test al, al
je 0x4b353d
mov eax, edi
mov si, 0xffee
call fcn.00403838
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004b3758
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b355d
lea eax, [ebp - 0x108]
call fcn.004044d4
ret
Function at 0x4ba974
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4baa17
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004ba698
test al, al
jne 0x4ba9a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4baa21
xor eax, eax
mov dword [ebx + 0xc0], eax
xor eax, eax
mov dword [ebx + 0xc4], eax
lea eax, [ebx + 0x78]
mov ebx, eax
mov eax, ebx
call fcn.004044d4
lea eax, [ebx + 4]
call fcn.004044d4
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
xor eax, eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
lea eax, [ebx + 0x3c]
call fcn.004044d4
xor eax, eax
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x38]
call fcn.004044d4
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4baa21
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bb4e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bb5a4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4bb57c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x80
call fcn.00404b20
push 0x80
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 8]
call fcn.00404994
call fcn.00409bb0
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404b20
mov eax, dword [ebp - 8]
call fcn.00404794
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x4bb567
lea eax, [ebp - 8]
mov edx, 0x4bb5bc
call fcn.0040479c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb58e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb5ab
lea eax, [ebp - 8]
call fcn.004044d4
ret
Function at 0x4bb5c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bb680
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4bb658
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x80
call fcn.00404b20
push 0x80
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 8]
call fcn.00404994
call fcn.00409bb0
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404b20
mov eax, dword [ebp - 8]
call fcn.00404794
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x4bb643
lea eax, [ebp - 8]
mov edx, 0x4bb698
call fcn.0040479c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb66a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb687
lea eax, [ebp - 8]
call fcn.004044d4
ret

Function at 0x4bb7c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov ebx, edx
xor edx, edx
push ebp
push 0x4bb81c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb826
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bbbb0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4bbc3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x53c730]
cmp dword [eax], 2
jne 0x4bbc29
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x14]
push eax
push 0x4bbc54
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 8
call sub.user32.dll_ExitWindowsEx
jmp 0x4bbc32
push 0
push 1
call sub.user32.dll_ExitWindowsEx
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bbc4a
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bbf0c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4bc103
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4bc0d1
push dword fs:[edx]
mov dword fs:[edx], esp
push edi
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4bbf89
push 0
push 0
push 0x10
push eax
call sub.user32.dll_SendMessageA
xor edx, edx
mov eax, 2
call fcn.004bb064
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004bb084
jmp 0x4bc0b9
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404744
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409a14
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408b18
mov eax, dword [ebp - 0x130]
push eax
lea eax, [ebp - 0x140]
mov edx, edi
call fcn.004046cc
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408b18
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004048e0
je 0x4bc078
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404744
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00408b18
mov eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x150]
mov edx, edi
call fcn.004046cc
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00408b18
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.004048e0
jne 0x4bc0aa
mov eax, dword [ebp - 0x124]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
mov bl, 1
lea eax, [ebp - 4]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404744
jmp 0x4bc0c1
xor ebx, ebx
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.004bb0a4
test eax, eax
jne 0x4bbfb3
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bc0dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc10a
lea eax, [ebp - 0x150]
mov edx, 9
call fcn.004044f8
lea eax, [ebp - 4]
call fcn.004044d4
ret
Function at 0x4bc584
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4bc633
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov ebx, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x4bc648]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bc63d
fld qword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bcb80
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bcc4f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4bcc27
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
call fcn.004044d4
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4bcbed
pop dword fs:[0]
add esp, 8
jmp 0x4bcc39
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4bcc06
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 8]
call fcn.004046cc
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4bcbf4
call sub.wsock32.dll_WSACleanup
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bcc39
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcc56
lea eax, [ebp - 8]
call fcn.004044d4
ret
Function at 0x4cbb3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
rcl byte [ebp + 0x68], cl
in eax, dx
mov ebx, 0xff64004c
xor ah, byte [ecx + ecx*4 + 0x22]
cmp byte [0x53e174], 0
je 0x4cbb69
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cbbf7
cmp byte [0x53e175], 0
jne 0x4cbb7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cbbf7
mov byte [0x53e175], 0
mov eax, dword [0x53e17c]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x4cbc00
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x4cbbb6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cbbf7
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x53e178
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4cbc14
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cbbf7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cefa0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404984
xor eax, eax
push ebp
push 0x4cf094
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cf074
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x53c730]
cmp dword [eax], 2
jne 0x4cf016
push 0x4cf0a4
mov eax, dword [ebp - 4]
call fcn.00404994
mov esi, eax
push esi
mov edx, 0x4cf0b0
xor ecx, ecx
mov eax, 0x80000001
call fcn.004bcd98
push 0x4cf0a4
push esi
mov edx, 0x4cf0f8
xor ecx, ecx
mov eax, 0x80000001
call fcn.004bcd98
jmp 0x4cf035
push 0x4cf0a4
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
mov edx, 0x4cf13c
xor ecx, ecx
mov eax, 0x80000003
call fcn.004bcd98
test bl, bl
je 0x4cf06a
mov eax, dword [edi + 0x6fc]
mov edx, dword [ebp - 4]
call fcn.0046aaec
mov eax, 0x4cf198
call fcn.004338f4
mov eax, dword [0x53be20]
mov edx, dword [ebp - 4]
call fcn.00404528
mov eax, dword [0x53c470]
mov eax, dword [eax]
call fcn.00504384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cf07e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf09b
lea eax, [ebp - 4]
call fcn.004044d4
ret