joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b618
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x44b664
mov eax, esi
call fcn.00433328
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44b664
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x44b664
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x44b7a3
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x44b6a4
cmp eax, 0x108
ja 0x44b6a4
mov eax, esi
call fcn.00433328
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44b79a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x44b7a3
jmp 0x44b79a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x44b783
cmp eax, 0x20a
ja 0x44b783
test byte [esi + 0x50], 0x80
jne 0x44b6d6
sub eax, 0x203
je 0x44b6d3
sub eax, 3
je 0x44b6d3
sub eax, 3
jne 0x44b6d6
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x44b6ea
dec eax
je 0x44b6ff
dec eax
je 0x44b71c
dec eax
je 0x44b6ff
jmp 0x44b723
mov ecx, ebx
mov eax, dword [0x4e7bcc]
mov eax, dword [eax]
mov edx, esi
call fcn.0043caa8
jmp 0x44b79a
cmp byte [esi + 0x5d], 1
jne 0x44b715
mov eax, esi
mov si, 0xffed
call fcn.00403f5c
jmp 0x44b7a3
or word [esi + 0x54], 1
jmp 0x44b79a
and word [esi + 0x54], 0xfffe
jmp 0x44b79a
mov eax, dword [0x4e8b30]
cmp byte [eax + 0x20], 0
je 0x44b79a
mov eax, dword [0x4e8b30]
cmp dword [eax + 0x1c], 0
je 0x44b79a
mov eax, dword [ebx]
mov edx, dword [0x4e8b30]
cmp eax, dword [edx + 0x1c]
jne 0x44b79a
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0043326c
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403f5c
jmp 0x44b7a3
cmp eax, 0xb00b
jne 0x44b79a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00449f48
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ec38
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x44ec54
cmp dword [esi + 4], 0
je 0x44ec81
test byte [ebx + 0x55], 1
jne 0x44ec73
mov eax, ebx
call fcn.0044d844
test eax, eax
jne 0x44ec73
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x44ed91
mov edx, esi
mov eax, ebx
call fcn.0044e75c
jmp 0x44ed91
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44ed8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00450b08
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0044b54c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0044ec38
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00450b08
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ed91
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4552c8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4e7ea0]
cmp byte [eax + 0xc], 0
je 0x455435
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45542e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e8b84], 0
jne 0x45531c
push 0x45543c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x455444
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8b84], eax
cmp dword [0x4e5d90], 0
jne 0x455417
push 0x455454
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e5d90], eax
cmp dword [0x4e5d90], 0
je 0x455417
push 0x455460
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8b88], eax
push 0x455470
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8b8c], eax
push 0x455484
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8b90], eax
push 0x45549c
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8b94], eax
push 0x4554b4
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8b98], eax
push 0x4554c8
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8b9c], eax
push 0x4554e0
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8ba0], eax
push 0x4554f8
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8ba4], eax
push 0x455514
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8ba8], eax
push 0x455520
mov eax, dword [0x4e5d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e8bac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455435
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45d24c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0045d0ec
dec esi
jne 0x45d26e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x46f918
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0xd], 0
je 0x46f933
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x46f933
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4cd2a4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4cd342
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x34]
add eax, 8
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0xc
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x1c
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x20
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x18
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x24
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x28
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x30
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x34
call fcn.00404c48
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
call fcn.0046444c
mov eax, dword [ebx + 0x1c]
call fcn.0046444c
mov eax, dword [ebx + 0x20]
call fcn.0046444c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cd34c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d0190
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d02e8
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e785c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x4e7cac]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 5
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 1
mov dword [eax + 0x30], 1
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 0
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e7d6c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e7aec]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e7a08]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e7e44]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e79b8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e78cc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e7a80]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e7ac4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e7afc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e7ab8]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d02f2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d0514
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d0695
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e7d68]
mov edx, dword [edx]
call fcn.00404c9c
mov ecx, dword [0x4e7990]
mov ecx, dword [ecx]
mov edx, dword [0x4e76dc]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.00404f54
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x4e76dc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 3
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e7a60]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e77b4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e76e8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e7b4c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e769c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e7dcc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e7768]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e7798]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e77c0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e7790]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d069f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d085c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d09dd
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e7918]
mov edx, dword [edx]
call fcn.00404c9c
mov ecx, dword [0x4e7990]
mov ecx, dword [ecx]
mov edx, dword [0x4e7aa8]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.00404f54
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x4e7aa8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 0xa
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e7e14]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e7b90]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e7ab4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e76e4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e7a50]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e798c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e7b38]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e7b78]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e7b98]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e7b64]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d09e7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d0ba4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d0c80
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov byte [ebx + 0x30], 0
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e7e28]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e7ba0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e7acc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e7700]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e7a78]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e799c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x4e77ec]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d0c8a
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d0f14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d0fec
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x30], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 6
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e7ccc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e7a14]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e792c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e7d88]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e78dc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e7804]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x4e7e8c]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d0ff6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d1224
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d1381
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e7818]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x4e7c50]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 8
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 0
mov byte [ebx + 0x18], 1
mov eax, dword [ebx + 0x44]
xor edx, edx
mov dword [eax + 0x30], edx
mov byte [eax + 0xa], 0
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 0
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e7d0c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e7a84]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e79a0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e7ddc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e7954]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e7870]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e7a28]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e7a4c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e7a90]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e7a34]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d138b
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d17a0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d190d
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x31], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4e7788]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x4e7bc4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 9
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 0
xor edx, edx
mov dword [eax + 0x30], edx
mov byte [eax + 0xa], 0
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 1
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4e7c8c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4e79dc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4e78e4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4e7d38]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x20
mov edx, dword [0x4e7e60]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4e78a0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4e77e8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4e797c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4e79b4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4e79e8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4e79a4]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d1917
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e1940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00481b98
xor edx, edx
push ebp
push 0x4e19b2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e19bc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x2c674c48
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x65de243a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219