joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f354
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0049ea10
xor eax, eax
push ebp
push 0x49f4c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x49f4b0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
je 0x49f39f
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
jne 0x49f3a9
call fcn.00403fc8
jmp 0x49f4cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00419594
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 8]
mov ebx, eax
test ebx, ebx
jle 0x49f4a5
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x49f457
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x49f444
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.0040394c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0049f30c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x49f4d8]
cmp dl, byte [eax + 0x38]
je 0x49f4ac
call fcn.0040c444
jmp 0x49f4ac
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004195b4
jmp 0x49f4ac
cmp ecx, ebx
jge 0x49f473
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004195b4
jmp 0x49f3a9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00419594
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004195c8
cmp edx, dword [esp + 4]
jne 0x49f494
cmp eax, dword [esp]
pop edx
pop eax
jne 0x49f3a9
push ebp
call fcn.0049f30c
pop ecx
jmp 0x49f4ac
push ebp
call fcn.0049f30c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f4cd
mov eax, dword [ebp - 4]
call fcn.0049ea1c
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f4dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49f5fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0049ea10
xor eax, eax
push ebp
push 0x49f5e1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
jne 0x49f52c
call fcn.00403fc8
jmp 0x49f5e8
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49f5cb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x49f5cb
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.0040394c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x49f5cb
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bc4c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x49f618
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x531838]
mov dl, 1
mov eax, dword [0x49d580]
call fcn.0040c5a4
call fcn.00403f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f5e8
mov eax, dword [ebp - 4]
call fcn.0049ea1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f605
lea eax, [ebp - 0x28]
call fcn.0040455c
ret
Function at 0x49f664
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49f7ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0049ea10
xor eax, eax
push ebp
push 0x49f791
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x49f6c9
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
je 0x49f6c9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x49f77b
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc], 0
jne 0x49f6dc
call fcn.00403fc8
jmp 0x49f798
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49f77b
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x49f77b
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.0040394c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x49f77b
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bc4c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x49f7c8
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x531838]
mov dl, 1
mov eax, dword [0x49d580]
call fcn.0040c5a4
call fcn.00403f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f798
mov eax, dword [ebp - 4]
call fcn.0049ea1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f7b5
lea eax, [ebp - 0x28]
call fcn.0040455c
ret
Function at 0x4a120c
Capabilities:
Create pipe

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.004a13b0
mov dword [esp + 0xc], 0xc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xffffffff
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [ebx + 0x40]
push eax
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4a124d
call fcn.0040da94
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [ebx + 0x3c]
push eax
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4a126b
call fcn.0040da94
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [ebx + 0x44]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
jne 0x4a1289
call fcn.0040da94
push 2
push 0
push 0
lea eax, [ebx + 0x34]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x4a12b2
call fcn.0040da94
push 2
push 0
push 0
lea eax, [ebx + 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x4a12db
call fcn.0040da94
push 2
push 0
push 0
lea eax, [ebx + 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
jne 0x4a1304
call fcn.0040da94
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dl, 1
mov eax, dword [0x414d94]
call fcn.00403720
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, dword [0x414d94]
call fcn.00403720
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x78], eax
xor eax, eax
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x68]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x64]
mov edx, dword [eax]
call dword [edx + 0x44]
add esp, 0x18
pop ebx
ret
Function at 0x4a18b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1999
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4a197b
inc esi
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x4a19b4
call fcn.00404b50
mov edi, eax
test edi, edi
jle 0x4a1928
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404a6c
mov bl, 1
jmp 0x4a1935
lea eax, [ebp - 0x10]
mov edx, 0x4a19c0
call fcn.0040481c
cmp dword [ebp - 0x10], 0
je 0x4a1971
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404814
push eax
lea eax, [ebp - 0x10]
call fcn.00404a64
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x4a1971
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xe8
je 0x4a1971
call fcn.0040da94
inc dword [ebp - 0xc]
dec esi
jne 0x4a18ef
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a19a0
lea eax, [ebp - 0x10]
call fcn.0040455c
ret

Function at 0x4a8780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a8833
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4a881d
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, 0x4a8848
call fcn.00404b50
test eax, eax
jle 0x4a87e6
lea edx, [ebp - 0xc]
mov ecx, 0x400
xchg edx, eax
call fcn.00404aac
mov eax, dword [ebp - 0xc]
call fcn.00404814
mov edx, eax
test edx, edx
jle 0x4a8805
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor byte [ecx + eax - 1], 0x80
inc eax
dec edx
jne 0x4a87f9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4a87b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a883a
lea eax, [ebp - 0xc]
call fcn.0040455c
ret
Function at 0x4ad83c
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.004051e0
xor eax, eax
push ebp
push 0x4ad9d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52e530]
cmp eax, 1
sete byte [ebp - 0xb]
test eax, eax
jne 0x4ad9b8
mov dword [0x52e530], 0xffffffff
mov byte [0x52e534], 0
call sub.winmm.dll_waveInGetNumDevs
mov ebx, eax
test ebx, ebx
jle 0x4ad9b8
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1d]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp - 0xa]
call fcn.004ad7f4
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00404f50
je 0x4ad919
mov edi, 2
dec ebx
test ebx, ebx
jl 0x4ad937
inc ebx
xor esi, esi
push 0x54
lea eax, [ebp - 0x74]
push eax
push esi
call sub.winmm.dll_waveInGetDevCapsW
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x6c]
mov ecx, 0x20
call fcn.00404dfc
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 8]
call fcn.00404f50
jne 0x4ad913
push 0x30000
push 0
push 0x4ad7ac
lea eax, [ebp - 0x1d]
push eax
push esi
push 0x534408
call sub.winmm.dll_waveInOpen
mov edi, eax
jmp 0x4ad937
inc esi
dec ebx
jne 0x4ad8cb
jmp 0x4ad937
push 0x30000
push 0
push 0x4ad7ac
lea eax, [ebp - 0x1d]
push eax
push 0xffffffffffffffff
push 0x534408
call sub.winmm.dll_waveInOpen
mov edi, eax
test edi, edi
jne 0x4ad9b8
mov eax, dword [ebp - 4]
mov dword [0x52e540], eax
mov esi, 5
mov ebx, 0x534410
mov edi, 0x5344ac
movzx eax, word [ebp - 0xa]
imul eax, eax, 0x780
imul dword [ebp + 0xc]
mov ecx, 0x15888
xor edx, edx
div ecx
mov dword [ebx], eax
mov eax, edi
mov dword [ebx - 4], eax
xor eax, eax
mov dword [ebx + 0xc], eax
push 0x20
lea eax, [ebx - 4]
push eax
mov eax, dword [0x534408]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x4ad9b8
push 0x20
lea eax, [ebx - 4]
push eax
mov eax, dword [0x534408]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x4ad9b8
add edi, 0x780
add ebx, 0x20
dec esi
jne 0x4ad952
mov dword [0x52e530], 1
mov byte [ebp - 0xb], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad9dd
lea eax, [ebp - 0x78]
call fcn.00404c78
lea eax, [ebp - 8]
call fcn.00404c78
ret

Function at 0x4adc18
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push esp
push 0x208
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404dfc
add esp, 0x208
pop ebx
ret

Function at 0x4af9d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x53120c]
mov dword [eax], 0x3ef
mov eax, dword [ebx + 0x31c]
test eax, eax
je 0x4af9f7
cmp byte [eax + 0x57], 0
jne 0x4af9f7
call fcn.00443ab8
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.004469f0
push 0
mov eax, dword [0x531704]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.004afe8c
mov eax, dword [0x53120c]
xor edx, edx
mov dword [eax], edx
pop ebx
ret
Function at 0x4b0464
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x53120c]
mov dword [eax], 0x3f6
cmp dword [0x52e558], 0
jne 0x4b0498
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ad388]
call fcn.0043f87c
mov dword [0x52e558], eax
mov eax, dword [0x52e558]
call fcn.004ad5c8
mov eax, dword [0x52e558]
call fcn.00443ab8
mov eax, dword [0x52e558]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xc0]
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.004469f0
push 0
mov eax, dword [0x531704]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.004afe8c
mov eax, dword [0x53120c]
xor edx, edx
mov dword [eax], edx
pop ebx
ret
Function at 0x4b97c4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b97cc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b99be
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b99d4
mov eax, esi
call fcn.004b7554
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045b0
lea ecx, [ebp - 0x10]
mov edx, 0x4b99e8
mov eax, esi
call fcn.004b7554
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045b0
lea ecx, [ebp - 0x14]
mov edx, 0x4b9a00
mov eax, esi
call fcn.004b7554
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045b0
lea ecx, [ebp - 0x18]
mov edx, 0x4b9a1c
mov eax, esi
call fcn.004b7554
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045b0
lea ecx, [ebp - 0x1c]
mov edx, 0x4b9a38
mov eax, esi
call fcn.004b7554
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045b0
lea ecx, [ebp - 0x24]
mov edx, 0x4b9a50
mov eax, esi
call fcn.004b7554
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408fac
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040940c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b9a68
mov eax, esi
call fcn.004b7554
mov eax, dword [ebp - 0x28]
call fcn.004b666c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b9a78
mov eax, esi
call fcn.004b7554
mov eax, dword [ebp - 0x2c]
call fcn.004b666c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b9a90
mov eax, esi
call fcn.004b7554
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040940c
inc eax
je 0x4b9961
lea ecx, [ebp - 0x34]
mov edx, 0x4b9a90
mov eax, esi
call fcn.004b7554
mov eax, dword [ebp - 0x34]
call fcn.004093d0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ac60
fstp qword [ebp - 0x3c]
wait
call fcn.0040b024
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b997c
lea ecx, [ebp - 0x40]
mov edx, 0x4b9a90
mov eax, esi
call fcn.004b7554
mov eax, dword [ebp - 0x40]
call fcn.004b666c
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b9aa0
mov eax, esi
call fcn.004b7554
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004045b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b99c5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404580
ret
Function at 0x4c5b88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c5be2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c5b78
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004b52d8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004b4ed8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5be9
lea eax, [ebp - 4]
call fcn.0040455c
ret

Function at 0x4c9098
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4c9161
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov dl, 1
mov eax, dword [0x4c8f2c]
call fcn.0041f1c4
mov ebx, eax
mov byte [ebx + 0xf], 1
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.004045b0
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], esi
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov byte [ebx + 0x3c], 1
mov byte [ebx + 0x3d], 0
mov eax, ebx
call fcn.0041f510
jmp 0x4c9128
call sub.kernel32.dll_GetTickCount
sub eax, edi
lea edx, [esi + 0x7d0]
cmp eax, edx
ja 0x4c912e
cmp byte [ebp + 8], 0
jne 0x4c9121
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.00446cc8
push 1
call sub.kernel32.dll_Sleep
cmp byte [ebx + 0x3c], 1
je 0x4c90fe
cmp byte [ebx + 0x3c], 2
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4c9147
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x34]
call fcn.004045b0
mov byte [ebx + 0x3d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9168
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4cb14c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov ebx, ecx
mov ebp, edx
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cb370
mov edx, 0x4cb374
mov eax, esi
call fcn.004cae44
test al, al
jne 0x4cb180
xor eax, eax
jmp 0x4cb364
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b3c
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x52edc8]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
test ebx, ebx
je 0x4cb204
or dword [esp + 0xd4], 0x20
mov eax, dword [ebx]
lea edx, [esp + 0xd8]
mov dword [edx], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0xd8]
mov dword [edx + 4], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esp + 0x118], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x20
call fcn.0040303c
mov edx, 0x4cb384
mov eax, esi
call fcn.004cb060
mov ebx, eax
test ebx, ebx
jne 0x4cb230
xor eax, eax
jmp 0x4cb364
push 0x4cb390
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cb3a4
push ebx
call sub.advapi32.dll_RegDeleteValueA
test ebp, ebp
je 0x4cb253
mov dword [esp], 3
jmp 0x4cb258
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb3b4
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb279
xor eax, eax
jmp 0x4cb364
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb3c8
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb2a1
xor eax, eax
jmp 0x4cb364
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb3e4
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb2c9
xor eax, eax
jmp 0x4cb364
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x4cb2f6
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov edi, eax
test edi, edi
je 0x4cb2f6
push edi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cb30b
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push esi
push edi
lea edi, [esi + 4]
lea esi, [esp + 0xb4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esi + 0xa0]
lea edx, [esp + 8]
mov ecx, 0x20
call fcn.004047c4
push ebp
call sub.user32.dll_SetThreadDesktop
test edi, edi
je 0x4cb35c
push edi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
mov al, 1
add esp, 0x148
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cb3f8
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.0040455c
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cb540
mov edx, 0x4cb544
mov eax, ebx
call fcn.004cae44
test al, al
je 0x4cb535
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b3c
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x52edc8]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4cb554
mov eax, ebx
call fcn.004cb060
mov ebx, eax
test ebx, ebx
je 0x4cb535
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb560
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4cb574
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cb588
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4cb4f2
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4cb4f2
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cb507
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4cb52f
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret