joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d8f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x19c], ebx
test dl, dl
je 0x47d913
add esp, 0xfffffff0
call fcn.0040423c
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47d9c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00423964
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x84], 2
sete al
mov byte [esi + 0x32], al
push 0x104
lea eax, [ebp - 0x198]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x19c]
lea edx, [ebp - 0x198]
mov ecx, 0x104
call fcn.00404edc
mov edx, dword [ebp - 0x19c]
lea eax, [esi + 0x3c]
mov ecx, 0x47d9f0
call fcn.004050f8
lea eax, [esi + 0x40]
call fcn.00404dec
mov byte [esi + 0x30], 0
mov byte [esi + 0x31], 1
lea eax, [esi + 0x44]
call fcn.00404dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d9cb
lea eax, [ebp - 0x19c]
call fcn.00404dec
ret

Function at 0x47db0c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x47dc11
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov byte [ebx + 0x48], 0
push dword [ebx + 0x3c]
push 0x47dc28
push dword [0x4fd17c]
push 0x47dc34
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040516c
push 4
mov eax, dword [0x4fd17c]
call fcn.004052ac
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.advapi32.dll_OpenServiceA
test eax, eax
je 0x47db76
mov byte [ebx + 0x48], 1
push eax
call sub.advapi32.dll_CloseServiceHandle
mov bl, 1
jmp 0x47dbf6
push 0
push 0
push 0
push 0
mov eax, dword [0x4fd184]
call fcn.004052ac
push eax
mov eax, dword [ebp - 4]
call fcn.004052ac
push eax
push 1
push 3
push 1
push 0x10034
mov eax, dword [0x4fd180]
call fcn.004052ac
push eax
mov eax, dword [0x4fd17c]
call fcn.004052ac
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.advapi32.dll_CreateServiceA
test eax, eax
jne 0x47dbc9
call sub.kernel32.dll_GetLastError_1
mov esi, eax
jmp 0x47dbcf
push eax
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
je 0x47dbf1
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.00409bdc
mov ecx, dword [ebp - 8]
lea eax, [ebx + 0x44]
mov edx, 0x47dc44
call fcn.004050f8
test esi, esi
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dc18
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e10
ret
Function at 0x47dc5c
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47dd4d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [esi + 0x49], 0
push 4
mov eax, dword [0x4fd17c]
call fcn.004052ac
push eax
mov eax, dword [esi + 0x38]
push eax
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x47dd07
lea eax, [ebp - 0x20]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x47dd07
mov eax, dword [ebp - 0x1c]
cmp eax, 4
jne 0x47dcc0
mov byte [esi + 0x49], 1
push edi
call sub.advapi32.dll_CloseServiceHandle
mov bl, 1
jmp 0x47dd37
cmp eax, 1
jne 0x47dd02
push edi
call sub.advapi32.dll_CloseServiceHandle
push 0x10
mov eax, dword [0x4fd17c]
call fcn.004052ac
push eax
mov eax, dword [esi + 0x38]
push eax
call sub.advapi32.dll_OpenServiceA
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0
push edi
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x47dcfa
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x47dd0e
or ebx, 0xffffffff
jmp 0x47dd0e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
test ebx, ebx
je 0x47dd30
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00409bdc
mov ecx, dword [ebp - 0x24]
lea eax, [esi + 0x44]
mov edx, 0x47dd68
call fcn.004050f8
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dd54
lea eax, [ebp - 0x24]
call fcn.00404dec
ret

Function at 0x47dd80
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47de2b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [esi + 0x49], 0
je 0x47ddaa
mov bl, 1
jmp 0x47de15
push 0x24
mov eax, dword [0x4fd17c]
call fcn.004052ac
push eax
mov eax, dword [esi + 0x38]
push eax
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x47dde5
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x47dddd
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x47ddec
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
test ebx, ebx
je 0x47de0e
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409bdc
mov ecx, dword [ebp - 0x20]
lea eax, [esi + 0x44]
mov edx, 0x47de44
call fcn.004050f8
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47de32
lea eax, [ebp - 0x20]
call fcn.00404dec
ret
Function at 0x481abc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x481b50
push 0
mov eax, ebx
call fcn.004052ac
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x481b2b
mov eax, esi
call fcn.004050ac
inc eax
push eax
mov eax, esi
call fcn.004052ac
push eax
push 1
push 0
mov eax, edi
call fcn.004052ac
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x481b46
mov ecx, dword [0x50090c]
mov dl, 1
mov eax, dword [0x47ff14]
call fcn.0040da9c
call fcn.00404768
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4b34a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x502664], 0
je 0x4b34c3
cmp byte [0x502665], 0
jne 0x4b34c3
mov esi, dword [0x502668]
jmp 0x4b34cb
mov esi, dword [0x500920]
mov esi, dword [esi]
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
mov edx, 0x4b35a0
mov eax, 0x4b35a4
xor ecx, ecx
call fcn.00408384
mov edi, eax
mov dword [ebx + 0x3c], edi
test edi, edi
jne 0x4b350c
push 0
mov ecx, 0xfffffc12
mov dl, 1
mov eax, dword [0x48c6f0]
call fcn.0049035c
call fcn.00404768
push 0
mov eax, dword [ebx + 0x3c]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b356a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 8
call fcn.004028a0
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
mov edx, dword [ebp - 4]
mov eax, dword [0x502dd8]
call fcn.0041aee8
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0xc8]
call fcn.004a3b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3598
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c90e8
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x90], 1
jne 0x4c9108
or byte [esp + 0x90], 1
jmp 0x4c9110
and byte [esp + 0x90], 0xfe
push esp
call sub.user32.dll_SetKeyboardState
add esp, 0x100
ret
Function at 0x4ca614
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ca874
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4ca677
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004ca0dc
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e3e4
cmp al, 1
jne 0x4ca677
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004ca3f4
test al, al
je 0x4ca803
cmp dword [ebp - 8], 0
jge 0x4ca695
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004ca0dc
mov eax, dword [ebp - 0x210]
call fcn.004050ac
cmp ebx, eax
jge 0x4ca6df
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004ca0dc
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x501610]
and eax, 0xff
bt dword [edx], eax
jae 0x4ca6df
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4ca6f3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ca5f0
cmp ebx, dword [ebp - 8]
je 0x4ca7f5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4ca71f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ff9f4]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4ca7e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ff9f4]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0045e9e4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ff9f4]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0045e9e4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca7e9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4ca856
cmp dword [ebp - 8], 0
jge 0x4ca80e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004ca0dc
mov eax, dword [ebp - 0x218]
call fcn.004050ac
cmp eax, dword [ebp - 8]
jg 0x4ca848
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004ca0dc
mov eax, dword [ebp - 0x21c]
call fcn.004050ac
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ca5f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca87b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404e10
ret
Function at 0x4cdfd8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, eax
mov eax, ebx
call fcn.0040a87c
test eax, eax
jbe 0x4ce01c
mov eax, dword [0x500cb4]
mov eax, dword [eax]
mov dword [esp + 0x204], eax
mov eax, ebx
call fcn.0040a87c
add eax, 1
jae 0x4ce00c
call fcn.00403e18
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], ebx
jmp 0x4ce03c
mov eax, dword [0x500cb4]
mov eax, dword [eax]
mov dword [esp + 0x204], eax
xor eax, eax
mov dword [esp + 0x208], eax
xor eax, eax
mov dword [esp + 0x20c], eax
call fcn.004cdfc0
test al, al
je 0x4ce07b
mov eax, dword [0x500f10]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4ce06a
mov eax, dword [0x500f10]
mov eax, dword [eax]
call fcn.004779e8
jmp 0x4ce16c
mov eax, dword [0x500f10]
mov eax, dword [eax]
call fcn.00477ae8
jmp 0x4ce16c
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
mov eax, dword [0x500f10]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetClassNameA
push pe_nt_image_headers32
lea eax, [esp + 0x108]
push eax
mov eax, dword [0x500f10]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4ce16c
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [esp]
jne 0x4ce16c
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 8]
push eax
push ebx
push 0
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4ce16c
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x4ce110
push 9
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_SetForegroundWindow
push ebx
call sub.user32.dll_GetLastActivePopup
mov esi, eax
test esi, esi
je 0x4ce154
cmp ebx, esi
je 0x4ce154
push esi
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ce154
push esi
call sub.user32.dll_IsWindowEnabled
test eax, eax
je 0x4ce154
push esi
call sub.user32.dll_BringWindowToTop
lea eax, [esp + 0x204]
push eax
push 0
push 0x4a
push esi
call sub.user32.dll_SendMessageA
jmp 0x4ce16c
push ebx
call sub.user32.dll_BringWindowToTop
lea eax, [esp + 0x204]
push eax
push 0
push 0x4a
push ebx
call sub.user32.dll_SendMessageA
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x4ce178
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ce1f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x201
lea eax, [ebp - 0x201]
push eax
mov eax, dword [0x500f10]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x201]
mov ecx, 0x201
call fcn.0040505c
mov ecx, dword [ebp - 0x208]
mov eax, ebx
mov edx, 0x4ce20c
call fcn.004050f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce1fe
lea eax, [ebp - 0x208]
call fcn.00404dec
ret
Function at 0x4d10d0
Capabilities:
Stop service

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x58], eax
push 0xf01ff
mov eax, dword [ebx + 0x4c]
call fcn.004052ac
push eax
mov eax, dword [ebx + 0x54]
push eax
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x4d1110
push esp
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x4d1118
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x58], eax
jmp 0x4d1118
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x58], eax
test esi, esi
je 0x4d1122
push esi
call sub.advapi32.dll_CloseServiceHandle
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x4d1128
Capabilities:
Create service
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d1202
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x58], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x108]
call fcn.0040aaa8
push dword [ebp - 0x10c]
push 0x4d1218
push dword [ebx + 0x48]
push 0x4d1224
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040516c
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004052ac
push eax
push 1
push 3
push 1
push 0xf01ff
mov eax, dword [ebx + 0x4c]
call fcn.004052ac
mov esi, eax
push esi
push esi
mov eax, dword [ebx + 0x54]
push eax
call sub.advapi32.dll_CreateServiceA
test eax, eax
jne 0x4d11d6
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x58], eax
jmp 0x4d11e1
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
mov dword [ebx + 0x58], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1209
lea eax, [ebp - 0x10c]
call fcn.00404dec
lea eax, [ebp - 4]
call fcn.00404dec
ret
Function at 0x4d1378
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4d14a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov esi, 0x4d14b4
push 0
push 0x4000000
push 1
push 0
push 0
push 0
push 0x4d14c0
push dword [edi + 0x48]
push 0x4d14d0
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040516c
mov eax, dword [ebp - 8]
call fcn.004052ac
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [edi + 0x50], eax
cmp dword [edi + 0x50], 0xffffffff
jne 0x4d1443
push 0x104
push esi
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404fe4
push 0x4d14c0
push dword [ebp - 4]
push 0x4d14e0
push dword [edi + 0x48]
push 0x4d14d0
lea eax, [ebp - 4]
mov edx, 5
call fcn.0040516c
push 0
push 0x4000000
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004052ac
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
mov dword [edi + 0x50], esi
cmp esi, 0xffffffff
jne 0x4d1443
call sub.kernel32.dll_GetLastError_1
mov dword [edi + 0x58], eax
jmp 0x4d1486
lea ecx, [edi + 0x7c]
lea edx, [edi + 0x78]
mov eax, edi
call fcn.004d16fc
test al, al
jne 0x4d1484
mov dword [edi + 0x50], 0xffffffff
call sub.kernel32.dll_GetLastError_1
mov dword [edi + 0x58], eax
lea edx, [ebp - 0xc]
mov eax, 0x4d0e8c
call fcn.00407104
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4d0894]
call fcn.0040d9e0
call fcn.00404768
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d14a8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e10
ret

Function at 0x4d1624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4d16c3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.0040505c
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 4]
mov ecx, 0x4d16dc
call fcn.004050f8
mov eax, dword [ebp - 4]
call fcn.004052ac
push eax
call sub.kernel32.dll_LoadLibraryA
test eax, eax
je 0x4d16a2
push 0x4d16ec
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d16ca
lea eax, [ebp - 0x10c]
call fcn.00404dec
lea eax, [ebp - 4]
call fcn.00404dec
ret
Function at 0x4e9bdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x4e9bf4
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4e9bed
mov edx, esp
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040529c
xor eax, eax
push ebp
push 0x4e9c52
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.004050ac
test eax, eax
jle 0x4e9c3c
mov esi, 1
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
xor bl, dl
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 8]
mov bl, byte [ecx + edx]
inc esi
dec eax
jne 0x4e9c25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9c59
lea eax, [ebp - 4]
call fcn.00404dec
ret

Function at 0x4f8314
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0
push 0
push 0x4f8380
push 0x4f83a0
mov eax, ebx
call fcn.0045e9e4
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0
push 0x4f83a8
push 0x4f83a0
mov eax, ebx
call fcn.0045e9e4
push eax
call sub.shell32.dll_ShellExecuteA
push 1
push 0
push 0
push 0x4f83d0
push 0x4f83a0
mov eax, ebx
call fcn.0045e9e4
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5007c4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
pop ebx
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x7f6e6e4d
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x8d6484d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219