joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba7f8
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4ba896
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4cbae4]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4cbae4]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4cbae4]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4cbae4]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4ba817
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4ba8ac
dec edx
je 0x4ba8e1
jmp 0x4ba932
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4cbae4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4cbae4]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4ba932
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4cbae4]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4cbae4]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4cbae4]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c01bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, edx
lea edx, [ebp - 4]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.00409ff0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c04d4
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4c05d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004049a0
xor ecx, ecx
push ebp
push 0x4c05b3
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 4]
call fcn.00409e9c
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4c05a9
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4c05a9
mov esi, dword [edx]
test esi, esi
je 0x4c05a9
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x120], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x110], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], 0
lea edx, [ebp - 0x124]
mov ecx, 3
mov eax, 0x4c05ec
call fcn.0040a4e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c05bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c05da
lea eax, [ebp - 4]
call fcn.004049a0
ret

Function at 0x4c05f8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [esp + 0x105]
push eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [esp + 0x105]
call fcn.00409ff0
add esp, 0x20c
pop ebx
ret
Function at 0x4c1f74
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e50
mov eax, dword [ebp - 8]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4c2049
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
call fcn.004c05f8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004c2068
test al, al
je 0x4c2026
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c60
mov edx, eax
sub edx, 3
mov ecx, 4
mov eax, dword [ebp - 4]
call fcn.00404ec0
mov edx, 0x4c2060
mov eax, dword [ebp - 0x10]
call fcn.00408d1c
test eax, eax
jne 0x4c2007
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004c0710
test al, al
je 0x4c2026
mov bl, 1
jmp 0x4c2026
push 0
mov eax, dword [ebp - 8]
call fcn.00404e60
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e60
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4c2026
mov bl, 1
mov eax, dword [ebp - 0xc]
call fcn.004099ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2050
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004049c4
ret
Function at 0x4c40fc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e50
mov eax, dword [ebp - 8]
call fcn.00404e50
mov eax, dword [ebp - 0xc]
call fcn.00404e50
xor eax, eax
push ebp
push 0x4c41ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x4c41c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e60
push eax
mov ecx, dword [0x4cd668]
mov dl, 1
mov eax, dword [0x417640]
call fcn.0041c718
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4c41b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004096f8
test al, al
je 0x4c4192
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404e60
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0041c3e4
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c41be
mov eax, dword [ebp - 0x14]
call fcn.00403bcc
ret
Function at 0x4c448c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0xc], ecx
mov esi, eax
lea edi, [ebp - 0x40]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov ebx, edx
lea eax, [ebp - 0x40]
mov edx, dword [0x4c2f20]
call fcn.00405594
xor eax, eax
push ebp
push 0x4c468e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c4653
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x48]
xor eax, eax
call fcn.00402c64
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.00409b18
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0xc]
mov ecx, 0x4c46a8
call fcn.00404cac
mov eax, dword [ebp - 0xc]
call fcn.004096f8
test al, al
je 0x4c4528
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404e60
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4c453a
mov ecx, dword [ebp - 0xc]
mov edx, 0x4c46bc
mov eax, 0x4c46d0
call fcn.004c40fc
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4330a0]
call fcn.00433150
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c4642
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4c459b
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x4c46e0
mov edx, 0x4c46f8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.004091f8
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, 0x4c4708
mov edx, 0x4c46f8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
jmp 0x4c45d6
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x4c46e0
mov edx, 0x4c46f8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.004091f8
mov eax, dword [ebp - 0x50]
push eax
mov ecx, 0x4c4708
mov edx, 0x4c46f8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x40]
push eax
mov ecx, 0x4c471c
mov edx, 0x4c46f8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0x38]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x54]
call fcn.004091f8
mov eax, dword [ebp - 0x54]
push eax
mov ecx, 0x4c4730
mov edx, 0x4c46f8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
push 0x4c4740
mov ecx, 0x4c474c
mov edx, 0x4c46f8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4649
mov eax, dword [ebp - 8]
call fcn.00403bcc
ret
Function at 0x4c47dc
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 8], ecx
mov esi, eax
lea edi, [ebp - 0x3c]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, edx
lea eax, [ebp - 0x3c]
mov edx, dword [0x4c2f20]
call fcn.00405594
xor eax, eax
push ebp
push 0x4c4931
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x4c48f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x4cc668]
mov ebx, dword [ebx + 0x24]
test ebx, ebx
jle 0x4c485a
mov eax, dword [0x4cc668]
call fcn.004c475c
cmp ebx, eax
jle 0x4c48e9
push 0x104
lea eax, [ebp - 0x141]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x148]
lea eax, [ebp - 0x141]
call fcn.00409ff0
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 8]
mov ecx, 0x4c494c
call fcn.00404cac
mov eax, dword [ebp - 8]
call fcn.00404e60
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x150]
xor eax, eax
call fcn.00402c64
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00409b18
mov eax, dword [ebp - 0x14c]
call fcn.00409dd0
call fcn.004c4200
mov edx, esi
lea eax, [ebp - 0x3c]
call fcn.004c448c
test al, al
je 0x4c48e9
push 5
push 0x4c4960
call sub.kernel32.dll_WinExec
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c48fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4938
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.004049c4
lea eax, [ebp - 0x3c]
mov edx, dword [0x4c2f20]
call fcn.00405450
lea eax, [ebp - 8]
call fcn.004049a0
ret
Function at 0x4079b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0
push 0
push 0
cld
call dword es:[sym.imp.KERNEL32.dll_GetShortPathNameW]
sub eax, 2
mov edx, dword [ecx]
imul eax, edx
cmp al, 0x7c
jne 0x407a0a
lea eax, [esp + 4]
push eax
push esp
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
cmp eax, dword [edx + ebp]
je 0x407a4e
mov eax, 0x407a05
lea eax, [edx + eax]
push ebp
push eax
push 0
call sub.KERNEL32.dll_EnumResourceTypesW
test eax, eax
jne 0x407a23
jmp 0x407a4e
cmc
nop
mov eax, esp
lea eax, [eax + 8]
mov ecx, eax
or eax, dword [ecx]
and eax, dword [ecx]
cld
or eax, 7
xchg dword [esp + 0xc], edx
lea eax, es:[eax + 0x789692]
xchg edx, eax
xchg esi, eax
js 0x407a27
sub eax, 0x783648
xacquire lock add dword es:[edx - 0x1b4], eax
mov ecx, dword [esp]
sub esp, 0xffffffec
mov eax, 0
mov dx, cs
push dx
push ecx
retf
add byte [eax], al
add byte [eax], al
int3
Function at 0x40fd61
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add ecx, dword [ebx + 0x3c]
stc
nop
jb 0x40fa8a
mov ecx, ebx
stc
nop
jb 0x40e764
imul edi, dword [eax + eax], 0xffffffb1
pop es
add byte [esi - 0xd40a8af], bl
cld
inc eax
add byte [edi - 0x733cdbc4], al
add byte [eax], al
add byte [eax], al
add byte [edx + ecx*4 - 0x7d], bh
aas
adc byte [eax + 0xbe990fc], dl
invalid
pushal
stc
nop
jb 0x40eb12
push eax
add byte ss:[eax + eax - 0x4cff5200], dl
ljmp 0x47e9

Function at 0xdc7e58
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdc7e62
pushal
call 0xdc7e68
pop ebp
sub ebp, 0x10
sub ebp, 0x9c7e58
jmp 0xdc7e7e
mov eax, 0x9c7e58
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ce
mov edx, 0xbb1becfb
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc7e95
jmp 0xdc7ea8
jo 0xdc7ee0
jo 0xdc7f1e
invalid
cli
xlatb
fist word [ebx + 0x28696b95]
adc edi, esi
sti
sti
sti
adc dl, ch
sti
sti
sti
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
jo 0xdc7f75
sti
sti
sti
jo 0xdc7f6b
idiv ebx
sti
sti
jo 0xdc7f79
jmp 0xdc7f00
idiv ebx
jo 0xdc7f99
invalid
sti
xchg ebx, eax
arpl word [eax - 0x7f], cx
sti
cli
xlatb
fbstp tbyte [esi - 0x61]
fild word [edi]
jb 0xdc7f31
fist word [ebx]
invalid
enter 0x7a32, 9
dec ecx
mov bl, ah
mov dl, 0x7a
or dword [ecx - 0x78], ecx
jecxz 0xdc7f2b
dec ecx
mov bl, ah
mov dl, 0xc8
sub dword [eax + 0x13], edi
enter 0x7829, 0x13
invalid
add byte [edx], dl
hlt
Function at 0x6e0438
Capabilities:
Authenticate hmac

Disassembly:
sub cl, byte [ebx + 0x134c61b9]
invalid
js 0x6dd724
xor eax, 0x5d2bcc00
jb 0x6dd6a9
dec ebx
dec ebx
fcomp qword [eax]
push ebx
fstp dword [ebx + 0x7a]
cmp al, 0x39
invalid
cmp al, 0x3a
popal
comiss xmm0, xmm7
sub byte [esi + esi + 0x3c7a5bda], cl
cmp ah, byte [eax]
wait
sal ebp, 1
push ebp
mov ecx, 0x71483b3c
pop ebp
lds edi, [ebx + 0x71db3c77]
imul edi, dword [edx + ebx*8], 0x5e1f7a5b
jp 0x6dd768
pop esi
jecxz 0x6dd769
pop edi
invalid
jp 0x6dd6e7
push ebp
xchg esi, eax
stosb byte es:[edi], al
or al, ch
dec edi
jp 0x6dd79d
ficomp dword [eax + eax*8 + 0x23]
and ebx, dword [ebp + 0x6b]
rcl byte [edi + 0x5d]
push edi
pop ebp
out 0x48, eax
mov bl, 0xd2
test byte [eax], ah
pop ebp
or dword [ebp + 0x1a5bda3c], eax
or eax, 0xda91821b
jg 0x6dd747
or ecx, dword [ebx + 0x358bb996]
ficomp dword [ebx + 0x7a]
mov eax, dword [0x42c065d]
outsd dx, dword [esi]
sar bh, cl
shr byte [ecx], 1
xchg byte [edx + 0x23], dh
pop edi
invalid
ficomp dword [ebx + 0x7a]
push ebx
pushal
retf 0x14b8
mov ebx, 0x14f175ce
pop ebx
popal
push dword [esp]
pop esi
add esp, 4
pushal
adc esi, 0x6666a9c6
pushal
call 0x6e0461
or byte [0x4033a74c], dh
insb byte es:[edi], dx
mov cl, 0xf0
mov ebp, 0xb48fdc23
pop ecx
jmp 0x6e047a
popal
popal
push eax
mov eax, esp
add eax, 4
push ecx
mov ecx, 4
add eax, ecx
pop ecx
xchg dword [esp], eax
pop esp
cmc
jmp 0x6dd757

Function at 0x6e0461
Capabilities:
Authenticate hmac

Disassembly:
sub cl, byte [ebx + 0x134c61b9]
invalid
js 0x6dd724
xor eax, 0x5d2bcc00
jb 0x6dd6a9
dec ebx
dec ebx
fcomp qword [eax]
push ebx
fstp dword [ebx + 0x7a]
cmp al, 0x39
invalid
cmp al, 0x3a
popal
comiss xmm0, xmm7
sub byte [esi + esi + 0x3c7a5bda], cl
cmp ah, byte [eax]
wait
sal ebp, 1
push ebp
mov ecx, 0x71483b3c
pop ebp
lds edi, [ebx + 0x71db3c77]
imul edi, dword [edx + ebx*8], 0x5e1f7a5b
jp 0x6dd768
pop esi
jecxz 0x6dd769
pop edi
invalid
jp 0x6dd6e7
push ebp
xchg esi, eax
stosb byte es:[edi], al
or al, ch
dec edi
jp 0x6dd79d
ficomp dword [eax + eax*8 + 0x23]
and ebx, dword [ebp + 0x6b]
rcl byte [edi + 0x5d]
push edi
pop ebp
out 0x48, eax
mov bl, 0xd2
test byte [eax], ah
pop ebp
or dword [ebp + 0x1a5bda3c], eax
or eax, 0xda91821b
jg 0x6dd747
or ecx, dword [ebx + 0x358bb996]
ficomp dword [ebx + 0x7a]
mov eax, dword [0x42c065d]
outsd dx, dword [esi]
sar bh, cl
shr byte [ecx], 1
xchg byte [edx + 0x23], dh
pop edi
invalid
ficomp dword [ebx + 0x7a]
push ebx
pushal
retf 0x14b8
mov ebx, 0x14f175ce
pop ebx
popal
push dword [esp]
pop esi
add esp, 4
pushal
adc esi, 0x6666a9c6
pushal
call 0x6e0461
or byte [0x4033a74c], dh
insb byte es:[edi], dx
mov cl, 0xf0
mov ebp, 0xb48fdc23
pop ecx
jmp 0x6e047a
popal
popal
push eax
mov eax, esp
add eax, 4
push ecx
mov ecx, 4
add eax, ecx
pop ecx
xchg dword [esp], eax
pop esp
cmc
jmp 0x6dd757
Function at 0xb4f08a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 4], ebx
mov ecx, dword [ebx + 0x68]
mov eax, dword [ecx + 0x2c]
and eax, 4
or eax, 0x432
shr eax, 1
push eax
call fcn.00b5114e
push 0x1c
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
xor edi, edi
mov dword [ebp - 8], esi
test esi, esi
je 0xb4f143
mov dword [esi], edi
mov dword [esi + 0x18], edi
test esi, esi
je 0xb4f138
push esi
mov ecx, ebx
call fcn.00b4f147
mov ecx, dword [ebp - 4]
mov ebx, eax
mov eax, dword [ecx + 0x68]
test byte [eax + 0x2c], 4
jne 0xbf0a6f
test ebx, ebx
js 0xbf0a9c
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [0xd0a20c]
mov dword [esi + 4], eax
mov eax, dword [0xd0ac3c]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x68]
push edi
push 0x2001
push esi
mov eax, dword [eax + 0x2c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
push 0xb4db20
mov dword [esi + 0x14], eax
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
test eax, eax
je 0xbf0a9c
xor edi, edi
inc edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, edi
jmp 0xb4f0d0
mov eax, dword [eax + 0xc4]
test eax, eax
je 0xb4f0ee
lea ecx, [esi + 0x18]
push ecx
push eax
call fcn.00c7aca7
mov ecx, dword [ebp - 4]
test al, al
je 0xb4f0ee
mov ebx, 0x80004005
jmp 0xb4f0ee
cmp dword [esi], 0
je 0xbf0ab0
push edi
push 0xb51950
push dword [esi]
call fcn.00b51d9e
mov dword [esi], edi
lea ecx, [esi + 0x18]
call fcn.00b4dd44
cmp dword [esi], edi
je 0xbf0ac3
mov ecx, esi
call fcn.00c1ea56
push esi
push edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb4f138
Function at 0xb5114e
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
xor esi, esi
cmp dword [ebx + 0xc4], esi
je 0xb51209
mov eax, dword [ebx + 0xc4]
test eax, eax
je 0xb511f7
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebx + 0xc4]
cmp dword [eax + 4], esi
je 0xb5121e
push dword [eax + 4]
call fcn.00b51487
mov eax, dword [ebx + 0xc4]
cmp dword [eax + 4], esi
je 0xb511f7
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x30
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
cmp dword [ebp + 8], 0x21b
pop edi
je 0xbf6ea0
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebx + 0xc4]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push 0xb50670
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_EnumWindows]
test esi, esi
jne 0xb51235
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4
push 8
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebx + 0xc4], eax
jmp 0xb51172
push 4
push 0x34
call fcn.00b7e813
mov ecx, dword [ebx + 0xc4]
mov dword [ecx + 4], eax
jmp 0xb51198
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0xb511f7
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, eax
jmp 0xb511c9

Function at 0xb51ff1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov dword [ebp - 8], 4
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push ecx
push 0x10
push 0xb26d64
push 0xb26d00
push reloc.SHCORE.dll_Ordinal_1
mov dword [edi], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jne 0xbd5f71
mov eax, dword [ebp - 4]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x490
je 0xb5203a
cmp esi, 2
je 0xb5203a
test esi, esi
jle 0xbd5f95
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xbd5fa8
mov ecx, dword [ebp + 4]
push esi
push 0xb3eac4
push 0x70
pop edx
call fcn.00bc28ed
mov eax, esi
jmp 0xb5203c
Function at 0xb5208a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push 0x20010010
push 0xb27590
push 0xb27510
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp dword [ebp - 8], esi
jne 0xbd6b00
push edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - 8]
xor edi, edi
or edi, dword [ebp - 0xc]
or ecx, esi
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x24]
add edx, 0x61c46800
adc eax, 8
cmp ecx, eax
ja 0xb520f9
jb 0xb52102
cmp edi, edx
jb 0xb52102
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
inc esi
jmp 0xb520f9
push ecx
call fcn.00c449db
xor eax, eax
jmp 0xb520fc

Function at 0xb551d6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
cmp byte [0xd0a416], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], ecx
jne 0xb5529b
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x10
push 0xb28a54
push 0xb289b8
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jg 0xbdedd1
js 0xb5529b
cmp dword [ebp - 4], 0
je 0xb5529b
call fcn.00b552da
test al, al
jne 0xb5529b
mov bl, 1
push 2
pop esi
call fcn.00b552a4
test eax, eax
jne 0xbdede0
and dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0x10
push 0xb28a34
push 0xb289b8
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jg 0xbdedff
js 0xb55285
cmp dword [ebp - 8], 0
jne 0xb5529f
mov eax, dword [ebp - 0x10]
test eax, eax
je 0xb5528e
mov dword [eax], esi
test edi, edi
je 0xb55294
mov byte [edi], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
jmp 0xb5523a
push 3
pop esi
jmp 0xb55285
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xb55227
push 5
xor bl, bl
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, eax
call fcn.00c394c6
mov esi, eax
neg esi
sbb esi, esi
add esi, 5
jmp 0xb55285
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xb5527d
Function at 0xb579c0
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add ecx, 0xfffffff0
pop ebp
jmp fcn.00b588f3