joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476982
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce135
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x476a18
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4769dd
push 0x612d
push 0x616e
push 1
push 0xebb
call fcn.00476ba8
add esp, 0x10
jmp 0x476a13
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0xfe8
push 0x57ad
push 0x7b65
push 0
push 0x187
push 0x55af
push dword [ebp - 0x34]
push 0x1126
push 0x7924
call fcn.00485e43
add esp, 0x24
jmp 0x476b97
mov dword [ebp - 0x1c], 0x8901f2c
push 1
lea ecx, [ebp - 0x4c]
call fcn.0040bdd2
mov dword [ebp - 0x18], 0
jmp 0x476a39
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x476a4c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x58], 0x6af1
jmp 0x476a32
mov dword [ebp - 0x18], 0
jmp 0x476a5c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x476a75
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4c]
call fcn.0040bec0
mov dword [eax], 0x5c19c5a6
jmp 0x476a55
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x28], 0xe7e
mov dword [ebp - 0x38], str.ffaw_nsm_lzpky
cmp dword [ebp - 0x28], 0x110e
jle 0x476aea
push 0xab5
call dword [sym.imp.USER32.dll_GetKeyState]
and dword [ebp - 0x20], 0
jmp 0x476aa8
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3eb
jge 0x476aea
and dword [ebp - 0x24], 0
jmp 0x476abe
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5183
jge 0x476ae8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl eax, cl
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x476ab7
jmp 0x476aa1
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x476b09
push 0
push 0xe3c
push 0x783
push 0xecd
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0xd43
jge 0x476b23
mov edx, dword [ebp - 0x38]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x476b3f
or dword [ebp - 4], 0xffffffff
jmp 0x476b49
mov dword [ebp - 0x1c], 0
jmp 0x476b59
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x476b6c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x58], 0xa3df
jmp 0x476b52
lea ecx, [ebp - 0x4c]
call fcn.0040bea4
push 0x423e
push 0x203d
push 0x25c0
push 0
push 0x1f09
push 0x5008
call fcn.004741b8
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e595
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x47e6ee
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x47e675
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x47e64e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x47e62f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x47e64c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0040bec0
mov dword [eax], 0x6318d581
jmp 0x47e624
jmp 0x47e673
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x47e673
push 0
push 0x1313
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x47e6ec
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x47e6c0
push 0x225a
push 0x1e88
push 0x2438
push 0x26ef
push 0x1a07
push 0x770
push 0xbde
push 0x1ba0
push 0xc9a
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x47e6ec
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x47e6ec
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x47e74b
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x47e723
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
push 0x6249
push 0
push dword [ebp - 0x60]
push 0x5537
call fcn.00477b02
add esp, 0x10
jmp 0x47e74b
push 0
push 0x26d1
push 0x330c
push 0x7408
push 0x6bea
push 0x14d6
push 0x4760
call fcn.0047f1bc
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x47f266
Capabilities:
Get geographical location
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce261
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x733e
mov dword [ebp - 0x54], str.czqu_ftakgjzr_coierwckq_fuqznxnp_vsvtoh_idd_kajvfd_rgk_ozynxnjno_pbkoqqo_yvey_eenkhs_xfl
cmp dword [ebp - 0x1c], 0x769d
jle 0x47f31c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
and dword [ebp - 0x14], 0
jmp 0x47f2be
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5b77
jge 0x47f2fe
and dword [ebp - 0x18], 0
jmp 0x47f2d4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5d5b
jge 0x47f2fc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x47f2cd
jmp 0x47f2b7
push 0x1bdb
push 0x1605
push 0
push 0
push 0x18d4
push 0x206e
call dword [sym.imp.USER32.dll_ToUnicode]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x47f353
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
push 0x2d52
push dword [ebp - 0x20]
push 1
push 0x4150
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
call fcn.0047f45d
add esp, 0x14
jmp 0x47f40c
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x47f3c8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x47f3b5
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x47f3b3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x47f3c6
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x47f40c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0x3e9f
push 0x645c
push dword [ebp - 0x4c]
push 0x4091
push 0x70b7
push 0x1d53
push dword [ebp - 0x50]
push 0
push 0x45e5
push 0x4c00
push 0x436d
call fcn.0047d58b
add esp, 0x2c
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x7119
jge 0x47f426
mov edx, dword [ebp - 0x54]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x47f442
or dword [ebp - 4], 0xffffffff
jmp 0x47f44c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485098
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x485108
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push 1
push 0x21bd
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004851aa
add esp, 0x2c
jmp 0x4851a6
lea eax, [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x485159
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x385
call fcn.0047e54d
add esp, 0x10
jmp 0x4851a6
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x485199
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x4851a6
push 0x124e
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x485b02
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce30b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x485d11
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x485d01
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x485cd3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x44], 0x5fe46c2e
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x48], 0xf9a0
mov dword [ebp - 0x34], 0x9da9
mov dword [ebp - 0x30], 0xbbfad0d7
mov dword [ebp - 0x58], 0x800f
push 1
lea eax, [ebp - 0x44]
push eax
push 0x2b31
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x4288
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0049102e
add esp, 0x2c
mov dword [ebp - 0x28], 0x1873
mov dword [ebp - 0x54], str.yvkja_ohmc_ortrgxae_jhwcgy_sktizlw_ikx_hpuh
cmp dword [ebp - 0x28], 0x1bb8
jle 0x485c77
and dword [ebp - 0x20], 0
jmp 0x485bf0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x64a3
jge 0x485c6d
and dword [ebp - 0x18], 0
jmp 0x485c06
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5cdf
jge 0x485c68
and dword [ebp - 0x1c], 0
jmp 0x485c1c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5317
jge 0x485c66
and dword [ebp - 0x24], 0
jmp 0x485c32
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x2ad9
jge 0x485c64
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0x24]
sar eax, cl
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x485c2b
jmp 0x485c15
jmp 0x485bff
jmp 0x485be9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x17e3
jge 0x485c91
mov edx, dword [ebp - 0x54]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x485cad
or dword [ebp - 4], 0xffffffff
jmp 0x485cb7
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0048d6d8
add esp, 0x14
jmp 0x485cff
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x485cff
push 0x3520
push 0x5372
push 0x4072
push 0x1f1b
push 0x74
push 0
call fcn.00496ad5
add esp, 0x18
jmp 0x485d0f
push 0
push 0x4b1f
call fcn.00495c2b
pop ecx
pop ecx
jmp 0x485d25
push 0x4782
push 1
push 0x808
call fcn.0047a159
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48beed
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce3bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x48bf5e
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x30d2
push dword [ebp - 0x2c]
push 1
push dword [ebp - 0x30]
push 0
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
push eax
call fcn.00495db1
add esp, 0x20
jmp 0x48c0b6
lea eax, [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0x5b1a
mov dword [ebp - 0x38], str.ivqfdg_ynvt_vpknh_dgw_qhavpiv_vlw_xhhimnnz_tdgdlr
cmp dword [ebp - 0x20], 0x5d17
jle 0x48bff3
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
and dword [ebp - 0x14], 0
jmp 0x48bf96
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1f2
jge 0x48bff3
and dword [ebp - 0x18], 0
jmp 0x48bfac
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5d93
jge 0x48bff1
and dword [ebp - 0x1c], 0
jmp 0x48bfc2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xa6
jge 0x48bfef
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0xaa47f8
call fcn.0040bbab
jmp 0x48bfbb
jmp 0x48bfa5
jmp 0x48bf8f
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5aa1
jge 0x48c013
mov edx, dword [ebp - 0x38]
mov ecx, 0xaa47f8
call fcn.0040e430
jmp 0x48c02f
or dword [ebp - 4], 0xffffffff
jmp 0x48c039
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x48c099
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x48c086
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x48c084
push 1
push 0
push 0x603e
push 1
push 1
call fcn.004761b6
add esp, 0x14
jmp 0x48c097
push 0x1eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x48c0b6
push 1
push 1
push 0x2b9
push 0xa58
push 0x73b5
push 0
call fcn.00495c4c
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493dad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x493e84
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x493e71
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x493e4c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x493e4a
push 1
push 0x4cbf
push 0x4a3b
push 0x6980
push 0x574b
push 0x4804
push 0x1ff9
push 1
push 0x647f
push 0
push 1
call fcn.004800e0
add esp, 0x2c
jmp 0x493e6f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x493e6f
push 0x1889
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x493e82
push 0
push 0x1347
push 1
call fcn.00473f01
add esp, 0xc
jmp 0x493eb7
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x38], eax
push 0
push dword [ebp - 0x30]
push 0x6234
push dword [ebp - 0x34]
push 0x2a4b
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
call fcn.0047e507
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4c812e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cf7d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004bbb6b
mov dword [ebp - 0x14], eax
cmp dword [0xaa595c], esi
jne 0x4c8221
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4c81ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4c8301
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4c8301
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c8301
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaa595c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaa5960], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaa5964], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa596c], eax
test eax, eax
je 0x4c821e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa5968], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4c8246
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c8239
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4c825b
push 4
pop eax
jmp 0x4c8303
cmp dword [ebp - 0x14], esi
je 0x4c825b
push dword [0xaa595c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4c8240
mov eax, dword [0xaa5968]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4c82b9
cmp dword [0xaa596c], edi
je 0x4c82b9
push eax
call ebx
push dword [0xaa596c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4c82b9
test eax, eax
je 0x4c82b9
call ecx
test eax, eax
je 0x4c82ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4c82ae
test byte [ebp - 8], 1
jne 0x4c82b9
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4c82e9
mov eax, dword [0xaa5960]
cmp eax, edi
je 0x4c82e6
push eax
call ebx
test eax, eax
je 0x4c82e6
call eax
mov esi, eax
test esi, esi
je 0x4c82e6
mov eax, dword [0xaa5964]
cmp eax, edi
je 0x4c82e6
push eax
call ebx
test eax, eax
je 0x4c82e6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaa595c]
call ebx
test eax, eax
je 0x4c8301
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4c8303
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b8fcb
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x109fcee4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x109fceee
pushal
call 0x109fcef4
pop ebp
sub ebp, 0x10
sub ebp, 0x9fcee4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x109fcf18
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x109fcf21
mov eax, 0x9fcee4
add eax, ebp
add eax, 0x63
mov ecx, 0x5c4
mov edx, 0xdf15c03a
xor byte [eax], dl
inc eax
dec ecx
jne 0x109fcf38
jmp 0x109fcf4b
mov cl, 0xf7
mov cl, 0xb3
push es
cmp bh, byte [edx]
cmp bh, byte [ebx + 0x3a3ac2fb]
cmp bh, byte [ecx]
test dword [edx + 0x3a3a3a3c], 0x3a3a1280
cmp cl, ch
fdivr dword [ecx]
mov cl, 0xbb
cmp bh, byte ss:[edx]
cmp bh, byte [ecx]
jmp [edx + 0x6a]