joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afb00
Capabilities:
Capture microphone audio
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xd4], 0
mov eax, dword [ebp + 8]
mov cx, word [eax]
mov word [ebp - 0x18], cx
mov edx, dword [ebp + 8]
mov ax, word [edx + 2]
mov word [ebp - 0x16], ax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov ax, word [edx + 0xc]
mov word [ebp - 0xc], ax
xor ecx, ecx
mov word [ebp - 8], cx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0xc]
shl eax, 3
mov word [ebp - 0xa], ax
push 0x10000
push 0
mov ecx, dword [0x18a0254]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0xffffffffffffffff
push 0x553494
call dword [sym.imp.WINMM.dll_waveInOpen]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x4afb9b
mov eax, 3
jmp 0x4afd52
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0xc]
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx + 2]
cdq
idiv ecx
imul eax, eax, 0x898
mov dword [0x553480], eax
mov edx, dword [0x553480]
push edx
push 0x32
mov eax, dword [0x553494]
push eax
call fcn.004afdd0
add esp, 0xc
mov dword [ebp - 0xd4], eax
cmp dword [0x553484], 0
je 0x4afbf6
mov ecx, dword [0x553484]
push ecx
call fcn.004b6bd9
add esp, 4
mov dword [0x553484], 0
push 1
mov edx, dword [0x553480]
push edx
call fcn.004bb221
add esp, 8
mov dword [0x553484], eax
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [eax + 0x553380]
test ecx, ecx
je 0x4afd2b
push 0x1000
lea edx, [ebp - 0xcc]
push edx
push 0x553380
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [0x553498], eax
cmp dword [0x553498], 0xffffffff
jne 0x4afc5a
mov dword [0x553498], 0
or eax, 0xffffffff
jmp 0x4afd52
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax - 0x44], 0x52
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x44], 0x49
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x44], 0x46
mov eax, 1
imul eax, eax, 3
mov byte [ebp + eax - 0x44], 0x46
push str.WAVEfmt
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004b5e60
add esp, 8
mov edx, 1
imul edx, edx, 7
mov byte [ebp + edx - 0x3c], 0x20
mov dword [ebp - 0x34], 0x10
mov ax, word [ebp - 0x18]
mov word [ebp - 0x30], ax
mov cx, word [ebp - 0x16]
mov word [ebp - 0x2e], cx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov cx, word [ebp - 0xc]
mov word [ebp - 0x24], cx
mov dx, word [ebp - 0xa]
mov word [ebp - 0x22], dx
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x64
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x20], 0x61
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x20], 0x74
mov eax, 1
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x61
mov dword [ebp - 0x1c], 0
push 0x2c
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [0x553498]
push edx
call dword [sym.imp.KERNEL32.dll__lwrite]
mov eax, dword [0x553494]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
je 0x4afd50
mov dword [ebp - 0xd4], 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4afdd0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4afe09
mov eax, 1
jmp 0x4afefd
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x553490], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp + 0xc]
shl ecx, 5
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4afe51
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
jmp 0x4afefd
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x55348c], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x55348c]
mov dword [ebp - 4], edx
mov eax, dword [0x553490]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
jmp 0x4afe8d
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jge 0x4afefa
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 4], eax
push 0x20
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4afec6
mov dword [ebp - 0x1c], 2
push 0x20
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4afee6
mov dword [ebp - 0x1c], 2
mov edx, dword [ebp - 4]
add edx, 0x20
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
jmp 0x4afe84
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x4aff10
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x553494], 0
je 0x4aff76
cmp dword [0x553498], 0
je 0x4aff3f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [0x553498]
push ecx
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp dword [0x553484], 0
je 0x4aff63
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
mov eax, dword [0x553484]
push eax
call fcn.004b8640
add esp, 0xc
push 0x20
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x553494]
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
xor eax, eax
pop ebp
ret
Function at 0x4aff80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004b0250
push 0x14
push 0x2000
call fcn.004b03a0
add esp, 8
mov dword [0x5534b0], eax
cmp dword [0x5534b0], 0
jne 0x4affc6
push str.woPlay__waveBlocks0
push 5
call fcn.00440830
add esp, 8
jmp 0x4b0154
mov dword [0x5534d4], 0x14
mov dword [0x5534d8], 0
mov dword [ebp - 0x48], 0
jmp 0x4affec
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
mov ecx, dword [0x5534d4]
cmp dword [ebp - 0x48], ecx
jge 0x4b000c
mov edx, dword [ebp - 0x48]
shl edx, 5
mov eax, dword [0x5534b0]
mov dword [eax + edx + 0x10], 1
jmp 0x4affe3
push 0x5534bc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4f66fc
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041a470
add esp, 8
mov dword [0x5534b8], eax
cmp dword [0x5534b8], 0
jne 0x4b0063
push str.woPlay__hFile0
push 5
call fcn.00440830
add esp, 8
mov edx, dword [0x5534b0]
push edx
call fcn.004b0430
add esp, 4
mov dword [0x5534b0], 0
jmp 0x4b0154
mov eax, dword [0x5534b8]
push eax
push 0x2c
push 1
lea ecx, [ebp - 0x44]
push ecx
call fcn.004b8e47
add esp, 0x10
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], edx
mov ax, word [ebp - 0x22]
mov word [ebp - 0xa], ax
mov cx, word [ebp - 0x2e]
mov word [ebp - 0x16], cx
xor edx, edx
mov word [ebp - 8], dx
mov eax, 1
mov word [ebp - 0x18], ax
movzx ecx, word [ebp - 0xa]
movzx edx, word [ebp - 0x16]
imul ecx, edx
sar ecx, 3
mov word [ebp - 0xc], cx
movzx eax, word [ebp - 0xc]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push 0x30000
push 0x5534d4
push 0x4b0350
lea ecx, [ebp - 0x18]
push ecx
push 0xffffffffffffffff
push 0x5534b4
call dword [sym.imp.WINMM.dll_waveOutOpen]
test eax, eax
je 0x4b012b
mov edx, dword [0x5534b8]
push edx
call fcn.00419ca0
add esp, 4
mov dword [0x5534b8], 0
mov eax, dword [0x5534b0]
push eax
call fcn.004b0430
add esp, 4
mov dword [0x5534b0], 0
mov dword [0x5534b4], 0
push str.woPlay__waveOutOpen
push 5
call fcn.00440830
add esp, 8
jmp 0x4b0154
mov dword [0x5534dc], 0x400
mov dword [ebp - 0x48], 0
jmp 0x4b0147
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0x14
jge 0x4b0154
call fcn.004b01a0
jmp 0x4b013e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret

Function at 0x4b01a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5534b8], 0
je 0x4b01b6
cmp dword [0x5534b4], 0
jne 0x4b01bb
jmp 0x4b0241
cmp dword [0x5534dc], 0
je 0x4b0241
cmp dword [0x5534d4], 2
jle 0x4b0241
mov eax, dword [0x5534b8]
push eax
push 0x400
push 1
push 0x5534e0
call fcn.004b8e47
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b01fa
mov dword [0x5534dc], 0
cmp dword [0x5534dc], 0
je 0x4b0241
cmp dword [ebp - 4], 0x400
jae 0x4b0229
mov ecx, 0x400
sub ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 4]
add edx, 0x5534e0
push edx
call fcn.004b6780
add esp, 0xc
push 0x400
push 0x5534e0
mov eax, dword [0x5534b4]
push eax
call fcn.004b0450
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4b28a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [ebp - 0x1c], 0
jne 0x4b28c9
jmp 0x4b2a4d
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x553a24]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
push ecx
push 0
mov edx, dword [0x553a24]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x470
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x28], eax
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x474
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x28], eax
push 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4d1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x28], eax
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
push eax
call fcn.004b1e20
add esp, 4
mov dword [ebp - 0x14], 0xa
mov dword [ebp - 0x10], 0xa
mov ecx, 0xff
imul ecx, ecx, 0
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ecx + edx + 0x557a60]
test eax, eax
jne 0x4b29fe
mov ecx, 0xff
shl ecx, 0
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ecx + edx + 0x557a60]
test eax, eax
jne 0x4b29fe
mov ecx, 0xff
shl ecx, 1
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ecx + edx + 0x557a60]
test eax, eax
jne 0x4b29fe
push 1
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
sub ecx, 0xe
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [0x553a20]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x4b2a2f
push 1
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
sub ecx, 0x36
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [0x553a20]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [0x553a20]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4b4840
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x304]
push ecx
call fcn.004b5e60
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.004b5e60
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
call fcn.00429ab0
add esp, 4
push 0x4f6ee8
lea edx, [ebp - 0x204]
push edx
call fcn.004b5e70
add esp, 8
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0xffffffff
jne 0x4b48c4
jmp 0x4b4982
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ebp + edx - 0x418]
cmp eax, 0x2e
jne 0x4b48db
jmp 0x4b4959
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e60
add esp, 8
lea eax, [ebp - 0x104]
push eax
call fcn.00429ab0
add esp, 4
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov eax, dword [0x4f9208]
add eax, 1
mov dword [0x4f9208], eax
mov ecx, dword [ebp - 0x444]
and ecx, 0x10
je 0x4b493f
lea edx, [ebp - 0x104]
push edx
call fcn.004b4840
add esp, 4
jmp 0x4b4959
mov eax, dword [ebp - 0x428]
imul eax, eax, 0xffffffff
add eax, dword [ebp - 0x424]
add eax, dword [0x4f920c]
mov dword [0x4f920c], eax
lea ecx, [ebp - 0x444]
push ecx
mov edx, dword [ebp - 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4b48c4
mov eax, dword [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret

Function at 0x4b4990
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b5f60
add esp, 4
mov dword [ebp - 0x108], eax
jmp 0x4b49d6
mov edx, dword [ebp - 0x108]
sub edx, 1
mov dword [ebp - 0x108], edx
cmp dword [ebp - 0x108], 0
je 0x4b4a47
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x108]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x4b4a45
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.004b6e08
add esp, 8
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0xff
jae 0x4b4a1d
jmp 0x4b4a22
call fcn.004b64ae
mov edx, dword [ebp - 0x10c]
mov byte [ebp + edx - 0x104], 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x110], eax
jmp 0x4b49c7
jmp 0x4b49c7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4b4ed0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x100
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.QTMLInitTermMutex_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x4b4f10
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x558ef0]
test eax, eax
jle 0x4b4f24
inc eax
mov dword [0x558ef0], eax
jmp 0x4b4ff1
push str.QuickTime.qts
call fcn.004b5aa0
add esp, 4
mov dword [0x558ef4], eax
test eax, eax
jne 0x4b4f47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
jmp 0x4b4fb9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._CallComponentFunctionWithStorage
push eax
call esi
test eax, eax
mov dword [0x4f6ef8], eax
je 0x4b4fb4
mov edx, dword [0x558ef4]
push str._CallComponent
push edx
call esi
test eax, eax
mov dword [0x4f6ef4], eax
je 0x4b4fb4
mov eax, dword [0x558ef4]
push str.theQuickTimeDispatcher
push eax
call esi
test eax, eax
mov dword [0x4f6ef0], eax
je 0x4b4fb4
mov ecx, dword [esp + 0x10c]
mov dword [0x4f6eec], 0
push ecx
call fcn.004b4e00
mov esi, eax
add esp, 4
test si, si
jne 0x4b4fb9
inc dword [0x558ef0]
jmp 0x4b4ff1
mov esi, 0xfffff7d2
mov eax, dword [0x558ef4]
test eax, eax
je 0x4b4fd3
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x558ef4], 0
mov eax, 0x4b4e20
mov dword [0x4f6eec], 0x4b5010
mov dword [0x4f6ef4], eax
mov dword [0x4f6ef8], eax
mov dword [0x4f6ef0], eax
test edi, edi
je 0x4b5003
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, si
pop edi
pop esi
add esp, 0x100
ret

Function at 0x4b5080
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 8]
push str.QTMLInitTermMutex_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x4b50bf
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x558ef0]
test eax, eax
jg 0x4b50d4
mov dword [0x558ef0], 0
jmp 0x4b510e
dec eax
test eax, eax
mov dword [0x558ef0], eax
jg 0x4b510e
call fcn.004b4e10
mov edx, dword [0x558ef4]
mov eax, 0x4b4e20
push edx
mov dword [0x4f6eec], 0x4b5010
mov dword [0x4f6ef4], eax
mov dword [0x4f6ef8], eax
mov dword [0x4f6ef0], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x4b5120
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x100
ret
Function at 0x4c57e4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004bc255
mov dword [ebp - 0x14], eax
cmp dword [0x559c70], edi
jne 0x4c58d5
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4c5862
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4c59b5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4c59b5
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c59b5
push eax
call ebx
push 0x4d0434
push esi
mov dword [0x559c70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x559c74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x559c78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x559c80], eax
test eax, eax
je 0x4c58d2
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x559c7c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4c58fa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c58ed
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4c590f
push 4
pop eax
jmp 0x4c59b7
cmp dword [ebp - 0x14], edi
je 0x4c590f
push dword [0x559c70]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4c58f4
mov eax, dword [0x559c7c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4c596d
cmp dword [0x559c80], esi
je 0x4c596d
push eax
call ebx
push dword [0x559c80]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4c596d
test eax, eax
je 0x4c596d
call ecx
test eax, eax
je 0x4c5962
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4c5962
test byte [ebp - 8], 1
jne 0x4c596d
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4c599d
mov eax, dword [0x559c74]
cmp eax, esi
je 0x4c599a
push eax
call ebx
test eax, eax
je 0x4c599a
call eax
mov edi, eax
test edi, edi
je 0x4c599a
mov eax, dword [0x559c78]
cmp eax, esi
je 0x4c599a
push eax
call ebx
test eax, eax
je 0x4c599a
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x559c70]
call ebx
test eax, eax
je 0x4c59b5
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4c59b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b6253
leave
ret
Function at 0x18f7a92
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
pushal
call fcn.018f7aa1

Function at 0x18f8262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.018f826e

Function at 0x18f88e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.018f88fa

Function at 0x18f8961
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.018f8974
Function at 0x406ab7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x40
xor edx, edx
pop eax
div dword [ebp + 0x18]
xor edi, edi
cmp dword [ebp + 0x18], edi
jbe 0x406b02
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], edi
lea esi, [eax - 1]
xor eax, eax
inc eax
xor edx, edx
mov ecx, edi
call fcn.0044ff20
and eax, dword [ebp + 0x14]
and edx, dword [ebp - 4]
mov ecx, ebx
call fcn.0044ff20
xor dword [ebp + 0xc], eax
xor dword [ebp + 0x10], edx
inc edi
add ebx, esi
cmp edi, dword [ebp + 0x18]
jb 0x406ad9
pop esi
pop ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
pop edi
leave
ret 0x14

Function at 0x40d2c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 9
push str.EFI_PART
push esi
call fcn.00450140
cmp eax, 9
jne 0x40d31b
mov edx, dword [esi + 0x10]
xor ecx, ecx
or eax, 0xffffffff
mov dword [esi + 0x10], ecx
cmp dword [esi + 0xc], ecx
jbe 0x40d304
push ebx
push edi
mov edi, dword [esi + 0xc]
movzx ebx, byte [ecx + esi]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x464600]
inc ecx
cmp ecx, edi
jb 0x40d2e7
pop edi
pop ebx
not eax
mov dword [esi + 0x10], edx
cmp edx, eax
jne 0x40d31b
xor eax, eax
inc eax
cmp dword [esi + 0x18], eax
jne 0x40d31b
cmp dword [esi + 0x1c], 0
je 0x40d31d
xor al, al
ret
Function at 0x4237b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
rdtsc
push 0
push 0xf4240
push dword [0x48d0fc]
mov edi, eax
push dword [0x48d0f8]
mov ebx, edx
call fcn.0044fdb0
push 0
push dword [ebp + 8]
push edx
push eax
call fcn.00443810
mov esi, eax
mov ecx, edx
add esi, edi
adc ecx, ebx
rdtsc
cmp edx, ecx
jl 0x4237ec
jg 0x4237f8
cmp eax, esi
jb 0x4237ec
pop edi
pop esi
pop ebx
pop ebp
ret 4