joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490964
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x4252f8]
call fcn.0042b914
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x490b37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x490b16
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0042cda0
mov eax, dword [ebp - 8]
call fcn.0042bee4
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.00426a94
cmp byte [ebp + 8], 0
je 0x4909fe
xor edx, edx
mov eax, ebx
call fcn.0048f8ec
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0048f8ec
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.0048f81c
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x490a3a
xor edx, edx
mov eax, ebx
call fcn.0048f8ec
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.0048f81c
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0048f8ec
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004195b8
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.0042bee4
pop edx
call fcn.00426e80
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.0048f81c
dec eax
test eax, eax
jl 0x490aee
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0048f7c0
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.0048f918
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
xor edx, edx
mov dl, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.0048f918
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
mov dl, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.00419590
mov eax, dword [ebp - 8]
call fcn.0042bee4
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x490a84
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0048f7c0
cmp byte [ebp + 0xc], 0
je 0x490b16
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.0042e0b8
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0048efb0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490b3e
mov eax, dword [ebp - 8]
call fcn.004042f0
ret
Function at 0x4a0980
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a0b02
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004a0d74
mov eax, ebx
call fcn.004265c0
dec al
je 0x4a09c4
dec al
je 0x4a09ca
jmp 0x4a09d0
mov byte [ebp - 0x77], 2
jmp 0x4a09d4
mov byte [ebp - 0x77], 1
jmp 0x4a09d4
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0042654c
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x4a0a21
cmp edi, 0x20000000
jne 0x4a0a2d
mov dword [ebp - 0x88], 0x40000000
jmp 0x4a0a37
mov eax, edi
call fcn.00425e08
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.00426588
test al, 1
je 0x4a0a49
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.00426588
test al, 2
je 0x4a0a5b
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.00426588
test al, 4
je 0x4a0a6d
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.00426588
test al, 8
je 0x4a0a7f
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.004264d8
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040a4f4
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.004265f0
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.004262dc
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x4a0adc
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004a0da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0b09
lea eax, [ebp - 0x94]
call fcn.00405140
ret
Function at 0x4a1aa8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 0x4e3320
xor eax, eax
push ebp
push 0x4a1c2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4e6e00], 1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1c11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a1c3c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x4a1b03
cmp dword [ebx], 0x20
jae 0x4a1b03
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x4a1b2f
push 0x4a1c4c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x4a1bfa
cmp dword [ebx], 0x20
jae 0x4a1bfa
xor eax, eax
mov dword [ebx], eax
jmp 0x4a1bfa
mov byte [0x4e6e00], 2
lea eax, [ebp - 8]
mov edx, 0x4a1c64
call fcn.004051d8
lea eax, [ebp - 8]
call fcn.00405660
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405610
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4a1bfa
mov eax, ebx
call fcn.00402b60
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a1bf3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405610
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4a1bdd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4a1c74
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4a1bdd
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
and eax, 0xffff
mov ecx, 0xa
xor edx, edx
div ecx
mov byte [0x4e6e00], al
cmp byte [0x4e6e00], 0
jne 0x4a1bdd
mov byte [0x4e6e00], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1bfa
mov eax, dword [ebp - 0x10]
call fcn.00402b90
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1c18
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4a4920
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4a4928
push ebx
push esi
push edi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4a4b0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 1]
call fcn.004030a0
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0x41
jb 0x4a4ada
cmp byte [ebp - 1], 0x5a
ja 0x4a4ada
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403660
mov edx, 0x4a4b18
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403630
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004053b4
mov eax, dword [ebp - 0xc]
call fcn.00405610
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4a4ada
lea eax, [ebp - 0x1c]
call fcn.004cadc4
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 8]
mov edx, 0x4a4b24
call fcn.0040a1cc
mov eax, dword [ebp - 8]
call fcn.00409ffc
test al, al
jne 0x4a49aa
push 0x4a4b34
push 0x4a4b3c
mov ecx, dword [0x4e5668]
mov dl, 1
mov eax, dword [0x418c9c]
call fcn.0041d1d8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a4a1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0041cfd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4a23
mov eax, dword [ebp - 0x10]
call fcn.004042f0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4b11
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405164
lea eax, [ebp - 0x1c]
call fcn.00405140
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405164
ret
Function at 0x4a6910
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x230], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x242], 0
jne 0x4a695d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x232], 1
je 0x4a695d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x232], 2
jne 0x4a6acf
mov eax, dword [ebp - 4]
call fcn.004a639c
test al, al
je 0x4a6acf
mov eax, dword [ebp - 4]
call fcn.00449c94
push eax
call sub.user32.dll_HideCaret
xor eax, eax
push ebp
push 0x4a6ac8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00449c94
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a6ab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a6a8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00442ebc
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00442e78
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a6a6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00447c98
mov eax, dword [ebp - 4]
cmp byte [eax + 0x241], 0
je 0x4a6a12
mov eax, dword [ebp - 4]
call fcn.004a6734
push 0xcc0020
push 1
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00442ebc
push eax
mov eax, dword [ebp - 4]
call fcn.00442e78
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x20c]
mov esi, dword [eax*4 + 0x4e3324]
push esi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6a75
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x230], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c33f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x4c341b
mov ecx, edi
mov dl, 1
mov eax, dword [0x4c21d0]
call fcn.004c2234
mov dword [edi + 0x294], eax
jmp 0x4c3524
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x4c345c
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x4c3451
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.004c29a4
jmp 0x4c3492
xor edx, edx
mov eax, edi
call fcn.004c29a4
jmp 0x4c3492
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x4c3489
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.004c29a4
jmp 0x4c3492
mov dl, 0x64
mov eax, edi
call fcn.004c29a4
cmp byte [edi + 0x22b], 0
je 0x4c34a4
cmp byte [edi + 0x22a], 0
je 0x4c34b6
cmp byte [edi + 0x22b], 0
jne 0x4c34c1
cmp byte [edi + 0x22a], 0x64
jne 0x4c34c1
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x4c34f1
mov eax, dword [0x4e44dc]
mov eax, dword [eax]
call fcn.0046333c
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x4c34f1
cmp byte [edi + 0x224], 0
jne 0x4c34f1
cmp byte [edi + 0x2a0], 0
je 0x4c34c1
test bl, bl
jne 0x4c350b
cmp byte [edi + 0x224], 0
jne 0x4c350b
cmp byte [edi + 0x2a0], 0
je 0x4c341d
cmp byte [edi + 0x2a0], 0
jne 0x4c351d
cmp byte [edi + 0x224], 0
jne 0x4c3524
mov eax, edi
call fcn.004c3818
pop edi
pop esi
pop ebx
ret
Function at 0x4cadc4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [esp + 0x105]
push eax
push 0
push 0x4cae08
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [esp + 0x105]
call fcn.0040a638
add esp, 0x20c
pop ebx
ret

Function at 0x4cb0bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov ecx, dword [0x4e44dc]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4ca334]
call fcn.0045baf0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb278
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4e4740]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00461478
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x1ec]
mov edx, edi
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
call fcn.0045c8e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
call fcn.0045c914
mov eax, dword [0x4e4740]
mov eax, dword [eax]
call fcn.00460ebc
mov edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + 0x48]
sar edx, 1
jns 0x4cb157
adc edx, 0
mov eax, dword [ebp - 4]
call fcn.00442be4
mov eax, dword [0x4e4740]
mov eax, dword [eax]
call fcn.00460eb0
mov edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + 0x4c]
sar edx, 1
jns 0x4cb17a
adc edx, 0
mov eax, dword [ebp - 4]
call fcn.00442c08
test bl, bl
je 0x4cb1cd
mov eax, dword [edi + 0xc]
mov edx, dword [0x4654c8]
call fcn.00404488
test al, al
jne 0x4cb1cd
mov eax, dword [edi + 0xc]
mov edx, dword [0x42543c]
call fcn.00404488
test al, al
jne 0x4cb1cd
push 0
mov eax, dword [edi + 0xc]
call fcn.004cac80
push eax
mov eax, dword [ebp - 4]
call fcn.00449c94
push eax
call sub.user32.dll_SetWindowRgn
mov eax, dword [ebp - 4]
mov byte [eax + 0x2fc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2fe], 0
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax + 0x2fd], dl
mov eax, dword [ebp - 4]
call fcn.0045fe60
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x88]
mov eax, dword [0x4e44dc]
mov eax, dword [eax]
call fcn.00462fc0
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4cb217
mov eax, dword [0x4e44dc]
mov eax, dword [eax]
call fcn.0046333c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2fe], 0
jne 0x4cb254
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
imul eax, esi, 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x4cb250
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4cb20b
jmp 0x4cb254
pop edx
pop eax
jg 0x4cb20b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb27f
mov eax, dword [0x4e4740]
mov eax, dword [eax]
xor edx, edx
call fcn.00461478
mov eax, dword [ebp - 4]
call fcn.004042f0
ret
Function at 0x4cb544
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405600
mov eax, dword [ebp - 8]
call fcn.00405600
xor eax, eax
push ebp
push 0x4cb64f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4cb627
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0047a6a0
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 4]
call fcn.004051d8
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.0047a6a0
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 8]
call fcn.004051d8
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, 0x4cb660
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00405610
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00405610
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x50]
call fcn.0040a424
mov eax, dword [ebp - 0x50]
call fcn.00405610
mov dword [ebp - 0x2c], eax
test bl, bl
je 0x4cb5fe
mov dword [ebp - 0x28], 3
jmp 0x4cb605
mov dword [ebp - 0x28], 5
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4cb627
cmp byte [ebp + 8], 0
je 0x4cb627
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4cb627
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb656
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00405164
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405164
ret

Function at 0x4cb668
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov eax, dword [0x4e4764]
cmp dword [eax], 2
je 0x4cb681
mov byte [esp], 1
jmp 0x4cb756
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4cb6bf
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4cb6bf
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4cb756
mov eax, 0x400
call fcn.00402b60
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x4cb74f
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4e3ab4
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4cb745
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4cb741
mov byte [esp], 1
jmp 0x4cb745
inc edi
dec ebx
jne 0x4cb728
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402b90
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4cb860
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cb8ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cb8cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004cb7f8
mov eax, dword [ebp - 0xc]
call fcn.00405610
push eax
call sub.kernel32.dll_GetFileAttributesA
test eax, eax
jns 0x4cb8b5
call fcn.0040422c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb8d6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4d7bc8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403800
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4dd204
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4dd31d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x14]
mov eax, dword [0x4e44dc]
mov eax, dword [eax]
call fcn.00463bb8
mov eax, dword [ebp - 0x14]
call fcn.00405610
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4dd307
push 2
push 0
push 0xfffffffffffffff6
push esi
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0xf]
xor ecx, ecx
mov edx, 0xb
call fcn.00403800
push 0
lea eax, [ebp - 4]
push eax
push 0xa
lea eax, [ebp - 0xf]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
mov edx, 0x4dd32c
lea eax, [ebp - 0xf]
call fcn.0040a51c
test eax, eax
jne 0x4dd2bc
push 2
push 0
push 0xfffffffffffffff2
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x4e8004
push esi
call sub.kernel32.dll_ReadFile_1
mov bl, 1
jmp 0x4dd301
mov edx, 0x4dd338
lea eax, [ebp - 0xf]
call fcn.0040a51c
test eax, eax
jne 0x4dd301
push 2
push 0
push 0xfffffffffffffff2
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x4e8004
push esi
call sub.kernel32.dll_ReadFile_1
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
sub eax, dword [0x4e8004]
mov dword [0x4e8004], eax
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd324
lea eax, [ebp - 0x14]
call fcn.00405140
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4014b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4014cc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret 4

Function at 0x4014d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push edi
xor eax, eax
mov ecx, 0x49
lea edi, [esp + 0xc]
mov dword [esp + 8], 0x128
push eax
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40156c
lea eax, [esp + 8]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40156c
push ebp
mov ebp, dword [esp + 0x138]
push esi
lea ecx, [esp + 0x34]
push ecx
call fcn.00401b89
push eax
call fcn.00401aeb
push ebp
mov esi, eax
call fcn.00401b89
push eax
call fcn.00401aeb
mov edi, eax
push edi
push esi
call fcn.00401cb0
add esp, 0x18
test eax, eax
je 0x40154c
mov edx, dword [esp + 0x18]
push edx
call fcn.004014b0
push esi
call fcn.00401a6a
push edi
call fcn.00401a6a
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401514
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x128
ret 4