joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e9ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x46e9dd
dec al
je 0x46ea19
dec al
je 0x46ea5d
dec al
je 0x46eac8
jmp 0x46eb52
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x46eb52
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x46e9ed
jmp 0x46eb52
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46eb52
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x46ea29
jmp 0x46eb52
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46eb52
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x46ea8b
xor ebp, ebp
jmp 0x46ea9c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x46eaa5
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x46ea6d
jmp 0x46eb52
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x46eb52
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x46eb20
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0046bf54
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x46eadc
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x478ef8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417aac]
call fcn.00404b0c
xor eax, eax
push ebp
push 0x47903c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a8b74], 0
jne 0x478f4b
mov ecx, dword [0x4a98a8]
mov dl, 1
mov eax, dword [0x407638]
call fcn.0040c008
call fcn.00403ba4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402e08
mov eax, ebx
call fcn.004049dc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x47904c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405bd4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004049ec
test eax, eax
jle 0x478fe3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x478fdc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004043f0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004043d8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004084ec
test eax, eax
jne 0x478fdc
mov ebx, 0x15
jmp 0x478fe8
mov ebx, 0x10
jmp 0x478fe8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4a8b74]
call fcn.00478e50
mov eax, dword [ebp - 8]
call fcn.00478e50
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405bec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479043
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040418c
lea eax, [ebp - 0x10]
mov edx, dword [0x417aac]
call fcn.00404bdc
ret

Function at 0x47b548
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.0040701c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
jb 0x47b57c
cmp dword [esp + 8], 1
jb 0x47b57c
cmp dword [esp + 0x10], 2
je 0x47b580
xor eax, eax
jmp 0x47b582
mov al, 1
add esp, 0x94
ret

Function at 0x47b58c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.0040701c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
jne 0x47b5c0
cmp dword [esp + 8], 0
jne 0x47b5c0
cmp dword [esp + 0x10], 2
je 0x47b5c4
xor eax, eax
jmp 0x47b5c6
mov al, 1
add esp, 0x94
ret
Function at 0x47e788
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0047e228
test byte [ebx + 0x23d], 4
jne 0x47e81d
mov edx, esp
mov eax, ebx
call fcn.00442798
push esp
mov eax, ebx
call fcn.00449414
push eax
push 0
mov eax, ebx
test eax, eax
je 0x47e7bd
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x47e7ee
mov ecx, dword [0x4a9af4]
mov dl, 1
mov eax, dword [0x478b10]
call fcn.0040c008
call fcn.00403ba4
mov eax, ebx
call fcn.0047ed5c
cmp byte [ebx + 0x57], 0
jne 0x47e824
mov eax, ebx
call fcn.00449618
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47e824
push 0
mov eax, ebx
call fcn.00449618
push eax
call sub.user32.dll_ShowWindow
jmp 0x47e824
mov eax, ebx
call fcn.00446598
add esp, 0x10
pop ebx
ret

Function at 0x4835cc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x483633
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.004047b4
push edi
mov eax, dword [ebp - 8]
call fcn.00404628
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004041bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48363a
lea eax, [ebp - 8]
call fcn.00404168
ret

Function at 0x487d68
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x487df2
xor edx, edx
push ebp
push 0x487dd3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x487df2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48bc94
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48bcc2
mov eax, ebx
call fcn.0048c748
cmp dword [ebx + 0x40], 0
je 0x48bcbb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48bd33
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x48bd25
cmp dword [ebx + 8], 0
je 0x48bce4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48bcf6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48bd25
cmp dword [ebx + 8], 0
je 0x48bcd7
cmp eax, 3
je 0x48bd09
dec eax
jne 0x48bcd7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48bcd7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48bcd7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x48bd51
cmp dword [ebx + 0x14], 0xcc
je 0x48bd51
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048bd5c
pop ebx
ret

Function at 0x49c598
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404618
mov eax, dword [ebp - 8]
call fcn.00404618
xor eax, eax
push ebp
push 0x49c6b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00404628
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x49c6c4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404628
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x49c69a
xor eax, eax
push ebp
push 0x49c693
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x49c673
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x49c677
xor eax, eax
jmp 0x49c679
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c69a
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c6bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040418c
ret
Function at 0x49c6cc
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404618
mov eax, dword [ebp - 8]
call fcn.00404618
mov eax, dword [ebp - 0xc]
call fcn.00404618
mov eax, dword [ebp + 0xc]
call fcn.00404618
xor eax, eax
push ebp
push 0x49c83b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00404628
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x49c84c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404628
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49c818
xor edx, edx
push ebp
push 0x49c811
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00404628
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404628
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00404628
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x49c7fa
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x49c7f1
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x49c7f5
xor eax, eax
jmp 0x49c7f7
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c818
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c842
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040418c
lea eax, [ebp + 0xc]
call fcn.00404168
ret
Function at 0x49c854
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x49c91c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x49c920
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x49c91c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49c913
xor eax, eax
push ebp
push 0x49c90c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c913
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49cb14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49cd28
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402800
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49cb92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x49cb7c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404360
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cb99
mov eax, dword [ebp - 8]
call fcn.00402820
ret

Function at 0x49e03c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00402e08
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x49e076
cmp byte [ebp - 0xa], 0x31
jne 0x49e074
mov bl, 1
jmp 0x49e076
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f6b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044991c
test al, al
je 0x49f76d
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x49f74b
cmp word [esi + 0x5da], 0
je 0x49f705
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x49f722
cmp dword [ebp - 4], 0
jbe 0x49f71e
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x49f722
xor ebx, ebx
jmp 0x49f724
mov bl, 1
test bl, bl
jne 0x49f76d
mov eax, dword [0x4a9c30]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x49f76d
mov eax, dword [0x4a9c30]
mov eax, dword [eax]
call fcn.004629e8
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x49f76d
cmp byte [esi + 0x584], 0
jne 0x49f76d
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0047eb94
cmp eax, 4
jne 0x49f6e2
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1918
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4a1920
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a1ac0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x4a1ad4
call fcn.00404200
lea eax, [ebp - 0xc]
mov edx, 0x4a1ae0
call fcn.00404200
lea eax, [ebp - 0x10]
mov edx, 0x4a1af0
call fcn.00404200
lea eax, [ebp - 0x14]
mov edx, 0x4a1afc
call fcn.00404200
lea eax, [ebp - 0x18]
mov edx, 0x4a1b0c
call fcn.00404200
lea eax, [ebp - 0x1c]
mov edx, 0x4a1b18
call fcn.00404200
lea eax, [ebp - 0x20]
mov edx, 0x4a1b28
call fcn.00404200
lea eax, [ebp - 0x24]
mov edx, 0x4a1b38
call fcn.00404200
lea eax, [ebp - 0x28]
mov edx, 0x4a1b44
call fcn.00404200
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x4a1ad4
push 0x4a1b50
push 0x4a1b5c
push 0x4a1b68
push 0x4a1b78
push 0x4a1b84
push 0x4a1b94
push 0x4a1ba0
lea eax, [ebp - 4]
mov edx, 0x10
call fcn.004044e8
mov eax, dword [ebx + 0x364]
mov edx, dword [eax]
call dword [edx + 0xc8]
cmp al, 1
jne 0x4a1a19
lea eax, [ebp - 4]
mov edx, 0x4a1bb4
call fcn.00404430
mov eax, dword [ebx + 0x368]
mov edx, dword [eax]
call dword [edx + 0xc8]
cmp al, 1
jne 0x4a1a38
lea eax, [ebp - 4]
mov edx, 0x4a1bd0
call fcn.00404430
mov eax, dword [ebx + 0x364]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4a1a5c
mov eax, dword [ebx + 0x368]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a1aa5
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404628
push eax
lea edx, [ebp - 0x30]
mov eax, dword [0x4a9c30]
mov eax, dword [eax]
call fcn.004631a4
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00408da0
lea eax, [ebp - 0x2c]
mov edx, 0x4a1be4
call fcn.00404430
mov eax, dword [ebp - 0x2c]
call fcn.00404628
push eax
push 0x4a1bf4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1ac7
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.0040418c
ret

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x40c650
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40cb08
call fcn.0040c94c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40c6b0
cmp eax, 0xffffffff
je 0x40c6b0
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40c6a9
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40c6a9
cmp edx, 0x10000000
jae 0x40c6a9
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40c6a6
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40c730
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40c76e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40c766
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40c770
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40c756
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40c850
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c87f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c87f
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219