joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9490
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4c94ac
cmp dword [esi + 4], 0
je 0x4c94d9
test byte [ebx + 0x55], 1
jne 0x4c94cb
mov eax, ebx
call fcn.004c80e8
test eax, eax
jne 0x4c94cb
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4c95e9
mov edx, esi
mov eax, ebx
call fcn.004c8fb0
jmp 0x4c95e9
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c95e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004cb260
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004c5c70
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004c9490
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004cb260
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c95e9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cfb0c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x51204c]
cmp byte [eax + 0xc], 0
je 0x4cfc79
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cfc72
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x51373c], 0
jne 0x4cfb60
push 0x4cfc80
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x4cfc88
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51373c], eax
cmp dword [0x50d960], 0
jne 0x4cfc5b
push 0x4cfc98
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x50d960], eax
cmp dword [0x50d960], 0
je 0x4cfc5b
push 0x4cfca4
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513740], eax
push 0x4cfcb4
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513744], eax
push 0x4cfcc8
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513748], eax
push 0x4cfce0
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51374c], eax
push 0x4cfcf8
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513750], eax
push 0x4cfd0c
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513754], eax
push 0x4cfd24
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513758], eax
push 0x4cfd3c
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51375c], eax
push 0x4cfd58
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513760], eax
push 0x4cfd64
mov eax, dword [0x50d960]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x513764], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfc79
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d522c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d5304
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x513778], 0
jne 0x4d52e8
lea eax, [ebp - 4]
mov edx, 0x4d531c
call fcn.0047ef20
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0047f338
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4d52e8
mov eax, ebx
call fcn.0047d108
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d52e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x4d52cb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4d532c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x4d52cb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x513778], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d52e8
mov eax, dword [ebp - 0xc]
call fcn.0047d128
ret
mov ebx, dword [0x513778]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d530b
lea eax, [ebp - 4]
call fcn.0047ee88
ret

Function at 0x4e42c4
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x51379c], 0
jne 0x4e42e7
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x4e4238
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x51379c], eax
ret

Function at 0x4e6090
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4e6162
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4e6134
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x4e6123
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.0047d36c
mov eax, dword [ebp - 4]
call fcn.004e5fcc
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e612a
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
Function at 0x4e6174
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e61e6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4e61ba
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.0047f078
jmp 0x4e61c1
mov eax, ebx
call fcn.0047ee88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e61ed
cmp dword [ebp - 8], 0
je 0x4e61dd
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4e621c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4e62be
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x4e6291
mov edx, ebx
mov eax, dword [0x4a4120]
call fcn.004a8708
test al, al
je 0x4e6281
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.004a8618
call fcn.0047e9b0
jmp 0x4e62c5
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x4e624c
mov ecx, dword [0x51237c]
mov dl, 1
mov eax, dword [0x46c1b0]
call fcn.00470a88
call fcn.0047e904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e62c5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e62cc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4e6324
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e632b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4e6334
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x4e6389
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6390
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4e6400
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4e6475
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004e5fcc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.004a86dc
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4e645f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e647c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4e6484
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4e64f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004e5fcc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x4e64e3
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6500
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4e8924
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e8940
call fcn.004e99c8
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4e895c
test bl, 1
je 0x4e895c
call fcn.004ed5c8
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4e8aa8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004e9564
test byte [ebp + 0xd], 0xc0
jne 0x4e8acc
mov eax, dword [0x50e914]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4e8ad9
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4e8b06
je 0x4e8b18
sub ecx, 0x100
je 0x4e8b26
sub ecx, 0x100
je 0x4e8b2d
sub ecx, 0x100
je 0x4e8b1f
jmp 0x4e8b34
sub ecx, 0x600
je 0x4e8b2d
sub ecx, 0x100
je 0x4e8b18
jmp 0x4e8b34
mov edi, 1
jmp 0x4e8b39
mov edi, 2
jmp 0x4e8b39
mov edi, 4
jmp 0x4e8b39
mov edi, 5
jmp 0x4e8b39
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4e8b60
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x50e38c]
test al, 0x80
je 0x4e8b59
mov ebx, 0x80
jmp 0x4e8b72
mov ebx, 1
jmp 0x4e8b72
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e8b72
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4e8b84
je 0x4e8b8d
dec eax
je 0x4e8b96
jmp 0x4e8b9f
mov dword [ebp - 4], bind
jmp 0x4e8bae
mov dword [ebp - 4], 0x40000000
jmp 0x4e8bae
mov dword [ebp - 4], 0xc0000000
jmp 0x4e8bae
push 1
call fcn.004e995c
pop ecx
mov ebx, eax
jmp 0x4e8c9e
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4e8bca
sub eax, 0x10
je 0x4e8bd1
sub eax, 0x10
je 0x4e8bda
sub eax, 0x10
je 0x4e8be3
jmp 0x4e8be3
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4e8bea
mov dword [ebp - 8], 1
jmp 0x4e8bea
mov dword [ebp - 8], 2
jmp 0x4e8bea
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4e8c57
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4e8c4c
test byte [ebp + 0xd], 1
je 0x4e8c47
mov ebx, 0x50
jmp 0x4e8c4c
mov ebx, 2
push ebx
call fcn.004e995c
pop ecx
mov ebx, eax
jmp 0x4e8c9e
mov edi, esi
push edi
call fcn.004e8a0c
pop ecx
test eax, eax
je 0x4e8c6b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4e8c77
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004e9684
add esp, 8
mov ebx, eax
inc eax
jne 0x4e8c9e
push 4
call fcn.004e995c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004e9598
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ed560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4ed5c2
call fcn.004ed510
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004e76d8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004e76d8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4ed640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x50f820], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4ed71a
cmp dword [0x50f81c], 0
jne 0x4ed71a
cmp dword [0x50fa00], 0
je 0x4ed6d4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004ed410
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ed6ba
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004ed410
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ed6ba
lea ebx, [ebp - 0x84]
jmp 0x4ed6bb
inc ebx
call fcn.004ed5fc
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4ed755
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x50f824
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004e76d8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x50f827
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4ed755
cmp dword [0x50f81c], 0
je 0x4ed734
cmp dword [0x50f81c], 0xffffffff
je 0x4ed755
push esi
call dword [0x50f81c]
pop ecx
mov eax, dword [0x50f820]
test eax, eax
je 0x4ed755
cmp dword [0x50f820], 0xffffffff
je 0x4ed755
cmp byte [eax], 0
je 0x4ed755
push esi
push eax
call fcn.004ed560
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f42e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4f430e
mov eax, ebx
call fcn.004f4d98
cmp dword [ebx + 0x3c], 0
je 0x4f4307
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4f437f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4f4371
cmp dword [ebx + 8], 0
je 0x4f4330
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4f4342
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4f4371
cmp dword [ebx + 8], 0
je 0x4f4323
cmp eax, 3
je 0x4f4355
dec eax
jne 0x4f4323
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4f4323
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4f4323
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4f439d
cmp dword [ebx + 0x10], 0xcc
je 0x4f439d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004f43a8
pop ebx
ret
Function at 0x300015be
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
fisttp word cs:[edx]
add byte [edx - 0x11fff520], dh
loopne 0x300015b5
add byte [edx], ah
loope 0x300015b9
add byte [eax], al
add byte [eax], al
add al, ch
invalid
add eax, 0xe9000000
rol dword [eax], 0
add byte [ebp - 0x75], dl
in al, dx
sub esp, 0x14
push ebx
push esi
push edi
push 0x3000166c
push 0x3001fa10
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x300015f3
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x3002dd90
push ebx
call edi
test esi, esi
mov dword [0x3002dd90], esi
je 0x3003e7f1
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [0x300b4d4c], 0x44bf19b1
pop ebx
leave
ret
mov dword [0x3002dd90], 0xbb40e64e
jmp 0x30001651

Function at 0x30001bc7
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.30001c6c
mov eax, 0x30000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x30001c48
cmp dword [ebp - 0x1c], 5
jb 0x30001c18
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x30001c5c
call fcn.30001ca2
test eax, eax
jl 0x3003ea5b
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.30001d24
add ebp, 0x78
leave
ret
cmp dword [ebp - 0x10], 1
je 0x3003ea46
jmp 0x30001c18
cmp dword [ebp - 0x18], 0
jbe 0x30001c18
jmp 0x30001c14
cmp dword [ebp - 0x1c], 4
ja 0x30001c14
je 0x30001c54
jmp 0x30001c18
mov byte [0x300b7fe0], 1
jmp 0x30001c36
Function at 0x30058716
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea edx, [ebp - 0x210]
push edx
push 0x2001f
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
push 0
push ecx
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x208]
mov esi, eax
test esi, esi
jne 0x30058791
test ecx, ecx
je 0x3005877f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [ebp - 0x210]
mov esi, eax
mov dword [ebp - 0x208], ecx
je 0x3005879f
test ecx, ecx
je 0x30058865
push ecx
jmp 0x3005885f
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x204]
push eax
push 0
push ecx
mov dword [ebp - 0x20c], 0x100
call esi
test eax, eax
jne 0x30058827
lea ecx, [ecx]
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x208]
call fcn.30058716
mov edi, eax
test edi, edi
jne 0x30058879
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x208]
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x204]
push ecx
push edi
push edx
mov dword [ebp - 0x20c], 0x100
call esi
test eax, eax
je 0x300587d5
mov edi, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x30058842
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x218]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x30058865
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x3005888a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4
Function at 0x407fb0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x407fbd
xor eax, eax
pop esi
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jne 0x407fcf
pop esi
ret
cmp ecx, 1
jne 0x407fdd
cmp byte [esi], 0x5c
jne 0x407fdd
xor eax, eax
pop esi
ret
push esi
call fcn.00407d60
add esp, 4
test eax, eax
je 0x407ff1
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop esi
ret

Function at 0x4013dc
Capabilities:
Encode data using xor

Disassembly:
push 0x4015e4
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esp + edx*2 - 0x36], cl
out 0xac, al
mov dword [0x819e49dd], eax
xor byte [ebx + 0x35], 0xf0
invalid