joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ebe78
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4ebee3
cmp byte [ebx + 0xd3], 0
jne 0x4ebee3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406f84
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4ebed0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4ebef0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004071dc
jmp 0x4ebef0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004071dc
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4ed6b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4ed726
mov eax, esi
call fcn.00496028
test al, al
je 0x4ed726
mov eax, dword [ebx + 0x84]
call fcn.00495c7c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ed726
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4ed71a
push 0
mov eax, dword [ebx + 0x84]
call fcn.00495c7c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0048cbf8
jmp 0x4ed726
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004ed4f0
pop esi
pop ebx
ret
Function at 0x501584
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5016ac
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00501470
mov eax, dword [esi]
call fcn.00408fd0
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4176d4]
call fcn.00409198
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004048f4
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004048f4
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00408fd0
mov dword [ebp - 0xc], eax
mov eax, dword [0x5b485c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004f00ac
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404c78
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00408fd0
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004eff9c
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004efd54
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004f00a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5016b3
lea eax, [ebp - 4]
mov edx, dword [0x4176d4]
call fcn.004092bc
ret

Function at 0x52c994
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00407da8
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x52c9b9
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.00407c34
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x52c9d8
mov eax, ebx
mov edx, dword [esp]
call fcn.00407da8
pop ecx
pop edx
pop ebx
ret
Function at 0x406a97
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x56a2b5f0
push 0
push ebx
call ebp
add al, 0x89
push ecx
sbb al, 0x8b
push ecx
adc al, 0x66
mov esi, dword [eax + 0x38]
mov edx, dword [edx*4 + 0x2240c240]
lea edx, [edx + esi - 1]
xor edi, dword [eax - 0x8dfae77]
sal byte [esi - 0x1b7695af], cl
sub byte [esi - 0x75], ah
invalid

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
stc
jge 0x407f0d
mov dword [ebp - 0x23], eax
jbe 0x407f43
xchg ebp, eax
dec esi
xor dword [esi - 0x70], eax
fld qword [ebp + 8]
fcomp qword [0x40c230]
inc eax
dec ebp
sbb byte [ebx - 0x75], dl
pop ebp
pushfd
push esi
adc dh, dh
push edi
fnstsw ax
mov edi, eax
cld
mov dword [ecx], esi
test ah, 5
mov edi, ebx
jp 0x407f33
fld qword [ebp + 8]
aad 0xe0
fstp qword [ebp + 8]
mov dword [ecx], 0x94790001
cmp byte [ebp + 0xc], cl
mov edx, dword [ebp + 0x65]
lea esp, [ebp - 0x14]
push eax
push ecx
push edx
call dword [0x84d718]
adc eax, 0x84d718
test byte [eax], al
fstp qword [ebp + 8]
fisttp qword [esp + ebp*8 + 0x22]
sbb eax, 0x40c231
xor al, ah
or al, 0xdf
xor edx, eax
inc eax
add byte [edx], dh
les ecx, [edi + ebx*8]
loopne 0x407f4d
xor dword [ebx + edi*2 - 0x5e], eax
lea edx, [ebp - 0xb0cc4b0]
loop 0x407f40
push 0xffffffffffffffec
in al, dx
fdivr st(4), st(0)
xor dl, al
inc eax
add bh, bl
loopne 0x407f64
les ebx, [ecx]
jnp 0x407fba
fld qword [ebp - 0x14]
fmul qword [0x40c310]
push edi
inc ebp
in al, dx
invalid
lea ecx, [edi]
push eax
cmp esi, eax
jae 0x40801d
mov dl, byte [esi]
mov byte [edi], dl
inc edi
jno 0x408003
invalid
dec esi
fld st(0)
fcomp qword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0xffffffffffffffe0
les edx, [bx + 0x7b]
out 0xdd, eax
pop ebp
pop edx
mov dword [esp + edi*8 - 0x15], esp
add bl, ch
fmul dword [ebx + 0x348d1045]
lea esi, [eax + ebx]
inc esi
sbb bl, byte [eax*4 - 0x6ffc4959]
mov eax, dword [ebp + 0x10]
Function at 0x454114
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x454142
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x454160
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045407e
jmp 0x454160
mov eax, dword [esi + 0x14]
test eax, eax
je 0x454160
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0045407e
test edi, edi
mov eax, edi
jne 0x45414a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x487b1c]
test ecx, ecx
je 0x454213
jmp 0x454113
ret 8

Function at 0x45c4e9
Capabilities:
Encode data using xor

Disassembly:
push ebx
adc ah, byte [ecx - 0x4a74e0ba]
mov dh, 0x56
push esi
test eax, 0x573e4e06
jecxz 0x45c528
pop ebx
cmp al, 0x8c
stosd dword es:[edi], eax
mov edi, 0x6daec1a5
mov ch, 0x6d
pop edx
pop ds
das
mov byte [edi + ebx*8], bh
and al, 0x91
loope 0x45c521
sbb al, 0x72
sahf
xchg esi, eax
cmp ebp, ebx
mov dh, 0xaa
xchg ah, al
fidivr dword [0xea7055b2]
ljmp 0xeecb
stc
mov esp, 0xe0eecb23
and dh, byte [esi + 0x4a]
jbe 0x45c574
or al, 0x8d
sbb ebx, dword [esi - 0xc2482b1]
cmc
pop esi
push ecx
dec esp
sub ebx, dword [esi]
mov eax, dword [0xd3ff5b88]
mov ebp, 0x27c73ec5
div dword [eax - 0x67c0646e]
xor ah, bl
jo 0x45c533
xor edx, dword [eax + 0x2f1109a3]
sub byte [eax - 0x25], bl
push 0xffffffffffffffc6
and al, 0xec
sti
and esi, ecx
das
add bl, byte [ebx + esi*4]
jno 0x45c5c0
cmc
hlt
retf
jmp 0x8abe835f
Function at 0x406004
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x422a1c], esi
push edi
jne 0x40603e
mov ecx, 0x422a18
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x40601a
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422e18
jl 0x406015
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406073
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a18]
xor eax, esi
inc ecx
dec edx
jne 0x406056
pop edi
pop esi
not eax
ret 0xc

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x7eaf3b7c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x4f8c5b23
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40df40
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ddb8
mov eax, dword [0x6390e4]
cmp byte [eax], 0
je 0x40dfbc
mov eax, dword [0x638d58]
call fcn.00403804
call fcn.004030e8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040a6fc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40e004
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40dff2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x638cd4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x63c7f8]
call fcn.00406870
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40e8bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40e992
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040537c
lea eax, [ebp - 4]
call fcn.004057cc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405774
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40e97c
mov eax, ebx
call fcn.00402f8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40e975
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405774
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40e95f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40e9a4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e95f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e97c
mov eax, dword [ebp - 0x10]
call fcn.00402fa8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e999
lea eax, [ebp - 4]
call fcn.004052e4
ret

Function at 0x4211bc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00420ef8
dec esi
jne 0x4211de
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x422364
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x63e9f0
cmp dword [edi], 0
jne 0x4223e0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x63e9ec]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b3af8
mov ecx, 2
call fcn.0040317c
mov edx, 0x42233c
lea eax, [esi + 5]
call fcn.0042235c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042235c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4223b5
mov dword [0x63e9ec], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424c7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405774
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x424cd4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6392fc]
mov dl, 1
mov eax, dword [0x424634]
call fcn.0040e10c
call fcn.00404c78
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042473c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x426014
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42601a
ret
Function at 0x44fc2c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x63ec94], 0
je 0x44fd75
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x63902c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x44fd75
mov eax, dword [0x63ec98]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x63ec94]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44fd44
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x63ec94]
call fcn.0041a0b4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44fd3c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x44fd3c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x44fd3c
mov eax, dword [ebp - 0x14]
call fcn.0045a45c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44fd3c
push ebp
call fcn.0044fbe8
pop ecx
test al, al
jne 0x44fd3c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00404600
test al, al
je 0x44fd3c
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00404600
cmp byte [ebp - 1], 0
je 0x44fd3c
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x44fd3c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x63ec98]
call fcn.0044f358
inc edi
dec ebx
jne 0x44fc91
mov eax, dword [0x63ec98]
cmp dword [eax + 8], 0
jle 0x44fd5c
mov eax, dword [0x63ec98]
call fcn.0044f410
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44fd75
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044fa4c
pop ecx
test al, al
jne 0x44fd75
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f814
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x6392e8]
cmp byte [eax + 0xc], 0
je 0x45f981
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f97a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x63eca4], 0
jne 0x45f868
push 0x45f988
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45f990
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63eca4], eax
cmp dword [0x4b486c], 0
jne 0x45f963
push 0x45f9a0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4b486c], eax
cmp dword [0x4b486c], 0
je 0x45f963
push 0x45f9ac
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63eca8], eax
push 0x45f9bc
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecac], eax
push 0x45f9d0
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecb0], eax
push 0x45f9e8
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecb4], eax
push 0x45fa00
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecb8], eax
push 0x45fa14
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecbc], eax
push 0x45fa2c
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecc0], eax
push 0x45fa44
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecc4], eax
push 0x45fa60
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ecc8], eax
push 0x45fa6c
mov eax, dword [0x4b486c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63eccc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f981
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x46e414
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46e42b
add esp, 0xfffffff0
call fcn.00404728
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421290
mov eax, dword [0x638f30]
cmp word [eax + 2], 0
jne 0x46e453
mov eax, dword [0x638f30]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047002c
mov eax, dword [0x63906c]
cmp word [eax + 2], 0
jne 0x46e46d
mov eax, dword [0x63906c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00470238
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4179e4]
call fcn.004043d4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4179e4]
call fcn.004043d4
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x4179e4]
call fcn.004043d4
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x425e50]
call fcn.0042dca4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x46e624
mov eax, dword [0x638da8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e078
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x47090c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x638da8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ef64
test eax, eax
je 0x46e574
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a750
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ef98
test eax, eax
je 0x46e588
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405554
mov byte [ebx + 0xd4], 0
push ebx
push 0x46fb3c
call fcn.00422420
mov dword [ebx + 0xc8], eax
mov eax, dword [0x638b3c]
cmp byte [eax], 0
jne 0x46e5d9
mov eax, ebx
call fcn.0046e768
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00470ae4
mov eax, ebx
call fcn.00471648
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46e619
call fcn.00404780
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9e2c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405764
xor eax, eax
push ebp
push 0x4a9f67
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4a9f37
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405774
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a420
test al, al
jne 0x4a9ea7
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403754
lea eax, [ebp - 0x1d0]
call fcn.004034f0
call fcn.004030e8
push dword [0x63fd3c]
push 0x4a9f80
push dword [0x63fd40]
push 0x4a9f80
push dword [0x63fd44]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00405678
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004afcc8
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405a94
call fcn.00403e4c
call fcn.004030e8
lea eax, [ebp - 0x1d0]
call fcn.0040381c
call fcn.004030e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a9f41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9f6e
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405308
lea eax, [ebp - 4]
call fcn.004052e4
ret
Function at 0x4ab118
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405764
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ab280
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004aa2c0
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004aa2e0
mov ebx, eax
jmp 0x4ab252
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405554
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a54c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409724
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409724
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040570c
je 0x4ab232
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405554
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409724
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409724
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040570c
jne 0x4ab247
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004aa300
mov ebx, eax
test ebx, ebx
jne 0x4ab193
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab287
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405308
lea eax, [ebp - 4]
call fcn.004052e4
ret