joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4806d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4806d8
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b7650
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b76ee
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b76b2
cmp byte [ebx + 0x11], 0
jne 0x4b76b2
cmp byte [ebx + 0x24], 0
jne 0x4b76b2
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b76d3
lea edx, [ebp - 4]
mov eax, dword [0x5177b4]
call fcn.0040f074
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48fa40]
call fcn.00426c5c
call fcn.004091ec
jmp 0x4b76d3
lea edx, [ebp - 8]
mov eax, dword [0x5177b4]
call fcn.0040f074
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48fa40]
call fcn.00426c5c
call fcn.004091ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b76f5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409bd0
ret

Function at 0x4b7f08
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b7f56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b74d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7f6f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b7f78
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b74d0
dec esi
jne 0x4b7f9a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4d7554
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
pop ebp
xor eax, eax
mov eax, dword fs:[eax + 0x18]
mov eax, dword [eax + 0xc0]
test eax, eax
jne 0x4d7579
xor ecx, ecx
mov eax, dword [0x516708]
lea edx, [esp + 4]
int 0x2e
ret 4
xor ecx, ecx
mov eax, dword [0x516708]
lea edx, [esp + 4]
call dword fs:[0xc0]
cmp dword [0x5166d4], 0
jne 0x4d7598
add esp, 4
ret 4

Function at 0x4d75c4
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
pop ebp
xor eax, eax
mov eax, dword fs:[eax + 0x18]
mov eax, dword [eax + 0xc0]
test eax, eax
jne 0x4d75e9
xor ecx, ecx
mov eax, dword [0x5166f0]
lea edx, [esp + 4]
int 0x2e
ret 0x10
xor ecx, ecx
mov eax, dword [0x5166f0]
lea edx, [esp + 4]
call dword fs:[0xc0]
cmp dword [0x5166d4], 0
jne 0x4d7608
add esp, 4
ret 0x10
Function at 0x4d7944
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
pop ebp
xor eax, eax
mov eax, dword fs:[eax + 0x18]
mov eax, dword [eax + 0xc0]
test eax, eax
jne 0x4d7969
xor ecx, ecx
mov eax, dword [0x516734]
lea edx, [esp + 4]
int 0x2e
ret 0x10
xor ecx, ecx
mov eax, dword [0x516734]
lea edx, [esp + 4]
call dword fs:[0xc0]
cmp dword [0x5166d4], 0
jne 0x4d7988
add esp, 4
ret 0x10
Function at 0x4da504
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4da50c
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4da71e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x4da54f
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x51678c]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040aa74
jmp 0x4da6eb
test ebx, 0xc0000000
je 0x4da597
lea edx, [ebp - 0x10]
mov eax, dword [0x5169c4]
call fcn.004da73c
mov eax, dword [ebp - 0x10]
call fcn.0040a5f4
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x5167ac]
call fcn.004da73c
mov eax, dword [ebp - 0x14]
call fcn.0040a5f4
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_2
test eax, eax
je 0x4da597
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x4da5dc
cmp ebx, 0xbb7
ja 0x4da5dc
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x5169c0]
call fcn.004da73c
mov eax, dword [ebp - 0x18]
call fcn.0040a5f4
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4da5e1
or edi, 0x800
jmp 0x4da5e1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4da6e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x4da684
xor eax, eax
push ebp
push 0x4da67d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040aa04
mov eax, dword [esi]
call fcn.0040a060
mov ebx, eax
test ebx, ebx
jbe 0x4da666
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x4da64d
mov eax, esi
call fcn.0040a128
mov word [eax + ebx*2 - 2], 0x20
jmp 0x4da661
cmp di, 0xa
jne 0x4da661
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.0040adc0
dec ebx
test ebx, ebx
ja 0x4da630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da6c7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree_1
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x5169c8]
call fcn.004da73c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040aa74
push dword [ebp - 0x1c]
push 0x4da738
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.004d9fe0
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.0040ac90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da6eb
cmp dword [ebp - 8], 0
je 0x4da6e3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da725
lea eax, [ebp - 0x24]
call fcn.00409b70
lea eax, [ebp - 0x20]
call fcn.00409b94
lea eax, [ebp - 0x1c]
call fcn.00409b70
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00409c00
ret
Function at 0x4da73c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00409fec
mov eax, ebx
call fcn.0040a140
mov eax, dword [ebx]
call fcn.0040a06c
test eax, eax
jle 0x4da76d
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x4da762
pop esi
pop ebx
ret
Function at 0x4e0b88
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e0c4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
mov eax, ebx
call fcn.0040a5f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e0c36
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
call fcn.0040a6b8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, ebx
call fcn.0040a5f4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4e0c36
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4e0c60
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4e0c36
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0c53
lea eax, [ebp - 4]
call fcn.00409b94
ret

Function at 0x4e0ea8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x4e0ef4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.004e1d9c
test al, al
jne 0x4e0eea
cmp word [edi], 0x5a4d
jne 0x4e0eea
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x4e0eea
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e0f00
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e109c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x516a50], 0
jne 0x4e117d
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4e10ef
push 0x10000
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameW_1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileW
mov esi, eax
jmp 0x4e1120
push 0x105
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov ebx, eax
push 0x104
push ebx
push esi
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.kernel32.dll_CreateFileA
mov esi, eax
push ebx
call sub.kernel32.dll_LocalFree_1
cmp esi, 0xffffffff
je 0x4e117d
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4e114b
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x4e115d
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x4e1177
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4e4fa0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffedc
mov ebp, ecx
mov esi, edx
mov edi, eax
xor ebx, ebx
push 0x1c
lea eax, [esp + 4]
push eax
push edi
call sub.kernel32.dll_VirtualQuery_1
cmp eax, 0x1c
jne 0x4e501c
cmp dword [esp + 0x10], 0x1000
jne 0x4e501c
cmp dword [esp + 4], 0
je 0x4e501c
push 0x104
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_GetModuleFileNameA
test eax, eax
je 0x4e501c
mov eax, dword [esp + 4]
mov dword [esi], eax
mov eax, dword [esi]
cmp word [eax], 0x5a4d
jne 0x4e501c
mov eax, dword [esi]
mov edx, dword [esi]
add edx, 0x3c
add eax, dword [edx]
cmp dword [eax], 0x4550
jne 0x4e501c
mov edx, dword [esi]
add edx, dword [eax + 0x78]
mov dword [ebp], edx
cmp dword [ebp], 0
setne bl
mov eax, ebx
add esp, 0x124
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e6ee4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp dword [0x5173b0], 0
je 0x4e6f29
push esp
push 0x40
push 4
mov eax, dword [0x5173b0]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4e6f29
mov eax, dword [0x5173b0]
mov edx, dword [0x5173b4]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x5173b0]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
mov dword [0x5173b0], eax
cmp dword [0x5173b8], 0
je 0x4e6f6d
push esp
push 0x40
push 4
mov eax, dword [0x5173b8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4e6f6d
mov eax, dword [0x5173b8]
mov edx, dword [0x5173bc]
mov dword [eax], edx
push esp
mov eax, dword [esp + 4]
push eax
push 4
mov eax, dword [0x5173b8]
push eax
call sub.kernel32.dll_VirtualProtect
xor eax, eax
mov dword [0x5173b8], eax
xor eax, eax
mov dword [0x51de0c], eax
pop edx
ret
Function at 0x4e87c4
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e8925
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [edi + 0x10], 0
je 0x4e8907
cmp word [edi + 0x1e], 2
jb 0x4e8907
movzx edx, word [edi + 0x1e]
sub edx, 2
sar edx, 1
jns 0x4e8818
adc edx, 0
mov eax, esi
call fcn.0040ab30
lea eax, [ebp - 8]
push eax
movzx eax, word [edi + 0x1e]
sub eax, 2
push eax
mov eax, dword [esi]
push eax
mov eax, dword [edi + 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4e884d
mov eax, dword [ebp - 8]
add eax, 2
movzx edx, word [edi + 0x1e]
cmp eax, edx
je 0x4e8851
xor ebx, ebx
jmp 0x4e8853
mov bl, 1
test bl, bl
je 0x4e8907
mov eax, dword [esi]
call fcn.0040a99c
mov edx, eax
mov eax, esi
call fcn.0040aa04
mov edx, dword [esi]
mov eax, 0x4e8944
call fcn.004d96f8
test al, al
je 0x4e888e
mov eax, esi
mov ecx, 4
mov edx, 1
call fcn.0040adc0
jmp 0x4e8907
mov edx, dword [esi]
mov eax, 0x4e895c
call fcn.004d9768
test al, al
je 0x4e88f4
push 0x104
lea eax, [ebp - 0x212]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x218]
push eax
mov eax, dword [esi]
mov ecx, 0x7fffffff
mov edx, 0x15
call fcn.0040ad78
mov eax, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040aa58
mov edx, dword [ebp - 0x21c]
mov eax, esi
pop ecx
call fcn.0040ac08
jmp 0x4e8907
mov eax, dword [esi]
call fcn.0040a99c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e892c
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00409bd0
ret
Function at 0x4e8988
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409c64
xor eax, eax
push ebp
push 0x4e8b08
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040a5f4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, ebx
and dl, 0xff
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x170]
call fcn.0040a23c
lea eax, [ebp - 0x174]
mov edx, 0xff00
and edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x170]
mov cl, 2
call fcn.0040a248
lea edx, [ebp - 0x170]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040a340
mov eax, dword [ebp - 8]
mov edx, 0x4e8b24
call fcn.0040a574
jne 0x4e8a53
mov bl, 1
jmp 0x4e8add
mov eax, dword [ebp - 8]
mov edx, 0x4e8b34
call fcn.0040a574
jne 0x4e8a66
mov bl, 2
jmp 0x4e8add
mov eax, dword [ebp - 8]
mov edx, 0x4e8b44
call fcn.0040a574
jne 0x4e8a85
mov eax, ebx
call fcn.0041440c
test ax, ax
jne 0x4e8a85
mov bl, 3
jmp 0x4e8add
mov eax, dword [ebp - 8]
mov edx, 0x4e8b44
call fcn.0040a574
jne 0x4e8aa4
mov eax, ebx
call fcn.0041440c
test ax, ax
jbe 0x4e8aa4
mov bl, 4
jmp 0x4e8add
lea eax, [ebp - 0x17c]
mov edx, dword [ebp - 4]
call fcn.0040aa74
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.00421cd0
mov eax, dword [ebp - 0x178]
mov edx, 0x4e8b54
call fcn.004d909c
test al, al
je 0x4e8adb
mov bl, 1
jmp 0x4e8add
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8b0f
lea eax, [ebp - 0x17c]
mov edx, 2
call fcn.00409bd0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c00
ret
Function at 0x4e8b70
Capabilities:
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409c64
xor eax, eax
push ebp
push 0x4e8ca2
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x4010
cmp byte [ebp - 9], 0
je 0x4e8bbb
or esi, 1
jmp 0x4e8bbe
or esi, 0
test bl, bl
je 0x4e8c2c
lea eax, [ebp - 0x174]
mov edx, dword [ebp - 4]
call fcn.0040aa74
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
call fcn.00421d0c
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040a730
mov edx, 0x4e8cc0
mov eax, dword [ebp - 8]
call fcn.004d9048
test al, al
jne 0x4e8c1a
mov edx, 0x4e8cd4
mov eax, dword [ebp - 8]
call fcn.004d9048
test al, al
jne 0x4e8c1a
xor ebx, ebx
jmp 0x4e8c1c
mov bl, 1
test bl, bl
je 0x4e8c2c
or esi, 0x100
or esi, 0x8000
push esi
push 0x160
lea eax, [ebp - 0x169]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a5f4
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
push eax
push edi
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x4e8c5a
xor ebx, ebx
jmp 0x4e8c77
test bl, bl
je 0x4e8c66
mov ebx, dword [ebp - 0x169]
jmp 0x4e8c77
push 0
mov eax, dword [ebp - 0x165]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIcon
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8ca9
lea eax, [ebp - 0x174]
mov edx, 2
call fcn.00409bd0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c00
ret
Function at 0x4f905c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f9175
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004ddb68
test al, al
je 0x4f9157
mov eax, dword [ebp - 4]
cmp byte [eax + 0x81], 0
jne 0x4f9129
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x54]
xor eax, eax
push ebp
push 0x4f9122
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x78], 0
je 0x4f90fe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x4f90fe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x94]
test eax, eax
je 0x4f910c
mov eax, dword [ebp - 4]
push eax
push 0x4f8f50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x78]
mov edx, dword [eax]
call dword [edx + 0x94]
push eax
call sub.user32.dll_EnumThreadWindows
jmp 0x4f910c
mov eax, dword [ebp - 4]
push eax
push 0x4f8f50
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9157
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x58]
ret
lea eax, [ebp - 0x10]
mov edx, dword [0x5173f4]
mov ecx, 0
call fcn.0040a2cc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.0040aa74
mov ecx, dword [ebp - 0xc]
mov edx, 0x30000
mov eax, dword [ebp - 4]
call fcn.004dd4a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f917c
lea eax, [ebp - 0x10]
call fcn.00409b94
lea eax, [ebp - 0xc]
call fcn.00409b70
ret
Function at 0x5001e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5001ec
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x50035b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x54], 0
jne 0x500324
mov eax, ebx
call fcn.004ddb68
test al, al
je 0x500324
mov eax, dword [ebx + 0x38]
mov edx, dword [eax]
call dword [edx + 0x94]
mov esi, eax
call sub.kernel32.dll_GetCurrentProcessId
cmp esi, eax
je 0x50024c
lea eax, [ebp - 0x30]
call fcn.004e01b0
cmp byte [ebp - 0x20], 0
je 0x50025c
cmp dword [ebx + 0x3c], 0x80000000
jb 0x50025c
mov eax, dword [ebx + 0x3c]
call fcn.004e0ea8
mov dword [ebx + 0x54], eax
jmp 0x500310
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x38]
call fcn.0040da50
lea ecx, [ebp - 8]
mov edx, 0x10
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xbc]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x5002ef
push 2
lea ecx, [ebp - 0xa]
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x500310
cmp word [ebp - 0xa], 0x5a4d
jne 0x500310
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x3c]
add edx, 0x3c
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x500310
mov eax, dword [ebx + 0x3c]
add eax, dword [ebp - 0x10]
mov dword [ebx + 0x54], eax
push 4
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x54]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x120]
test al, al
je 0x5002e8
cmp dword [ebp - 0x10], 0x4550
je 0x500310
xor eax, eax
mov dword [ebx + 0x54], eax
jmp 0x500310
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.004dd4a8
cmp dword [ebx + 0x54], 0
jne 0x500324
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.004dd4a8
mov ebx, dword [ebx + 0x54]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500362
lea eax, [ebp - 0x34]
call fcn.00409b70
lea eax, [ebp - 0x30]
mov edx, dword [0x4dfc1c]
call fcn.0040b17c
lea eax, [ebp - 8]
call fcn.0040da38
lea eax, [ebp - 4]
call fcn.0040da38
ret
Function at 0x503a7c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x503b79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5175e0]
mov byte [eax], 1
mov eax, 8
call fcn.00406e04
mov ebx, eax
mov dword [ebx], esi
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0x5039f4
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_CreateThread_1
mov esi, eax
test esi, esi
jne 0x503b16
mov eax, ebx
call fcn.00406e20
call sub.kernel32.dll_GetLastError_2
push eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4eb1a4]
call fcn.004f04c0
mov edx, eax
test edx, edx
je 0x503b0d
sub edx, 0xffffff90
mov eax, edi
call fcn.0040da50
jmp 0x503b5b
lea ecx, [ebp - 0x10]
mov dl, 1
mov eax, esi
call fcn.004f2798
mov edx, dword [ebp - 0x10]
mov al, 5
call fcn.004efcf8
mov ebx, eax
mov byte [ebx + 0x4c], 1
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x50], eax
lea eax, [ebp - 0x14]
call fcn.0050a1bc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x6c]
call fcn.0040da50
mov eax, edi
mov edx, ebx
test edx, edx
je 0x503b56
sub edx, 0xffffff90
call fcn.0040da50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503b80
lea eax, [ebp - 0x14]
call fcn.0040da38
lea eax, [ebp - 0x10]
call fcn.0040da38
ret