joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406930
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c568
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4276f8]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
lea ecx, [ebp - 0x20]
call fcn.004066f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x20]
call fcn.004068d0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4069c1
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00406720
mov eax, dword [ebp - 0x230]
jmp 0x406a60
mov dword [ebp - 0x10], 0x100
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x406a2e
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00406930
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x406a25
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x234], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00406720
mov eax, dword [ebp - 0x234]
jmp 0x406a60
mov dword [ebp - 0x10], 0x100
jmp 0x4069c8
lea ecx, [ebp - 0x20]
call fcn.00406810
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x23c]
call fcn.004067b0
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00406720
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0041b02a
mov esp, ebp
pop ebp
ret 4
Function at 0x407060
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x407069
xor ecx, ecx
jne 0x407069
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x40708a
mov eax, 0xd
jmp 0x4070e5
xor eax, eax
jne 0x407071
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x40709b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x40acd0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 4
mov eax, dword [ebp - 4]
push eax
push 0x40b7b0
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x40], 0
jne 0x40ad16
push 0
push 1
push 0x464
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040d1a0
jmp 0x40ad23
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x40b020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41cb36
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4276f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push str.8BA048BA_1981_47d2_B367_1E92D411FAAF
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40b09d
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x24
push 0x41fff0
push 0x41fff8
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.0040d220
cmp eax, 6
jne 0x40b098
push 0x420028
call sub.OSUtil.dll_Ordinal_10
add esp, 4
jmp 0x40b09d
jmp 0x40b11e
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
push 0
push 0
call fcn.004088b0
mov ecx, eax
call fcn.00409e00
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jge 0x40b11e
lea ecx, [ebp - 0x18]
call fcn.0040a2b0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
push edx
push 0x420050
lea eax, [ebp - 0x18]
push eax
call fcn.0040cf00
add esp, 0xc
push 0x30
push 0x420084
lea ecx, [ebp - 0x18]
call fcn.00409e00
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.0040d220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4136f0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
call fcn.004137b0
movzx eax, al
test eax, eax
je 0x413703
xor al, al
jmp 0x413760
cmp dword [0x427894], 0
je 0x413719
mov ecx, dword [0x427894]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x427890], 1
push 0
push 4
push 0
push 0x413830
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [0x427894], eax
cmp dword [0x427894], 0
jne 0x413751
mov byte [0x427890], 0
xor al, al
jmp 0x413760
mov edx, dword [0x427894]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop ebp
ret

Function at 0x413cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov ecx, 0x427770
call fcn.00416dd0
mov dword [ebp - 0x1c], eax
push 0x420350
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x413d17
push 0x420358
movzx edx, word [ebp + 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x413d17
xor eax, eax
jmp 0x413de6
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x413d35
xor eax, eax
jmp 0x413de6
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x413d53
xor eax, eax
jmp 0x413de6
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x413d74
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x413de6
mov ecx, dword [ebp - 0x14]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x413d97
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x413de6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x41abbc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x427930], 0
push esi
jne 0x41ab2a
call fcn.0041aa3e
test eax, eax
je 0x41ab6d
mov eax, dword [0x427930]
cmp eax, 1
jne 0x41ab4b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41ab6d
pop esi
ret
push eax
call dword [0x427938]
test eax, eax
jne 0x41abb5
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41ab71
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x427930]
call dword [0x427938]
mov edi, eax
test edi, edi
je 0x41ab96
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41abb2
mov edi, esi
add esi, 0xff0
push edi
push dword [0x427930]
call dword [0x427934]
add edi, 0x10
cmp edi, esi
jb 0x41ab9e
mov eax, edi
pop edi
pop esi
ret
jmp 0x41ab17

Function at 0x41b02a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4276f8]
jne 0x41b034
repz ret
jmp fcn.0041b811
Function at 0x405420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.004d98e0
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40548a
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4054fd
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.004d98e0
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4054f3
push 6
call fcn.004d8e21
add esp, 4
jmp 0x405505
mov eax, dword [ebp - 4]
jmp 0x405505
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412002
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x41203b
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x412029
mov al, 1
jmp 0x412083
cmp dword [ebx + 0x54], ecx
jne 0x412032
mov al, 2
jmp 0x412083
cmp dword [ebx + 0x7c], ecx
jmp 0x412083
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x412050
mov al, 4
jmp 0x412083
cmp ecx, 5
jne 0x412070
cmp ebx, 0
jne 0x41205e
mov al, 5
jmp 0x412083
cmp ebx, 1
jne 0x412067
mov al, 6
jmp 0x412083
cmp ebx, 2
jne 0x412070
mov al, 7
jmp 0x412083
cmp ecx, 6
jne 0x412083
cmp ebx, 0
jne 0x41207c
mov al, 8
cmp ebx, 1
jne 0x412083
mov al, 9
pop ebx
pop edx
leave
ret
Function at 0x412835
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x412877
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push str.CallWindowProcA
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4128a1
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00412943
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [0x52f5d9]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4128ee
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x412927
mov dword [ebp - 0x10], esp
push 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x412922
push 6
call fcn.004d8e21
add esp, 4
call fcn.00412a7b
call fcn.00412a7b
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x41293d
mov esp, ebp
pop ebp
ret 0xc

Function at 0x412a0a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x412a2b
mov dword [ebp + 8], 0x400
mov eax, dword [ebp + 8]
mov dword [0x52f5e1], eax
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
push dword [0x52f5d9]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x412a6a
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x412a75
mov esp, ebp
pop ebp
ret 8
Function at 0x438017
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 1
push 0x509313
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x43805d
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x438079
mov eax, 0
jmp 0x438083
mov eax, 1
jmp 0x438083
mov esp, ebp
pop ebp
ret 4
Function at 0x43ae8f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov eax, str.kernel32.dll
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405fde
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x43aed6
push ebx
call fcn.004d8e2d
add esp, 4
mov dword [ebp - 0x18], esp
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x43aee3
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x43af00
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x43af13
push ebx
call fcn.004d8e2d
add esp, 4
mov eax, str.GetNativeSystemInfo
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043afe7
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x43af37
push ebx
call fcn.004d8e2d
add esp, 4
mov dword [ebp - 0x28], esp
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 0x28], esp
je 0x43af5c
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x43af73
mov eax, 0
jmp 0x43afe3
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push 0x2c
call fcn.00405420
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x43afae
push 6
call fcn.004d8e21
add esp, 4
push dword [ebp - 4]
call fcn.0040550b
mov dword [ebp - 8], eax
push dword [ebp - 4]
call fcn.00405527
cmp dword [ebp - 8], 6
je 0x43afd9
cmp dword [ebp - 8], 9
je 0x43afd9
xor eax, eax
jmp 0x43afde
mov eax, 1
jmp 0x43afe3
mov esp, ebp
pop ebp
ret
Function at 0x43cd5f
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [0x52f8e5]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x43cd8d
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43cdb0
pushal
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
popal
leave
ret 0xc
push 0x80000301
push 0
push dword [ebp + 0xc]
push 1
mov ebx, 0x168
call fcn.004d9970
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x52556c
mov ecx, 2
call fcn.0040106b
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43cdf7
push ebx
call fcn.004d8e2d
add esp, 4
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call fcn.0043ce3f
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43ce29
push ebx
call fcn.004d8e2d
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x43ce39
push ebx
call fcn.004d8e2d
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45223c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x452277
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004db730
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4522da
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004d98e0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4522fe
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004db730
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x452361
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004d98e0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x452385
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.004db730
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4523e8
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.004d98e0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4523f0
mov esp, ebp
pop ebp
ret
Function at 0x473a59
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push 0x200
call fcn.00405420
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0x200
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x473aba
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fmul qword [0x50b45a]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
call fcn.00401feb
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.004d9d40
add esp, 0x1c
mov dword [ebp - 0x20], eax
push 0x50bdb1
push dword [ebp - 0x20]
mov ecx, 2
call fcn.00405cf0
add esp, 8
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x473b26
push ebx
call fcn.004d8e2d
add esp, 4
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
call fcn.00405e95
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x473b4e
push ebx
call fcn.004d8e2d
add esp, 4
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x473b62
push ebx
call fcn.004d8e2d
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call fcn.00405527
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x473b8a
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.004d8e1b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x473b8f
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x473ba0
push ebx
call fcn.004d8e2d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x478ebc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x14]
mov dword [ebx], 0
push VariantCopy
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.004d9c40
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x478f2b
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x478f5f
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x478f5a
push 6
call fcn.004d8e21
add esp, 4
jmp 0x478f67
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x478f78
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x49b6ad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x20], 0
jne 0x49b6c7
mov dword [ebp + 0x1c], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x1c]
push 0x509313
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x49b702
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
mov eax, 0
setg al
jmp 0x49b716
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4bc485
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4bc4c7
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push str.CallWindowProcA
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4bc4f1
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004bc589
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [0x52f7a5]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4bc53e
push 6
call fcn.004d8e21
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x4bc572
mov dword [ebp - 0x10], esp
push 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4bc572
push 6
call fcn.004d8e21
add esp, 4
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4bc583
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4da6e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4da772
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4da764
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4da75c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4da725
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x4da780
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret