joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478d28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x478d92
mov eax, ebx
call fcn.0047b188
test al, al
jne 0x478d92
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404e88
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x478d7f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x478d9f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404dec
jmp 0x478d9f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404dec
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x47a2ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47a31a
mov eax, esi
call fcn.00461578
test al, al
je 0x47a31a
mov eax, dword [ebx + 0x84]
call fcn.004611d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47a31a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x47a30e
push 0
mov eax, dword [ebx + 0x84]
call fcn.004611d8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00459030
jmp 0x47a31a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0047a0e8
pop esi
pop ebx
ret
Function at 0x4a21b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x134], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a2395
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x48]
call fcn.00404dec
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4a2375
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x3c]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4a2206
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x28], eax
jmp 0x4a2252
mov esi, dword [ebx + 4]
mov eax, esi
mov edx, dword [0x454940]
call fcn.00404004
test al, al
je 0x4a2226
mov eax, esi
call fcn.004611d8
mov dword [ebp - 0x28], eax
jmp 0x4a2252
mov eax, dword [0x4f90e4]
mov eax, dword [eax]
mov esi, dword [eax + 0x44]
test esi, esi
je 0x4a2245
mov eax, dword [0x4f90e4]
mov eax, esi
call fcn.004611d8
mov dword [ebp - 0x28], eax
jmp 0x4a2252
mov eax, dword [0x4f90e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x28], eax
movzx eax, byte [ebx + 0x51]
cmp al, 1
jne 0x4a2261
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x4a2280
lea edx, [ebp - 0x24]
push edx
and eax, 0x7f
mov eax, dword [eax*4 + 0x4f6f4c]
push eax
mov eax, dword [0x4f90e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 0x40]
call fcn.00405228
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x38]
call fcn.00405228
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor esi, esi
mov eax, esi
mov edx, eax
cmp dl, 7
ja 0x4a22ad
and edx, 0x7f
bt dword [ebx + 0x50], edx
jae 0x4a22bc
and eax, 0x7f
mov eax, dword [eax*4 + 0x4f6f34]
or dword [ebp - 0x18], eax
inc esi
cmp esi, 6
jne 0x4a229d
mov eax, 0x4a0a10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x48]
call fcn.00404dec
xor eax, eax
mov dword [ebx + 0x6c], eax
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x58], 0
lea eax, [ebx + 0x48]
mov edx, dword [ebx + 0x4c]
call fcn.00404dec
lea eax, [ebp - 0x28]
push eax
call sub.shell32.dll_SHBrowseForFolderA
mov dword [ebp - 8], eax
cmp byte [ebx + 0x58], 0
jne 0x4a22e2
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4a2355
lea eax, [ebp - 0x12d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x12d]
call fcn.0040a92c
mov edx, dword [ebp - 0x134]
lea eax, [ebx + 0x48]
call fcn.00404dec
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x48]
call fcn.00404dec
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x44], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a237c
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, dword [ebp - 0x24]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
Function at 0x4a81c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a81ee
mov eax, ebx
call fcn.004a8c74
cmp dword [ebx + 0x40], 0
je 0x4a81e7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a825f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a8251
cmp dword [ebx + 8], 0
je 0x4a8210
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a8222
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a8251
cmp dword [ebx + 8], 0
je 0x4a8203
cmp eax, 3
je 0x4a8235
dec eax
jne 0x4a8203
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a8203
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a8203
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a827d
cmp dword [ebx + 0x14], 0xcc
je 0x4a827d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a8288
pop ebx
ret

Function at 0x4b8a8c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4b8ad1
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4b8ad1
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4b8b6b
mov eax, 0x400
call fcn.00402f04
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x400
push esi
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x4b8b64
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4f78a0
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
sub ebx, 1
jae 0x4b8b38
call fcn.00403d48
test ebx, ebx
jl 0x4b8b5b
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4b8b57
mov byte [ebp - 1], 1
jmp 0x4b8b5b
inc edi
dec ebx
jne 0x4b8b3f
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402f20
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8b78
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x410
push 0x160
lea eax, [ebp - 0x160]
push eax
push esi
mov eax, ebx
call fcn.00405228
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
setne al
mov ebx, eax
test bl, bl
je 0x4b8bc3
mov eax, edi
lea edx, [ebp - 0x50]
mov ecx, 0x50
call fcn.00405008
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b8bcc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff698
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor edx, edx
push ebp
push 0x4b8c51
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x965]
xor ecx, ecx
mov edx, 0x801
call fcn.00403768
mov eax, esi
call fcn.00405228
mov edx, eax
lea eax, [ebp - 0x965]
call fcn.0040a700
test bl, bl
je 0x4b8c1b
mov eax, 0x111
jmp 0x4b8c20
mov eax, 0x110
push eax
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x80
lea eax, [ebp - 0x965]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x164]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8c5b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b8c68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405218
mov eax, dword [ebp - 8]
call fcn.00405218
xor eax, eax
push ebp
push 0x4b8d32
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 3
push 0
mov eax, dword [ebp - 8]
call fcn.00405228
push eax
mov eax, dword [ebp - 4]
call fcn.00405228
push eax
push 0x4b8d40
push 0
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4b8cc8
call fcn.00403d40
cmp eax, 0x20
jg 0x4b8d15
push 0x10
push 0x4b8d48
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, 0x4b8d58
mov eax, 0x4b8d7c
call fcn.004a4538
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x18]
xor ecx, ecx
pop eax
call fcn.0040ae1c
mov eax, dword [ebp - 0xc]
call fcn.00405228
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x4b8d17
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8d39
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404dbc
ret

Function at 0x4b8e04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, edx
lea edx, [ebp - 4]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00405008
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405218
xor eax, eax
push ebp
push 0x4b904e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b905c
mov eax, dword [ebp - 4]
call fcn.00405228
push eax
mov eax, dword [0x4fc7f8]
push eax
call sub.kernel32.dll_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x4fc7f8]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x41a750]
call fcn.00403e48
mov ebx, eax
mov dl, 1
mov eax, dword [0x4a5404]
call fcn.004a56b8
mov esi, eax
push edi
mov eax, dword [0x4fc7f8]
push eax
call sub.kernel32.dll_SizeofResource
test eax, eax
jns 0x4b8fec
call fcn.00403d40
mov edi, eax
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x10]
mov ecx, edi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeResource
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
call fcn.00403e78
mov eax, ebx
call fcn.00403e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9055
lea eax, [ebp - 4]
call fcn.00404d98
ret
Function at 0x4b9764
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b9865
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
test eax, eax
je 0x4b9788
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x4b97ac
mov eax, 2
dec eax
test ebx, ebx
je 0x4b979c
cmp eax, dword [ebx - 4]
jb 0x4b97a1
call fcn.00403d40
inc eax
cmp byte [ebx + eax - 1], 0x3a
sete al
jmp 0x4b97ae
xor eax, eax
test al, al
je 0x4b97d1
mov eax, 3
dec eax
test ebx, ebx
je 0x4b97c1
cmp eax, dword [ebx - 4]
jb 0x4b97c6
call fcn.00403d40
inc eax
cmp byte [ebx + eax - 1], 0x5c
sete al
jmp 0x4b97d3
xor eax, eax
test al, al
je 0x4b9848
call sub.kernel32.dll_GetLogicalDrives
test eax, eax
jns 0x4b97e5
call fcn.00403d40
mov esi, eax
lea eax, [ebp - 8]
mov edx, 1
dec edx
test ebx, ebx
je 0x4b97f9
cmp edx, dword [ebx - 4]
jb 0x4b97fe
call fcn.00403d40
inc edx
movzx edx, byte [ebx + edx - 1]
call fcn.00404f80
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040923c
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4b9826
cmp eax, dword [edx - 4]
jb 0x4b982b
call fcn.00403d40
inc eax
movzx eax, byte [edx + eax - 1]
sub eax, 0x41
jno 0x4b983b
call fcn.00403d48
cmp eax, 0x1f
ja 0x4b9843
bt esi, eax
setb bl
jmp 0x4b984a
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b986c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404dbc
ret

Function at 0x4b9bbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.0040a92c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd0b4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4bd172
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x4f7900]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
jno 0x4bd107
call fcn.00403d48
movzx edx, byte [edx + 0x4f7900]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
jno 0x4bd134
call fcn.00403d48
movzx edx, byte [edx + 0x4f7900]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x4f7900]
mov byte [ebp + edi + 3], dl
add edi, 4
jno 0x4bd161
call fcn.00403d48
add ebx, 3
jno 0x4bd16b
call fcn.00403d48
dec eax
jne 0x4bd0d7
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4bd188
dec edx
je 0x4bd1bd
jmp 0x4bd215
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4f7900]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x4f7900]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4bd215
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x4f7900]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
jno 0x4bd1ec
call fcn.00403d48
movzx eax, byte [eax + 0x4f7900]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x4f7900]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
jno 0x4bd222
call fcn.00403d48
mov ecx, 3
cdq
idiv ecx
imul eax, eax, 4
jno 0x4bd234
call fcn.00403d48
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bd2a0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ecx, ecx
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4bd2bf
add edx, 3
sar edx, 2
test edx, edx
jle 0x4bd434
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ebx, byte [edi + esi]
cmp ebx, 0x3d
jg 0x4bd2f4
je 0x4bd35a
sub ebx, 0x2b
je 0x4bd350
sub ebx, 4
je 0x4bd355
dec ebx
sub ebx, 0xa
jb 0x4bd334
jmp 0x4bd35d
add ebx, 0xffffffbf
sub ebx, 0x1a
jb 0x4bd306
add ebx, 0xfffffffa
sub ebx, 0x1a
jb 0x4bd318
jmp 0x4bd35d
movzx ebx, byte [edi + esi]
sub ebx, 0x41
jno 0x4bd314
call fcn.00403d48
mov byte [eax], bl
jmp 0x4bd35d
movzx ebx, byte [edi + esi]
sub ebx, 0x61
jno 0x4bd326
call fcn.00403d48
add ebx, 0x1a
jno 0x4bd330
call fcn.00403d48
mov byte [eax], bl
jmp 0x4bd35d
movzx ebx, byte [edi + esi]
sub ebx, 0x30
jno 0x4bd342
call fcn.00403d48
add ebx, 0x34
jno 0x4bd34c
call fcn.00403d48
mov byte [eax], bl
jmp 0x4bd35d
mov byte [eax], 0x3e
jmp 0x4bd35d
mov byte [eax], 0x3f
jmp 0x4bd35d
mov byte [eax], 0xff
add esi, 1
jno 0x4bd367
call fcn.00403d48
inc eax
dec edx
jne 0x4bd2d7
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or eax, edx
mov edx, dword [esp + 8]
mov byte [edx + ecx], al
mov eax, ecx
add eax, 1
jno 0x4bd395
call fcn.00403d48
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4bd3d6
cmp byte [esp + 7], 0xff
jne 0x4bd3d6
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or eax, edx
mov edx, dword [esp + 8]
mov byte [edx + ecx + 1], al
mov eax, ecx
add eax, 2
jno 0x4bd3ca
call fcn.00403d48
add ecx, 1
jno 0x4bd3d4
call fcn.00403d48
jmp 0x4bd420
cmp dl, 0xff
je 0x4bd420
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or eax, edx
mov edx, dword [esp + 8]
mov byte [edx + ecx + 1], al
movzx eax, byte [esp + 6]
shl eax, 6
movzx edx, byte [esp + 7]
or eax, edx
mov edx, dword [esp + 8]
mov byte [edx + ecx + 2], al
mov eax, ecx
add eax, 3
jno 0x4bd416
call fcn.00403d48
add ecx, 2
jno 0x4bd420
call fcn.00403d48
add ecx, 1
jno 0x4bd42a
call fcn.00403d48
dec dword [esp + 0xc]
jne 0x4bd2ce
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4bfd08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bfd8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4bef18]
mov eax, 0x14
call fcn.00405cd8
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004092c4
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00404dec
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x4fee44]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x4fee44], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfd91
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404dbc
ret

Function at 0x4bfd98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4bfe14
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4bef40]
mov eax, 0x10
call fcn.00405cd8
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004092c4
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404dec
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x4fee48]
mov dword [ebx], eax
mov dword [0x4fee48], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfe1b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404dbc
ret
Function at 0x4c03a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xa3
push 0
push 0
dec ecx
jne 0x4c03a9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
call fcn.00405218
lea eax, [ebp - 0x20]
mov edx, dword [0x4b9e88]
call fcn.00405898
lea eax, [ebp - 0x28]
mov edx, dword [0x4b9e88]
call fcn.00405898
xor eax, eax
push ebp
push 0x4c10cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x4f7968]
call fcn.004bff48
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x4d4]
call fcn.004bffe0
push dword [ebp - 0x4d4]
lea eax, [ebp - 0x4d8]
call fcn.004c0040
push dword [ebp - 0x4d8]
push 0x4c10e4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040512c
mov eax, dword [ebp - 0x14]
call fcn.00409ff4
test al, al
je 0x4c0501
push 0
push 0x10000000
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0x14]
call fcn.00405228
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x4c04fa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x38], 0xffffffff
je 0x4c04dd
mov eax, 0x63
call fcn.00403350
sub eax, 0xcc
jno 0x4c049c
call fcn.00403d48
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x38]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
mov eax, dword [ebp - 0x38]
push eax
call sub.kernel32.dll_GetFileSize
cmp eax, 0x3e8
ja 0x4c04dd
push 0
lea eax, [ebp - 0x3c]
push eax
push 0x1f5
lea eax, [ebp - 0x275]
push eax
mov eax, dword [ebp - 0x38]
push eax
call sub.kernel32.dll_ReadFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0636
cmp dword [ebp - 0x38], 0xffffffff
je 0x4c04f9
mov eax, dword [ebp - 0x38]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov byte [ebp - 0x59], 0
mov dl, 1
mov eax, dword [0x4b9d8c]
call fcn.0042b78c
mov dword [ebp - 0x58], eax
xor eax, eax
push ebp
push 0x4c0597
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c0577
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x58]
call fcn.0042b82c
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x58]
call fcn.0042b894
push 0x1f5
lea ecx, [ebp - 0x275]
mov edx, 0x4c10f4
mov eax, dword [ebp - 0x58]
call fcn.004b9de8
cmp byte [ebp - 0x274], 0
setne byte [ebp - 0x59]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c0581
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c059e
mov eax, dword [ebp - 0x58]
call fcn.00403e78
ret
Function at 0x4c6580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405218
xor eax, eax
push ebp
push 0x4c6659
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
cmp dword [0x4feee0], 0
jne 0x4c65dd
push 0x4c666c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4feee4], eax
cmp dword [0x4feee4], 0
je 0x4c65dd
push 0x4c6678
mov eax, dword [0x4feee4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4feee0], eax
cmp dword [0x4feee0], 0
jne 0x4c662c
call fcn.0040e830
cmp byte [0x4feee8], 0
jne 0x4c6643
push 0
movzx ecx, word [0x4c6684]
mov dl, 1
mov eax, 0x4c6690
call fcn.0044ad50
dec eax
jne 0x4c6643
push 1
push 0
push 0
push 0x4c672c
push 0x4c676c
push 0
call sub.shell32.dll_ShellExecuteA
mov byte [0x4feee8], 1
jmp 0x4c6643
mov eax, dword [ebp + 8]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.00405228
push eax
push esi
call dword [0x4feee0]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6660
lea eax, [ebp - 4]
call fcn.00404d98
ret

Function at 0x4f290c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4f2858
call sub.user32.dll_EnumWindows
ret

Function at 0x4f2a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4f2aad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004f248c
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4f2a55
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004f208c
cmp dword [ebp - 4], 0
je 0x4f2a97
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00405228
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2ab4
lea eax, [ebp - 4]
call fcn.00404d98
ret