joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0a28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4a0a30
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0cae
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a0c8c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x298]
mov ecx, 0x200
call fcn.004055ac
mov edx, dword [ebp - 0xc]
mov eax, 0x4a0cc4
call fcn.00405918
test eax, eax
jle 0x4a0a9c
mov eax, ebx
call fcn.004a0ea8
lea edx, [ebp - 0x10]
call fcn.00409d7c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 0x4a0cd0
call fcn.00405654
jmp 0x4a0abb
mov eax, ebx
call fcn.004a0ea8
lea edx, [ebp - 0x14]
call fcn.00409d7c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 0x4a0ce0
call fcn.00405654
lea eax, [ebp - 0x18]
lea edx, [ebx + 0x1641]
mov ecx, 0x12c
call fcn.004055ac
cmp dword [ebp - 0x18], 0
je 0x4a0b87
call fcn.0040bb80
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebx + 0x14c0]
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0048f398
cmp eax, 3
jge 0x4a0b87
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004033dc
push dword [ebp - 0x1c]
push 0x4a0cf0
lea eax, [ebp - 0x20]
mov edx, dword [0x4b9a44]
mov ecx, 8
call fcn.004055ac
push dword [ebp - 0x20]
push 0x4a0cf0
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x1641]
mov ecx, 0x12c
call fcn.004055ac
push dword [ebp - 0x24]
push dword [ebp - 8]
push 0x4a0cf0
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x290]
call fcn.00409d7c
push dword [ebp - 0x28]
push 0x4a0cf0
lea edx, [ebp - 0x2c]
mov eax, dword [ebx + 0x294]
call fcn.00409d7c
push dword [ebp - 0x2c]
push 0x4a0cfc
lea eax, [ebp - 4]
mov edx, 0xb
call fcn.004056d0
jmp 0x4a0c0b
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.004033dc
push dword [ebp - 0x30]
push 0x4a0cf0
lea eax, [ebp - 0x34]
mov edx, dword [0x4b9a44]
mov ecx, 8
call fcn.004055ac
push dword [ebp - 0x34]
push 0x4a0cf0
lea eax, [ebp - 0x38]
lea edx, [ebx + 0x298]
mov ecx, 0x200
call fcn.004055ac
push dword [ebp - 0x38]
push dword [ebp - 8]
push 0x4a0cf0
lea edx, [ebp - 0x3c]
mov eax, dword [ebx + 0x290]
call fcn.00409d7c
push dword [ebp - 0x3c]
push 0x4a0cf0
lea edx, [ebp - 0x40]
mov eax, dword [ebx + 0x294]
call fcn.00409d7c
push dword [ebp - 0x40]
push 0x4a0cfc
lea eax, [ebp - 4]
mov edx, 0xb
call fcn.004056d0
cmp byte [ebx + 0x14e7], 0
jne 0x4a0c24
push 0
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
call sub.kernel32.dll_WinExec
call fcn.0040bb80
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0048f37c
mov esi, eax
mov eax, dword [ebx + 0x14c0]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0048f37c
cmp si, ax
je 0x4a0c65
call fcn.0040bb80
mov esi, dword [ebx + 0x14c0]
fstp qword [esi + 8]
wait
mov dword [esi + 0x1c], 1
jmp 0x4a0c77
call fcn.0040bb80
mov esi, dword [ebx + 0x14c0]
fstp qword [esi + 8]
wait
inc dword [esi + 0x1c]
mov eax, ebx
call fcn.004a1fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0c93
ret
Function at 0x4a193c
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057bc
xor eax, eax
push ebp
push 0x4a1ac7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040533c
mov dword [ebp - 0x1c], 0x7d0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004727f8
push 0
push 0x4a1ad8
push 0x4a1ad8
push 0
push 0x4a1adc
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4a1aa5
push dword fs:[edx]
mov dword fs:[edx], esp
push 4
lea eax, [ebp - 0x1c]
push eax
push 2
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebp - 0x1c]
push eax
push 8
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, 0x400
call fcn.00402f84
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41804c]
call fcn.0041cb68
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 0x401
lea eax, [ebp - 0x429]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x4a1a48
cmp dword [ebp - 0x28], 0
je 0x4a1a48
lea edx, [ebp - 0x429]
mov ecx, dword [ebp - 0x28]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
jmp 0x4a1a13
mov eax, esi
mov edx, dword [ebx + 4]
call fcn.00405390
mov eax, ebx
call fcn.00404378
mov eax, dword [ebp - 0x24]
call fcn.00402fa0
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1aac
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x4a42fc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a442f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a4407
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x57], 0
je 0x4a4366
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
call fcn.00463d04
xor edx, edx
mov eax, ebx
call fcn.0045be98
push 0
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x374]
mov edx, 0x4a4448
call fcn.0043c564
jmp 0x4a43fd
push 5
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, ebx
call fcn.0045be98
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
call fcn.0046441c
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
call fcn.00463de4
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
call fcn.004631c8
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
call fcn.00463f14
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x3a8]
mov edx, 0xd3
call fcn.0046be2c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004055c4
mov eax, dword [ebp - 4]
mov edx, 0x4a445c
call fcn.004098e0
test al, al
je 0x4a43ed
mov eax, dword [ebx + 0x364]
mov dl, 1
call fcn.004362c4
mov eax, dword [ebx + 0x374]
mov edx, 0x4a4470
call fcn.0043c564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4411
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4436
lea eax, [ebp - 8]
call fcn.00405af0
lea eax, [ebp - 4]
call fcn.0040533c
ret

Function at 0x4a6bd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a6c37
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 4]
call fcn.00405a5c
push edi
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405390
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6c3e
lea eax, [ebp - 4]
call fcn.0040533c
ret

Function at 0x4ab310
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ab39a
xor edx, edx
push ebp
push 0x4ab37b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ab39a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4ac5e4
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057bc
mov eax, dword [ebp - 8]
call fcn.004057bc
xor eax, eax
push ebp
push 0x4ac701
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.004057cc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x4ac714
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ac6e6
xor eax, eax
push ebp
push 0x4ac6df
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4ac6bf
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4ac6c3
xor eax, eax
jmp 0x4ac6c5
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac6e6
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac708
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405360
ret
Function at 0x4ac71c
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057bc
mov eax, dword [ebp - 8]
call fcn.004057bc
mov eax, dword [ebp - 0xc]
call fcn.004057bc
mov eax, dword [ebp + 0xc]
call fcn.004057bc
xor eax, eax
push ebp
push 0x4ac88b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004057cc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x4ac8a0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ac868
xor edx, edx
push ebp
push 0x4ac861
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004057cc
push eax
movzx eax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x4ac84a
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4ac841
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4ac845
xor eax, eax
jmp 0x4ac847
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac868
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac892
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405360
lea eax, [ebp + 0xc]
call fcn.0040533c
ret
Function at 0x4ac8a8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x4ac970
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4ac974
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x4ac970
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ac967
xor eax, eax
push ebp
push 0x4ac960
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac967
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4acb68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4acd7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x105
mov eax, dword [ebp - 0x20]
call fcn.00402f84
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4acbe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x4acbd0
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00405534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acbed
mov eax, dword [ebp - 0x10]
call fcn.00402fa0
ret

Function at 0x4ae098
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00403a64
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x4ae0d2
cmp byte [ebp - 0xa], 0x31
jne 0x4ae0d0
mov bl, 1
jmp 0x4ae0d2
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af5e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044dcf8
test al, al
je 0x4af69d
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x4af67b
cmp word [esi + 0x642], 0
je 0x4af635
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x644]
call dword [esi + 0x640]
cmp byte [ebp - 9], 0
jne 0x4af652
cmp dword [ebp - 4], 0
jbe 0x4af64e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4af652
xor ebx, ebx
jmp 0x4af654
mov bl, 1
test bl, bl
jne 0x4af69d
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x4af69d
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
call fcn.0046441c
push 1
call sub.kernel32.dll_Sleep_2
test esi, esi
je 0x4af69d
cmp byte [esi + 0x5ec], 0
jne 0x4af69d
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0046bc90
cmp eax, 4
jne 0x4af612
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b2e5c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4b2e64
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b3022
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebx + 0x3a0]
call fcn.004362c4
cmp byte [ebx + 0x57], 0
jne 0x4b2fe5
lea ecx, [ebp - 0x1c]
mov edx, 0xd3
mov eax, dword [ebx + 0x398]
call fcn.0046be2c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.004055c4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004716b8
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x3ac]
call fcn.004716b8
mov eax, dword [ebp - 0x20]
pop edx
call fcn.004098e0
test al, al
jne 0x4b2f25
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov edx, 0xd3
mov eax, dword [ebx + 0x398]
call fcn.0046be2c
mov eax, dword [ebp - 0x2c]
mov ecx, 7
mov edx, 1
call fcn.00405e64
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.004055c4
mov eax, dword [ebp - 0x24]
mov edx, 0x4b3038
call fcn.004098e0
test al, al
je 0x4b2fde
mov eax, ebx
call fcn.004607a0
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
call fcn.0046441c
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, dword [ebx + 0x48]
sar edx, 1
jns 0x4b2f59
adc edx, 0
add edx, eax
mov eax, ebx
call fcn.004611f8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
sub edx, eax
sub edx, dword [ebx + 0x4c]
sar edx, 1
jns 0x4b2f74
adc edx, 0
add edx, eax
mov eax, ebx
call fcn.00461234
push 5
mov eax, dword [0x4b9a58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
push 0x203
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, ebx
call fcn.0044d958
push eax
call sub.user32.dll_SetWindowPos
push 0x203
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, ebx
call fcn.0044d958
push eax
call sub.user32.dll_SetWindowPos
mov eax, 0x4b3048
call fcn.00470a48
mov edx, eax
xor ecx, ecx
mov al, 1
call fcn.00491254
jmp 0x4b2fe5
mov eax, ebx
call fcn.004605f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3029
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405b08
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405360
lea eax, [ebp - 0x1c]
call fcn.00405af0
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405360
ret
Function at 0x417c10
Capabilities:
Check os version

Disassembly:
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x4c5988
mov dword [0x4c5b54], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
mov word [0x4c5c7c], 0x7f
call sub.comdlg32.dll_ChooseColorW
add dword [0x4c5b54], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
and esi, 0xff
cmp esi, 6
setae al
cmp esi, 6
mov byte [0x4c5c5d], al
jb 0x417cb7
push edi
call sub.comdlg32.dll_CommDlgExtendedError
mov ecx, dword [0x4c2064]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ecx
mov dword [0x4c5b54], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetThreadPreferredUILanguages
push eax
call edi
mov edx, dword [0x4c2064]
mov dword [0x4c59a8], eax
push edx
call esi
push str.SetThreadPreferredUILanguages
push eax
call edi
mov dword [0x4c59a4], eax
mov eax, dword [0x4c2064]
push eax
call esi
push str.GetThreadUILanguage
push eax
call edi
mov esi, eax
pop edi
mov dword [0x4c59a0], esi
push 0x4c5988
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x4a16fc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x17b1b1a3]
test al, dh
pop es
push edx
sbb dh, byte [ecx + 0x25b52276]
push ecx
aaa
lodsb al, byte [esi]
inc edi
sahf
push ebp
dec ebp
daa
pop es
pop ss
xor cl, byte [eax]
rol edi, 0x84
mov dh, 0x40
aam 0x4d
adc eax, 0x1dd6b4a3
push edx
xlatb
pop ds
sub dword [eax], edi
lcall 0x5722, 0xed1a8ab6
sbb ch, ch
and dl, byte [edi - 0x7e]
xor esi, dword [ebx]
adc byte [edi], al
jle 0x4a16e0
mov ecx, 0x117ac536
outsd dx, dword [esi]
mov ebx, 0x5ef88716
or byte [ebp + 0x276cc1db], dh
jns 0x4a1695
salc
pop es
Function at 0x4ba3d9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23e8
cmp edx, dword [eax]
je 0x4ba3fb
add eax, 8
inc ecx
cmp eax, 0x4c2478
jl 0x4ba3ec
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23e8]
jne 0x4ba529
mov eax, dword [0x4c6d94]
cmp eax, 1
je 0x4ba503
test eax, eax
jne 0x4ba42c
cmp dword [0x4c2314], 1
je 0x4ba503
cmp edx, 0xfc
je 0x4ba529
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba463
lea eax, [ebp - 0x1a4]
push 0x4bf8d0
push eax
call fcn.004badc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb250
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba4a6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb250
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf8cc
push edi
call fcn.004bd120
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf8b0
push eax
call fcn.004badc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004badd0
lea eax, [ebp - 0xa0]
push 0x4bf8ac
push eax
call fcn.004badd0
push dword [esi + 0x4c23ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.004badd0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf884
push eax
call fcn.004bd094
add esp, 0x2c
pop edi
jmp 0x4ba529
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23ec]
push 0
push eax
push dword [esi]
call fcn.004bb250
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1fdf7ec
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1fdf7f6
pushal
call 0x1fdf7fc
pop ebp
sub ebp, 0x10
sub ebp, 0x3bf7ec
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1fdf820
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1fdf829
mov eax, 0x3bf7ec
add eax, ebp
add eax, 0x63
mov ecx, 0x5f3
mov edx, 0x3db153c9
xor byte [eax], dl
inc eax
dec ecx
jne 0x1fdf840
jmp 0x1fdf853
inc edx
add al, 0x42
inc eax
cmc
leave
leave
leave
dec eax
or byte [ecx], dh
leave
leave
leave
retf 0x7104
Function at 0x402742
Capabilities:
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
xor ebx, ebx
xor edi, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x5c9f22f
jg 0x402772
inc edi
cmp edi, 0x1fa20be2
jl 0x402758
cmp dword [0x44cf1c], 0x400
jne 0x4027ca
push 0x443a80
push str.zudutalegexojefupo
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebx
push ebx
lea eax, [ebp - 0x800]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push ebx
push ebx
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push ebx
call fcn.0040282e
push ebx
push ebx
call fcn.00402868
push ebx
call fcn.00402b51
push ebx
call fcn.00402bc5
add esp, 0x14
xor edi, edi
cmp edi, 0xd0fe
jge 0x4027db
push ebx
call dword [sym.imp.USER32.dll_GetCaretPos]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58bc6e
jg 0x4027f4
inc edi
cmp edi, 0xe52f
jl 0x4027cc
mov eax, dword [0x445eb4]
mov dword [0x44cf1c], eax
call fcn.004024c7
mov esi, 0x3078f
cmp dword [0x44cf1c], 0x51f
jne 0x402822
push ebx
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec esi
jne 0x402808
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x405ece
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445d10]
jne 0x405ed8
repz ret
jmp fcn.00407afc