joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455110
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004076bc
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0044ff08
test ebx, ebx
jne 0x455163
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0045504c
mov ebx, eax
test ebx, ebx
je 0x45524e
cmp esi, ebx
je 0x45518c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4551a1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4551d9
add eax, 0xffffff5f
sub eax, 2
jb 0x4551f1
dec eax
sub eax, 2
jb 0x455205
dec eax
sub eax, 2
jb 0x4551fb
jmp 0x45520f
add eax, 0xfffffdff
sub eax, 2
jb 0x4551f1
dec eax
sub eax, 2
jb 0x455205
dec eax
sub eax, 2
jb 0x4551fb
jmp 0x45520f
mov byte [esp + 0x120], 0
jmp 0x455217
mov byte [esp + 0x120], 2
jmp 0x455217
mov byte [esp + 0x120], 1
jmp 0x455217
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00436448
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00451678
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x455250
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x45d3a4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x635140]
cmp byte [eax + 0xc], 0
je 0x45d511
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d50a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x63ae8c], 0
jne 0x45d3f8
push 0x45d518
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45d520
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ae8c], eax
cmp dword [0x48ea08], 0
jne 0x45d4f3
push 0x45d530
call sub.kernel32.dll_LoadLibraryA
mov dword [0x48ea08], eax
cmp dword [0x48ea08], 0
je 0x45d4f3
push 0x45d53c
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ae90], eax
push 0x45d54c
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ae94], eax
push 0x45d560
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ae98], eax
push 0x45d578
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63ae9c], eax
push 0x45d590
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aea0], eax
push 0x45d5a4
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aea4], eax
push 0x45d5bc
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aea8], eax
push 0x45d5d4
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aeac], eax
push 0x45d5f0
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aeb0], eax
push 0x45d5fc
mov eax, dword [0x48ea08]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x63aeb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d511
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x461e38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x461f42
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 1
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403aec
push 1
call sub.kernel32.dll_Sleep_2
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], 0x540
cmp byte [0x48ebe4], 0
je 0x461eae
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x461eb6
mov eax, 0x461f54
mov dword [ebp - 0x38], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00461db0
mov eax, dword [ebp - 0x48]
call fcn.00405d34
mov dword [ebp - 0x34], eax
push 1
call sub.kernel32.dll_Sleep_2
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00461db0
mov eax, dword [ebp - 0x4c]
call fcn.00405d34
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x461f1a
push 1
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcessId
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461f49
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00405bbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x461f6c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x462010
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x461ff5
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x462020
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x461ff5
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462017
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x462130
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x4622e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x134]
mov eax, 0x4622fc
call fcn.00461f6c
mov eax, dword [ebp - 0x134]
mov edx, 0x462314
call fcn.004057f0
setne byte [ebp - 5]
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4622b0
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.00462048
cmp dword [ebp - 4], 0
je 0x4622a3
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040e23c
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
call fcn.00461f60
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040e23c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
jne 0x462282
lea eax, [ebp - 0x14c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.0046385c
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004095e0
mov eax, dword [ebp - 0x144]
mov edx, 0x46232c
call fcn.004057f0
sete al
and al, byte [ebp - 5]
je 0x462282
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea eax, [ebp - 0x150]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 4]
call fcn.00405694
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4621cc
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4622eb
lea eax, [ebp - 0x150]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x462424
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x462459
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x48edc4]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x462439
pop edi
pop esi
pop ebx
ret
Function at 0x46248c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x462516
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x4624f0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x110]
call fcn.0040cce0
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x408910]
call fcn.0040d4f4
call fcn.00404d34
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a5e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46251d
lea eax, [ebp - 0x110]
call fcn.004053c8
ret

Function at 0x462704
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x46288a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x462856
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a29c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409558
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409558
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004057f0
je 0x462829
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409558
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409558
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004057f0
jne 0x462843
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x462784
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462891
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x462b70
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x462cd4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x462ca4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
nop
add eax, 0
add eax, 0
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x10]
call fcn.00409f68
test al, al
je 0x462bdb
nop
add eax, 0
add eax, 0
push ebx
call sub.kernel32.dll_DeleteFileA
nop
add eax, 0
add eax, 0
nop
add eax, 0
add eax, 0
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
xor edx, edx
call fcn.00461db0
mov eax, dword [ebp - 0x14]
call fcn.00405d34
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x462c93
push dword fs:[eax]
mov dword fs:[eax], esp
nop
add eax, 0
add eax, 0
cmp dword [ebp - 8], 0
je 0x462c75
nop
add eax, 0
add eax, 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
nop
add eax, 0
add eax, 0
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
nop
add eax, 0
add eax, 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462c9a
nop
add eax, 0
add eax, 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x463190
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46322a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x90]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x90]
call fcn.00409f68
test al, al
je 0x463211
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x8c]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x463211
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00425798
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425824
mov eax, ebx
call fcn.00425664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463231
lea eax, [ebp - 0x90]
call fcn.004053c8
ret
Function at 0x46323c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4632d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x8c]
mov edx, ebx
call fcn.004055c0
mov eax, dword [ebp - 0x8c]
call fcn.00409f68
test al, al
je 0x4632bc
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 1
lea eax, [ebp - 0x88]
push eax
push ebx
call sub.kernel32.dll_OpenFile
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4632bc
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00425798
mov edx, edi
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.00425824
mov eax, ebx
call fcn.00425664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4632dc
lea eax, [ebp - 0x8c]
call fcn.004053c8
ret
Function at 0x463898
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, ebp
mov edx, esi
call fcn.0040541c
mov eax, esi
test eax, eax
je 0x4638b4
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jbe 0x4638e9
mov ebx, 1
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 4
mov byte [eax + ebx - 1], dl
mov eax, ebp
call fcn.004058b8
movzx edx, byte [esi + ebx - 1]
xor dl, 0xc
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x4638bf
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x466240
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x466309
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4662ee
mov eax, dword [ebp - 0x10]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x466318
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4662cd
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004055c0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x466340
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4662ee
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466310
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x466364
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x466408
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405460
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4663ed
mov eax, dword [ebp - 0xc]
call fcn.00402eb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x466418
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4663ed
mov eax, edi
mov edx, dword [ebp - 0x14]
call fcn.004055c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46640f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x466c1c
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x466d2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call fcn.0046614c
test al, al
je 0x466c63
mov byte [ebp - 5], 1
jmp 0x466d08
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x466cfe
mov eax, dword [edi + 8]
call fcn.00466730
test al, al
je 0x466c95
mov byte [ebp - 5], 1
jmp 0x466d02
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.00466588
cmp dword [ebp - 4], 0
je 0x466cf1
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x134]
call fcn.0046643c
test al, al
je 0x466cf1
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x466c83
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466d35
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x466e04
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
xor ecx, ecx
mov eax, dword [0x6387f8]
test eax, eax
je 0x466e47
movzx edx, word [eax]
not dx
cmp dx, 0x5a4d
je 0x466e47
mov esi, eax
mov edx, esi
mov ebx, dword [eax + 0x3c]
add edx, ebx
mov edx, dword [edx]
not edx
cmp edx, 0x4550
je 0x466e47
mov edx, ebx
add edx, 0x18
add edx, 0x34
sub edx, 8
add edx, 0x14
add edx, esi
mov eax, edx
mov ecx, dword [eax]
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x46ad38
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov dword [0x48f224], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov ebx, 0xff
jmp 0x46ad7c
cmp dword [0x48f224], 0
je 0x46ad8e
mov eax, edi
call fcn.0046aca4
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, ebp
jbe 0x46ad7c
mov ebx, 0x102
jmp 0x46ad8e
cmp ebx, 0xff
jne 0x46ad8e
mov eax, dword [0x6349ec]
cmp byte [eax], 0
je 0x46ad58
xor eax, eax
mov dword [0x48f224], eax
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46b3b8
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46b574
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 0
xor eax, eax
push ebp
push 0x46b544
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x46b390]
call fcn.004068bc
add esp, 4
test esi, esi
je 0x46b43b
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0046bb1c
jmp 0x46b480
mov ebx, 0x41
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004055b0
lea eax, [ebp - 0x14]
mov edx, 0x46b58c
call fcn.00405694
mov esi, dword [ebp - 0x14]
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x46b47a
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0046bb1c
inc ebx
cmp ebx, 0x5b
jne 0x46b440
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 0
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x46b4cf
inc esi
xor ebx, ebx
mov edx, dword [0x46b2f8]
xor eax, eax
call fcn.00423fac
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + ebx*4], edi
mov eax, dword [ebp - 8]
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x30]
push eax
push 4
push edi
push 0x46b334
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov dword [edx + 0x20], eax
inc ebx
dec esi
jne 0x46b492
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x46b4f0
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.004252ac
push 1
call sub.kernel32.dll_Sleep_1
inc ebx
dec esi
jne 0x46b4da
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x46b515
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00425304
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00423fcc
inc ebx
dec esi
jne 0x46b4fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b54b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.0046bb84
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 1
ret