joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cced
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push ecx
add esp, 4
add edx, 0x8aaa
jmp 0x43cc7c
or edx, 0x16113
xor edx, 0x84d4
pop edx
push ebx
push ecx
add esp, 4
or ebx, 0x13807
xor ebx, 0x94af
pop ebx
lea eax, [ebp - 0xc44]
mov dword [ebp - 0x6f0], eax
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6ec], edx
xor eax, eax
mov word [ebp - 0x120], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push esi
add esi, 0x131fe
or esi, 0x162e8
pop esi
push edx
or edx, 0x75ba
xor edx, 0xefab
call fcn.0043cced
add byte [edx + ecx*2 + 0x4c], cl
push eax
dec edi
dec edi
add esp, 4
add esp, 4
add esp, 4
add edx, 0x18038
pop edx
mov edx, dword [ebp - 0x6ec]
mov ax, word [edx]
mov word [ebp - 0x892], ax
mov ecx, dword [ebp - 0x6ec]
add ecx, 2
mov dword [ebp - 0x6ec], ecx
mov dx, word [ebp - 0x892]
mov word [ebp - 0x120], dx
mov eax, dword [ebp - 0x6f0]
mov cx, word [eax]
mov word [ebp - 0x894], cx
mov edx, dword [ebp - 0x6f0]
add edx, 2
mov dword [ebp - 0x6f0], edx
mov ax, word [ebp - 0x894]
mov word [ebp - 0x2c], ax
push edi
xor edi, 0x1b8b
sub edi, 0x5960
or edi, 0x9e31
pop edi
push edi
jmp 0x43cd6b
or edi, 0x1509b
jmp 0x43cd79
xor edi, 0x1618a
pop edi
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x43cd9d
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0xbec], edx
jmp 0x43cdf7
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x43ccc5
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x43ccc5
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
jge 0x43cde1
mov dword [ebp - 0xbe8], 0xffffffff
jmp 0x43cdeb
mov dword [ebp - 0xbe8], 1
mov ecx, dword [ebp - 0xbe8]
mov dword [ebp - 0xbec], ecx
cmp dword [ebp - 0xbec], 0
jne 0x43ce40
push ebx
push ecx
add esp, 4
add ebx, 0x11ba7
or ebx, 0xa285
pop ebx
push ecx
push edi
add esp, 4
call 0x43ce23
add byte [0x42433a34], bh
cmp eax, 0x8104c483
leave
mov bl, 0x24
add byte [eax], al
jmp 0x43ce31
pop ecx
mov edx, dword [ebp - 0x2dc]
mov dword [ebp - 0x18c], edx
jmp 0x43cea8
push ecx
jmp 0x43ce47
call 0x43ce54
add byte [esi + 0x43], al
cmp dword [esi + 0x37], eax
inc edx
dec ebp
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x43ce63
sub esi, 0x1c9b
pop esi
push edx
xor edx, 0xe6bf
pop edx
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0x2dc]
cmp edx, dword [ebp - 0x6f4]
je 0x43ce9e
mov eax, dword [ebp - 0x2dc]
cmp dword [eax + 0x30], 0
jne 0x43cc69
mov dword [ebp - 0x18c], 0
Function at 0x43ce23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push ecx
add esp, 4
add edx, 0x8aaa
jmp 0x43cc7c
or edx, 0x16113
xor edx, 0x84d4
pop edx
push ebx
push ecx
add esp, 4
or ebx, 0x13807
xor ebx, 0x94af
pop ebx
lea eax, [ebp - 0xc44]
mov dword [ebp - 0x6f0], eax
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6ec], edx
xor eax, eax
mov word [ebp - 0x120], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push esi
add esi, 0x131fe
or esi, 0x162e8
pop esi
push edx
or edx, 0x75ba
xor edx, 0xefab
call fcn.0043cced
add byte [edx + ecx*2 + 0x4c], cl
push eax
dec edi
dec edi
add esp, 4
add esp, 4
add esp, 4
add edx, 0x18038
pop edx
mov edx, dword [ebp - 0x6ec]
mov ax, word [edx]
mov word [ebp - 0x892], ax
mov ecx, dword [ebp - 0x6ec]
add ecx, 2
mov dword [ebp - 0x6ec], ecx
mov dx, word [ebp - 0x892]
mov word [ebp - 0x120], dx
mov eax, dword [ebp - 0x6f0]
mov cx, word [eax]
mov word [ebp - 0x894], cx
mov edx, dword [ebp - 0x6f0]
add edx, 2
mov dword [ebp - 0x6f0], edx
mov ax, word [ebp - 0x894]
mov word [ebp - 0x2c], ax
push edi
xor edi, 0x1b8b
sub edi, 0x5960
or edi, 0x9e31
pop edi
push edi
jmp 0x43cd6b
or edi, 0x1509b
jmp 0x43cd79
xor edi, 0x1618a
pop edi
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x43cd9d
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0xbec], edx
jmp 0x43cdf7
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x43ccc5
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x43ccc5
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
jge 0x43cde1
mov dword [ebp - 0xbe8], 0xffffffff
jmp 0x43cdeb
mov dword [ebp - 0xbe8], 1
mov ecx, dword [ebp - 0xbe8]
mov dword [ebp - 0xbec], ecx
cmp dword [ebp - 0xbec], 0
jne 0x43ce40
push ebx
push ecx
add esp, 4
add ebx, 0x11ba7
or ebx, 0xa285
pop ebx
push ecx
push edi
add esp, 4
call 0x43ce23
add byte [0x42433a34], bh
cmp eax, 0x8104c483
leave
mov bl, 0x24
add byte [eax], al
jmp 0x43ce31
pop ecx
mov edx, dword [ebp - 0x2dc]
mov dword [ebp - 0x18c], edx
jmp 0x43cea8
push ecx
jmp 0x43ce47
call 0x43ce54
add byte [esi + 0x43], al
cmp dword [esi + 0x37], eax
inc edx
dec ebp
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x43ce63
sub esi, 0x1c9b
pop esi
push edx
xor edx, 0xe6bf
pop edx
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0x2dc]
cmp edx, dword [ebp - 0x6f4]
je 0x43ce9e
mov eax, dword [ebp - 0x2dc]
cmp dword [eax + 0x30], 0
jne 0x43cc69
mov dword [ebp - 0x18c], 0
Function at 0x43ce54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push ecx
add esp, 4
add edx, 0x8aaa
jmp 0x43cc7c
or edx, 0x16113
xor edx, 0x84d4
pop edx
push ebx
push ecx
add esp, 4
or ebx, 0x13807
xor ebx, 0x94af
pop ebx
lea eax, [ebp - 0xc44]
mov dword [ebp - 0x6f0], eax
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6ec], edx
xor eax, eax
mov word [ebp - 0x120], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push esi
add esi, 0x131fe
or esi, 0x162e8
pop esi
push edx
or edx, 0x75ba
xor edx, 0xefab
call fcn.0043cced
add byte [edx + ecx*2 + 0x4c], cl
push eax
dec edi
dec edi
add esp, 4
add esp, 4
add esp, 4
add edx, 0x18038
pop edx
mov edx, dword [ebp - 0x6ec]
mov ax, word [edx]
mov word [ebp - 0x892], ax
mov ecx, dword [ebp - 0x6ec]
add ecx, 2
mov dword [ebp - 0x6ec], ecx
mov dx, word [ebp - 0x892]
mov word [ebp - 0x120], dx
mov eax, dword [ebp - 0x6f0]
mov cx, word [eax]
mov word [ebp - 0x894], cx
mov edx, dword [ebp - 0x6f0]
add edx, 2
mov dword [ebp - 0x6f0], edx
mov ax, word [ebp - 0x894]
mov word [ebp - 0x2c], ax
push edi
xor edi, 0x1b8b
sub edi, 0x5960
or edi, 0x9e31
pop edi
push edi
jmp 0x43cd6b
or edi, 0x1509b
jmp 0x43cd79
xor edi, 0x1618a
pop edi
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x43cd9d
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0xbec], edx
jmp 0x43cdf7
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
je 0x43ccc5
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x43ccc5
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x2c]
cmp edx, eax
jge 0x43cde1
mov dword [ebp - 0xbe8], 0xffffffff
jmp 0x43cdeb
mov dword [ebp - 0xbe8], 1
mov ecx, dword [ebp - 0xbe8]
mov dword [ebp - 0xbec], ecx
cmp dword [ebp - 0xbec], 0
jne 0x43ce40
push ebx
push ecx
add esp, 4
add ebx, 0x11ba7
or ebx, 0xa285
pop ebx
push ecx
push edi
add esp, 4
call 0x43ce23
add byte [0x42433a34], bh
cmp eax, 0x8104c483
leave
mov bl, 0x24
add byte [eax], al
jmp 0x43ce31
pop ecx
mov edx, dword [ebp - 0x2dc]
mov dword [ebp - 0x18c], edx
jmp 0x43cea8
push ecx
jmp 0x43ce47
call 0x43ce54
add byte [esi + 0x43], al
cmp dword [esi + 0x37], eax
inc edx
dec ebp
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x43ce63
sub esi, 0x1c9b
pop esi
push edx
xor edx, 0xe6bf
pop edx
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [ebp - 0x2dc]
cmp edx, dword [ebp - 0x6f4]
je 0x43ce9e
mov eax, dword [ebp - 0x2dc]
cmp dword [eax + 0x30], 0
jne 0x43cc69
mov dword [ebp - 0x18c], 0

Function at 0x44d318
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406448
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x44d35f
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406640
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x4b0390
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4b03be
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00406640
jmp 0x4b03c7
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x24
pop ebx
ret

Function at 0x4b03cc
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4b03fd
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00406640
jmp 0x4b0406
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x208
pop ebx
ret

Function at 0x4b0418
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x50605c]
cmp dword [eax], 2
jne 0x4b0480
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b043b
xor eax, eax
jmp 0x4b048f
lea eax, [esp + 8]
push eax
push 0x4b0494
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4b0480
xor eax, eax
jmp 0x4b048f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4b04bc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4b0516
inc esi
xor edi, edi
cmp edi, 1
jne 0x4b04e2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x4b04f0
cmp edi, 1
jle 0x4b04f0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004ad4a8
test eax, eax
jne 0x4b0516
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4b0516
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4b0516
inc edi
dec esi
jne 0x4b04d2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4b0d74
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0047fb88
and eax, 0x7f
mov ecx, dword [eax*4 + 0x5052e0]
mov edx, 0x80000002
xor eax, eax
call fcn.0047fdb8
test eax, eax
jne 0x4b0dbe
mov eax, esi
call fcn.004064d4
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
call fcn.004064d4
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x4b0ddf
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
pop edx
pop esi
pop ebx
ret
Function at 0x4bfebc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bff8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.0047e328
lea eax, [ebp - 0x25c]
mov edx, 0x4bffac
call fcn.00406854
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4bff75
xor eax, eax
push ebp
push 0x4bff6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.004bfe6c
test al, al
je 0x4bff43
mov byte [ebp - 1], 1
jmp 0x4bff57
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4bff2e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bff75
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bff95
lea eax, [ebp - 0x25c]
call fcn.00406438
ret

Function at 0x4c04ec
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x4c0500
add esp, 0xfffffff0
call fcn.004044d0
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0045e160
mov eax, dword [0x4c05a4]
not eax
and eax, dword [esi + 0x50]
mov dword [esi + 0x50], eax
mov edx, 0x79
mov eax, esi
call fcn.0045a7f0
mov edx, 0x61
mov eax, esi
call fcn.0045a824
xor edx, edx
mov eax, esi
call fcn.0045b36c
mov dl, 1
mov eax, esi
call fcn.00463d84
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jae 0x4c055f
mov dx, 0xfffe
mov eax, esi
call fcn.0045b3b4
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x4c0585
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x64]
call fcn.0043103c
mov eax, esi
test bl, bl
je 0x4c059a
call fcn.00404528
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4da3f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4da487
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
mov ebx, eax
test ebx, ebx
jle 0x4da45b
cmp ebx, 0x104
jge 0x4da45b
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00406640
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.004da2e4
jmp 0x4da46e
mov eax, 0x4da4a0
call fcn.004ae054
mov eax, esi
xor edx, edx
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da48e
lea eax, [ebp - 0x20c]
call fcn.00406438
ret

Function at 0x4da724
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4da7f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4d9f88]
call fcn.004da81c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4da7cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4da80c
call fcn.0040e2c8
mov edx, dword [ebp - 8]
mov eax, dword [0x505e5c]
mov eax, dword [eax]
call fcn.0047bfc0
call fcn.004d9ff0
call sub.user32.dll_GetFocus
mov edx, dword [0x505e5c]
mov edx, dword [edx]
cmp eax, dword [edx + 0x170]
jne 0x4da7af
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4da7b6
call sub.user32.dll_WaitMessage
jmp 0x4da789
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da7d3
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x4dfe14
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4dfe1c
push ecx
push ebx
xor eax, eax
push ebp
push 0x4dff66
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004ae5e0
mov edx, dword [ebp - 0x10]
mov eax, 0x50cdc8
call fcn.00406448
lea eax, [ebp - 0x14]
mov ecx, dword [0x50cdc8]
mov edx, 0x4dff80
call fcn.00406914
mov eax, dword [ebp - 0x14]
call fcn.004b2f34
mov eax, dword [0x505f20]
cmp byte [eax], 0
je 0x4dfe77
mov eax, dword [0x50cdc8]
call fcn.004b263c
lea edx, [ebp - 0x18]
mov eax, dword [0x50cdc8]
call fcn.0047e328
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x4dffc8
call fcn.00406914
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4dff0d
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.004abea8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0040d1cc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.00480914
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x68
call fcn.004abe78
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x40ab6c]
call fcn.004119a0
call fcn.00404a74
lea eax, [ebp - 8]
call fcn.004b37e4
cmp dword [ebp - 8], 0
je 0x4dff3e
lea eax, [ebp - 0xc]
mov ecx, 0x4dffe4
mov edx, dword [ebp - 4]
call fcn.00406914
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004dfdbc
mov eax, dword [ebp - 0xc]
call fcn.004b383c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dff6d
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00406440
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00406440
ret

Function at 0x4e2850
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x50d0a1], 1
call fcn.004b0418
test al, al
jne 0x4e28a2
push 5
mov eax, dword [0x505e5c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x505e5c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x505e6c]
mov eax, dword [eax + 0x124]
mov cl, 2
xor edx, edx
call fcn.004e2734
ret

Function at 0x4e5ba0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4e5bc5
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e7918
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4e7944
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x4e794d
call fcn.004e6638
mov eax, 0xa
call fcn.00480d18
call fcn.004e6638
call fcn.004e78e4
test al, al
jne 0x4e7922
pop ebx
ret

Function at 0x4e7e70
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x505a00]
cmp dword [eax], 0
je 0x4e7f1b
mov eax, dword [0x505a00]
mov eax, dword [eax]
call fcn.00463e54
test al, al
je 0x4e7f1b
mov eax, dword [0x505a00]
mov eax, dword [eax]
cmp byte [eax + 0x1e2], 0
je 0x4e7ec5
cmp byte [ebx + 0x389], 0
jne 0x4e7ec5
mov eax, dword [0x505e5c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4e7ec9
xor eax, eax
jmp 0x4e7ecb
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x505a00]
mov eax, dword [eax]
call fcn.00463aa8
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x4e7f1b
test bl, bl
je 0x4e7f07
push 5
mov eax, dword [0x505a00]
mov eax, dword [eax]
call fcn.00463aa8
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e7f1b
push 0
mov eax, dword [0x505a00]
mov eax, dword [eax]
call fcn.00463aa8
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4e7fcc
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x50d05a], 0
push 0x4e80b4
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
push 0x4e80d0
push ebx
call fcn.00409620
test eax, eax
je 0x4e8058
lea edx, [esp + 4]
push edx
call eax
push 0x4e80f8
push ebx
call fcn.00409620
mov esi, eax
test esi, esi
je 0x4e8062
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x4e8062
cmp dword [esp], 0
je 0x4e8062
call fcn.004ad2bc
test al, al
je 0x4e8062
push 0x4e8118
push ebx
call fcn.00409620
test eax, eax
je 0x4e8062
push 0x4e814c
push 0x4e816c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409620
test eax, eax
je 0x4e8062
mov byte [0x50d05a], 1
jmp 0x4e8062
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
movzx eax, word [esp + 4]
sub ax, 1
jb 0x4e8081
sub ax, 5
je 0x4e808a
sub ax, 3
je 0x4e8093
sub ax, 3
je 0x4e809c
jmp 0x4e80a5
mov byte [0x5054f4], 1
jmp 0x4e80ac
mov byte [0x5054f4], 3
jmp 0x4e80ac
mov byte [0x5054f4], 2
jmp 0x4e80ac
mov byte [0x5054f4], 4
jmp 0x4e80ac
mov byte [0x5054f4], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x4e8188
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e81f8
mov edx, 0x80000002
xor eax, eax
call fcn.0047fdb8
test eax, eax
jne 0x4e81f1
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4e824c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4e81e8
cmp dword [ebp - 0xc], 4
jne 0x4e81e8
cmp dword [ebp - 8], 4
jne 0x4e81e8
movzx eax, word [ebp - 0x10]
mov word [0x50d070], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret

Function at 0x4e83f4
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e84a3
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x50d06c], eax
cmp byte [0x50d059], 0
je 0x4e84a3
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4e8494
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e84a3
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x50d070], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x50d072], al
movzx eax, word [esp + 0x22c]
mov word [0x50d074], ax
jmp 0x4e84a3
cmp eax, 4
jne 0x4e84a3
call fcn.004e8188
call fcn.004e8264
add esp, 0x230
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219