joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474610
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4f8bf4]
cmp dword [eax + 0x30], 0
je 0x4746ba
cmp dword [ebx + 0x94], 0
jne 0x4746b4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4745a0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4746b4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47467a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4746b4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041ad5c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x474689
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x47521c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x475251
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040491c
jmp 0x47525e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404880
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x476368
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4763a9
mov eax, esi
call fcn.0045c534
test al, al
je 0x4763a9
mov eax, dword [ebx + 0x84]
call fcn.0045c230
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4763a9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045c230
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x47d05c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47d116
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f60
mov eax, dword [0x4f6b24]
cmp byte [eax], 0
je 0x47d0cb
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004052c0
mov eax, dword [ebx]
call fcn.004050ec
push eax
mov eax, dword [ebx]
call fcn.004050dc
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004050ec
mov edx, eax
dec edx
mov eax, ebx
call fcn.004052c0
jmp 0x47d0fd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409dec
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004050cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d11d
lea eax, [ebp - 0x3f0]
call fcn.0040482c
ret
Function at 0x47d124
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409dec
add esp, 0x3ec
pop ebx
ret

Function at 0x47d2e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov esi, edx
mov ebp, eax
mov edx, esi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
cmp dword [esi + 0xc], 0
jne 0x47d3aa
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0046c828
mov ebx, eax
mov dx, word [esi + 4]
mov eax, ebp
call fcn.0047cfa0
mov edi, eax
test edi, edi
je 0x47d343
mov al, byte [0x47d3b8]
cmp al, bl
jne 0x47d343
mov edx, edi
mov eax, ebp
call fcn.0047ced8
mov dword [esi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x47d3aa
cmp byte [ebp + 0x171], 2
jne 0x47d36e
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x4f7144]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, 0xb006
call fcn.00456ab0
test eax, eax
jne 0x47d3aa
jmp 0x47d3a5
mov edx, dword [0x4f6f98]
mov edx, dword [edx]
mov edx, dword [edx + 0x44]
mov eax, dword [ebp + 0x138]
cmp edx, eax
je 0x47d3a5
test byte [eax + 0x2f4], 8
jne 0x47d3a5
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x4f6f98]
mov eax, edx
mov edx, 0xb006
call fcn.00456ab0
xor eax, eax
mov dword [esi + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4836e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x4f7144]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x483786
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x483725
cmp eax, dword [esp]
pop edx
pop eax
jae 0x483761
jmp 0x483729
pop edx
pop eax
jge 0x483761
mov eax, dword [0x4f7144]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0047e0d8
mov eax, dword [ebx + 0x104]
test eax, eax
je 0x483786
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x483786
cmp dword [ebx + 0x12c], 0
je 0x483786
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0043611c
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x13c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x48a620
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48a6da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f60
mov eax, dword [0x4f6b24]
cmp byte [eax], 0
je 0x48a68f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004052c0
mov eax, dword [ebx]
call fcn.004050ec
push eax
mov eax, dword [ebx]
call fcn.004050dc
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004050ec
mov edx, eax
dec edx
mov eax, ebx
call fcn.004052c0
jmp 0x48a6c1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409dec
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004050cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a6e1
lea eax, [ebp - 0x3f0]
call fcn.0040482c
ret

Function at 0x48d934
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48d98e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.0048d998
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d995
ret

Function at 0x4941b0
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4941e6
jmp 0x49428c
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x49422a
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x184], 0
je 0x49422a
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x184]
mov eax, dword [eax + 0x14]
jmp 0x49423a
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x180]
test edx, edx
je 0x49423a
mov eax, dword [edx + 0x14]
test eax, eax
je 0x494253
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.00490b54
jmp 0x49428c
mov dl, 1
mov eax, dword [0x425a74]
call fcn.00427a58
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.00428568
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xc4]
mov eax, dword [esi + 0x10]
call fcn.00427608
mov edx, esp
mov eax, esi
call fcn.0042815c
mov eax, esi
call fcn.004039f8
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x496a90
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.0045c230
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.0045581c
pop ebx
ret
Function at 0x4a10c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x4a10e6
push 0
mov eax, dword [ebx + 0x94]
call fcn.0045c230
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x4a11a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1311
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4a12f6
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409dec
mov dl, 1
mov eax, dword [0x477554]
call fcn.004775ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x418c54]
call fcn.004039c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00477628
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4a12f3
mov dl, 1
mov eax, dword [0x478abc]
call fcn.00478b24
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, 0x4a1328
call fcn.00477d90
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404b38
xor eax, eax
push ebp
push 0x4a12ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00478e24
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004a1330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a12f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.004039f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004039f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004039f8
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1318
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404850
ret
Function at 0x4a2850
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41785c]
call fcn.00405324
xor eax, eax
push ebp
push 0x4a2994
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f5348], 0
jne 0x4a28a3
mov ecx, dword [0x4f6a4c]
mov dl, 1
mov eax, dword [0x407fc0]
call fcn.0040d1a4
call fcn.004041c4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030d4
mov eax, ebx
call fcn.004050dc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a29a4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004063f0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050ec
test eax, eax
jle 0x4a293b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a2934
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404ab4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a9c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408e6c
test eax, eax
jne 0x4a2934
mov ebx, 0x15
jmp 0x4a2940
mov ebx, 0x10
jmp 0x4a2940
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4f5348]
call fcn.004a27a8
mov eax, dword [ebp - 8]
call fcn.004a27a8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a299b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404850
lea eax, [ebp - 0x10]
mov edx, dword [0x41785c]
call fcn.004053f4
ret

Function at 0x4acaa4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4acad2
mov eax, ebx
call fcn.004ad558
cmp dword [ebx + 0x40], 0
je 0x4acacb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4acb43
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4acb35
cmp dword [ebx + 8], 0
je 0x4acaf4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4acb06
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4acb35
cmp dword [ebx + 8], 0
je 0x4acae7
cmp eax, 3
je 0x4acb19
dec eax
jne 0x4acae7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4acae7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4acae7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4acb61
cmp dword [ebx + 0x14], 0xcc
je 0x4acb61
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004acb6c
pop ebx
ret
Function at 0x4c57ec
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4c57f4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4c59e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4c59fc
mov eax, esi
call fcn.004c357c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404880
lea ecx, [ebp - 0x10]
mov edx, 0x4c5a10
mov eax, esi
call fcn.004c357c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404880
lea ecx, [ebp - 0x14]
mov edx, 0x4c5a28
mov eax, esi
call fcn.004c357c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404880
lea ecx, [ebp - 0x18]
mov edx, 0x4c5a44
mov eax, esi
call fcn.004c357c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404880
lea ecx, [ebp - 0x1c]
mov edx, 0x4c5a60
mov eax, esi
call fcn.004c357c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404880
lea ecx, [ebp - 0x24]
mov edx, 0x4c5a78
mov eax, esi
call fcn.004c357c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408edc
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004092bc
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4c5a90
mov eax, esi
call fcn.004c357c
mov eax, dword [ebp - 0x28]
call fcn.004c2694
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4c5aa0
mov eax, esi
call fcn.004c357c
mov eax, dword [ebp - 0x2c]
call fcn.004c2694
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4c5ab8
mov eax, esi
call fcn.004c357c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004092bc
inc eax
je 0x4c5989
lea ecx, [ebp - 0x34]
mov edx, 0x4c5ab8
mov eax, esi
call fcn.004c357c
mov eax, dword [ebp - 0x34]
call fcn.00409280
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040af34
fstp qword [ebp - 0x3c]
wait
call fcn.0040b298
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4c59a4
lea ecx, [ebp - 0x40]
mov edx, 0x4c5ab8
mov eax, esi
call fcn.004c357c
mov eax, dword [ebp - 0x40]
call fcn.004c2694
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4c5ac8
mov eax, esi
call fcn.004c357c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c59ed
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404850
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404850
ret
Function at 0x4d1c84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4d1cde
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004d1c74
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004c1300
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004c0f00
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1ce5
lea eax, [ebp - 4]
call fcn.0040482c
ret
Function at 0x4f2afc
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4f2c8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x1400
mov eax, dword [ebp - 4]
call fcn.004027a4
mov ebx, eax
lea edx, [ebp - 4]
push edx
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x4f2b43
push eax
call sub.kernel32.dll_SetLastError
call fcn.0040e808
cmp dword [ebp - 8], 0
jne 0x4f2b5f
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x190]
lea eax, [ebx + 0x194]
call fcn.004d54dc
jmp 0x4f2b8b
push dword [ebp - 8]
push 0x4f2ca0
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x190]
lea eax, [ebx + 0x194]
call fcn.004d54dc
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404bac
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4f2b43
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d2388]
call fcn.004d2870
mov ebx, eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x418cd0]
call fcn.0041def0
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.004d43ec
add eax, 0x24
mov edx, 0x4f2cac
call fcn.00404880
xor eax, eax
push ebp
push 0x4f2c41
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f2cd8
push dword [ebp - 8]
push 0x4f2ce8
push 0x4f2cf4
call fcn.0040b298
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x1c]
mov eax, 0x4f2d08
call fcn.0040bf14
push dword [ebp - 0x1c]
push 0x4f2ce8
push 0x4f2d1c
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.00404bac
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.0041e004
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x4f2d30
mov eax, ebx
call fcn.004d2ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f2c5a
mov eax, dword [ebp - 0x10]
call fcn.004039f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2c91
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404850
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404850
ret
Function at 0x10002450
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1006a180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov edx, ecx
movq qword [ebp - 0x10], xmm0
push esi
lea ecx, [ebp - 0x10]
xor bl, bl
call fcn.10002330
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x100024b0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call edi
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
add esi, 4
cmp esi, dword [ebp - 0x14]
jne 0x10002491
mov esi, dword [ebp - 0x10]
pop edi
test esi, esi
je 0x100024e0
mov ecx, dword [ebp - 8]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100024d6
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100024f2
push ecx
push esi
call fcn.100318e5
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1003189d
mov esp, ebp
pop ebp
ret
call fcn.1003a00e
int3
Function at 0x10002d60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10002d7e
push 0
push 0
push 0
push 0x10002d50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1000ec80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054230
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1006a180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
call fcn.100318b0
mov esi, eax
add esp, 4
test esi, esi
je 0x1000ed69
mov ecx, esi
call fcn.10011f60
push 0x34
mov dword [esi], vtable.tvg::Shape.0
call fcn.100318b0
add esp, 4
test eax, eax
je 0x1000ed48
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], esi
mov byte [eax + 0x30], 0
mov byte [eax + 0x32], 0
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
mov byte [eax + 0x13], 1
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
mov byte [eax + 0x13], 1
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret