joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447f98
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4994c4]
cmp byte [eax + 0xc], 0
je 0x448105
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4480fe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49ac1c], 0
jne 0x447fec
push 0x44810c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x448114
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac1c], eax
cmp dword [0x497b24], 0
jne 0x4480e7
push 0x448124
call sub.kernel32.dll_LoadLibraryA
mov dword [0x497b24], eax
cmp dword [0x497b24], 0
je 0x4480e7
push 0x448130
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac20], eax
push 0x448140
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac24], eax
push 0x448154
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac28], eax
push 0x44816c
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac2c], eax
push 0x448184
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac30], eax
push 0x448198
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac34], eax
push 0x4481b0
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac38], eax
push 0x4481c8
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac3c], eax
push 0x4481e4
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac40], eax
push 0x4481f0
mov eax, dword [0x497b24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49ac44], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448105
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44c35c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004044d0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44c3ab
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404738
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4543e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x454430]
test si, 4
je 0x4543f4
or bl, 1
test si, 8
je 0x4543fe
or bl, 4
test si, 1
je 0x454408
or bl, 8
test si, 2
je 0x454412
or bl, 0x10
test si, 0x10
je 0x45441c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45442b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x454434
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45446c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45444d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45445c
or bl, 4
test esi, 0x20000000
je 0x454467
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45aa88
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45aa9a
add esp, 0xfffffff0
call fcn.00403ac8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423c14
mov eax, dword [0x499028]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ae2c
mov eax, dword [0x499038]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ae38
mov eax, ebx
call fcn.0045ae44
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4195cc]
call fcn.00403734
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4195cc]
call fcn.00403734
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4195cc]
call fcn.00403734
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4195cc]
call fcn.00403734
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4195cc]
call fcn.00403734
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45730c
push eax
push 0
push 0
mov eax, dword [0x499214]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x42564c]
call fcn.00426e00
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x42564c]
call fcn.00426e00
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x42564c]
call fcn.00426e00
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045b264
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b140
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b140
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45b140
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45abd7
call fcn.00403b20
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45af24
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b0cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45b0b0
mov dl, 1
mov eax, dword [0x419b74]
call fcn.00403734
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004044d0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45b09f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004482f8
test al, al
je 0x45b092
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45b0e0
lea eax, [ebp - 0x254]
call fcn.004097d0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45b092
xor eax, eax
push ebp
push 0x45b08b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45b118
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45b074
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404738
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45b074
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404738
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b092
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45af95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041e0f0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b0d6
lea eax, [ebp - 0x260]
call fcn.004044d0
ret

Function at 0x45ba04
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x49ac60]
cmp byte [eax + 0xa5], 0
jne 0x45ba75
cmp dword [0x49ac78], 0
jne 0x45ba36
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45b9c0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49ac78], eax
cmp dword [0x49ac74], 0
jne 0x45ba51
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x49ac74], eax
cmp dword [0x49ac7c], 0
jne 0x45ba75
push esp
push 0
push 0
push 0x45b964
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x49ac7c], eax
pop edx
ret
Function at 0x45bbe4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45bbfb
add esp, 0xfffffff0
call fcn.00403ac8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423c14
mov eax, dword [0x4991f8]
cmp word [eax + 2], 0
jne 0x45bc23
mov eax, dword [0x4991f8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d2a8
mov eax, dword [0x4992ec]
cmp word [eax + 2], 0
jne 0x45bc3d
mov eax, dword [0x4992ec]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d4a0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4195cc]
call fcn.00403734
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4195cc]
call fcn.00403734
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x42616c]
call fcn.0042dfbc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45bdc4
mov eax, dword [0x4990c0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e38c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45da20
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4990c0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cee8
test eax, eax
je 0x45bd32
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040912c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cf10
test eax, eax
je 0x45bd46
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404738
mov eax, dword [0x498ed4]
cmp byte [eax], 0
jne 0x45bd7a
mov eax, ebx
call fcn.0045beec
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045dbfc
mov eax, ebx
call fcn.0045e5ac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45bdba
call fcn.00403b20
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c160
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x49ac60]
cmp dword [eax + 0x30], 0
je 0x45c20a
cmp dword [ebx + 0x94], 0
jne 0x45c204
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c0f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c204
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c1ca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c204
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041bdac
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c1d9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45cce8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45cd1d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045c0
jmp 0x45cd2a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404524
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45ddd8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45de19
mov eax, esi
call fcn.00443a34
test al, al
je 0x45de19
mov eax, dword [ebx + 0x84]
call fcn.00443730
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45de19
push 0
mov eax, dword [ebx + 0x84]
call fcn.00443730
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45eac4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418c40]
call fcn.00404ecc
xor eax, eax
push ebp
push 0x45ec08
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x497d60], 0
jne 0x45eb17
mov ecx, dword [0x498f00]
mov dl, 1
mov eax, dword [0x407a8c]
call fcn.0040c278
call fcn.00403f30
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403064
mov eax, ebx
call fcn.00404d1c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45ec18
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040636c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d2c
test eax, eax
jle 0x45ebaf
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45eba8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404750
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404738
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004088a4
test eax, eax
jne 0x45eba8
mov ebx, 0x15
jmp 0x45ebb4
mov ebx, 0x10
jmp 0x45ebb4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x497d60]
call fcn.0045ea1c
mov eax, dword [ebp - 8]
call fcn.0045ea1c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ec0f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044f4
lea eax, [ebp - 0x10]
mov edx, dword [0x418c40]
call fcn.00404f9c
ret

Function at 0x46ba0c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407534
ret
Function at 0x46edf8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46ee26
mov eax, ebx
call fcn.0046f8b0
cmp dword [ebx + 0x3c], 0
je 0x46ee1f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46ee97
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x46ee89
cmp dword [ebx + 8], 0
je 0x46ee48
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x46ee5a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46ee89
cmp dword [ebx + 8], 0
je 0x46ee3b
cmp eax, 3
je 0x46ee6d
dec eax
jne 0x46ee3b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46ee3b
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x46ee3b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x46eeb5
cmp dword [ebx + 0x10], 0xcc
je 0x46eeb5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046eec0
pop ebx
ret

Function at 0x480a38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x480a8c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 4]
mov eax, dword [0x4992c0]
mov eax, dword [eax]
call fcn.0045d780
mov eax, dword [ebp - 4]
call fcn.00404980
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4992c0]
mov eax, dword [eax]
call fcn.0045d294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480a93
lea eax, [ebp - 4]
call fcn.004044d0
ret
Function at 0x495a28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
xor ecx, ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404970
mov eax, dword [ebp - 8]
call fcn.00404970
xor eax, eax
push ebp
push 0x495b35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0x22
jne 0x495a72
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404568
jmp 0x495a8c
push 0x495b48
push dword [ebp - 8]
push 0x495b48
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404848
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408f6c
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403064
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404980
push eax
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
push dword [ebp - 4]
push 0x495b54
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 3
call fcn.00404848
mov eax, dword [ebp - 0x68]
call fcn.00404980
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x495b12
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495b3c
lea eax, [ebp - 0x68]
call fcn.004044d0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004044f4
ret
Function at 0x496670
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
lea edi, [ebp - 0x2c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x494ce4]
call fcn.004050c8
xor eax, eax
push ebp
push 0x4968bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebp - 0x20]
mov edx, 0x4968d8
call fcn.004048cc
jne 0x4966dc
lea eax, [ebp - 0xc]
mov edx, 0x4968e4
call fcn.00404568
jmp 0x4966ec
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x496904
call fcn.004047d4
xor eax, eax
push ebp
push 0x496733
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4968e4
call fcn.00408ea0
test al, al
je 0x496712
mov eax, 0x4968e4
call fcn.00408ed4
push 0xffff
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x419d74]
call fcn.0041e6b0
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496747
xor eax, eax
push ebp
push 0x496770
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x304]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x28]
call fcn.0048e844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49678c
mov eax, dword [ebp - 8]
call fcn.00403764
mov eax, dword [ebp - 0x20]
mov edx, 0x4968d8
call fcn.004048cc
jne 0x4967db
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x496904
call fcn.004047d4
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x10]
mov eax, 0x4968e4
call fcn.00495b58
test eax, eax
jne 0x496886
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x496904
call fcn.004047d4
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
sub eax, 0x30
jne 0x49684b
lea eax, [ebp - 0x38]
call fcn.004959c8
push dword [ebp - 0x38]
push 0x496918
push dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404848
mov eax, dword [ebp - 0x34]
call fcn.00408ea0
test al, al
jne 0x49684b
push 0
lea eax, [ebp - 0x40]
call fcn.004959c8
push dword [ebp - 0x40]
push 0x496918
push dword [ebp - 0x2c]
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404848
mov eax, dword [ebp - 0x3c]
call fcn.00404980
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404980
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
sub eax, 0x30
dec eax
je 0x49685e
sub eax, 2
je 0x496878
jmp 0x496882
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00495e14
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00495e14
jmp 0x496882
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00495a28
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4968c3
lea eax, [ebp - 0x40]
mov edx, 5
call fcn.004044f4
lea eax, [ebp - 0x2c]
mov edx, dword [0x494ce4]
call fcn.00404f9c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004044f4
ret
Function at 0x496cec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov eax, 0x49697c
call fcn.00406a4c
xor eax, eax
push ebp
push 0x496e4c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x495f50]
call fcn.00455a7c
mov ebx, eax
mov eax, ebx
call fcn.00496298
test al, al
jne 0x496d33
mov eax, ebx
call fcn.00403764
jmp 0x496e3e
mov edx, 0x49bef4
mov eax, ebx
call fcn.0049611c
mov esi, eax
mov eax, ebx
call fcn.00403764
test esi, esi
jne 0x496e3e
mov eax, 0x496e64
cmp byte [eax + 0x33], 0x31
jne 0x496d8d
push 1
push 0x496e9c
mov eax, dword [0x49bef4]
call fcn.00404980
push eax
push 0x496ea0
push 0x496eac
push 0
call sub.shell32.dll_ShellExecuteA
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x496e3e
mov eax, dword [0x4992c0]
mov eax, dword [eax]
call fcn.0045d110
mov eax, dword [0x4992c0]
mov eax, dword [eax]
mov edx, 0x496ebc
call fcn.0045cd34
mov ecx, dword [0x499414]
mov eax, dword [0x4992c0]
mov eax, dword [eax]
mov edx, dword [0x47fd34]
call fcn.0045d128
mov eax, dword [0x4990f0]
add eax, 0x10
mov edx, dword [0x49bef4]
call fcn.00404524
mov ecx, dword [0x49905c]
mov eax, dword [0x4992c0]
mov eax, dword [eax]
mov edx, dword [0x47f0bc]
call fcn.0045d128
mov eax, dword [0x499414]
mov eax, dword [eax]
mov edx, dword [eax + 0x320]
mov eax, dword [0x499414]
mov eax, dword [eax]
call fcn.00480bdc
push 0x2c
push 0
push 1
push 0
call sub.user32.dll_RegisterHotKey
push 0x2c
push 1
push 2
push 0
call sub.user32.dll_RegisterHotKey
mov eax, dword [0x4992c0]
mov eax, dword [eax]
call fcn.0045d1a8
push 1
push 0
call sub.user32.dll_UnregisterHotKey
push 2
push 0
call sub.user32.dll_UnregisterHotKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496e53
ret