joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x472218
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004720f8
test al, al
je 0x4721fa
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404a40
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x4721fa
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e10
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00404e10
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404b48
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4721b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47221f
lea eax, [ebp - 0x2c]
call fcn.00404950
lea eax, [ebp - 0xc]
call fcn.00404950
ret

Function at 0x472388
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00471ca0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404e10
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4723e6
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x511edc]
mov dl, 1
mov eax, dword [0x471b98]
call fcn.0040d1fc
call fcn.004042e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4723f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404e10
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x472448
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x512388]
mov dl, 1
mov eax, dword [0x471b98]
call fcn.0040d1fc
call fcn.004042e0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00471cd0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4826e0
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x513c28], 0
jne 0x482703
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x482628
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x513c28], eax
ret
Function at 0x4892a8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x48933c
push 0
mov eax, ebx
call fcn.00404e10
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x489317
mov eax, esi
call fcn.00404c10
inc eax
push eax
mov eax, esi
call fcn.00404e10
push eax
push 1
push 0
mov eax, edi
call fcn.00404e10
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x489332
mov ecx, dword [0x511ca4]
mov dl, 1
mov eax, dword [0x4878b4]
call fcn.0040d1c0
call fcn.004042e0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x489470
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4183cc]
call fcn.004053c0
xor eax, eax
push ebp
push 0x4895b4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x510380], 0
jne 0x4894c3
mov ecx, dword [0x5119ec]
mov dl, 1
mov eax, dword [0x408158]
call fcn.0040d1c0
call fcn.004042e0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040340c
mov eax, ebx
call fcn.004051dc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4895c4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406538
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004051ec
test eax, eax
jle 0x48955b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x489554
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404bd8
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404bc0
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409060
test eax, eax
jne 0x489554
mov ebx, 0x15
jmp 0x489560
mov ebx, 0x10
jmp 0x489560
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x510380]
call fcn.00489238
mov eax, dword [ebp - 8]
call fcn.00489238
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4895bb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404974
lea eax, [ebp - 0x10]
mov edx, dword [0x4183cc]
call fcn.00405490
ret
Function at 0x494830
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49485e
mov eax, ebx
call fcn.004952e4
cmp dword [ebx + 0x40], 0
je 0x494857
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4948cf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4948c1
cmp dword [ebx + 8], 0
je 0x494880
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x494892
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4948c1
cmp dword [ebx + 8], 0
je 0x494873
cmp eax, 3
je 0x4948a5
dec eax
jne 0x494873
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x494873
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x494873
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4948ed
cmp dword [ebx + 0x14], 0xcc
je 0x4948ed
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004948f8
pop ebx
ret

Function at 0x4a6c60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a6dd1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a6dac
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404b38
lea eax, [ebp - 0x118]
mov edx, 0x4a6de8
call fcn.00404c18
mov eax, dword [ebp - 0x118]
call fcn.00404e10
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4a6d1e
lea eax, [ebp - 0x111]
call fcn.00409e88
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404a40
jmp 0x4a6d25
mov eax, esi
call fcn.00404950
cmp bl, 0x61
jae 0x4a6d46
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040dfb8
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004049a4
jmp 0x4a6d60
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040df2c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004049a4
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4a6df4
call fcn.0040a5a8
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004049a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6db3
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4ac144
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4ac31a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x4ac301
mov eax, dword [edi + 0x30]
call fcn.00404c10
test eax, eax
jne 0x4ac19a
mov eax, dword [edi + 0x34]
call fcn.00404c10
test eax, eax
jne 0x4ac19a
mov eax, edi
call fcn.004ac3b8
jmp 0x4ac301
cmp dword [edi + 0xa0], 0
jne 0x4ac1d1
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00409f20
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x514004]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x4ac208
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00409f20
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x514004]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004ac3f8
mov ebx, eax
test bl, bl
jne 0x4ac2b6
mov eax, dword [edi + 0x30]
call fcn.00404c10
test eax, eax
jne 0x4ac240
mov eax, dword [edi + 0xc0]
call fcn.00404c10
test eax, eax
je 0x4ac2b6
mov eax, dword [edi + 0xc0]
call fcn.00404c10
test eax, eax
je 0x4ac262
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00409f20
jmp 0x4ac28e
push dword [edi + 0x30]
push 0x4ac334
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404cd0
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00409f20
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4ac2b6
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004ac3f8
mov ebx, eax
test bl, bl
jne 0x4ac2c3
mov eax, edi
call fcn.004ac3b8
jmp 0x4ac301
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4ac2d2
mov dword [edi + 0xa8], eax
jmp 0x4ac2dc
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.004ac470
test al, al
je 0x4ac301
mov eax, edi
mov si, 0xffee
call fcn.00403c84
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004ac520
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac321
lea eax, [ebp - 0x108]
call fcn.00404950
ret
Function at 0x4b2a80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
cmp byte [0x51403c], 0
je 0x4b2a9b
mov byte [ebp - 1], 1
jmp 0x4b2b7b
mov byte [ebp - 1], 0
push 0x4b2b88
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4b2b73
xor eax, eax
push ebp
push 0x4b2b69
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b2b94
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b2b5f
mov eax, dword [ebp - 8]
mov dword [0x51402c], eax
push 0x4b2bac
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b2b5f
mov eax, dword [ebp - 8]
mov dword [0x514030], eax
push 0x4b2bc4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b2b5f
mov eax, dword [ebp - 8]
mov dword [0x514034], eax
push 0x4b2be0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b2b5f
mov eax, dword [ebp - 8]
mov dword [0x514038], eax
push 0x4b2bfc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b2b5f
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b2b73
mov al, byte [ebp - 1]
mov byte [0x51403c], al
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b2ddc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b2eb2
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004b2a80
test al, al
jne 0x4b2e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b2ebc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc0], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc4], edx
mov eax, dword [ebp - 4]
add eax, 0x78
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00404950
mov eax, dword [ebp - 8]
add eax, 4
call fcn.00404950
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 8]
add eax, 0x3c
call fcn.00404950
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 8]
add eax, 0x38
call fcn.00404950
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x40], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b2ebc
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b3a5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b3ab8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3ac2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3e80
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4b3f10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x512358]
cmp dword [eax], 2
jne 0x4b3ef9
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x18]
push eax
push 0x4b3f28
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 8
call sub.user32.dll_ExitWindowsEx
jmp 0x4b3f02
push 0
push 1
call sub.user32.dll_ExitWindowsEx
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b3f1e
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4204
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4429
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b43f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4b428d
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SendMessageA
xor edx, edx
mov eax, 2
call fcn.004b35dc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x148], 0x128
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x10]
call fcn.004b35fc
mov dword [ebp - 0xc], eax
jmp 0x4b43d8
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404bc0
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00409cfc
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00408e58
mov eax, dword [ebp - 0x14c]
push eax
lea eax, [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.00404b48
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00408e58
mov edx, dword [ebp - 0x158]
pop eax
call fcn.00404d5c
je 0x4b4383
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404bc0
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.00408e58
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x16c]
mov edx, dword [ebp - 4]
call fcn.00404b48
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.00408e58
mov edx, dword [ebp - 0x168]
pop eax
call fcn.00404d5c
jne 0x4b43c3
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x1c], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_TerminateProcess
mov byte [ebp - 5], 1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404bc0
jmp 0x4b43e2
mov byte [ebp - 5], 0
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0x10]
call fcn.004b361c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b42bc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4403
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4430
lea eax, [ebp - 0x16c]
mov edx, 9
call fcn.00404974
lea eax, [ebp - 0x14]
call fcn.00404950
ret
Function at 0x4b48d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4b498f
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov dword [ebp - 0x18], eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
fild qword [ebp - 0x20]
fdiv dword [0x4b49a4]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4999
fld qword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b4ee0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe1c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4fcb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b4fa3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404950
lea eax, [ebp - 0x1e4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x54]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x54]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b4f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4fb5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4b4f7d
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404b48
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp dword [eax + edx*4], 0
jne 0x4b4f60
call sub.wsock32.dll_WSACleanup
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004049a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4fb5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4fd2
lea eax, [ebp - 8]
call fcn.00404950
ret