joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc55c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov ebx, ecx
mov ebp, edx
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cc780
mov edx, 0x4cc784
mov eax, esi
call fcn.004cc254
test al, al
jne 0x4cc590
xor eax, eax
jmp 0x4cc774
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b44
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x530de0]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
test ebx, ebx
je 0x4cc614
or dword [esp + 0xd4], 0x20
mov eax, dword [ebx]
lea edx, [esp + 0xd8]
mov dword [edx], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0xd8]
mov dword [edx + 4], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esp + 0x118], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x20
call fcn.0040303c
mov edx, 0x4cc794
mov eax, esi
call fcn.004cc470
mov ebx, eax
test ebx, ebx
jne 0x4cc640
xor eax, eax
jmp 0x4cc774
push 0x4cc7a0
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cc7b4
push ebx
call sub.advapi32.dll_RegDeleteValueA
test ebp, ebp
je 0x4cc663
mov dword [esp], 3
jmp 0x4cc668
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cc7c4
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cc689
xor eax, eax
jmp 0x4cc774
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cc7d8
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cc6b1
xor eax, eax
jmp 0x4cc774
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cc7f4
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cc6d9
xor eax, eax
jmp 0x4cc774
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x4cc706
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov edi, eax
test edi, edi
je 0x4cc706
push edi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cc71b
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push esi
push edi
lea edi, [esi + 4]
lea esi, [esp + 0xb4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esi + 0xa0]
lea edx, [esp + 8]
mov ecx, 0x20
call fcn.004047c4
push ebp
call sub.user32.dll_SetThreadDesktop
test edi, edi
je 0x4cc76c
push edi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
mov al, 1
add esp, 0x148
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cc808
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.0040455c
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cc950
mov edx, 0x4cc954
mov eax, ebx
call fcn.004cc254
test al, al
je 0x4cc945
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b44
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x530de0]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4cc964
mov eax, ebx
call fcn.004cc470
mov ebx, eax
test ebx, ebx
je 0x4cc945
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cc970
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4cc984
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cc998
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4cc902
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4cc902
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cc917
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4cc93f
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x4ccbf8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4cce1f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x530e00], eax
xor eax, eax
mov dword [0x5390b0], eax
xor eax, eax
mov dword [0x5390b4], eax
xor eax, eax
mov dword [0x5390b8], eax
xor eax, eax
mov dword [0x5390bc], eax
xor eax, eax
mov dword [0x5390ac], eax
xor eax, eax
mov dword [0x5390c0], eax
xor eax, eax
mov dword [0x5390c4], eax
xor eax, eax
mov dword [0x5390c8], eax
xor eax, eax
mov dword [0x5390cc], eax
cmp dword [0x530e04], 0
je 0x4cce01
push 0x4cce2c
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390b0], eax
push 0x4cce34
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390b4], eax
push 0x4cce3c
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390b8], eax
push 0x4cce44
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390bc], eax
push 0x4cce4c
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390ac], eax
push 0x4cce54
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390c0], eax
push 0x4cce64
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390c4], eax
push 0x4cce70
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390c8], eax
push 0x4cce80
mov eax, dword [0x530e04]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5390cc], eax
cmp dword [0x5390b0], 0
je 0x4cce01
cmp dword [0x5390b4], 0
je 0x4cce01
cmp dword [0x5390b8], 0
je 0x4cce01
cmp dword [0x5390bc], 0
je 0x4cce01
cmp dword [0x5390ac], 0
je 0x4cce01
cmp dword [0x530e08], 0xffffffff
jne 0x4ccd9d
push 0
push 1
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4cce9c
call fcn.00404860
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 4]
mov edx, 0x4cceb0
call fcn.0046d098
mov dword [0x530e08], eax
cmp dword [0x530e08], 2
jge 0x4ccdb5
push 0x58
push 0x6f401
call dword [0x5390bc]
jmp 0x4ccdc9
cmp dword [0x530e08], 2
jne 0x4ccdc9
push 0x51a7b0e
call dword [0x5390b4]
mov dword [0x530e00], 1
cmp dword [0x5390c0], 0
je 0x4cce01
cmp dword [0x5390c4], 0
je 0x4cce01
cmp dword [0x5390c8], 0
je 0x4cce01
cmp dword [0x5390cc], 0
je 0x4cce01
mov dword [0x530e00], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cce26
lea eax, [ebp - 8]
call fcn.0040455c
lea eax, [ebp - 4]
call fcn.00404c78
ret
Function at 0x4d2168
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d22cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x531ee8], 0x7d9
cmp si, 2
jne 0x4d21c2
lea eax, [ebp - 0x20]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d22e4
call fcn.0046d3cc
jmp 0x4d21ee
cmp si, 8
je 0x4d21ce
cmp si, 1
jne 0x4d21ee
lea eax, [ebp - 0x24]
mov edx, dword [0x533514]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d22f4
call fcn.0046d3cc
cmp dword [ebp - 0xc], 0
je 0x4d2209
push 1
lea eax, [ebp - 0xc]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d22a1
test si, 2
jne 0x4d221e
test si, 1
jne 0x4d221e
test si, 8
je 0x4d2287
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d2287
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004a94c4
mov eax, dword [ebp - 0x28]
call fcn.00404a0c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d228f
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x531ee8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d22d3
lea eax, [ebp - 0x28]
call fcn.0040455c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0xc]
call fcn.0040455c
ret

Function at 0x4d2eec
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x531ee8], 0x7e9
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d2f23
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d2f2a
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x531ee8], eax
add esp, 0x108
pop ebx
ret

Function at 0x4d2f3c
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x531ee8], 0x7ea
push 0
push 7
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d2f73
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d2f7a
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x531ee8], eax
add esp, 0x108
pop ebx
ret
Function at 0x4d5f18
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d6059
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x53a510], 0
je 0x4d6009
mov dl, 1
mov eax, dword [0x414ad0]
call fcn.00403720
mov edi, eax
mov edx, dword [0x53a504]
mov eax, 0x4d6070
call fcn.00404b50
test eax, eax
jle 0x4d5f91
push 0x4d607c
push dword [0x53a504]
push 0x4d6088
push dword [0x53a508]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d5fbe
push 0x4d6094
push dword [0x53a504]
push 0x4d6070
push dword [0x53a508]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x53383c]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4d60a4
call fcn.00404860
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x53a50c]
call fcn.00404a0c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a0c
push eax
push 0x4d60b0
mov eax, esi
call fcn.0045dd40
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d603e
push 1
mov eax, dword [0x53a50c]
call fcn.00404a0c
push eax
mov eax, dword [0x53a508]
call fcn.00404a0c
push eax
mov eax, dword [0x53a504]
call fcn.00404a0c
push eax
push 0x4d60b0
mov eax, esi
call fcn.0045dd40
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6060
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret
Function at 0x4dcde8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4dceff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x531ee8], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004a94c4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x53a194
mov ecx, 0x105
call fcn.004047c4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00404860
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046da2c
mov ebx, eax
test ebx, ebx
je 0x4dcec8
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00403750
mov eax, 0xc8
call fcn.004d1e78
push 1
push 0x4dcf0c
push 0x4dcf18
push dword [ebp - 4]
push 0x4dcf28
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x14]
call fcn.00404a0c
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004a94c4
mov eax, dword [ebp - 0x18]
call fcn.00404a0c
push eax
push 0x4dcf2c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x531ee8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcf06
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x10]
call fcn.00404c78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret

Function at 0x4dedb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4def12
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x53a2a4], 0
jbe 0x4dee25
mov ax, word [0x531f28]
cmp ax, word [0x53a2a4]
jb 0x4dee25
mov eax, dword [0x531ef0]
mov dword [0x531f18], eax
mov eax, dword [0x531ef4]
mov dword [0x531f1c], eax
mov word [0x531f28], 0
mov eax, dword [0x539154]
call fcn.0049dbf8
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004e2aa4
mov dl, 1
mov ax, 2
call fcn.004d2168
jmp 0x4deefc
cmp word [0x53a2a6], 0
jbe 0x4dee93
mov ax, word [0x531f28]
cmp ax, word [0x53a2a6]
jb 0x4dee93
mov eax, dword [0x531ef0]
mov dword [0x531f18], eax
mov eax, dword [0x531ef4]
mov dword [0x531f1c], eax
mov word [0x531f28], 0
cmp dword [0x53a2a8], 0
je 0x4dee93
lea eax, [ebp - 4]
mov ecx, dword [0x53a2a8]
mov edx, 0x4def28
call fcn.00404860
lea eax, [ebp - 4]
call fcn.004d30ec
push 0
lea eax, [ebp - 4]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
cmp word [0x53a2ac], 0
jbe 0x4deefc
mov ax, word [0x531f28]
cmp ax, word [0x53a2ac]
jb 0x4deefc
mov eax, dword [0x531ef0]
mov dword [0x531f18], eax
mov eax, dword [0x531ef4]
mov dword [0x531f1c], eax
mov word [0x531f28], 0
cmp dword [0x53a2b0], 0
je 0x4deefc
lea eax, [ebp - 4]
mov edx, dword [0x53a2b0]
call fcn.004045f4
lea eax, [ebp - 4]
call fcn.004d30ec
push 0
lea eax, [ebp - 4]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4def19
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4e2018
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e213b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x531ee8], 0x821
mov dl, 1
mov eax, dword [0x4221c0]
call fcn.004287fc
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push esi
mov eax, ebx
call fcn.00428dc4
xor ecx, ecx
xor edx, edx
call fcn.00423bf0
lea edx, [ebp - 8]
mov eax, 0x105
call fcn.004a94c4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x53a29c]
call fcn.00404860
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, ebx
call fcn.00403750
lea edx, [ebp - 0xc]
mov eax, 0x106
call fcn.004a94c4
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0xb0
call fcn.004a94c4
mov eax, dword [ebp - 0x10]
mov ecx, 0x4e2150
pop edx
call fcn.0046c0a0
lea edx, [ebp - 0x14]
mov eax, 0x107
call fcn.004a94c4
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0xb0
call fcn.004a94c4
mov eax, dword [ebp - 0x18]
mov ecx, 0x4e215c
pop edx
call fcn.0046c0a0
push 3
lea eax, [ebp - 4]
call fcn.00404a64
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
mov dword [0x531ee8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2142
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404580
ret
Function at 0x4e5264
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e526c
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4e546e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00408d64
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x20]
call fcn.00404e18
mov eax, dword [0x53a308]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e542e
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x53a308]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x4e5488
call fcn.00404b50
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404a6c
mov eax, dword [ebp - 0x1c]
call fcn.004093d8
mov dword [0x53a5fc], eax
cmp dword [0x53a5fc], 4
je 0x4e5422
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 1
call fcn.00404aac
mov eax, dword [ebp - 0x10]
mov edx, 0x4e5494
call fcn.00404958
jne 0x4e533b
mov byte [0x53262c], 1
jmp 0x4e5342
mov byte [0x53262c], 0
cmp byte [0x53262c], 0
je 0x4e53df
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.004045f4
mov ebx, 1
jmp 0x4e538b
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ebx - 1]
cmp al, 0x61
jb 0x4e5376
mov edx, dword [ebp - 0x18]
cmp al, 0x7a
ja 0x4e5376
inc ebx
jmp 0x4e538b
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x400
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.00404a6c
jmp 0x4e5397
mov eax, dword [ebp - 0x18]
call fcn.00404814
cmp ebx, eax
jl 0x4e5361
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4e54a8
call fcn.00404860
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x14]
call fcn.00405ac4
mov ebx, eax
cmp dword [ebp - 0x14], 0
jne 0x4e53df
cmp ebx, 0x3e8
jbe 0x4e53df
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
jae 0x4e53df
call sub.kernel32.dll_GetTickCount
sub eax, 0x30d40
cmp ebx, eax
jbe 0x4e53df
mov byte [ebp - 5], 1
jmp 0x4e542e
cmp byte [0x53262c], 0
je 0x4e53fb
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00404958
jne 0x4e53fb
mov byte [ebp - 5], 1
jmp 0x4e542e
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00404e18
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0040514c
test eax, eax
jle 0x4e5422
mov byte [0x53262c], 0
mov byte [ebp - 5], 1
jmp 0x4e542e
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x4e52c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5475
lea eax, [ebp - 0x30]
call fcn.0040455c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404580
lea eax, [ebp - 0x10]
call fcn.0040455c
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4e59dc
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4e5acf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41446c]
call fcn.00403720
mov edi, eax
push edi
push 0x4e5564
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x4e5ab2
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.00416d88
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4e5aaa
lea eax, [ebp - 4]
call fcn.00404a64
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.00409d4c
test eax, eax
jne 0x4e5aaa
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.00416d88
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e5a8e
cmp eax, 0xffffffff
je 0x4e5aaa
cmp dword [ebp - 0xc], 0
je 0x4e5aaa
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x4e5a29
mov eax, edi
call fcn.00403750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5ad6
lea eax, [ebp - 4]
call fcn.0040455c
ret

Function at 0x4e5ae0
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4e5af9
cmp eax, 0xffffffff
je 0x4e5b0d
test ebx, ebx
je 0x4e5b0d
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret
Function at 0x4ee4a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebp, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dl, 1
mov eax, dword [0x41446c]
call fcn.00403720
mov esi, eax
push esi
push 0x4ee490
call sub.user32.dll_EnumWindows
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x4ee528
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.00416d88
cmp ebp, eax
je 0x4ee524
push 0x50
lea eax, [esp + 0xc]
push eax
mov edx, ebx
mov eax, esi
call fcn.00416d88
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4ee524
lea eax, [esp + 8]
mov edx, dword [esp]
call fcn.00409d4c
test eax, eax
jne 0x4ee524
mov edx, ebx
mov eax, esi
call fcn.00416d88
mov dword [esp + 4], eax
jmp 0x4ee528
inc ebx
dec edi
jne 0x4ee4de
mov eax, esi
call fcn.00403750
mov eax, dword [esp + 4]
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ee5a4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4ee65f
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
jne 0x4ee5f7
lea ecx, [ebp - 0x88]
mov edx, 0x4ee674
mov eax, 0x4ee688
call fcn.0046c2cc
mov eax, dword [ebp - 0x88]
mov edx, ebx
call fcn.00408d64
cmp dword [ebx], 0
jne 0x4ee641
mov dword [ebp - 4], 0x21
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x83]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4ee641
lea eax, [ebp - 0x83]
call fcn.00409c4c
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x84]
call fcn.004047b8
mov eax, dword [ebp - 0x8c]
mov edx, ebx
call fcn.00408d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee666
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.00404580
ret