joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4781cc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4781fa
mov eax, ebx
call fcn.00478c70
cmp dword [ebx + 0x3c], 0
je 0x4781f3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47826b
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x47825d
cmp dword [ebx + 8], 0
je 0x47821c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x47822e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47825d
cmp dword [ebx + 8], 0
je 0x47820f
cmp eax, 3
je 0x478241
dec eax
jne 0x47820f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47820f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x47820f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x478289
cmp dword [ebx + 0x10], 0xcc
je 0x478289
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00478294
pop ebx
ret

Function at 0x488d94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404028
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x488dad
test al, 0x10
jne 0x488db1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x489474
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [0x4d09dc]
call fcn.00437ee8
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x4cf384]
mov eax, dword [eax]
call fcn.00437ee8
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4cf384]
mov eax, dword [eax]
call fcn.00437ee8
push eax
call sub.user32.dll_SetForegroundWindow
mov dword [ebx + 0x318], 1
pop ebx
ret

Function at 0x48a07c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x2e0], 1
jne 0x48a103
cmp dword [ebx + 0x2e4], 0
jne 0x48a0e6
mov eax, dword [0x4cf384]
mov eax, dword [eax]
call fcn.0044d1b0
push 5
mov eax, dword [0x4cf384]
mov eax, dword [eax]
call fcn.00437ee8
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4cf02c]
mov eax, dword [eax]
cmp dword [eax + 0x318], 0
jne 0x48a0fc
push 5
mov eax, dword [0x4cf02c]
mov eax, dword [eax]
call fcn.00437ee8
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4cf02c]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x318], edx
jmp 0x48a0fc
mov eax, dword [0x4cf0fc]
cmp dword [eax], 0
je 0x48a0fc
mov eax, dword [0x4cf0fc]
mov eax, dword [eax]
call fcn.0044d1b0
mov eax, ebx
call fcn.0044cff8
pop ebx
ret
Function at 0x49f720
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404018
xor eax, eax
push ebp
push 0x49f93c
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x10]
call fcn.00409688
mov eax, dword [ebp - 0x10]
call fcn.00403e64
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404198
xor eax, eax
push ebp
push 0x49f7a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00402890
call fcn.00402854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f7b4
lea eax, [ebp - 0x150]
push eax
push 0x49f950
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x49f8c4
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403e14
mov eax, dword [ebp - 0xc]
mov edx, 0x49f95c
call fcn.00403f74
je 0x49f801
mov eax, dword [ebp - 0xc]
mov edx, 0x49f968
call fcn.00403f74
jne 0x49f812
test bl, bl
jne 0x49f809
xor eax, eax
jmp 0x49f80b
mov al, 1
mov ebx, eax
jmp 0x49f8a7
xor ebx, ebx
cmp dword [ebp - 0x150], 0x10
jne 0x49f885
mov eax, dword [ebp - 4]
call fcn.00403e64
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x49f857
push dword [ebp - 4]
push 0x49f974
push dword [ebp - 0xc]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403f24
mov eax, dword [ebp - 0x154]
call fcn.0049f720
jmp 0x49f873
lea eax, [ebp - 0x158]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00403eb0
mov eax, dword [ebp - 0x158]
call fcn.0049f720
mov eax, dword [ebp - 0xc]
call fcn.00404028
push eax
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jmp 0x49f8a7
mov eax, dword [ebp - 0xc]
call fcn.00404028
mov edx, eax
lea eax, [ebp - 0x15c]
call fcn.00403d9c
mov eax, dword [ebp - 0x15c]
call fcn.004094c8
test al, al
lea eax, [ebp - 0x150]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x49f7d0
jmp 0x49f8d7
mov eax, dword [ebp - 0x10]
call fcn.00402890
call fcn.00402854
mov byte [ebp - 5], 0
jmp 0x49f909
test bl, bl
je 0x49f8f8
mov eax, 0x49f968
call fcn.00402890
call fcn.00402854
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov eax, dword [ebp - 0x10]
call fcn.00402890
call fcn.00402854
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f943
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00403c08
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403c08
lea eax, [ebp - 4]
call fcn.00403be4
ret
Function at 0x49f978
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404018
xor eax, eax
push ebp
push 0x49f9f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
mov eax, dword [ebp - 4]
call fcn.00404028
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x410
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
mov eax, dword [ebp - 4]
call fcn.00488d94
test al, al
je 0x49f9e0
mov eax, dword [ebp - 4]
call fcn.0049f720
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f9fd
lea eax, [ebp - 4]
call fcn.00403be4
ret
Function at 0x4afff8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b0123
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d43c
test eax, eax
jle 0x4b0108
mov eax, dword [ebx + 0x684]
call fcn.0045efdc
call fcn.0045cc94
mov esi, dword [ebx + 0x4ffb8]
mov edx, esi
dec edx
cmp eax, edx
jle 0x4b00eb
cmp esi, 0x64
jge 0x4b00eb
mov dl, 1
mov eax, dword [ebx + 0x770]
call fcn.004532b0
mov byte [ebx + 0xa928], 8
push 9
lea edx, [ebp - 8]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.004507ac
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409560
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
mov eax, dword [0x4d23b8]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0xc]
mov ecx, 0x4b0138
call fcn.00403eb0
mov eax, dword [ebp - 0xc]
call fcn.00404028
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.004507ac
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409594
mov eax, dword [ebp - 0x10]
call fcn.00404028
push eax
push 0x4b0154
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b0108
xor edx, edx
mov eax, dword [ebx + 0x684]
call fcn.0045ed64
mov eax, dword [ebx + 0x684]
call fcn.0045efdc
call fcn.0045d0c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b012a
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403c08
ret
Function at 0x4b015c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b02db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d43c
test eax, eax
jle 0x4b02c0
mov eax, dword [ebx + 0x684]
call fcn.0045efdc
call fcn.0045cc94
mov edx, dword [ebx + 0x4ffb8]
dec edx
cmp eax, edx
jle 0x4b027f
cmp byte [ebx + 0x4ffb4], 0xb
jne 0x4b027f
mov dl, 1
mov eax, dword [ebx + 0x770]
call fcn.004532b0
push 0x4b02f0
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x4ffb8]
call fcn.0040920c
push dword [ebp - 4]
push 0x4b030c
push 0x4b031c
push 0x4b0328
lea eax, [ebx + 0xa5b4]
mov edx, 5
call fcn.00403f24
push 9
lea edx, [ebp - 0xc]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.004507ac
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409560
mov eax, dword [ebp - 8]
call fcn.00404028
push eax
mov eax, dword [0x4d23b8]
mov edx, dword [eax + 0x4ff90]
lea eax, [ebp - 0x10]
mov ecx, 0x4b035c
call fcn.00403eb0
mov eax, dword [ebp - 0x10]
call fcn.00404028
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.004507ac
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409594
mov eax, dword [ebp - 0x14]
call fcn.00404028
push eax
push 0x4b0378
mov eax, dword [0x4cf264]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b02c0
push 1
mov ecx, 0x4b0380
mov edx, 0x4b0388
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
dec eax
jne 0x4b02c0
mov eax, dword [ebx + 0x684]
call fcn.0045efdc
call fcn.0045cc94
mov edx, eax
mov eax, ebx
call fcn.004b03a4
mov edx, dword [ebx + 0xb39c]
mov eax, ebx
call fcn.004aadbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b02e2
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403c08
ret
Function at 0x4b4228
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b447a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x840], 1
jne 0x4b426a
push 0
mov ecx, 0x4b4488
mov edx, 0x4b4490
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
jmp 0x4b444f
mov eax, dword [ebx + 0x6e4]
cmp byte [eax + 0x47], 0
jne 0x4b4294
mov eax, dword [ebx + 0xb39c]
mov edx, eax
shl eax, 3
sub eax, edx
cmp byte [ebx + eax*8 + 0xb55e], 0
jbe 0x4b4294
mov byte [ebx + 0xa4ac], 0
mov eax, dword [ebx + 0x684]
call fcn.0045efdc
call fcn.0045cc94
mov edx, eax
shl eax, 3
sub eax, edx
cmp byte [ebx + eax*8 + 0xb55e], 5
je 0x4b42d6
mov eax, dword [ebx + 0x684]
call fcn.0045efdc
call fcn.0045cc94
mov edx, eax
shl eax, 3
sub eax, edx
cmp byte [ebx + eax*8 + 0xb55e], 6
jne 0x4b42dd
mov byte [ebx + 0xa4ac], 0
cmp byte [ebx + 0xa4ac], 1
jne 0x4b4314
mov eax, dword [ebx + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d43c
test eax, eax
jle 0x4b4314
mov eax, dword [ebx + 0x684]
call fcn.0045efdc
call fcn.0045cc94
mov edx, eax
mov eax, ebx
call fcn.004af720
cmp byte [ebx + 0x4ff98], 0
jne 0x4b43b5
mov eax, dword [ebx + 0x684]
mov eax, dword [eax + 0x254]
call fcn.0045d43c
test eax, eax
jle 0x4b439d
mov eax, dword [ebx + 0x2d4]
add eax, 0x68
mov edx, 0x4b44b8
call fcn.00403c38
mov eax, dword [ebx + 0x2d4]
add eax, 0x70
call fcn.00403be4
mov esi, dword [ebx + 0x2d4]
mov eax, dword [0x4b44c4]
mov dword [esi + 0x54], eax
lea eax, [esi + 0x58]
mov edx, 0x4b44d0
call fcn.00403c38
mov eax, dword [ebx + 0x2d4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x4b43b5
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x2d4]
call fcn.00456050
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, ebx
call fcn.004b275c
jmp 0x4b43b5
push 0
mov ecx, 0x4b4488
mov edx, 0x4b44ec
mov eax, dword [0x4cf264]
mov eax, dword [eax]
call fcn.0045043c
cmp byte [ebx + 0x4ff98], 2
jne 0x4b443c
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x4fbc8]
call fcn.00409058
mov eax, dword [ebp - 0x10]
call fcn.00403e64
sub eax, 4
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x4fbc8]
call fcn.00409058
mov eax, dword [ebp - 0x14]
mov edx, 1
pop ecx
call fcn.0040406c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x4b4504
call fcn.00403eb0
cmp byte [ebx + 0x510ac], 1
jne 0x4b442d
push 0
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
mov eax, dword [ebx + 0x4fbc8]
call fcn.00404028
push eax
call sub.kernel32.dll_CopyFileA
xor ecx, ecx
mov edx, dword [ebx + 0x4fbc8]
mov eax, ebx
call fcn.004b275c
mov eax, dword [ebx + 0x6e4]
cmp byte [eax + 0x47], 1
jne 0x4b444f
mov byte [ebx + 0x4ffc0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4481
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403c08
lea eax, [ebp - 8]
call fcn.00403be4
lea eax, [ebp - 4]
call fcn.00403be4
ret
Function at 0x4b8dbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b8dc4
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b8f64
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x4ffc4], 0
je 0x4b8df6
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x4ffc4]
call fcn.00409058
jmp 0x4b8e4d
call fcn.0042ce70
lea edx, [ebp - 0x10]
call fcn.0042ca90
mov eax, dword [ebx + 0x6e4]
call fcn.00428ab4
call fcn.0042ce70
lea edx, [ebp - 0x14]
call fcn.0042ca90
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.00409058
call fcn.0042ce70
mov edx, dword [ebp - 0x10]
call fcn.0042cb10
mov eax, dword [ebx + 0x6e4]
mov edx, dword [eax]
call dword [edx + 0xb8]
test eax, eax
jne 0x4b8e4d
lea eax, [ebp - 4]
call fcn.00403be4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00409058
cmp dword [ebp - 0x18], 0
jne 0x4b8e6b
lea eax, [ebp - 4]
mov edx, 0x4b8f78
call fcn.00403c7c
lea eax, [ebp - 8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040406c
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040406c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00408ebc
mov eax, dword [ebp - 0x1c]
mov edx, 0x4b8fa0
call fcn.00403f74
jne 0x4b8ed4
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
push 0
mov eax, dword [0x4d23b8]
call fcn.00437ee8
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b8f3e
mov eax, dword [ebx + 0x3e8]
cmp byte [eax + 0x2c], 0
jne 0x4b8f34
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00408ebc
mov eax, dword [ebp - 0x20]
mov edx, 0x4b8fb0
call fcn.00403f74
je 0x4b8f14
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00408ebc
mov eax, dword [ebp - 0x24]
mov edx, 0x4b8fc0
call fcn.00403f74
jne 0x4b8f34
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
push 0
mov eax, ebx
call fcn.00437ee8
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b8f3e
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004b8fc8
lea eax, [ebx + 0x4ffc4]
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8f6b
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403c08
ret
Function at 0x4b8fc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b8fd0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404018
xor eax, eax
push ebp
push 0x4b91b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00403be4
lea eax, [ebp - 0x10]
call fcn.00403be4
mov dl, 1
mov eax, dword [0x461110]
call fcn.00461210
mov ebx, eax
mov edx, 0x80000000
mov eax, ebx
call fcn.004612b0
xor ecx, ecx
mov edx, 0x4b91d0
mov eax, ebx
call fcn.00461318
test al, al
je 0x4b9082
lea ecx, [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004616e0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408ebc
mov edx, dword [ebp - 0x14]
mov eax, 0x4b91f8
call fcn.00404150
mov edi, eax
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 2]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040406c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409594
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409560
mov eax, ebx
call fcn.00461280
mov eax, ebx
call fcn.00402f5c
cmp dword [ebp - 0x10], 0
je 0x4b9154
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408ebc
mov edx, dword [ebp - 0x18]
mov eax, 0x4b9208
call fcn.00404150
test eax, eax
jg 0x4b90d2
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00408ebc
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b9218
call fcn.00404150
test eax, eax
jle 0x4b9106
push 3
mov eax, dword [ebp - 0xc]
call fcn.00404028
push eax
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404028
push eax
push 0x4b9220
mov eax, esi
call fcn.00437ee8
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b919e
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004bbfb8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 0x4b9230
call fcn.00403eb0
push 3
mov eax, dword [ebp - 0xc]
call fcn.00404028
push eax
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404028
push eax
push 0x4b9220
mov eax, esi
call fcn.00437ee8
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b919e
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00408ebc
mov edx, dword [ebp - 0x24]
mov eax, 0x4b9208
call fcn.00404150
test eax, eax
jne 0x4b9180
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4b9208
call fcn.00403eb0
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404028
push eax
push 0
mov eax, esi
call fcn.00437ee8
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b91c0
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403c08
ret
Function at 0x4bc5ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404018
xor eax, eax
push ebp
push 0x4bc7f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x4bc6db
cmp eax, 0xb7a2
jge 0x4bc67e
cmp eax, 0xb2c1
jge 0x4bc653
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x4bc77d
sub eax, 0x1fc
jb 0x4bc781
jmp 0x4bc7d9
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x4bc785
sub eax, 0x1fc
jb 0x4bc789
sub eax, 0xb8
jb 0x4bc78d
jmp 0x4bc7d9
cmp eax, 0xbbf7
jge 0x4bc6b0
add eax, 0xffff485e
sub eax, 0x11f
jb 0x4bc791
sub eax, 0x13d
jb 0x4bc795
sub eax, 0x1f9
jb 0x4bc799
jmp 0x4bc7d9
add eax, 0xffff4409
sub eax, 0x3af
jb 0x4bc79d
sub eax, 0x106
jb 0x4bc7a1
sub eax, 0x23c
jb 0x4bc7a5
jmp 0x4bc7d9
cmp eax, 0xc8f6
jge 0x4bc73b
cmp eax, 0xc5be
jge 0x4bc712
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x4bc7a9
sub eax, 0xf3
jb 0x4bc7ad
sub eax, 8
jb 0x4bc7b1
jmp 0x4bc7d9
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x4bc7b5
sub eax, 0x1e1
jb 0x4bc7b9
sub eax, 0x3b
jb 0x4bc7bd
jmp 0x4bc7d9
cmp eax, 0xcef4
jge 0x4bc75e
add eax, 0xffff370a
sub eax, 0x304
jb 0x4bc7c1
sub eax, 0x1e0
jb 0x4bc7c5
sub eax, 0x11a
jb 0x4bc7c9
jmp 0x4bc7d9
add eax, 0xffff310c
sub eax, 0x295
jb 0x4bc7cd
add eax, 0xffffffd0
sub eax, 0x318
jb 0x4bc7d1
sub eax, 0x329
jb 0x4bc7d5
jmp 0x4bc7d9
mov bl, 0x41
jmp 0x4bc7db
mov bl, 0x42
jmp 0x4bc7db
mov bl, 0x43
jmp 0x4bc7db
mov bl, 0x44
jmp 0x4bc7db
mov bl, 0x45
jmp 0x4bc7db
mov bl, 0x46
jmp 0x4bc7db
mov bl, 0x47
jmp 0x4bc7db
mov bl, 0x48
jmp 0x4bc7db
mov bl, 0x4a
jmp 0x4bc7db
mov bl, 0x4b
jmp 0x4bc7db
mov bl, 0x4c
jmp 0x4bc7db
mov bl, 0x4d
jmp 0x4bc7db
mov bl, 0x4e
jmp 0x4bc7db
mov bl, 0x4f
jmp 0x4bc7db
mov bl, 0x50
jmp 0x4bc7db
mov bl, 0x51
jmp 0x4bc7db
mov bl, 0x52
jmp 0x4bc7db
mov bl, 0x53
jmp 0x4bc7db
mov bl, 0x54
jmp 0x4bc7db
mov bl, 0x57
jmp 0x4bc7db
mov bl, 0x58
jmp 0x4bc7db
mov bl, 0x59
jmp 0x4bc7db
mov bl, 0x5a
jmp 0x4bc7db
mov bl, 0x20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc7f8
lea eax, [ebp - 4]
call fcn.00403be4
ret
Function at 0x4b2e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x70000]
push edi
jmp 0x4b2e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b2e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2e70
mov eax, 1
add ebx, ebx
jne 0x4b2e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b2ea4
jne 0x4b2ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2ec3
dec eax
add ebx, ebx
jne 0x4b2eb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b2e88
add ebx, ebx
jne 0x4b2ebf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b2f15
xor ecx, ecx
sub eax, 3
jb 0x4b2edb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b2f4a
sar eax, 1
mov ebp, eax
jmp 0x4b2ee6
add ebx, ebx
jne 0x4b2ee6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2eb4
inc ecx
add ebx, ebx
jne 0x4b2ef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2eb4
add ebx, ebx
jne 0x4b2f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b2ef6
jne 0x4b2f12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b2ef6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b2f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b2f26
jmp 0x4b2e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b2f34
add edi, ecx
jmp 0x4b2e76
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b2f52
cmp byte [edi], 0x13
jne 0x4b2f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b2f57
lea edi, [esi + 0xae000]
mov eax, dword [edi]
or eax, eax
je 0x4b2fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb4ce8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb4e3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b2f84
mov ecx, edi
jns 0x4b2fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb4e40]
or eax, eax
je 0x4b2fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b2fa1
call dword [esi + 0xb4e50]
mov ebp, dword [esi + 0xb4e44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b3003
sub esp, 0xffffff80
jmp 0x4165c1