joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499de8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x499e8a
cmp dword [ebx + 0x94], 0
jne 0x499e84
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x499d34
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x499e84
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x499e4a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x499e84
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0043741c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x499e59
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x49a0a8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5282c0]
cmp dword [eax + 0x170], 0
je 0x49a20d
test bl, bl
jne 0x49a15b
cmp dword [esi + 0x9c], 0
jne 0x49a150
mov eax, esi
call fcn.0049cd28
push eax
push 0x499fb4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x49a121
mov eax, dword [0x5282c0]
cmp byte [eax + 0xd3], 0
je 0x49a121
mov eax, dword [esi + 0xd8]
call fcn.00408cb0
mov edi, eax
cmp edi, 0
jl 0x49a121
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x49a10a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x49a150
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043741c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x49a130
inc dword [esi + 0x9c]
jmp 0x49a20d
cmp dword [esi + 0x9c], 0
jle 0x49a20d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x49a20d
cmp dword [esi + 0x44], 0
je 0x49a1b8
mov eax, dword [0x5282c0]
cmp byte [eax + 0xd3], 0
je 0x49a1b8
mov eax, dword [esi + 0xd8]
call fcn.00408cb0
mov edi, eax
cmp edi, 0
jl 0x49a1b8
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x49a1a1
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x49a1e7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043741c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x49a1c7
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x48f680]
call fcn.00408e70
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x49ae28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x49ae93
cmp byte [ebx + 0xd3], 0
jne 0x49ae93
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004074c8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x49ae80
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x49aea0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040738c
jmp 0x49aea0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040738c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x49c4e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x49c54e
mov eax, esi
call fcn.00481d3c
test al, al
je 0x49c54e
mov eax, dword [ebx + 0x84]
call fcn.004819bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x49c54e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x49c542
push 0
mov eax, dword [ebx + 0x84]
call fcn.004819bc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00478dc0
jmp 0x49c54e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0049c318
pop esi
pop ebx
ret
Function at 0x49dbdc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40cba8]
call fcn.00408004
xor eax, eax
push ebp
push 0x49dd26
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x521230], 0
jne 0x49dc30
mov ecx, dword [0x522740]
mov dl, 1
mov eax, dword [0x40e7ec]
call fcn.00418a68
call fcn.00405c4c
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00404a74
mov eax, ebx
call fcn.00406fb8
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x49dd34
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040a3f0
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x49dc77
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x49dccc
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x49dcc5
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.004075dc
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00407574
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.00412608
test eax, eax
jne 0x49dcc5
mov ebx, 0x15
jmp 0x49dcd1
mov ebx, 0x10
jmp 0x49dcd1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x521230]
call fcn.0049d990
mov eax, dword [ebp - 4]
call fcn.0049d990
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040a408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dd2d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407384
lea eax, [ebp - 0xc]
mov edx, dword [0x40cba8]
call fcn.004080dc
ret

Function at 0x4a22b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.004a1ce8
test byte [ebx + 0x2a5], 4
jne 0x4a2345
mov edx, esp
mov eax, ebx
call fcn.00478740
push esp
mov eax, ebx
call fcn.00481758
push eax
push 0
mov eax, ebx
test eax, eax
je 0x4a22e5
sub eax, 0xfffffd14
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x280]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x294], 0
jne 0x4a2316
mov ecx, dword [0x5229f8]
mov dl, 1
mov eax, dword [0x49d39c]
call fcn.00418a68
call fcn.00405c4c
mov eax, ebx
call fcn.004a2898
cmp byte [ebx + 0x59], 0
jne 0x4a234c
mov eax, ebx
call fcn.004819bc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a234c
push 0
mov eax, ebx
call fcn.004819bc
push eax
call sub.user32.dll_ShowWindow
jmp 0x4a234c
mov eax, ebx
call fcn.0047d86c
add esp, 0x10
pop ebx
ret
Function at 0x4a7344
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a73ab
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthW
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 4]
call fcn.004076f0
push edi
mov eax, dword [ebp - 4]
call fcn.00407418
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040738c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a73b2
lea eax, [ebp - 4]
call fcn.0040737c
ret

Function at 0x4ac5bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ac646
xor edx, edx
push ebp
push 0x4ac627
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac646
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b0610
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b063e
mov eax, ebx
call fcn.004b10c4
cmp dword [ebx + 0x40], 0
je 0x4b0637
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b06af
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b06a1
cmp dword [ebx + 8], 0
je 0x4b0660
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b0672
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b06a1
cmp dword [ebx + 8], 0
je 0x4b0653
cmp eax, 3
je 0x4b0685
dec eax
jne 0x4b0653
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b0653
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b0653
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b06cd
cmp dword [ebx + 0x14], 0xcc
je 0x4b06cd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b06d8
pop ebx
ret

Function at 0x4c1074
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407374
mov eax, dword [ebp - 8]
call fcn.00407374
mov eax, dword [ebp - 0xc]
call fcn.00407374
xor eax, eax
push ebp
push 0x4c11a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00407418
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, dword [ebp - 0xc]
call fcn.00407418
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
call fcn.004686a4
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00407418
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c1188
xor eax, eax
push ebp
push 0x4c1181
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
push 0
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4c1161
push 0
push 0
push 0x25
push 0
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x4c1165
xor eax, eax
jmp 0x4c1167
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1188
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c11aa
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407384
ret
Function at 0x4c11b4
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407374
mov eax, dword [ebp - 8]
call fcn.00407374
mov eax, dword [ebp - 0xc]
call fcn.00407374
mov eax, dword [ebp + 0xc]
call fcn.00407374
xor eax, eax
push ebp
push 0x4c131e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00407418
mov esi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 3
mov eax, 0x4c1334
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00407418
push eax
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c12fb
xor edx, edx
push ebp
push 0x4c12f4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00407418
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407418
push eax
movzx eax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectW
test eax, eax
je 0x4c12dd
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4c12d4
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionW
test eax, eax
jne 0x4c12d8
xor eax, eax
jmp 0x4c12da
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c12fb
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1325
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407384
lea eax, [ebp + 0xc]
call fcn.0040737c
ret
Function at 0x4c1344
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x4c140c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4c1410
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x4c140c
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c1403
xor eax, eax
push ebp
push 0x4c13fc
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1403
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c1748
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
xor edx, edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c1972
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x105
mov eax, dword [ebp - 0x24]
call fcn.004044c0
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4c17c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x4c17b3
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00407538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c17d0
mov eax, dword [ebp - 0x14]
call fcn.004044dc
ret

Function at 0x4c2fa0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov bl, 2
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x14
call fcn.00404a74
push 0x14
lea eax, [ebp - 0x14]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
je 0x4c2fdb
cmp word [ebp - 0x14], 0x31
jne 0x4c2fd9
mov bl, 1
jmp 0x4c2fdb
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c486c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00481d3c
test al, al
je 0x4c492b
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x4c4909
cmp word [esi + 0x67a], 0
je 0x4c48bd
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x67c]
call dword [esi + 0x678]
movzx eax, byte [esi + 0x670]
or al, byte [ebp - 9]
jne 0x4c48e0
cmp dword [ebp - 4], 0
jbe 0x4c48dc
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4c48e0
xor ebx, ebx
jmp 0x4c48e2
mov bl, 1
test bl, bl
jne 0x4c492b
mov eax, dword [0x522ba8]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x4c492b
mov eax, dword [0x522ba8]
mov eax, dword [eax]
call fcn.0049b32c
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x4c492b
cmp byte [esi + 0x610], 0
jne 0x4c492b
mov edx, 0xfffffdf3
mov eax, esi
call fcn.004a26d0
cmp eax, 4
jne 0x4c489a
mov byte [esi + 0x670], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e54f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe00
mov ebx, eax
test ebx, ebx
je 0x4e55fe
mov ebp, ebx
mov eax, ebp
test eax, eax
je 0x4e5515
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test ebx, ebx
je 0x4e5525
mov eax, ebp
sub eax, 0xa
movzx eax, word [eax]
jmp 0x4e5529
mov ax, 2
cmp ax, 1
jne 0x4e55a2
test ebx, ebx
je 0x4e553d
mov eax, ebp
sub eax, 0xc
movzx eax, word [eax]
jmp 0x4e5545
mov eax, dword [0x522c1c]
movzx eax, word [eax]
push 0
push 0
push edi
push ebx
push 0
movzx eax, ax
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x100
jle 0x4e556d
mov eax, edi
add eax, eax
call fcn.004044c0
mov esi, eax
jmp 0x4e556f
mov esi, esp
test ebx, ebx
je 0x4e557d
mov eax, ebp
sub eax, 0xc
movzx edx, word [eax]
jmp 0x4e5586
mov edx, dword [0x522c1c]
movzx edx, word [edx]
mov eax, ebp
test eax, eax
je 0x4e5591
sub eax, 4
mov eax, dword [eax]
push edi
push esi
push eax
push ebx
push 0
movzx eax, dx
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
jmp 0x4e55c6
cmp edi, 0x100
jle 0x4e55b7
mov eax, edi
add eax, eax
call fcn.004044c0
mov esi, eax
jmp 0x4e55b9
mov esi, esp
mov ecx, edi
add ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00404678
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4e55ef
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4e55d9
mov eax, esp
cmp esi, eax
je 0x4e5600
mov eax, esi
call fcn.004044dc
jmp 0x4e5600
xor ebx, ebx
mov eax, ebx
add esp, 0x200
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4fa87c
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x4fa8a1
cmp dword [esp + 4], 5
jb 0x4fa8a1
mov al, 1
jmp 0x4fa8a3
xor eax, eax
add esp, 0x114
ret
Function at 0x514690
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd5c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x288], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407374
lea eax, [ebp - 0x278]
mov edx, dword [0x40e62c]
call fcn.00408004
xor eax, eax
push ebp
push 0x51490e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x288]
mov eax, dword [ebp - 4]
call fcn.004128f4
mov edx, dword [ebp - 0x288]
lea eax, [ebp - 0x284]
call fcn.004075f0
mov eax, dword [ebp - 0x284]
lea ecx, [ebp - 0x280]
mov edx, 1
call fcn.0040e464
mov eax, dword [ebp - 0x280]
mov edx, 0x514928
call fcn.00407198
je 0x514772
lea edx, [ebp - 0x28c]
mov eax, dword [ebp - 4]
call fcn.004128f4
mov edx, dword [ebp - 0x28c]
lea eax, [ebp - 4]
mov ecx, 0x514938
call fcn.00407848
jmp 0x51478e
lea edx, [ebp - 0x290]
mov eax, dword [ebp - 4]
call fcn.004128f4
mov edx, dword [ebp - 0x290]
lea eax, [ebp - 4]
call fcn.004073e0
lea eax, [ebp - 0x294]
mov ecx, 0x514948
mov edx, dword [ebp - 4]
call fcn.00407848
mov eax, dword [ebp - 0x294]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.004137bc
mov edi, eax
xor eax, eax
push ebp
push 0x5148c0
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
jne 0x514892
mov eax, dword [ebp - 0x264]
mov edx, 0x51495c
call fcn.00407a4c
je 0x51487d
test dword [ebp - 0x268], 0x10
setg al
test al, bl
je 0x514840
lea eax, [ebp - 0x298]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00407848
mov edx, dword [ebp - 0x298]
mov cl, 1
mov eax, esi
call fcn.00514690
lea eax, [ebp - 0x29c]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00407848
mov eax, dword [ebp - 0x29c]
call fcn.00407418
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x51487d
lea eax, [ebp - 0x2a4]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00407848
mov eax, dword [ebp - 0x2a4]
call fcn.00407418
mov edx, eax
lea eax, [ebp - 0x2a0]
call fcn.00407538
mov eax, dword [ebp - 0x2a0]
call fcn.00407418
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x278]
call fcn.0041380c
mov edi, eax
test edi, edi
je 0x5147cf
mov eax, dword [ebp - 4]
call fcn.00407418
push eax
call sub.kernel32.dll_RemoveDirectoryW
mov byte [ebp - 0x279], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5148c7
lea eax, [ebp - 0x278]
call fcn.00413830
ret

Function at 0x514964
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
push 0xffffffffffffffec
mov eax, ebx
call fcn.004819bc
push eax
call sub.user32.dll_GetWindowLongW
mov esi, eax
and esi, 0xfffbffff
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.004819bc
push eax
call sub.user32.dll_SetWindowLongW
push 0
mov eax, dword [0x522ba8]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret