joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dc0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x440480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
call fcn.004209f8
add esp, 4
push eax
call fcn.004208c4
add esp, 4
call fcn.00401000
mov edi, eax
push edi
mov dword [ebp - 0x1ac], edi
call dword [0x43821c]
mov ebx, dword [0x438054]
test eax, eax
jne 0x407e29
push edi
call fcn.00422e5d
add esp, 4
push edi
call fcn.00402010
add esp, 4
push 0
push edi
call fcn.00408040
add esp, 8
push 6
push edi
call ebx
push edi
call dword [0x43806c]
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [0x438070]
call fcn.00401120
mov esi, eax
push esi
call dword [0x43821c]
test eax, eax
je 0x407e5f
push esi
call fcn.00422369
add esp, 4
cmp byte [0x443a59], 0
jne 0x407e74
call fcn.004060e0
mov byte [0x443a59], 1
mov ecx, dword [0x443b0c]
mov eax, dword [ecx + 0x98]
push eax
lea eax, [ebp - 0x110]
call fcn.00404ca0
add esp, 4
test al, al
je 0x407ec7
cmp byte [0x443a59], 0
jne 0x407ea8
call fcn.004060e0
mov byte [0x443a59], 1
mov edx, dword [0x443b0c]
mov ecx, dword [edx + 0x98]
push 1
push esi
lea eax, [ebp - 0x110]
call fcn.00404f70
add esp, 8
jmp 0x407ed6
push esi
lea eax, [ebp - 0x110]
call fcn.00401f80
add esp, 4
push esi
call fcn.004049b0
add esp, 4
push esi
call fcn.00402010
add esp, 4
push 6
push esi
call ebx
lea eax, [ebp - 0x1a8]
push eax
mov dword [ebp - 0x1a8], 0x94
call dword [0x438044]
cmp dword [ebp - 0x1a4], 6
jb 0x407f24
push 0
push 0
push 0
push 0x408320
push 0
push 0
call dword [0x438074]
jmp 0x407f93
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f30
sub eax, edx
mov edi, eax
call fcn.00401540
push 0
lea ecx, [ebp - 0x1b0]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov ebx, eax
call dword [section..rdata]
mov eax, dword [ebp - 0x1b0]
test eax, eax
je 0x407f8d
push edi
push esi
push 1
push 0
push ebx
push eax
call dword [0x438004]
mov edx, dword [ebp - 0x1b0]
push edx
call dword [0x438008]
mov edi, dword [ebp - 0x1ac]
mov ecx, esi
lea eax, [ebp - 0x110]
jmp 0x407fa0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407fc0
test dl, dl
je 0x407fbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407fc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x407fa0
xor eax, eax
jmp 0x407fc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408014
push esi
call dword [0x43821c]
test eax, eax
je 0x408014
mov eax, dword [0x443a5c]
test eax, eax
je 0x407fe4
push eax
call dword [0x43810c]
push 5
push 0
push 0x43b460
push esi
push 0x43c960
push 0
call dword [0x438214]
push edi
call fcn.004208b9
add esp, 4
push esi
call fcn.004208b9
add esp, 4
push 0
call fcn.00422df5
push edi
call fcn.004208b9
add esp, 4
push esi
call fcn.004208b9
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420826
mov esp, ebp
pop ebp
ret
Function at 0x408154
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.004085b4
mov byte [esp], al
cmp byte [esp], 0
jne 0x4082de
test edi, edi
je 0x4082de
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40821e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4081f9
cmp edi, 0xffffffff
je 0x4081b9
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4081b9
mov byte [esp], 0
jmp 0x4082de
mov ebx, dword [esi]
cmp ebx, 1
jg 0x4081f9
test ebx, ebx
jne 0x4081eb
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4081eb
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4082de
lea eax, [esp + 0xc]
call fcn.00407e34
dec ebp
test ebp, ebp
jg 0x40819e
cmp edi, 0xffffffff
je 0x40821e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40821c
mov byte [esp], 0
jmp 0x4082de
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408162
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40821e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040834c
mov edx, eax
mov ebx, dword [0x4e98f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408282
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408280
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408282
xor edi, edi
cmp byte [esp], 0
je 0x4082a8
mov ebx, dword [esi]
test bl, 1
jne 0x4082be
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408288
mov byte [esp + 1], 1
jmp 0x4082be
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4082a8
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408235
cmp byte [esp], 0
je 0x4082de
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408ef4
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x4ebb18
cmp dword [ebp + 0xc], 2
jl 0x408f08
mov ebx, 0x4ebb48
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x408f40
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x404c90
mov dword [0x4e901c], eax
mov eax, 0x404c98
mov dword [0x4e9020], eax
mov eax, ebx
call fcn.00408dd8
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x408f75
cmp al, 3
jge 0x408f75
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x408f86
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x408f91
call dword [ecx + eax*4]
cmp dword [0x4e9040], 0
jne 0x408fa7
mov byte [0x4e9048], 1
fnstcw word [0x4e5024]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00409238
call fcn.00408e88
ret 4

Function at 0x4091a0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e9058], 0
je 0x409207
cmp word [0x4e9344], 0xd7b2
jne 0x4091c9
cmp dword [0x4e934c], 0
jbe 0x4091c9
mov eax, 0x4e9340
call dword [0x4e935c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409234
call fcn.00409d40
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e502e], 0
jne 0x409223
push 0
push 0x4e59c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4093d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4e5030], 0
je 0x4093fb
mov edx, edi
mov eax, esi
call dword [0x4e5030]
mov ebx, eax
jmp 0x40940c
mov eax, 8
call fcn.004069b8
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4e9059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409398
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40943c
mov eax, ebx
call fcn.004069d4
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x40bcb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40be15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409510
cmp si, word [0x4e5a00]
jb 0x40bd48
cmp si, word [0x4e5c00]
ja 0x40bd48
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40bd48
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4e5a00]
jae 0x40bd22
mov edi, ebx
dec edi
jmp 0x40bd43
cmp si, word [ebx*8 + 0x4e5a00]
jbe 0x40bd32
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40bd43
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4e5a04]
call fcn.0040bbd0
jmp 0x40bd48
cmp edi, dword [ebp - 8]
jae 0x40bd0c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40bdf7
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40bdf7
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a0e0
push dword [ebp - 0x160]
push 0x40be30
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.0040a0e0
push dword [ebp - 0x164]
push 0x40be40
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.0040a0e0
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.0040a318
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be1c
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00409570
ret
Function at 0x40bfc8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c0cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4ebb88
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x4ebba0]
jne 0x40c014
mov eax, esi
mov edx, 0x4ebba2
mov ecx, 0x55
call fcn.0040a0e0
push 0x4ebb88
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40c0b6
push 0x4ebb88
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00409510
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c083
cmp byte [0x4ebb84], 0
je 0x40c048
mov edx, esi
mov eax, ebx
call fcn.0040beac
jmp 0x40c083
mov edx, esi
mov eax, ebx
call fcn.0040bcb0
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40c083
cmp dword [esi], 0
je 0x40c06c
mov eax, esi
mov edx, 0x40c0e4
call fcn.0040a238
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040bcb0
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a238
push 0x4ebb88
call sub.kernel32.dll_EnterCriticalSection
mov word [0x4ebba0], bx
mov eax, dword [esi]
call fcn.0040a03c
mov ecx, eax
mov eax, 0x4ebba2
mov edx, 0xaa
call fcn.0040bb30
push 0x4ebb88
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0d3
lea eax, [ebp - 4]
call fcn.00409510
ret
Function at 0x41e0f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x41e254
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x41e090]
call fcn.0040b3e0
add esp, 4
push 0x104
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x41e0c0]
call fcn.0040b3e0
add esp, 4
movzx ebx, byte [0x41e264]
mov dl, 1
mov eax, esi
call fcn.0041e458
test al, al
jne 0x41e16a
mov dl, 1
mov eax, esi
call fcn.0041e3c0
test al, al
je 0x41e1f4
lea edx, [ebp - 0x1c]
mov eax, esi
call fcn.0041e7e4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00424e74
push 0x104
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a03c
mov esi, eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x41e1ef
test byte [ebp - 0x14], 1
je 0x41e1ba
or bl, 1
test byte [ebp - 0x14], 2
je 0x41e1c3
or bl, 2
test byte [ebp - 0x14], 0x80
je 0x41e1cc
or bl, 0x20
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x41e1e0
dec eax
je 0x41e1e5
dec eax
je 0x41e1ea
dec eax
jne 0x41e215
or bl, 0x10
jmp 0x41e215
or bl, 4
jmp 0x41e215
or bl, 8
jmp 0x41e215
call fcn.0042567c
lea edx, [ebp - 0x20]
mov eax, dword [0x4e8a24]
call fcn.0040d0c4
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x416c90]
call fcn.004238f0
call fcn.00408b8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e25b
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00409570
lea eax, [ebp - 0xc]
mov edx, dword [0x41e0c0]
call fcn.0040b504
lea eax, [ebp - 8]
mov edx, dword [0x41e090]
call fcn.0040b504
lea eax, [ebp - 4]
call fcn.00409510
ret

Function at 0x41e2c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x41e2ed
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x423780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4238a5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00423588
mov esi, eax
mov eax, dword [0x4e89b0]
cmp byte [eax], 0
je 0x42384d
mov eax, dword [0x4e87f8]
call fcn.004070ec
call fcn.00406b0c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x423750]
call fcn.0040b3e0
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4238c0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x423889
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4e87b8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4ebc50]
call fcn.0040b7d0
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4238ac
lea eax, [ebp - 4]
mov edx, dword [0x423750]
call fcn.0040b504
ret
Function at 0x47d2f8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47d300
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4b1a08
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1aa6
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4b1a6a
cmp byte [ebx + 0x11], 0
jne 0x4b1a6a
cmp byte [ebx + 0x3c], 0
jne 0x4b1a6a
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b1a8b
lea edx, [ebp - 4]
mov eax, dword [0x4e896c]
call fcn.0040d0c4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48a4cc]
call fcn.004238f0
call fcn.00408b8c
jmp 0x4b1a8b
lea edx, [ebp - 8]
mov eax, dword [0x4e896c]
call fcn.0040d0c4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48a4cc]
call fcn.004238f0
call fcn.00408b8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1aad
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409570
ret

Function at 0x4b2444
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b2492
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b1888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b24ab
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b24b4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b1888
dec esi
jne 0x4b24d6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4db900
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.0040a03c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4db9d0
mov eax, dword [ebp - 8]
call fcn.004069b8
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4db9c9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, ebx
call fcn.0040a03c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4db9b3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4db9e0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4db9b3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov dword [edi], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db9d0
mov eax, dword [ebp - 0xc]
call fcn.004069d4
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ddd3c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4dde05
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e86c8], 0
je 0x4dddef
xor edx, edx
push ebp
push 0x4ddde8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4e86c8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4dddc8
inc ebx
xor esi, esi
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [0x4e86c8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041e458
test al, al
je 0x4ddda8
mov eax, dword [ebp - 4]
call fcn.004ddab4
jmp 0x4dddc4
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041e3c0
test al, al
je 0x4dddc4
mov eax, dword [ebp - 4]
call fcn.0040a03c
push eax
call sub.kernel32.dll_DeleteFileW
inc esi
dec ebx
jne 0x4ddd81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dddef
mov eax, dword [0x4e86c8]
xor edx, edx
mov dword [0x4e86c8], edx
call fcn.00407724
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dde0c
lea eax, [ebp - 4]
call fcn.00409510
ret
Function at 0x4de464
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e4
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4de562
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x400
lea eax, [ebp - 0x80c]
push eax
call sub.kernel32.dll_GetConsoleTitleW
test eax, eax
je 0x4de54c
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x81c], eax
mov byte [ebp - 0x818], 0
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebp - 0x814], eax
mov byte [ebp - 0x810], 0
lea edx, [ebp - 0x81c]
mov ecx, 1
mov eax, 0x4de580
call fcn.0041eddc
mov eax, dword [ebp - 4]
call fcn.0040a03c
mov esi, eax
push esi
call sub.kernel32.dll_SetConsoleTitleW
test eax, eax
je 0x4de54c
xor eax, eax
push ebp
push 0x4de538
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x28
call sub.kernel32.dll_Sleep
push esi
push 0
call sub.user32.dll_FindWindowW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4de51e
call fcn.00408c80
jmp 0x4de54c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de53f
lea eax, [ebp - 0x80c]
push eax
call sub.kernel32.dll_SetConsoleTitleW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de569
lea eax, [ebp - 4]
call fcn.00409510
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4a094a7e
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x51f7611d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219