joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486df8
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x486f84
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c8f70], 0
jne 0x486f69
test ebx, ebx
je 0x486f69
lea eax, [ebp - 4]
push eax
push 0x32
push 0
call sub.msacm32.dll_acmMetrics
mov eax, dword [ebp - 4]
call fcn.00402858
mov esi, eax
mov edx, esi
mov eax, ebx
mov ecx, dword [ebp - 4]
call fcn.00402a54
mov eax, dword [ebx + 8]
mov dword [0x4c8f6c], eax
mov eax, 4
call fcn.00402858
mov dword [0x4c8f70], eax
push 0x10004
push 0
mov eax, edi
call fcn.0044a56c
push eax
push esi
push 0
mov eax, dword [0x4c8f70]
push eax
call sub.winmm.dll_waveInOpen
mov esi, eax
test esi, esi
je 0x486eaf
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004093b4
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x486f9c
call fcn.00404c54
mov eax, dword [ebp - 8]
call fcn.004332ec
jmp 0x486f69
mov byte [0x4c8f68], 0
mov edi, 3
mov eax, 0x20
call fcn.00402858
mov eax, 1
call fcn.00402858
mov eax, dword [0x4c8f6c]
call fcn.00402858
mov esi, eax
mov eax, 0x20
call fcn.00402858
mov ebx, eax
mov dword [ebx], esi
mov eax, dword [0x4c8f6c]
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
push 0x20
push ebx
mov eax, dword [0x4c8f70]
mov eax, dword [eax]
push eax
call sub.winmm.dll_waveInPrepareHeader
mov esi, eax
test esi, esi
je 0x486f25
mov eax, 0x486fc4
call fcn.004332ec
push 0x20
push ebx
mov eax, dword [0x4c8f70]
mov eax, dword [eax]
push eax
call sub.winmm.dll_waveInAddBuffer
mov esi, eax
test esi, esi
je 0x486f45
mov eax, 0x486fe0
call fcn.004332ec
dec edi
jne 0x486ebb
mov eax, dword [0x4c8f70]
mov eax, dword [eax]
push eax
call sub.winmm.dll_waveInStart
mov esi, eax
test esi, esi
je 0x486f69
mov eax, 0x486ffc
call fcn.004332ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486f8b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040496c
ret

Function at 0x48864c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4886d5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4c8fec
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4886bf
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040ca4c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x4886ec
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4c6e84]
mov dl, 1
mov eax, dword [0x487678]
call fcn.0040d370
call fcn.004042c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4886dc
lea eax, [ebp - 0x1c]
call fcn.00404948
ret
Function at 0x488da0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00488cc4
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403c70
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x488e04
call fcn.00488594
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x488df6
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403c70
pop esi
pop ebx
ret

Function at 0x488e28
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00404e08
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00403230
test ebx, ebx
je 0x488e73
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x488f50
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x488f81
mov ecx, dword [0x4c6ffc]
mov dl, 1
mov eax, dword [0x487678]
call fcn.0040d334
call fcn.004042c4
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x488fae
mov ecx, dword [0x4c6c48]
mov dl, 1
mov eax, dword [0x487678]
call fcn.0040d334
call fcn.004042c4
xor eax, eax
push ebp
push 0x48902f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403c70
cmp byte [ebp + 8], 0
je 0x489009
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00488eb8
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00488d20
jmp 0x489025
mov eax, dword [ebp + 0x14]
push eax
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00488880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48904c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x489058
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x489089
mov ecx, dword [0x4c6d08]
mov dl, 1
mov eax, dword [0x487678]
call fcn.0040d334
call fcn.004042c4
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4890b6
mov ecx, dword [0x4c6c48]
mov dl, 1
mov eax, dword [0x487678]
call fcn.0040d334
call fcn.004042c4
xor eax, eax
push ebp
push 0x489132
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403c70
cmp byte [ebp + 8], 0
je 0x48910e
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00488eb8
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.00488da0
jmp 0x489128
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00488880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48914f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x489330
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00488b48
xor eax, eax
push ebp
push 0x4894a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x48948b
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x48937b
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x489385
call fcn.00404370
jmp 0x4894a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004206c8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x489480
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x489433
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x489420
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403c70
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004892e8
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4894b4]
cmp dl, byte [eax + 0x28]
je 0x489487
call fcn.0040d258
jmp 0x489487
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004206e8
jmp 0x489487
cmp ecx, ebx
jge 0x48944f
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004206e8
jmp 0x489385
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004206c8
cmp edx, dword [esp + 4]
jne 0x48946f
cmp eax, dword [esp]
pop edx
pop eax
jne 0x489385
push ebp
call fcn.004892e8
pop ecx
jmp 0x489487
push ebp
call fcn.004892e8
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4894a8
mov eax, dword [ebp - 4]
call fcn.00488b54
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4894d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4895f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00488b48
xor eax, eax
push ebp
push 0x4895d5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x489520
call fcn.00404370
jmp 0x4895dc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4895bf
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4895bf
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403c70
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4895bf
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040ca4c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x48960c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4c6e84]
mov dl, 1
mov eax, dword [0x487678]
call fcn.0040d370
call fcn.004042c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4895dc
mov eax, dword [ebp - 4]
call fcn.00488b54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4895f9
lea eax, [ebp - 0x28]
call fcn.00404948
ret
Function at 0x489658
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4897a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00488b48
xor eax, eax
push ebp
push 0x489785
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4896bd
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4896bd
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x48976f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4896d0
call fcn.00404370
jmp 0x48978c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x48976f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x48976f
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403c70
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x48976f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040ca4c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4897bc
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4c6e84]
mov dl, 1
mov eax, dword [0x487678]
call fcn.0040d370
call fcn.004042c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48978c
mov eax, dword [ebp - 4]
call fcn.00488b54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4897a9
lea eax, [ebp - 0x28]
call fcn.00404948
ret

Function at 0x4a66dc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4a6701
cmp dword [esp + 4], 5
jb 0x4a6701
mov al, 1
jmp 0x4a6703
xor eax, eax
add esp, 0x94
ret
Function at 0x4b81f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b82cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0xe
push ebx
call sub.user32.dll_SendMessageA
mov dword [0x4c9618], eax
cmp dword [0x4c9618], 0
jle 0x4b829d
mov eax, dword [0x4c9618]
inc eax
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4b81d0]
call fcn.00405f08
add esp, 4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x4c9618]
inc eax
push eax
push 0xd
push ebx
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
call fcn.00405d4c
mov ebx, eax
test ebx, ebx
jl 0x4b8291
inc ebx
xor esi, esi
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi]
call fcn.00404b30
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040904c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404c10
inc esi
dec ebx
jne 0x4b8269
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040499c
jmp 0x4b82a4
mov eax, edi
call fcn.00404948
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b82d4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040496c
lea eax, [ebp - 4]
mov edx, dword [0x4b81d0]
call fcn.00406028
ret

Function at 0x4b82dc
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov esi, edx
mov ebx, eax
push 0x4010
push 0x160
lea eax, [esp + 8]
push eax
push esi
mov eax, ebx
call fcn.00404e08
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x4b86f8
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4b8738
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4b872d
mov edx, eax
mov eax, ebx
call fcn.00450dbc
mov byte [ebx + 0x42], 1
add esp, 0x160
pop ebx
ret

Function at 0x4b8710
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4b8738
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4b872d
mov edx, eax
mov eax, ebx
call fcn.00450dbc
mov byte [ebx + 0x42], 1
add esp, 0x160
pop ebx
ret

Function at 0x4b88f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x4c6d84]
mov eax, dword [eax]
call fcn.00463544
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
ja 0x4b88ff
pop esi
pop ebx
ret
Function at 0x4b8ed0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404df8
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4b903e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00481f98
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00481fb8
jmp 0x4b900a
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404bb8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409ab0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408dfc
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408dfc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404d54
je 0x4b8fea
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404bb8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408dfc
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408dfc
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404d54
jne 0x4b9001
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.00481fd8
test eax, eax
jne 0x4b8f4b
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9045
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040496c
lea eax, [ebp - 4]
call fcn.00404948
ret

Function at 0x4b9050
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404df8
mov eax, dword [ebp - 8]
call fcn.00404df8
xor eax, eax
push ebp
push 0x4b90de
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b90b7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404e08
push eax
mov eax, dword [ebp - 4]
call fcn.00404e08
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b90c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b90e5
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040496c
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x73b643cc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x5f552f95
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5644103a
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x1fbf2296
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402a6c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402ac5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402908
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402908
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402aaf
inc ebx
jmp 0x402a98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402acc
lea eax, [ebp - 8]
call fcn.00403520
ret

Function at 0x402ad4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403520
test esi, esi
jne 0x402b0b
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004035e4
jmp 0x402b2c
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402908
mov dword [esp], eax
test esi, esi
je 0x402b2c
cmp dword [ebx], 0
je 0x402b2c
dec esi
jmp 0x402b13
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x402c9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40800c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d34
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d14
xor eax, eax
push ebp
push 0x402d0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d50
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d14
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40800c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40800c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40339c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x409034], 0
je 0x4033fd
cmp word [0x409208], 0xd7b2
jne 0x4033c5
cmp dword [0x409210], 0
jbe 0x4033c5
mov eax, 0x409204
call dword [0x409220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x408054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403424
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x408018], 0
jne 0x403419
push 0
push 0x40804c
push 0x408054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret