joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ef00
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x46efa3
test eax, eax
jbe 0x46efa3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x46efa3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46ef4e
xor esi, esi
jmp 0x46ef54
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46ef7f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004079e0
add esi, eax
push esi
mov ebx, esi
call fcn.004079e0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x46ef60
pop ebp
test edi, edi
pop edi
jne 0x46efa3
test ebx, ebx
je 0x46efa3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004b6ff0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x46f0c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46f1dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46f1dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004da6af
mov esi, eax
test esi, esi
je 0x46f1dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46f1dd
mov ecx, esi
call fcn.0046f050
cmp edi, eax
jge 0x46f1dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46f163
mov dword [esp + 0x34], 1
jmp 0x46f1be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46f1dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046e650
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x47f316
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
jmp 0x47f34d
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004a7d60
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x47f382
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004a7d60
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x47f3bb
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov dword [ebp - 8], eax
call fcn.0047f4f4
mov dword [ebp - 0x14], eax
push 0x80000301
push 0
push 3
push getpeername
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x47f3e6
mov eax, 0x58617c
push eax
push 2
mov ebx, 0x134
call fcn.004a77b0
add esp, 0x1c
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x47f40c
push ebx
call fcn.004a658a
add esp, 4
lea eax, [ebp - 0x10]
push eax
call fcn.0047f5fd
mov dword [ebp - 0x1c], eax
push 0xff
push dword [ebp - 8]
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, 0xff
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0xff
push dword [ebp - 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop
nop
nop
nop
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x47f463
push ebx
call fcn.004a658a
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x47f495
push 0x80000401
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
mov ebx, 0x168
call fcn.004a6e40
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x47f4ce
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004a6a70
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x47f4ce
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x47f4df
push ebx
call fcn.004a658a
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x47f4ef
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x47f4f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004a7d60
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x47f540
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x47f557
mov eax, 0x58617c
push eax
push 1
mov ebx, pe_nt_image_headers32
call fcn.004a70e0
add esp, 0x10
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x47f598
mov eax, 0x58617c
push eax
push 2
mov ebx, 0x134
call fcn.004a77b0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x47f5c2
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x47f5e2
push eax
mov ebx, eax
call fcn.00470f62
inc eax
push eax
call fcn.004a6584
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x47f5e7
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x47f5f8
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x48128e
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
jmp 0x4812b0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.004a7d60
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4812e5
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov dword [ebp - 4], eax
push getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4812fc
mov eax, 0x58617c
push eax
push 1
mov ebx, pe_nt_image_headers32
call fcn.004a70e0
add esp, 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
nop
nop
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x481351
mov eax, dword [ebp - 4]
test eax, eax
je 0x48134c
push eax
mov ebx, eax
call fcn.00470f62
inc eax
push eax
call fcn.004a6584
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x48138a
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004a6a70
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x48138a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x48139b
push ebx
call fcn.004a658a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x482c86
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
nop
nop
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x482cb5
mov esp, ebp
pop ebp
ret 4
Function at 0x482d1b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x482d6e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x482d76
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x482d87
mov esp, ebp
pop ebp
ret 0x14

Function at 0x488f56
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0xc
call fcn.004a6584
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
jmp 0x488f9e
mov ebx, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
nop
nop
nop
nop
mov dword [ebp - 4], eax
push 0x64
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x102
jne 0x488ffe
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
nop
nop
nop
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
push 0
call fcn.004a65ae
add esp, 4
jmp 0x48900e
mov ebx, dword [ebp - 8]
push ebx
call fcn.004a658a
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x4a87f0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x4a8860
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4a88c9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.004a67b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x4a88d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4a8962
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4a8954
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4a894c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4a8915
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x4a89e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4a89fe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4a89f3
pop esi
ret
Function at 0x4a8ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x4a8f01
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x4a8f5b
inc edi
cmp edi, esi
jl 0x4a8ef5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x4a8f90
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x4a8f4a
cmp byte [eax], bl
je 0x4a8f65
cmp byte [eax + 1], bl
je 0x4a8f6e
cmp byte [eax + 2], bl
je 0x4a8f78
cmp byte [eax + 3], bl
je 0x4a8f84
add eax, 4
cmp eax, edi
jb 0x4a8f21
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x4c78cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x4c79ee
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x4c79d2
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x4c7924
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x4c7902
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x4c8436
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4c848d
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4c848d
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x4c848d
xor eax, eax
inc eax
jmp 0x4c848f
xor eax, eax
leave
ret 0x10

Function at 0x4c84b8
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4c8526
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x56012c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c851d
cmp dword [ebp - 0xc], 4
jne 0x4c851d
cmp dword [ebp - 0x10], edi
je 0x4c851d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x59d888], edi
xor eax, eax
jmp 0x4c8565
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x59d888], edi
jge 0x4c8560
lea eax, [ebp - 0x34]
push eax
mov dword [0x59d888], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x4c8560
cmp word [ebp - 0x14], 5
jb 0x4c8560
call fcn.004c8493
test eax, eax
je 0x4c8560
emms
mov dword [0x59d888], 1
mov eax, dword [0x59d888]
pop edi
leave
ret

Function at 0x4db052
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4db08a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d9109
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d90e1
jmp 0x4db096
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4dc743
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4dc785
call fcn.004e2387
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4dc785
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4dc77c
xor eax, eax
jmp 0x4dc78d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004dc793
pop edi
pop esi
pop ebx
ret 4
Function at 0x4e28b7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e28e5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e2903
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e281d
jmp 0x4e2903
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e2903
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e281d
test edi, edi
mov eax, edi
jne 0x4e28ed
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x62
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4226cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4226db
pop dword [ebp - 0x28]
mov eax, 0x5f63af90
sub eax, 0x5f2188b5
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3d16a
push 0
mov eax, 0x5037a93a
sub eax, 0x4ff55722
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x19a652f5
add ecx, 0xe659f21e
xor ebx, ebx
add ebx, eax
mov edi, 0xd4567663
sub edi, 0xd4132263
add edi, dword [ebp - 0x28]
mov edx, 0x47c99795
sub edx, 0xeab5f66d
sub dword [ebp - 4], ebx
mov esi, dword [edi]
xor dword [ebp - 0x18], esi
add esi, edx
sub dword [ebp - 8], eax
mov dword [ebx], esi
mov dword [ebp - 0x20], 0x4ecd46e8
add ebx, 0x147f91d9
sub ebx, 0x147f91d5
add edi, 0xde80577
sub edi, 0xde80573
loop 0x42273c
add eax, 0xeab2c7dd
add eax, 0x154e3f42
xor ebx, ebx
add ebx, eax
add eax, 0xa6418e7e
sub eax, 0xa6418e79
mov ecx, 0xb2a9162f
add ecx, 0x4d96e9d1
add ecx, dword [ebp - 0x28]
call ebx
leave
ret