joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458a44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458b2d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x458b0f
inc esi
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x458b48
call fcn.0040410c
mov edi, eax
test edi, edi
jle 0x458abc
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404028
mov bl, 1
jmp 0x458ac9
lea eax, [ebp - 0x10]
mov edx, 0x458b54
call fcn.00403e28
cmp dword [ebp - 0x10], 0
je 0x458b05
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403e20
push eax
lea eax, [ebp - 0x10]
call fcn.00403ff0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x458b05
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xe8
je 0x458b05
call fcn.0040c6b0
inc dword [ebp - 0xc]
dec esi
jne 0x458a83
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458b34
lea eax, [ebp - 0x10]
call fcn.00403ba0
ret
Function at 0x45bb44
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x45bb72
mov eax, ebx
call fcn.0045c5e8
cmp dword [ebx + 0x3c], 0
je 0x45bb6b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x45bbe3
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x45bbd5
cmp dword [ebx + 8], 0
je 0x45bb94
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x45bba6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45bbd5
cmp dword [ebx + 8], 0
je 0x45bb87
cmp eax, 3
je 0x45bbb9
dec eax
jne 0x45bb87
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45bb87
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x45bb87
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x45bc01
cmp dword [ebx + 0x10], 0xcc
je 0x45bc01
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045bc0c
pop ebx
ret

Function at 0x46e298
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x46e2e9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x46e2d0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x46e2c0
jmp 0x46e2e9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x46e2d1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b768
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00410728
mov esi, eax
xor eax, eax
push ebp
push 0x47b7e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x47b7c6
mov edx, ebx
mov eax, esi
call fcn.0041031c
test byte [eax + 0x48], 1
je 0x47b7c0
push 0
mov edx, ebx
mov eax, esi
call fcn.0041031c
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.004101bc
dec ebx
cmp ebx, 0xffffffff
jne 0x47b794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b7e9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.0041078c
ret

Function at 0x47bbdc
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402b60
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x47d0d8
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x47d0e7
or edx, 0x200
test eax, 0x20000000
je 0x47d11b
test eax, 0x40000000
je 0x47d106
test eax, 0x80000000
je 0x47d101
or edx, 0x40
jmp 0x47d142
or edx, 0x20
jmp 0x47d142
test eax, 0x80000000
je 0x47d115
or edx, 0x80
jmp 0x47d142
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x47d133
test eax, 0x80000000
je 0x47d12e
or edx, 4
jmp 0x47d142
or edx, 2
jmp 0x47d142
test eax, 0x80000000
je 0x47d13f
or edx, 8
jmp 0x47d142
or edx, 1
mov eax, edx
ret
Function at 0x484fe8
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffd8
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x485026
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x485026
push 2
call sub.advapi32.dll_ImpersonateSelf
test eax, eax
je 0x485081
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x485081
lea eax, [esp + 0xc]
push eax
push 0x485088
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov dword [esp + 4], 0x10
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x485078
mov dword [esp + 4], 0xffff
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
add esp, 0x28
ret

Function at 0x485e50
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [eax + 0x2f4]
test edx, edx
je 0x485e67
mov eax, edx
cmp byte [eax + 0x47], 0
jne 0x485e67
call fcn.0042e390
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
call fcn.00430f08
push 0
mov eax, dword [0x4bdb04]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x491c98
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov ebx, ecx
mov ebp, edx
mov esi, eax

Function at 0x491f44
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.00403ba0
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x49208c
mov edx, 0x492090
mov eax, ebx
call fcn.00491990
test al, al
je 0x492081
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.004076fc
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x4bd608]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4920a0
mov eax, ebx
call fcn.00491bac
mov ebx, eax
test ebx, ebx
je 0x492081
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4920ac
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4920c0
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4920d4
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x49203e
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x49203e
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x492053
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x49207b
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x492320
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x4bd61c
xor eax, eax
mov dword [0x4bd618], eax
xor eax, eax
mov dword [0x4c7d10], eax
xor eax, eax
mov dword [0x4c7d14], eax
xor eax, eax
mov dword [0x4c7d18], eax
xor eax, eax
mov dword [0x4c7d1c], eax
xor eax, eax
mov dword [0x4c7d20], eax
xor eax, eax
mov dword [0x4c7d0c], eax
xor eax, eax
mov dword [0x4c7d24], eax
xor eax, eax
mov dword [0x4c7d28], eax
xor eax, eax
mov dword [0x4c7d2c], eax
xor eax, eax
mov dword [0x4c7d30], eax
cmp dword [ebx], 0
je 0x49249e
push 0x4924a0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d10], eax
push 0x4924a8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d14], eax
push 0x4924b0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d18], eax
push 0x4924b8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d1c], eax
push 0x4924c0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d20], eax
push 0x4924c8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d0c], eax
push 0x4924d0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d24], eax
push 0x4924e0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d28], eax
push 0x4924ec
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d2c], eax
push 0x4924fc
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c7d30], eax
cmp dword [0x4c7d10], 0
je 0x49249e
cmp dword [0x4c7d14], 0
je 0x49249e
cmp dword [0x4c7d18], 0
je 0x49249e
cmp dword [0x4c7d1c], 0
je 0x49249e
cmp dword [0x4c7d20], 0
je 0x49249e
cmp dword [0x4c7d0c], 0
je 0x49249e
mov dword [0x4bd618], 1
cmp dword [0x4c7d24], 0
je 0x49249e
cmp dword [0x4c7d28], 0
je 0x49249e
cmp dword [0x4c7d2c], 0
je 0x49249e
cmp dword [0x4c7d30], 0
je 0x49249e
mov dword [0x4bd618], 2
pop ebx
ret

Function at 0x492fb4
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
mov ebx, edx
mov esi, eax
test si, 2
jne 0x492fd2
test si, 1
jne 0x492fd2
test si, 8
je 0x49302e
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x49302e
lea eax, [esp + 0xc]
push eax
push 0x493048
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x493036
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x493250
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x49337c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4bdbac]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x493390
call fcn.00403e6c
lea eax, [ebp - 8]
mov ecx, 0x493390
mov edx, dword [0x4c8ea0]
call fcn.00403e6c
mov eax, dword [ebp - 4]
call fcn.00408dd4
mov ebx, eax
and ebx, 0xfffffffe
mov eax, dword [ebp - 8]
call fcn.00408dd4
and eax, 0xfffffffe
cmp ebx, eax
je 0x4932c5
push 0
lea eax, [ebp - 8]
call fcn.00403ff0
push eax
lea eax, [ebp - 4]
call fcn.00403ff0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 8]
call fcn.00408e3c
test al, al
je 0x493314
push 1
mov eax, 0x4c8ea0
call fcn.00403ff0
push eax
push 0x4933a4
push dword [ebp - 8]
push 0x4933b4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403ee0
mov eax, dword [ebp - 0xc]
call fcn.00403fe4
push eax
push 0x4933b8
push 0x4933c8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x493361
mov eax, dword [ebp - 4]
call fcn.00408e3c
test al, al
je 0x493361
push 1
mov eax, dword [0x4bdbac]
call fcn.00403ff0
push eax
push 0x4933a4
push dword [ebp - 4]
push 0x4933b4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403ee0
mov eax, dword [ebp - 0x10]
call fcn.00403fe4
push eax
push 0x4933b8
push 0x4933c8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493383
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403bc4
ret

Function at 0x4938d4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b60
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
mov ax, word [ebp + 8]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x493944
cmp byte [ebp - 1], 0
je 0x493942
push 0x64
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x493944
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x493c70
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x493c9d
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00403dd0
jmp 0x493ca4
mov eax, ebx
call fcn.00403ba0
add esp, 0x108
pop ebx
ret
Function at 0x497714
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4977f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x4c8d98
mov ecx, 0x105
call fcn.00403dd0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x49780c
call fcn.00403e6c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404314
mov eax, dword [ebp - 0xc]
mov dx, 0xffff
call fcn.00453dec
mov ebx, eax
test ebx, ebx
je 0x4977ca
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
mov eax, ebx
call fcn.00402e78
mov eax, 0xc8
call fcn.00454ea4
push 1
push 0x49781c
push 0x497828
push dword [ebp - 4]
push 0x497838
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403ee0
mov eax, dword [ebp - 0x10]
call fcn.00403fe4
push eax
push 0x49783c
push 0x497848
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4977fc
lea eax, [ebp - 0x10]
call fcn.00403ba0
lea eax, [ebp - 0xc]
call fcn.004041d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403bc4
ret

Function at 0x49a6a4
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x49a770
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417eb4]
call fcn.0041e37c
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push esi
mov eax, ebx
call fcn.0041e8e8
xor ecx, ecx
xor edx, edx
call fcn.00419838
lea eax, [ebp - 4]
mov ecx, 0x49a784
mov edx, dword [0x4c8ea0]
call fcn.00403e6c
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, ebx
call fcn.00402e78
mov ecx, 0x49a79c
mov edx, 0x49a7a8
mov eax, 0x49a7c0
call fcn.00453e98
mov eax, 0x49a7c0
mov ecx, 0x49a7f4
mov edx, 0x49a800
call fcn.00453e98
push 3
lea eax, [ebp - 4]
call fcn.00403ff0
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a777
lea eax, [ebp - 4]
call fcn.00403ba0
ret
Function at 0x49ccdc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x49cce4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fd4
xor eax, eax
push ebp
push 0x49cec3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408818
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x18]
call fcn.00404314
mov eax, dword [0x4c8ed4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x49ce83
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [0x4c8ed4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 1]
and eax, 0xff
sub eax, 0x30
mov dword [0x4c9038], eax
cmp dword [0x4c9038], 4
je 0x49ce77
lea eax, [ebp - 0xc]
mov ecx, 3
mov edx, 1
call fcn.00404068
mov eax, dword [ebp - 0xc]
mov edx, 0x49cedc
call fcn.00403f30
jne 0x49cd96
mov byte [0x4bd748], 1
jmp 0x49cd9d
mov byte [0x4bd748], 0
cmp byte [0x4bd748], 0
je 0x49ce38
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403c38
mov esi, 1
jmp 0x49cde6
mov eax, dword [ebp - 0x14]
mov al, byte [eax + esi - 1]
cmp al, 0x61
jb 0x49cdd1
mov edx, dword [ebp - 0x14]
cmp al, 0x7a
ja 0x49cdd1
inc esi
jmp 0x49cde6
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x400
mov edx, esi
mov eax, dword [ebp - 0x14]
call fcn.00404028
jmp 0x49cdf2
mov eax, dword [ebp - 0x14]
call fcn.00403e20
cmp esi, eax
jl 0x49cdbc
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, 0x49cef0
call fcn.00403e6c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x10]
call fcn.00405334
mov esi, eax
cmp dword [ebp - 0x10], 0
jne 0x49ce38
cmp esi, 0x3e8
jbe 0x49ce38
call sub.kernel32.dll_GetTickCount
cmp esi, eax
jae 0x49ce38
call sub.kernel32.dll_GetTickCount
sub eax, 0x30d40
cmp esi, eax
jbe 0x49ce38
mov bl, 1
jmp 0x49ce83
cmp byte [0x4bd748], 0
je 0x49ce52
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00403f30
jne 0x49ce52
mov bl, 1
jmp 0x49ce83
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00404314
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.00404500
test eax, eax
jle 0x49ce77
mov byte [0x4bd748], 0
mov bl, 1
jmp 0x49ce83
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x49cd3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ceca
lea eax, [ebp - 0x28]
call fcn.00403ba0
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004041e8
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403bc4
lea eax, [ebp - 0xc]
call fcn.00403ba0
lea eax, [ebp - 4]
call fcn.00403ba0
ret
Function at 0x49d630
Capabilities:
Enumerate gui resources
Get graphical window text
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403fd4
xor eax, eax
push ebp
push 0x49d723
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40ea34]
call fcn.00402e48
mov edi, eax
push edi
push 0x49cfac
call sub.user32.dll_EnumWindows
mov ebx, dword [edi + 8]
dec ebx
test ebx, ebx
jl 0x49d706
inc ebx
xor esi, esi
push 0x7f
lea eax, [ebp - 0x8c]
push eax
mov edx, esi
mov eax, edi
call fcn.0041031c
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x49d6fe
lea eax, [ebp - 4]
call fcn.00403ff0
mov edx, eax
lea eax, [ebp - 0x8c]
call fcn.0040940c
test eax, eax
jne 0x49d6fe
lea eax, [ebp - 8]
push eax
mov edx, esi
mov eax, edi
call fcn.0041031c
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp edx, 0xffffffff
jne 0x49d6e2
cmp eax, 0xffffffff
je 0x49d6fe
cmp dword [ebp - 0xc], 0
je 0x49d6fe
push 0x31
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
inc esi
dec ebx
jne 0x49d67d
mov eax, edi
call fcn.00402e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d72a
lea eax, [ebp - 4]
call fcn.00403ba0
ret

Function at 0x49d734
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x49d74d
cmp eax, 0xffffffff
je 0x49d761
test ebx, ebx
je 0x49d761
push 0x31
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret
Function at 0x409a30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x47d244], 0
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x409a6d
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409a58
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409a4a
mov dword [ecx*4 + 0x47d240], eax
inc ecx
cmp ecx, 0x100
jne 0x409a43
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409a8f
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x47d240]
jmp 0x409a77
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa