joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005de0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov edx, dword [eax + 8]
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push ebx
push 5
push ecx
mov eax, esp
mov dword [eax], esi
call edx
push ebx
push ecx
mov eax, esp
push dword [ebp + 8]
mov dword [eax], esi
call fcn.10001750
add esp, 0xc
movzx eax, bl
mov dword [ebp - 0x14], 0
test bl, bl
jne 0x10005e28
mov byte [ebp - 8], bl
mov byte [esi], 0xe8
jmp 0x10005e61
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
call ebx
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xe8
test eax, eax
je 0x10005e5e
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call ebx
mov ebx, dword [ebp + 0x14]
push ebx
push 4
push ecx
mov ecx, esp
inc esi
push ecx
mov dword [ecx], edi
mov ecx, esp
mov dword [ecx], esi
call fcn.10001600
mov eax, dword [ebp + 8]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000cf69
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000cfa8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000cfa8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000cfa8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000cfa8
cmp dword [ecx + 0x74], 0xe
jbe 0x1000cfa8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000fa2b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001ddac
push 0x1001dda4
push str.FlsAlloc
push 0x1f
call fcn.1000f907
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000fa5f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b130]
call esi
jmp 0x1000fa65
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000faa9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001ddbc
push 0x1001ddb4
push str.FlsGetValue
push 0x21
call fcn.1000f907
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000fae0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000fae8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001ddc4
push 0x1001ddbc
push str.FlsSetValue
push 0x22
call fcn.1000f907
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000fb22
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001b130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10011e42
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10011edf
push ebx
push esi
call fcn.10011e0b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10011d9f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10011e8c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011ede
push edi
push eax
call fcn.1000e391
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011eac
call fcn.1000e357
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011edd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10011d9f
add esp, 0x20
test eax, eax
jne 0x10011ecb
push edi
call fcn.1000e357
jmp 0x10011ed3
push ebx
call fcn.1000e357
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10019210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001923d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001923d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x467180
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467372
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.0041461c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.0041463c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e4]
mov edx, 0x20
call fcn.0041461c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e4]
mov edx, 0x20
call fcn.0041463c
xor eax, eax
push ebp
push 0x467347
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x10
push 0x467380
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x46725f
cmp byte [ebp - 0x158], 0
je 0x46725f
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x49b014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e0]
call fcn.004670c0
xor edx, edx
mov al, 6
call fcn.00478f58
test al, al
je 0x4672bb
push 0x27
lea edx, [ebp - 0x168]
mov eax, dword [0x49c194]
call fcn.0042c3fc
lea eax, [ebp - 0x168]
mov edx, 0x467398
call fcn.0040357c
mov eax, dword [ebp - 0x168]
call fcn.00403738
push eax
mov eax, dword [0x49b014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e4]
call fcn.004670c0
jmp 0x46733d
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.0047d490
cmp dword [ebp - 4], 0
jne 0x4672df
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.0047d490
cmp dword [ebp - 4], 0
je 0x46733d
push 0x1000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x46733d
cmp byte [ebp - 0x158], 0
je 0x46733d
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x49b014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e4]
call fcn.004670c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467351
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467379
lea eax, [ebp - 0x168]
call fcn.00403400
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x47034c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x470449
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, byte [0x49c439]
mov ecx, dword [eax*4 + 0x499be0]
mov edx, 0x80000002
xor eax, eax
call fcn.0042de1c
test eax, eax
jne 0x4703d1
mov eax, esi
call fcn.00403574
inc eax
push eax
mov eax, esi
call fcn.00403738
push eax
push 1
push 0
mov eax, edi
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4703c6
mov eax, 0x470460
call fcn.00457d10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x4703db
mov eax, 0x470494
call fcn.00457d10
test bl, bl
je 0x47042e
mov eax, esi
call fcn.00403738
push eax
call sub.gdi32.dll_AddFontResourceA
test eax, eax
je 0x470402
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
jmp 0x47042e
lea ecx, [ebp - 0xc]
mov edx, 0x4704c0
mov al, 0x3a
call fcn.00451458
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042e6ac
mov eax, dword [ebp - 8]
mov edx, dword [0x49bd18]
call fcn.0046e670
test al, al
je 0x4703df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470450
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403420
ret

Function at 0x472b4c
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x472c0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x472bf2
test bl, 0x10
je 0x472bf2
lea ecx, [ebp - 4]
mov edx, 0x472c24
mov eax, esi
call fcn.0042c57c
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x472c38
mov eax, 0x472c48
call fcn.0042cd94
mov edx, 0x472c60
mov eax, dword [ebp - 8]
call fcn.00406ac4
test eax, eax
jne 0x472bf2
mov eax, dword [ebp - 4]
call fcn.00406f50
lea ecx, [ebp - 0xc]
mov edx, 0x472c90
mov eax, esi
call fcn.0042c57c
mov eax, dword [ebp - 0xc]
call fcn.00406f50
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00403738
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesA
push edi
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472c14
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403420
ret
Function at 0x47372c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x473800
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x4737ea
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.004535b0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x473818
call fcn.00457f1c
mov edx, ebx
mov eax, dword [0x49c368]
call fcn.0040b24c
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.00403574
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.0045d04c
test al, al
jne 0x4737ea
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x4737cf
mov eax, 0x47384c
call fcn.00457d10
jmp 0x4737ea
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4738a8
call fcn.00457f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473807
lea eax, [ebp - 0x18]
call fcn.00403400
ret
Function at 0x4750dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x475246
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042c3fc
lea eax, [ebp - 0x148]
mov edx, 0x47525c
call fcn.0040357c
mov eax, dword [ebp - 0x148]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x475225
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.0040355c
mov eax, dword [ebp - 4]
call fcn.00403574
cmp eax, 9
jl 0x47520a
lea eax, [ebp - 0x148]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 0x148]
mov edx, 0x475270
call fcn.00406ac4
test eax, eax
jne 0x47520a
mov edx, 0x475278
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
call fcn.0042ea9c
test al, al
je 0x47520a
mov edx, 0x475278
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
call fcn.0042ea9c
test al, al
je 0x47520a
mov edx, 0x475278
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
call fcn.0042ea9c
test al, al
je 0x47520a
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x47520a
lea eax, [ebp - 0x148]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 0x148]
call fcn.00406d98
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x475145
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47524d
lea eax, [ebp - 0x148]
call fcn.00403400
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x477dc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0040ca4c
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.00477ce8
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4a
mov eax, dword [0x49c0e4]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
mov eax, esi
call fcn.0042e384
cmp ebx, 0x6c840001
jne 0x477e10
call fcn.00408c00
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x477e34
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x477ee4
call fcn.004533a0
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x477e8c
mov ebx, eax
mov edx, 1
mov ax, word [ebp - 6]
call fcn.00477d44
mov esi, eax
mov eax, esi
sub ax, 2
je 0x477e8c
dec eax
sub ax, 2
jb 0x477ea0
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x477f18
call fcn.004533a0
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x477e41
mov edx, 2
mov ax, word [ebp - 6]
call fcn.00477d44
movzx ebx, ax
mov edx, 3
mov ax, word [ebp - 6]
call fcn.00477d44
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4784c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
mov edi, edx
mov esi, eax
push 0x478570
push 0x47858c
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x47855a
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x47855a
test al, 0x10
je 0x47850b
mov ebp, 0x2000000
jmp 0x47850d
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebp, eax
cmp ebp, 0xffffffff
je 0x47855a
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jle 0x47855a
cmp ebx, 0xff0
jge 0x47855a
mov edx, edi
mov eax, esp
call fcn.004783ec
jmp 0x478563
mov eax, edi
mov edx, esi
call fcn.00403494
add esp, 0x1000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47859c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47862e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ebx, eax
test ebx, ebx
jle 0x478604
cmp ebx, 0x104
jge 0x478604
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.0040355c
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.004784c4
jmp 0x478615
mov eax, 0x478644
call fcn.00453554
mov eax, esi
call fcn.00403400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478635
lea eax, [ebp - 0x108]
call fcn.00403400
ret

Function at 0x478658
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4787a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004784c4
lea eax, [ebp - 0xc]
call fcn.0047859c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x4787b4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00403738
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
call fcn.00403738
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x478704
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x4c7
jne 0x4786fa
call fcn.00408be0
mov eax, 0x4787c4
call fcn.0045349c
cmp dword [ebp - 0x10], 0
jne 0x478714
mov eax, 0x4787dc
call fcn.00453344
xor edx, edx
push ebp
push 0x478784
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004781e4
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x478722
inc eax
jne 0x47874d
mov eax, 0x478808
call fcn.0045349c
call fcn.004781e4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x47876d
mov eax, 0x47882c
call fcn.0045349c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47878b
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x478840
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47890b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x4781d4
call fcn.0047892c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4788e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x478924
call fcn.004078f4
mov edx, dword [ebp - 8]
mov eax, dword [0x49b628]
call fcn.004242c4
call fcn.004781e4
call sub.user32.dll_GetFocus
mov edx, dword [0x49b628]
cmp eax, dword [edx + 0x20]
jne 0x4788c7
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4788ce
call sub.user32.dll_WaitMessage
jmp 0x4788a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4788eb
mov eax, dword [ebp - 4]
call fcn.00402b58
ret

Function at 0x47cce8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47ccf0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47ce3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00453a24
mov edx, dword [ebp - 0x10]
mov eax, 0x49c18c
call fcn.00403450
mov edx, 0x47ce54
lea eax, [ebp - 0x10]
call fcn.00403494
lea eax, [ebp - 0x10]
mov edx, dword [0x49c18c]
call fcn.0040357c
mov eax, dword [ebp - 0x10]
call fcn.00457d10
cmp byte [0x49c00c], 0
je 0x47cd53
mov eax, dword [0x49c18c]
call fcn.00457508
lea edx, [ebp - 0x10]
mov eax, dword [0x49c18c]
call fcn.0042c3fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47ce7c
call fcn.004035c0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x47cde5
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00451458
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00406d68
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0042e8c8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
mov al, 0x68
call fcn.00451428
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, 0x406400
call fcn.00408c0c
call fcn.0040311c
lea eax, [ebp - 8]
call fcn.00458410
cmp dword [ebp - 8], 0
je 0x47ce16
lea eax, [ebp - 0xc]
mov ecx, 0x47ce8c
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047cc90
mov eax, dword [ebp - 0xc]
call fcn.00458450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ce45
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403420
ret
Function at 0x47f218
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x49c481], 1
call fcn.004555e4
test al, al
jne 0x47f25a
push 5
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov cl, 2
xor edx, edx
mov eax, dword [0x49bd74]
call fcn.0047f124
ret

Function at 0x4835a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x4835d0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x4835d9
call fcn.004825fc
mov eax, 0xa
call fcn.0042ec74
call fcn.004825fc
call fcn.00483570
test al, al
jne 0x4835ae
pop ebx
ret

Function at 0x483a90
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x49c0a8], 0
je 0x483b27
mov eax, dword [0x49c0a8]
call fcn.00418378
test al, al
je 0x483b27
mov eax, dword [0x49c0a8]
cmp byte [eax + 0xc7], 0
je 0x483ad7
cmp byte [ebx + 0x1b9], 0
jne 0x483ad7
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x483adb
xor eax, eax
jmp 0x483add
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x49c0a8]
call fcn.004181e0
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x483b27
test bl, bl
je 0x483b15
push 5
mov eax, dword [0x49c0a8]
call fcn.004181e0
push eax
call sub.user32.dll_ShowWindow
jmp 0x483b27
push 0
mov eax, dword [0x49c0a8]
call fcn.004181e0
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x483bd0
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x49c43a], 0
push 0x483ca8
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x483cb8
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x483c5c
lea edx, [esp + 4]
push edx
call eax
push 0x483ccc
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x483c66
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x483c66
cmp dword [esp], 0
je 0x483c66
call fcn.0045271c
test al, al
je 0x483c66
push 0x483cdc
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x483c66
push 0x483cf8
push 0x483d08
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x483c66
mov byte [0x49c43a], 1
jmp 0x483c66
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ax, word [esp + 4]
sub ax, 1
jb 0x483c7f
sub ax, 5
je 0x483c88
sub ax, 3
je 0x483c91
jmp 0x483c9a
mov byte [0x499c80], 1
jmp 0x483ca1
mov byte [0x499c80], 3
jmp 0x483ca1
mov byte [0x499c80], 2
jmp 0x483ca1
mov byte [0x499c80], 0
add esp, 0x28
pop esi
pop ebx
ret