joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470e00
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
test eax, eax
jne 0x470e1f
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
pop ebx
add esp, 0x10
ret
push esi
push edi
push 1
lea esi, [esp + 0x10]
push esi
xor edx, edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x470e3f
xor esi, esi
xor edi, edi
jmp 0x470e47
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp esi, dword [esp + 0x14]
jne 0x470e6e
cmp edi, dword [esp + 0x18]
jne 0x470e6e
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x470e80
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [ecx + 4]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x470eb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d0968]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
je 0x470f09
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
add edi, 1
cmp edi, 0x3fffffff
jg 0x470f09
lea eax, [edi + edi]
call fcn.00480be0
mov esi, esp
test esi, esi
je 0x470f09
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0x3a8
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x470f0b
xor eax, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x470f3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x470f3b
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00480bcf
mov esp, ebp
pop ebp
ret
mov eax, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00480bcf
mov esp, ebp
pop ebp
ret
Function at 0x471500
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b2ba2
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.00483910
mov eax, dword [0x4d0968]
xor eax, esp
mov dword [esp + 0x2018], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d0968]
xor eax, esp
push eax
lea eax, [esp + 0x2030]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2040]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], edi
mov esi, ecx
mov dword [esp + 0x28], ebx
mov byte [ebx + 4], 0
mov eax, dword [esi + 4]
cmp eax, edi
mov dword [esp + 0x2038], edi
mov dword [esp + 0x1c], 1
mov byte [esp + 0x16], 0
jne 0x471585
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x471599
push 1
lea ebp, [esp + 0x24]
push ebp
xor edx, edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, esi
call fcn.00470e00
test eax, eax
jne 0x47169a
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, edi
mov edx, dword [esi + 4]
push edi
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x23]
push ecx
push edx
call ebp
mov al, byte [esp + 0x17]
cmp al, 0xd
je 0x4715cf
cmp al, 0xa
jne 0x4715df
mov ecx, esi
call fcn.00470e00
test eax, eax
je 0x4715b0
jmp 0x47169a
mov edx, dword [esi + 4]
cmp edx, edi
jne 0x4715f0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x471607
push 1
or eax, 0xffffffff
lea edi, [esp + 0x24]
push edi
or ecx, eax
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor edi, edi
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x22]
push ecx
push edx
call ebp
mov eax, dword [esi + 4]
test eax, eax
jne 0x47162c
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x471641
push 1
or ecx, 0xffffffff
lea ebp, [esp + 0x24]
push ebp
or edx, ecx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov al, byte [esp + 0x16]
cmp al, 0xd
je 0x471689
lea esp, [esp]
cmp al, 0xa
je 0x471689
mov ecx, esi
call fcn.00470e00
test eax, eax
jne 0x471689
cmp edi, 0x1fff
jae 0x471689
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1e]
push ecx
mov ecx, esi
call fcn.00470ca0
mov al, byte [esp + 0x16]
mov byte [esp + edi + 0x2c], al
add edi, 1
cmp al, 0xd
jne 0x471650
lea edx, [esp + 0x2c]
push edx
mov ecx, ebx
mov byte [esp + edi + 0x30], 0
call fcn.00414740
mov eax, ebx
mov ecx, dword [esp + 0x2030]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2018]
xor ecx, esp
call fcn.00480bcf
add esp, 0x2028
ret 4
Function at 0x475e90
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [esp + 0x20], ebx
push esi
mov esi, ecx
jle 0x476000
push edi
mov edi, dword [esp + 0x2c]
cmp edi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
je 0x475fab
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x475ef6
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], str.CryptCreateHash_error
call fcn.0048095e
push 0x4c9014
lea eax, [esp + 0x18]
push eax
call fcn.00480767
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
push ebx
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x475f31
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], str.CryptHashData_error
call fcn.0048095e
push 0x4c9014
lea ecx, [esp + 0x18]
push ecx
call fcn.00480767
mov eax, dword [esp + 0xc]
mov ecx, dword [esi]
lea edx, [esp + 0x10]
push edx
push ebx
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x475f73
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], str.CryptDeriveKey_error
call fcn.0048095e
push 0x4c9014
lea eax, [esp + 0x18]
push eax
call fcn.00480767
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x475fa7
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0x4b9428
call fcn.0048095e
push 0x4c9014
lea eax, [esp + 0x18]
push eax
call fcn.00480767
mov dword [esp + 0xc], ebx
mov edi, dword [esp + 0x24]
nop
mov eax, dword [esp + 0x28]
sub eax, ebx
cmp eax, 0x3e8
jbe 0x475fcf
add ebx, 0x3e8
mov dword [esp + 0x2c], 0x3e8
xor esi, esi
jmp 0x475fd8
mov dword [esp + 0x2c], eax
mov esi, 1
mov edx, dword [esp + 0x10]
push 0x3e8
lea ecx, [esp + 0x30]
push ecx
push edi
push 0
push esi
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test esi, esi
jne 0x475fff
add edi, 0x3e8
jmp 0x475fb0
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10

Function at 0x476010
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
mov esi, ecx
push str.MyContainer
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x476077
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push esi
call edi
test eax, eax
jne 0x476077
push 0x20
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push esi
call edi
test eax, eax
jne 0x476077
push 0x28
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push esi
call edi
test eax, eax
jne 0x476077
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.MyContainer
push esi
call edi
pop edi
mov eax, esi
pop esi
ret
Function at 0x478650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b3348
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4d0968]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
lea edx, [eax + ecx]
push edx
push eax
lea ecx, [esp + 0x14]
call fcn.00477ce0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esi + 4]
mov dword [esp + 0x28], 0
call fcn.00478540
mov ecx, eax
call fcn.00477ad0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4786c3
push eax
call fcn.004803bd
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc
Function at 0x47e0cc
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4d0968]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0047df2b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00480820
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x47e11b
cmp dword [ebp - 0x1c], 5
jb 0x47e133
jmp 0x47e12f
cmp dword [ebp - 0x10], 1
jne 0x47e133
cmp dword [ebp - 0x1c], 4
ja 0x47e12f
jne 0x47e133
cmp dword [ebp - 0x18], 0
jbe 0x47e133
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4bb324
call fcn.0040c320
test eax, eax
jge 0x47e154
mov byte [0x4d1dc4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00480bcf
add ebp, 0x78
leave
ret

Function at 0x47e36d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4d25a0], 0
push esi
jne 0x47e2db
call fcn.0047e1f9
test eax, eax
je 0x47e31e
mov eax, dword [0x4d25a0]
cmp eax, 1
jne 0x47e2fc
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x47e31e
pop esi
ret
push eax
call dword [0x4d25a8]
test eax, eax
jne 0x47e366
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x47e322
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4d25a0]
call dword [0x4d25a8]
mov edi, eax
test edi, edi
je 0x47e349
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x47e365
lea edi, [esi + 0xff0]
push esi
push dword [0x4d25a0]
call dword [0x4d25a4]
add esi, 0x10
cmp esi, edi
jb 0x47e34f
mov eax, esi
pop edi
pop esi
ret
jmp 0x47e2c8

Function at 0x480bcf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d0968]
jne 0x480bd9
repz ret
jmp fcn.0048b2a9
Function at 0x483b8b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x483bc8
cmp dword [ebp + 0x14], edi
je 0x483bc8
cmp ecx, edi
jne 0x483bcf
call fcn.00485eb0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004810dc
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x483be3
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x483c04
cmp ebx, 0xffffffff
je 0x483bf3
push ebx
push edi
push ecx
call fcn.00480820
add esp, 0xc
cmp esi, edi
je 0x483bb0
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x483bb0
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x483c20
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x483c27
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x483d18
test word [esi + 0xc], 0x10c
je 0x483c7b
mov eax, dword [esi + 4]
test eax, eax
je 0x483c7b
jl 0x483d79
cmp ebx, eax
mov edi, ebx
jb 0x483c4c
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x483d20
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0048050a
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x483d10
cmp ebx, dword [ebp - 0xc]
jb 0x483ce8
cmp dword [ebp - 0xc], 0
je 0x483ca5
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x483c9a
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x483ca1
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x483cb0
mov eax, closesocket
cmp ebx, eax
ja 0x483cb0
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x483d4c
push eax
push dword [ebp - 8]
push esi
call fcn.00490bce
pop ecx
push eax
call fcn.00492291
add esp, 0xc
test eax, eax
je 0x483d8b
cmp eax, 0xffffffff
je 0x483d79
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x483d10
push esi
call fcn.00490822
cmp eax, 0xffffffff
pop ecx
je 0x483d7d
cmp dword [ebp - 4], 0
je 0x483d4c
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x483c2f
mov eax, dword [ebp + 0x14]
jmp 0x483bca
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x483d37
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00480820
add esp, 0xc
call fcn.00485eb0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x483bc0
cmp dword [ebp + 0xc], 0xffffffff
je 0x483d62
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00480820
add esp, 0xc
call fcn.00485eb0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x483bc0
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x483bca
or dword [esi + 0xc], 0x10
jmp 0x483d7d
Function at 0x48af2f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4d0cc8]
je 0x48af4a
inc edi
cmp edi, 0x17
jb 0x48af3b
cmp edi, 0x17
jae 0x48b0ca
push ebp
push 3
call fcn.0049f74d
cmp eax, 1
pop ecx
je 0x48b096
push 3
call fcn.0049f74d
test eax, eax
pop ecx
jne 0x48af7e
cmp dword [0x4d09e0], 1
je 0x48b096
cmp ebx, 0xfc
je 0x48b0c9
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4d29e0
push ebp
call fcn.0048424b
add esp, 0xc
test eax, eax
je 0x48afb4
push esi
push esi
push esi
push esi
push esi
call fcn.00480fa8
add esp, 0x14
push 0x104
mov esi, 0x4d29f9
push esi
push 0
mov byte [0x4d2afd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x48aff8
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048424b
add esp, 0xc
test eax, eax
je 0x48aff8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00480fa8
add esp, 0x14
push esi
call fcn.00485f80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x48b03d
push esi
call fcn.00485f80
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4d2cf4
push 0x4bc40c
sub ecx, eax
push ecx
push eax
call fcn.00495fe6
add esp, 0x14
test eax, eax
je 0x48b03d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00480fa8
add esp, 0x14
jmp 0x48b03f
xor esi, esi
push 0x4bc408
push ebx
push ebp
call fcn.00495f75
add esp, 0xc
test eax, eax
je 0x48b05f
push esi
push esi
push esi
push esi
push esi
call fcn.00480fa8
add esp, 0x14
push dword [edi*8 + 0x4d0ccc]
push ebx
push ebp
call fcn.00495f75
add esp, 0xc
test eax, eax
je 0x48b081
push esi
push esi
push esi
push esi
push esi
call fcn.00480fa8
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0049f590
add esp, 0xc
jmp 0x48b0c9
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x48b0c9
cmp ebp, 0xffffffff
je 0x48b0c9
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4d0ccc]
push dword [esi]
call fcn.00485f80
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x49f590
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0048b4f2
xor ebx, ebx
cmp dword [0x4d33b0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x49f666
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x49f746
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4bda88
push edi
call esi
cmp eax, ebx
je 0x49f746
push eax
call fcn.0048b484
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d33b0], eax
call esi
push eax
call fcn.0048b484
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d33b4], eax
call esi
push eax
call fcn.0048b484
mov dword [0x4d33b8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00489100
test eax, eax
pop ecx
pop ecx
je 0x49f634
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00480fa8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x49f666
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0048b484
cmp eax, ebx
pop ecx
mov dword [0x4d33c0], eax
je 0x49f666
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048b484
pop ecx
mov dword [0x4d33bc], eax
mov eax, dword [0x4d33bc]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x49f6eb
cmp dword [0x4d33c0], ecx
je 0x49f6eb
push eax
call fcn.0048b4fb
push dword [0x4d33c0]
mov esi, eax
call fcn.0048b4fb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x49f6eb
cmp edi, ebx
je 0x49f6eb
call esi
cmp eax, ebx
je 0x49f6b8
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49f6b8
test byte [ebp - 0x18], 1
jne 0x49f6eb
lea eax, [ebp - 0x10]
push eax
call fcn.004891af
test eax, eax
pop ecx
je 0x49f6d3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00480fa8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x49f6e2
or dword [ebp + 0x10], 0x200000
jmp 0x49f726
or dword [ebp + 0x10], 0x40000
jmp 0x49f726
mov eax, dword [0x4d33b4]
cmp eax, dword [ebp - 8]
je 0x49f726
push eax
call fcn.0048b4fb
cmp eax, ebx
pop ecx
je 0x49f726
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x49f726
mov eax, dword [0x4d33b8]
cmp eax, dword [ebp - 8]
je 0x49f726
push eax
call fcn.0048b4fb
cmp eax, ebx
pop ecx
je 0x49f726
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d33b0]
call fcn.0048b4fb
cmp eax, ebx
pop ecx
je 0x49f746
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x49f748
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x401daa
push 6
call fcn.0055dd91
add esp, 4
jmp 0x401daf
mov esp, ebp
pop ebp
ret 4

Function at 0x402fde
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x402ffe
call fcn.004031b2
mov dword [ebp - 0xc], esp
push 0x49e2bb
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40302c
push 6
call fcn.0055dd91
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
call dword [0x614ae4]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40304e
push 6
call fcn.0055dd91
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push 0
push 0x11
push dword [ebp - 0x10]
call dword [0x614ae8]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x403082
push 6
call fcn.0055dd91
add esp, 4
push VariantClear
push 0
push 0x59ab7e
push 1
mov ebx, 0x268
call fcn.0055ee80
add esp, 0x10
mov dword [ebp - 0xc], eax
push VariantClear
push 0
push str.www.muzhuzai.net_www.xymusky.com
push 1
mov ebx, 0x198
call fcn.0055ed80
add esp, 0x10
mov dword [ebp - 0x10], eax
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x61421c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4030f0
push ebx
call fcn.0055dd85
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x403100
push ebx
call fcn.0055dd85
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403160
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [0x614aec]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403132
push 6
call fcn.0055dd91
add esp, 4
mov dword [ebp - 0xc], esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x403169
call 0x4031fe
call 0x403344
push 0x61421c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [0x614aec]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4031a4
push 6
call fcn.0055dd91
add esp, 4
mov eax, 0
jmp 0x4031ae
mov esp, ebp
pop ebp
ret
Function at 0x4222e9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.0055eb70
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42232e
push ebx
call fcn.0055dd85
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x422359
push 6
call fcn.0055dd91
add esp, 4
push 0x5b6e56
push dword [ebp - 4]
mov ecx, 2
call fcn.004036b1
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x422379
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42238a
push ebx
call fcn.0055dd85
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x45b4ee
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x45b526
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x45b514
mov al, 1
jmp 0x45b577
cmp dword [ebx + 0x54], ecx
jne 0x45b51d
mov al, 2
jmp 0x45b577
cmp dword [ebx + 0x7c], ecx
jne 0x45b577
mov al, 3
jmp 0x45b577
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x45b53b
mov al, 4
jmp 0x45b577
cmp ecx, 5
jne 0x45b55b
cmp ebx, 0
jne 0x45b549
mov al, 5
jmp 0x45b577
cmp ebx, 1
jne 0x45b552
mov al, 6
jmp 0x45b577
cmp ebx, 2
jne 0x45b55b
mov al, 7
jmp 0x45b577
cmp ecx, 6
jne 0x45b567
cmp ebx, 0
jne 0x45b569
mov al, 8
jmp 0x45b577
cmp ebx, 1
jne 0x45b570
mov al, 9
cmp ebx, 2
jne 0x45b577
mov al, 0xa
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45b78e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x45b841
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]