joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47248c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416050]
call fcn.00404bb8
xor eax, eax
push ebp
push 0x4725d0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4da220], 0
jne 0x4724df
mov ecx, dword [0x4db940]
mov dl, 1
mov eax, dword [0x4076c8]
call fcn.0040cb10
call fcn.00403bac
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402df4
mov eax, ebx
call fcn.00404a88
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4725e0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405b6c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404a98
test eax, eax
jle 0x472577
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x472570
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040449c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404484
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408654
test eax, eax
jne 0x472570
mov ebx, 0x15
jmp 0x47257c
mov ebx, 0x10
jmp 0x47257c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4da220]
call fcn.004723e4
mov eax, dword [ebp - 8]
call fcn.004723e4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4725d7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404238
lea eax, [ebp - 0x10]
mov edx, dword [0x416050]
call fcn.00404c88
ret

Function at 0x475dac
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0047584c
test byte [ebx + 0x23d], 4
jne 0x475e41
mov edx, esp
mov eax, ebx
call fcn.00443dd4
push esp
mov eax, ebx
call fcn.0044ab64
push eax
push 0
mov eax, ebx
test eax, eax
je 0x475de1
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x475e12
mov ecx, dword [0x4dbc10]
mov dl, 1
mov eax, dword [0x4720a4]
call fcn.0040cb10
call fcn.00403bac
mov eax, ebx
call fcn.00476380
cmp byte [ebx + 0x57], 0
jne 0x475e48
mov eax, ebx
call fcn.0044ad68
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x475e48
push 0
mov eax, ebx
call fcn.0044ad68
push eax
call sub.user32.dll_ShowWindow
jmp 0x475e48
mov eax, ebx
call fcn.00447ce8
add esp, 0x10
pop ebx
ret
Function at 0x4970f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044b06c
test al, al
je 0x4971ae
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x49718c
cmp word [esi + 0x5f2], 0
je 0x497141
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5f4]
call dword [esi + 0x5f0]
mov al, byte [esi + 0x5e8]
or al, byte [ebp - 9]
jne 0x497163
cmp dword [ebp - 4], 0
jbe 0x49715f
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x497163
xor ebx, ebx
jmp 0x497165
mov bl, 1
test bl, bl
jne 0x4971ae
mov eax, dword [0x4dbda8]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x4971ae
mov eax, dword [0x4dbda8]
mov eax, dword [eax]
call fcn.00463cc4
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x4971ae
cmp byte [esi + 0x588], 0
jne 0x4971ae
mov edx, 0xfffffdf3
mov eax, esi
call fcn.004761b8
cmp eax, 4
jne 0x49711e
mov byte [esi + 0x5e8], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49bb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00422f4c
cmp ebx, dword [ebp - 8]
jge 0x49bbb3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00423398
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00423398
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004233c4
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x49bb79
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x49bbbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00422f4c
cmp ebx, dword [ebp - 8]
jge 0x49bc1f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00423398
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00423398
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004233c4
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x49bbe5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4af89c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4af8d4]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4af8b2
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4af8c1
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4af8d0
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4b0c70
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4dbda8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b0c96
push 0
mov eax, dword [0x4dbda8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4bcff4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046c4
xor eax, eax
push ebp
push 0x4bd0a8
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4bd063
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004046d4
mov ebx, eax
push ebx
push 0x4bd0b4
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x4bd08d
push 1
push 0
push ebx
lea eax, [ebp - 8]
call fcn.004bd718
mov eax, dword [ebp - 8]
call fcn.004046d4
push eax
push 0x4bd0b4
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4bd08d
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
lea eax, [ebp - 0xc]
call fcn.004bd718
mov eax, dword [ebp - 0xc]
call fcn.004046d4
push eax
push 0x4bd0b4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd0af
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404238
ret

Function at 0x4bd718
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp + 4], 1
push esp
push 0xf003f
push 0
push 0x4bd79c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x4bd7e0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4bd77e
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, pe_nt_image_headers32
call fcn.00404484
jmp 0x4bd78a
mov eax, ebx
mov edx, 0x4bd7ec
call fcn.00404268
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x10c
pop ebx
ret

Function at 0x4be0b0
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x4be0c0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4be0d5
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4be1d8
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004be144
mov esi, eax
mov eax, ebx
call fcn.00403420
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4c1418
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046c4
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4c15aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c157a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
mov ebx, eax
mov edx, 0x4c15c0
mov eax, 0x4c15f0
call fcn.0040d7b4
jmp 0x4c1568
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404484
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040903c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004c0450
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004c0450
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404620
je 0x4c154a
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404484
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004c0450
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004c0450
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404620
jne 0x4c155f
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
mov ebx, eax
test ebx, ebx
jne 0x4c14ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c1584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c15b1
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404238
lea eax, [ebp - 4]
call fcn.00404214
ret
Function at 0x4c1618
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004046c4
mov eax, dword [ebp - 8]
call fcn.004046c4
xor eax, eax
push ebp
push 0x4c189b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4c1866
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x134]
push eax
mov ecx, 0x4c18b4
mov edx, 0x4c18c4
mov eax, 0x4c18d0
call fcn.00430c64
jmp 0x4c17ff
cmp edi, dword [ebp - 0x128]
jne 0x4c17ec
call fcn.0040ac28
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b34d4
cmp eax, 0x1f4
jge 0x4c1807
cmp eax, 0xa
jge 0x4c16fa
mov edx, 0xa
sub edx, eax
push edx
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 8]
mov edx, 0x4c1900
call fcn.00404620
jne 0x4c1713
mov eax, dword [ebp - 8]
call fcn.004c1418
jmp 0x4c172b
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 8]
mov edx, 0x4c1918
call fcn.00404620
je 0x4c1753
mov eax, dword [ebp - 8]
mov edx, 0x4c1930
call fcn.00404620
jne 0x4c177e
push 1
push 0
mov eax, dword [0x4dba54]
mov eax, dword [eax]
call fcn.004046d4
push eax
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
push 0x4c1944
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4c1807
mov eax, dword [ebp - 8]
mov edx, 0x4c1954
call fcn.00404620
je 0x4c179c
mov eax, dword [ebp - 8]
mov edx, 0x4c1970
call fcn.00404620
jne 0x4c17c4
push 1
push 0
mov eax, dword [0x4dba74]
mov eax, dword [eax]
call fcn.004046d4
push eax
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
push 0x4c1944
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4c1807
push 1
push 0
mov eax, dword [0x4dba30]
mov eax, dword [eax]
call fcn.004046d4
push eax
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
push 0x4c1944
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4c1807
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4c16ba
push esi
call sub.kernel32.dll_CloseHandle
lea ecx, [ebp - 0x138]
mov edx, 8
mov eax, 0x4c1984
call fcn.00430d00
mov eax, dword [ebp - 0x138]
push eax
lea ecx, [ebp - 0x13c]
mov edx, 2
mov eax, 0x4c19b4
call fcn.00430d00
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404620
jne 0x4c185c
lea edx, [ebp - 0x140]
mov eax, 0x4c19c4
call fcn.004c0450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c1870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c18a2
lea eax, [ebp - 0x140]
mov edx, 4
call fcn.00404238
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404238
ret
Function at 0x4c7760
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x4db860], 0
mov eax, dword [0x4dc004]
cmp dword [eax], 2
jne 0x4c7939
mov eax, dword [0x4dbb34]
cmp dword [eax], 5
jl 0x4c7939
call fcn.004c48fc
test al, al
jne 0x4c7791
call fcn.004c4908
call fcn.004c48f4
mov dword [0x4db868], eax
push 0x4c793c
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db82c], eax
cmp dword [0x4db82c], 0
jne 0x4c77ec
mov edx, 0x8000
mov eax, 0x4c7950
call fcn.0040e710
mov dword [0x4db864], eax
mov eax, dword [0x4db864]
mov dword [0x4db868], eax
push 0x4c793c
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db82c], eax
cmp dword [0x4db82c], 0
je 0x4c7934
push 0x4c795c
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db830], eax
cmp dword [0x4db830], 0
je 0x4c7934
push 0x4c7968
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db834], eax
cmp dword [0x4db834], 0
je 0x4c7934
mov byte [0x4db860], 1
push 0x4c7978
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db838], eax
push 0x4c7984
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db83c], eax
push 0x4c7990
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db840], eax
push 0x4c79a0
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db844], eax
push 0x4c79b0
mov eax, dword [0x4db868]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db848], eax
mov edx, 0x8000
mov eax, 0x4c79c8
call fcn.0040e710
mov dword [0x4db86c], eax
cmp dword [0x4db86c], 0
je 0x4c7939
push 0x4c79d8
mov eax, dword [0x4db86c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db84c], eax
push 0x4c79f4
mov eax, dword [0x4db86c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db850], eax
push 0x4c7a14
mov eax, dword [0x4db86c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db854], eax
push 0x4c7a30
mov eax, dword [0x4db86c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db858], eax
push 0x4c7a48
mov eax, dword [0x4db86c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4db85c], eax
ret
call fcn.004c76e0
ret
Function at 0x4ca06c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4ca194
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c9f58
mov eax, dword [esi]
call fcn.004052f8
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4c34a0]
call fcn.004054b4
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004029b8
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004029b8
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004052f8
mov dword [ebp - 0xc], eax
mov eax, dword [0x4dbf0c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.004c3734
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00402df4
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004052f8
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.004c3664
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004c3660
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004c372c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca19b
lea eax, [ebp - 8]
mov edx, dword [0x4c34a0]
call fcn.004054c0
ret

Function at 0x4cb8c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
xor edx, edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cb9dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4014
push 0xe5265400
push 0
call fcn.00429ee8
cmp eax, 0xd539de
jne 0x4cb920
mov eax, 0x4cb9f0
call fcn.0042de6c
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
push eax
mov ecx, 0x4cba00
mov edx, 0x4cba10
mov eax, 0x4cba1c
call fcn.00430c64
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404484
mov eax, dword [ebp - 0x110]
mov edx, ebx
call fcn.0040d73c
lea ecx, [ebp - 0x114]
mov edx, 9
mov eax, 0x4cba48
call fcn.00430d00
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x118]
mov edx, 2
mov eax, 0x4cba78
call fcn.00430d00
mov edx, dword [ebp - 0x118]
pop eax
call fcn.00404620
jne 0x4cb9be
lea edx, [ebp - 0x11c]
mov eax, 0x4cba88
call fcn.00408474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb9e3
lea eax, [ebp - 0x11c]
mov edx, 5
call fcn.00404238
ret
Function at 0x11a8473
Capabilities:
Execute anti-debugging instructions

Disassembly:
push di
push dword [esp + 3]
lea esp, [esp + 2]
jmp 0x11a84eb
push ecx
rol eax, 0x15
sub esp, 0x15
push word [esp + 0x13]
lea esp, [esp + 9]
jmp 0x11a852d
lea esp, [esp + 8]
stc
push eax
cld
bswap eax
mov eax, 0xd1ce6b11
jmp 0x11a84d2
mov dl, cl
xchg dx, ax
mov eax, edi
not eax
lea edi, [ebx + edi]
mov dl, 0x2c
jmp 0x11a855e
mov dword [esp + 7], esi
mov ax, 0x36dd
xchg byte [esp + 6], ah
mov al, byte [esp + 0x20]
mov dword [esp + 0x25], edx
bswap edi
jmp 0x11a84fb
lea esp, [esp + 2]
mov dword [esp + 0xa], edi
lea edi, [eax + ecx]
pushal
xchg dword [esp + 0x1b], eax
push dword [esp + 0x19]
jmp 0x11a8511
rcl ax, 0xa
xchg al, dl
mov edx, 0x87d35383
xchg di, dx
bsr di, si
xchg dx, di
jmp 0x11a85ac
btc dx, ax
mov ax, cx
cld
lea eax, [ebp*4]
rol dl, 6
lea edi, [eax*4]
jmp 0x11a8543
xchg edi, eax
mov di, bx
lea edx, [edx + ebp]
not di
dec dh
seto dl
jmp 0x11a85d4
mov edx, eax
dec dh
xchg edi, eax
mov edx, ecx
xchg dh, dl
mov edi, ecx
jmp 0x11a8579
mov al, 0xd1
lea edx, [ecx + 0xf]
rdtsc
not edx
mov eax, 0x1d50a939
xchg dl, al
jmp 0x11a858f
xchg al, ah
mov di, word [esp]
bsr di, si
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x11a85fa
mov dx, word [esp]
mov eax, dword [esp]
cmc
stc
mov dh, byte [esp]
bswap edi
jmp 0x11a85be
mov dx, 0xb214
pop word [esp]
add ax, 0x5c0e
clc
jmp 0x11a860c
mov ax, word [esp]
not dx
bswap edi
xchg dh, al
inc dl
sub esp, 0xe
jmp 0x11a85e4
xchg dword [esp + 7], eax
rdtsc
not dx
not ah
pop word [esp + 7]
mov dl, 0x76
jmp 0x11a8baa
xchg edx, edi
bswap edx
mov edi, dword [esp]
lea edx, [ecx + edi]
inc di
lea esp, [esp + 1]
jmp 0x11a8702
mov dword [esp + 5], edi
mov ax, word [esp + 0xa]
pop dword [esp]
pop word [esp + 3]
pop edi
jmp 0x11a8634
inc edi
std
xchg byte [esp + 6], al
neg dl
mov ax, word [esp + 6]
mov dword [esp + 2], esp
jmp 0x11a864a
lea esp, [esp]
pushal
mov di, 0x50da
call fcn.011a868c
bswap edx
call fcn.011a86e6
iretd
mov edx, ecx
mov edi, esi
bswap eax
mov dl, byte [esp]
mov dx, 0x459
lea esp, [esp]
jmp 0x11a86b2
xchg byte [esp + 8], al
mov dx, word [esp + 3]
rdtsc
push word [esp + 9]
bsr edi, esi
neg eax
jmp 0x11a8663
push word [esp + 2]
mov dl, byte [esp + 5]
push dword [esp + 5]
mov dh, 0x3c
mov di, word [esp + 7]
mov ax, cx
jmp 0x11a876e
xchg dl, al
mov dx, 0x7a04
bsr di, bp
lea eax, reloc.WINMM.dll_midiStreamOut
mov edi, 0xad3cdeb9
mov al, 0xc
jmp 0x11a8841
pop dword [esp]
push word [esp + 1]
lea esp, [esp + 4]
xchg dh, al
lea eax, [ecx + edx]
seto dh
jmp 0x11a8adc