joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d140
Capabilities:
Create thread
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512060
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x1ac], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x1b0], eax
cmp dword [edi + 0x1ac], 0
jne 0x46d1ba
mov eax, dword [edi]
push str.Unable_to_create__EWSControlSync
push 0
push edi
call dword [eax + 8]
add esp, 0xc
cmp dword [edi + 0x1b0], 0
jne 0x46d1d3
mov eax, dword [edi]
push str.Unable_to_create_handshake_event
push 0
push edi
call dword [eax + 8]
add esp, 0xc
mov dword [ebp - 0x14], 0x5f
lea esi, [edi + 0x238]
push 0x60
push 0
push esi
call fcn.004b8570
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [edi]
push esi
push str.InfoPush::Initialize
push str._s___Found_computer_name___s_
push 4
push edi
call dword [eax + 8]
mov dword [ebp - 0x14], 0x5f
lea esi, [edi + 0x1d8]
push 0x60
push 0
push esi
call fcn.004b8570
mov eax, dword [edi]
push esi
push str._s___Found_domain___s_InfoPush::Initialize
push 4
push edi
call dword [eax + 8]
add esp, 0x30
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x46d264
push str.GetComputerNameExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46d25d
lea ecx, [ebp - 0x14]
push ecx
push esi
push 2
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [esi], 0
jne 0x46d287
movq xmm0, qword [str.DfltDomain]
movq qword [esi], xmm0
mov ax, word [0x51e90c]
mov word [esi + 8], ax
mov al, byte [0x51e90e]
mov byte [esi + 0xa], al
mov eax, dword [edi]
push esi
push str.InfoPush::Initialize
push str._s___Found_dns_domain___s_
push 4
push edi
call dword [eax + 8]
add esp, 0x14
mov dword [edi + 0x298], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [edi + 0x29c], eax
push dword [ebp + 8]
mov ecx, edi
call fcn.0046d790
push dword [edi + 0x1c8]
mov eax, dword [edi + 0x1c4]
call eax
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push 0
push edi
push 0x46ff90
push 0
push 0
call fcn.004c63bb
add esp, 0x1c
test eax, eax
je 0x46d2f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46fbb0
Capabilities:
Delete directory
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512480
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
push str.ReloadSharedRegAndRestartRecording_
push 4
push edi
call dword [eax + 8]
add esp, 0xc
cmp dword [edi + 0x1b4], 0
je 0x46fc3d
mov dword [ebp - 4], 0
push dword [edi + 0x1b8]
mov eax, dword [edi + 0x1b4]
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x46fc3d
mov ecx, dword [edi + 0x198]
test ecx, ecx
je 0x46fd4d
cmp dword [edi + 0x74], 0
je 0x46fd43
mov dword [edi + 0x74], 0
mov edx, 1
mov ecx, dword [edi + 0x1a8]
xor eax, eax
lock cmpxchg dword [ecx], edx
push 0xffffffffffffffff
mov eax, dword [edi + 0x1a4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov ecx, dword [edi + 0x198]
mov edx, dword [ecx]
push 0x23145623
call dword [edx + 0x18]
test esi, esi
jne 0x46fd00
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x60]
add eax, 0x1e50
push eax
call fcn.0048b3d0
add esp, 4
test eax, eax
je 0x46fcbd
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x60]
add eax, 0x1e50
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea esi, [edi + 0x8f]
push 1
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x60]
add eax, 0x1e50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x46fd00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
push eax
push esi
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x60]
add eax, 0x1d4c
push eax
push str.Move_file_to_the_new_directory__s_from__s_failed_with__d.
push 0
push edi
call dword [ecx + 8]
add esp, 0x18
mov ecx, dword [edi + 0x198]
mov edx, dword [ecx]
push 0x23145623
call dword [edx + 0x20]
mov ecx, dword [edi + 0x198]
mov edx, dword [ecx]
push 0x23145623
call dword [edx + 0x14]
xor edx, edx
mov ecx, dword [edi + 0x1a8]
mov eax, 1
lock cmpxchg dword [ecx], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
push 0x23145623
call dword [eax + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fd60
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5124a0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov edi, dword [ebp + 8]
test edi, edi
je 0x46fe6e
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x46fe6e
mov dword [ebp - 4], 0
mov eax, dword [ecx]
push esi
push edi
push str.RunSetupExe_Start__s__s
push 4
push ecx
call dword [eax + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.004b8570
add esp, 0x20
mov dword [ebp - 0x6c], 0x44
xor eax, eax
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push 0
push 0x20
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push esi
push str.RunSetupExe_End___d_
push 4
push eax
call dword [ecx + 8]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x470280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x470297
call fcn.00470190
mov eax, 1
pop ebp
ret 4
push ecx
push 0
push 0x46ffa0
call fcn.004c632b
add esp, 0xc
mov eax, 1
pop ebp
ret 4

Function at 0x4712f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512710
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.004c60d9
add esp, 4
call fcn.00471d00
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, dword [ebp - 0x14]
mov dword [0x591ab4], eax
call fcn.00472020
mov dword [0x591abc], 1
push esi
push 0
push 0x471490
call fcn.004c632b
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4713e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512730
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x591a9c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
push 0
push 0x4719c0
call fcn.004c632b
add esp, 0xc
mov eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4741f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512cc0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
mov eax, dword [edi]
call dword [eax + 0x18]
cmp dword [ebp + 8], 0
je 0x474258
push 0
push 0x474020
push 0
push 0x65
push dword [0x591ad8]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.00473ec0
mov ebx, eax
push 1
mov ecx, edi
call fcn.00474330
mov esi, eax
test esi, esi
je 0x474280
mov dword [esi + 4], ebx
mov dword [esi], 1
nop dword [eax]
cmp dword [0x591bfc], 0
je 0x4742b8
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4742b8
cmp eax, 0xffffffff
je 0x4742b8
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x474280
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4742ca
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi], 0
mov dword [esi + 4], 0
push esi
mov ecx, edi
call fcn.00474150
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x476920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x47692c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00476940
Function at 0x478290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
nop dword [eax]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x47831f
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004b86d0
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x4782ef
sub eax, esi
jmp 0x4782f1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x4782e0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x478310
sub eax, esi
jmp 0x478312
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x478301
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x4783d4
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x47834c
xor eax, eax
jmp 0x478398
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x478369
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0047bb30
jmp 0x478379
cmp eax, 2
jne 0x478382
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00476920
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.004b86d0
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x4783c0
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x4783d4
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4782a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47d700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513360
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x18], ebx
or esi, 0xffffffff
mov dword [ebp - 0x14], esi
mov ecx, 0x591d1c
call fcn.00480dd0
mov dword [ebp - 4], ebx
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x32
jge 0x47d783
cmp esi, 0xffffffff
jne 0x47d788
test edi, edi
jle 0x47d75e
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
mov dword [ebp - 0x1c], edi
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call fcn.0047da10
mov esi, eax
mov dword [ebp - 0x14], esi
jmp 0x47d748
cmp esi, 0xffffffff
je 0x47d7ff
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edi, edi
mov dword [ebp - 0x20], edi
cmp edi, 0xa
jae 0x47d7cc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x104]
push 0
lea ecx, [ebp - 0x24]
push ecx
push dword [eax - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47d7f4
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, 1
mov dword [ebp - 0x18], ebx
cmp dword [ebp + 0xc], 0
je 0x47d7d9
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00485e90
add esp, 4
jmp 0x47d802
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x47d797
mov edi, dword [ebp + 8]
push 0x104
push 0
push edi
call fcn.004b8570
add esp, 0xc
lea ecx, [edi + 0x104]
call fcn.00489080
lea ecx, [edi + 0x108]
call fcn.00489080
mov ecx, 0x591d1c
call fcn.004812d0
mov edi, eax
test edi, edi
je 0x47d86a
push edi
mov ecx, 0x591d1c
call fcn.00481380
mov dword [ebp - 0x24], eax
mov ecx, edi
call fcn.0042e490
test eax, eax
je 0x47d883
mov ecx, edi
call fcn.0042e490
cmp dword [ebp + 8], eax
jne 0x47d883
push 0
push edi
mov ecx, 0x591d1c
call fcn.004815c0
mov eax, dword [ebp + 8]
test eax, eax
je 0x47d87a
push 1
mov ecx, eax
call fcn.0047d680
mov dword [ebp - 4], 0xffffffff
jmp 0x47d8ac
mov edi, dword [ebp - 0x24]
jmp 0x47d834
mov ecx, 0x591d1c
call fcn.00481550
cmp esi, 0xffffffff
je 0x47d8c2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ed40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x410], eax
test edi, edi
je 0x47ee52
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x47ee52
test ebx, ebx
je 0x47ee52
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004b8570
lea ecx, [ebp - 0x404]
add esp, 0xc
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x47eda0
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47ee52
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x1c]
sub eax, 1
je 0x47edef
sub eax, 3
je 0x47ee46
sub eax, 3
jne 0x47edf8
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x408]
push eax
push ebx
lea eax, [ebp + 0x1c]
push eax
push 0
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x40c]
test eax, eax
mov ecx, 1
mov ebx, 0
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4566
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x408], 4
jmp 0x47edf8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4566
mov esp, ebp
pop ebp
ret
Function at 0x47ffd0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48001a
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x480ed0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51381f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 8]
push 0x10
test esi, esi
je 0x480f46
push 8
push esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x480f31
push str.____DataEvent::_Failed_to_allocate_memory_n_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x58c988
lea eax, [ebp + 8]
mov dword [ebp + 8], 1
push eax
call fcn.004b84f4
mov dword [edx + 4], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
jmp 0x480f6b
call fcn.004a4577
mov edx, eax
add esp, 4
test edx, edx
je 0x480f1c
mov dword [edx + 4], 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov dword [edx + 0xc], ecx
mov dword [edx], 0x524950
mov dword [edx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x481c80
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 8]
mov dword [esi + 0x4c], 0x67452301
push eax
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov dword [esi + 0x5c], 0xc3d2e1f0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b8570
xor eax, eax
add esp, 0xc
mov word [esi + 0x48], ax
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], eax
pop esi
ret
Function at 0x485090
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51403b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0x524fa8
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 1
mov eax, dword [edi + 0x18]
test eax, eax
je 0x48510b
cmp dword [edi + 0xc], 0
je 0x48510b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x485111
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x18]
test eax, eax
je 0x48511b
push eax
call esi
mov byte [ebp - 4], 1
nop
cmp dword [edi + 0x2c], 0
je 0x485147
lea ecx, [edi + 0x1c]
call fcn.00486c30
mov ebx, dword [eax]
lea ecx, [edi + 0x1c]
call fcn.00486c70
test ebx, ebx
je 0x485120
push ebx
call fcn.004a4580
add esp, 4
jmp 0x485120
mov dword [ebp - 4], 0
jmp 0x485160
lea eax, [edi + 0x264]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call esi
lea eax, [edi + 0x24c]
push eax
call esi
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 0x1c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 4
mov ecx, esi
call fcn.00486ae0
mov dword [ebp - 4], 0xffffffff
push dword [esi]
call fcn.004722b0
add esp, 4
mov dword [esi], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485200
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514060
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x234], esi
lea eax, [esi + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
push 0
call fcn.004c60d9
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
push eax
call fcn.004c5f8a
push eax
lea eax, [esi + 0x44]
push eax
push 0x104
lea eax, [ebp - 0x118]
push eax
call fcn.004d2013
push 0x2e
lea eax, [ebp - 0x118]
push eax
call fcn.004b8c50
add esp, 0x20
mov esi, eax
mov dword [ebp - 0x224], esi
test esi, esi
jne 0x4852bf
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4852a8
sub ecx, edx
lea esi, [ebp - 0x118]
add esi, ecx
mov dword [ebp - 0x224], esi
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov eax, esi
lea ecx, [ebp - 0x118]
sub eax, ecx
lea edi, [ebp - 0x21c]
add edi, eax
mov dword [ebp - 0x230], edi
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc ebx
mov dword [ebp - 0x22c], ebx
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x118]
mov byte [ebp + eax - 0x21c], cl
lea eax, [eax + 1]
test cl, cl
jne 0x4852f0
push ebx
push str._02d
push edi
call fcn.00486d30
add esp, 0xc
mov edx, esi
mov al, byte [edx]
inc edx
test al, al
jne 0x485316
sub edx, esi
lea edi, [ebp - 0x21c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x485326
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x21c]
push eax
cmp ebx, 0x63
jge 0x485370
mov esi, dword [ebp - 0x220]
lea eax, [esi + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x48539b
mov esi, dword [ebp - 0x224]
mov edi, dword [ebp - 0x230]
jmp 0x4852e0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call edi
mov esi, dword [ebp - 0x220]
add esi, 0x148
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push esi
call edi
mov esi, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
jmp 0x4853c8
lea eax, [esi + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a4566
mov esp, ebp
pop ebp
ret