joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4950e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497bac
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 0x4b7de4
mov word [ebp - 0x1d], 0x2e45
mov dword [ebp - 0x22], 0x4f4c5058
mov dword [ebp - 0x26], 0x45495c73
mov word [ebp - 0x34], 0x7372
mov dword [ebp - 0x3a], 0x746e6572
mov dword [ebp - 0x4c], 0x6f736f72
mov dword [ebp - 0x2b], 0x74615020
mov dword [ebp - 0x51], 0x694d5c45
mov word [ebp - 0x31], 0x6e6f
mov word [ebp - 0x42], 0x6f64
mov word [ebp - 0x2e], 0x7041
mov dword [ebp - 0x47], 0x69575c74
mov byte [ebp - 0x4d], 0x63
mov word [ebp - 0x53], 0x5241
mov byte [ebp - 0x48], 0x66
mov dword [ebp - 0x40], 0x435c7377
mov word [ebp - 0x36], 0x6556
mov word [ebp - 0x3c], 0x7275
mov byte [ebp - 0x2c], 0x70
mov byte [ebp - 0x1e], 0x52
mov dword [ebp - 0x58], 0x54464f53
mov dword [ebp - 0x1b], 0x455845
mov byte [ebp - 0x32], 0x69
mov byte [ebp - 0x27], 0x68
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x54], 0x57
mov byte [ebp - 0x2f], 0x5c
call fcn.0040bf20
push ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
mov ecx, esp
push eax
call fcn.0040bf20
mov edx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00494440
add esp, 8
test al, al
jne 0x495325
push ecx
lea eax, [ebp - 0x84]
mov word [ebp - 0x89], 0x45
mov ecx, esp
mov dword [ebp - 0x8e], 0x452e4552
push eax
mov word [ebp - 0x93], 0x5845
mov byte [ebp - 0x8a], 0x58
mov word [ebp - 0x90], 0x4f4c
mov byte [ebp - 0x94], 0x49
mov byte [ebp - 0x91], 0x50
mov word [ebp - 0x6a], 0x6235
mov dword [ebp - 0x71], 0x3932622d
mov word [ebp - 0x67], 0x3233
mov dword [ebp - 0x83], 0x65353039
mov dword [ebp - 0x64], 0x31326433
mov word [ebp - 0x73], 0x6534
mov word [ebp - 0x5f], 0x7d
mov word [ebp - 0x7f], 0x3336
mov word [ebp - 0x76], 0x342d
mov word [ebp - 0x6d], 0x2d63
mov byte [ebp - 0x84], 0x7b
mov word [ebp - 0x79], 0x6231
mov byte [ebp - 0x77], 0x66
mov word [ebp - 0x7c], 0x2d36
mov byte [ebp - 0x7d], 0x62
mov byte [ebp - 0x68], 0x37
mov byte [ebp - 0x6b], 0x36
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x60], 0x61
mov byte [ebp - 0x74], 0x39
mov byte [ebp - 0x65], 0x64
mov dword [ebp - 0x98], 0
call fcn.0040bf20
lea ecx, [ebp - 0x98]
call fcn.004945a0
add esp, 4
push 0x4b7e58
lea edx, [ebp - 0x98]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xa0]
call fcn.00408ae0
add esp, 4
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x9c]
call fcn.00408ae0
add esp, 4
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004092a0
lea ecx, [ebp - 0x9c]
call fcn.0040c260
lea ecx, [ebp - 0xa0]
call fcn.0040c260
lea ecx, [ebp - 0x98]
call fcn.0040c260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x495340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497be8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x40], ecx
call fcn.0040c560
mov ecx, eax
test ecx, ecx
jne 0x495385
push 0x80004005
call fcn.0040c2a0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x49539a
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x49539c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], 0
call fcn.004942b0
push ecx
test eax, eax
mov dword [ebp - 0x2e], 0x656c676f
push edi
push ecx
setne bh
mov dword [ebp - 0x26], 0x656d6f
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2a], 0x72684320
mov ecx, esp
mov word [ebp - 0x30], 0x6f47
xor bl, bl
mov dword [ebp - 0x1c], 0x6f726843
push eax
mov word [ebp - 0x17], 0x65
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x35], bl
call fcn.0040bf20
mov dl, bl
mov cl, bl
call fcn.00494d40
mov bl, al
add esp, 0xc
test bl, bl
jne 0x4954d5
push ecx
push edi
push ecx
mov byte [ebp - 0x35], al
mov ecx, esp
lea eax, [ebp - 0x30]
mov bl, 1
push eax
call fcn.0040bf20
mov cl, byte [ebp - 0x35]
mov dl, bl
call fcn.00494d40
mov bl, al
add esp, 0xc
test bl, bl
jne 0x4954d5
test bh, bh
je 0x49545b
push ecx
push edi
push ecx
lea eax, [ebp - 0x30]
mov byte [ebp - 0x35], 1
mov ecx, esp
push eax
call fcn.0040bf20
mov cl, byte [ebp - 0x35]
mov dl, bl
call fcn.00494d40
mov bl, al
add esp, 0xc
test bl, bl
jne 0x4954d5
push ecx
push edi
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
xor bl, bl
push eax
mov byte [ebp - 0x35], bl
call fcn.0040bf20
mov dl, bl
mov cl, bl
call fcn.00494d40
mov bl, al
add esp, 0xc
test bl, bl
jne 0x4954d5
push ecx
push edi
push ecx
mov byte [ebp - 0x35], al
mov ecx, esp
lea eax, [ebp - 0x1c]
mov bl, 1
push eax
call fcn.0040bf20
mov cl, byte [ebp - 0x35]
mov dl, bl
call fcn.00494d40
mov bl, al
add esp, 0xc
test bl, bl
jne 0x4954d5
test bh, bh
je 0x4954cc
push ecx
push edi
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
mov bh, 1
call fcn.0040bf20
mov dl, bl
mov cl, bh
call fcn.00494d40
mov bl, al
add esp, 0xc
test bl, bl
jne 0x4954d5
mov ecx, edi
call fcn.00494820
mov bl, al
mov eax, dword [ebp - 0x40]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov byte [eax], 0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x495513
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x495511
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x495513
call edx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x495c70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497c88
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
xor bl, bl
call fcn.00495540
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x495d0f
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x495d0c
push dword [ebp - 0x14]
push 0x4b7e5c
push edi
call fcn.0040ae40
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x495d0c
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x495cfd
mov byte [esi], al
mov bl, 1
mov eax, dword [ebp - 0x14]
jmp 0x495d11
cmp eax, 6
jne 0x495d07
mov byte [esi], 1
mov bl, 1
mov eax, dword [ebp - 0x14]
jmp 0x495d11
mov eax, dword [ebp - 0x14]
xor bl, bl
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x495d4c
mov eax, dword [edx]
push edx
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x495d48
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x495d4c
mov ecx, eax
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x499dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2068
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 3
mov dword [ebp - 4], 0
xor bl, bl
call fcn.0043d2c6
call fcn.0043d2d7
push dword [ebp + 8]
mov edi, eax
push 0x2712
push edi
call fcn.00441b08
push 0x499d60
push 0x4e2b
push edi
call fcn.00441b08
push esi
push 0x2711
push edi
call fcn.00441b08
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1a], 0x302e31
push eax
push 0x2722
push edi
mov dword [ebp - 0x24], 0x2d6c7275
mov dword [ebp - 0x28], 0x6362696c
mov dword [ebp - 0x20], 0x6e656761
mov word [ebp - 0x1c], 0x2f74
call fcn.00441b08
push edi
call fcn.0043d320
test eax, eax
movzx ebx, bl
mov ecx, 1
push edi
cmove ebx, ecx
call fcn.0043d331
mov dword [ebp - 4], 0xffffffff
add esp, 0x3c
mov edx, dword [ebp + 8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x499eb9
mov eax, dword [edx]
push edx
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x499eb5
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x499eb9
mov ecx, eax
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x49dd80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x17], 0x68637261
mov word [ebp - 0x12], 0x6179
mov word [ebp - 0x1c], 0x7375
mov word [ebp - 0xc], 0x6f63
mov word [ebp - 0xf], 0x6f6f
mov word [ebp - 0xa], 0x6d
mov word [ebp - 0x19], 0x6573
mov byte [ebp - 0x10], 0x68
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0xd], 0x2e
mov byte [ebp - 0x1a], 0x2e
cmp dword [eax - 0xc], 0
push ebx
jl 0x49de17
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.0041ff98
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x49de14
mov eax, dword [ebp + 8]
sub ecx, eax
js 0x49de17
cmp dword [eax - 0xc], 0
jl 0x49de17
push str.param1
push eax
call fcn.0041ff98
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x49de14
mov eax, dword [ebp + 8]
sub ecx, eax
js 0x49de17
mov bl, 1
jmp 0x49de19
mov eax, dword [ebp + 8]
xor bl, bl
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49de5b
mov eax, dword [edx]
push esi
push edx
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x49de6c
mov ecx, dword [eax + 4]
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0041553e
mov esp, ebp
pop ebp
ret
mov ecx, eax
call esi
jmp 0x49de5a
Function at 0x49f960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], ecx
push 0
push eax
xor bl, bl
call fcn.004179d0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edx, str.tm.dat
lea ecx, [ebp - 0x108]
call fcn.00410f10
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x49fa16
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0041553e
mov esp, ebp
pop ebp
ret

Function at 0x49fa30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov edi, ecx
push 0
push eax
xor bl, bl
call fcn.004179d0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edx, str.tm.dat
lea ecx, [ebp - 0x108]
call fcn.00410f10
push 0
push 0
push 3
push 0
push 0
push accept
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x49fadd
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041553e
mov esp, ebp
pop ebp
ret

Function at 0x4a1000
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 0x20
call dword [0x4cc7bc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4a107b
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4a1072
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x4a16d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x44], 0x10
cmp ecx, 2
mov dword [ebp - 0x40], ecx
mov eax, 0x84
mov dword [ebp - 0x38], edx
cmove eax, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x1f], 0x6c6c64
mov dword [ebp - 0x24], 0x32336970
mov word [ebp - 0x27], 0x7664
mov byte [ebp - 0x20], 0x2e
mov byte [ebp - 0x28], 0x41
mov byte [ebp - 0x25], 0x61
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4a1795
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xf], 0x61745365
push ecx
push eax
mov dword [ebp - 0xb], 0x737574
mov word [ebp - 0x11], 0x6369
mov word [ebp - 0x17], 0x7465
mov word [ebp - 0x14], 0x7265
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x76
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cc7a8], eax
test eax, eax
je 0x4a1795
lea ecx, [ebp - 0x44]
push ecx
push dword [0x4cc794]
call eax
test eax, eax
jne 0x4a17a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004a17c0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret

Function at 0x4a17c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov word [ebp - 0x1b], 0x7265
push eax
lea eax, [ebp - 0x1c]
mov word [ebp - 0x15], 0x32
push eax
mov word [ebp - 0x18], 0x6c65
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x1c], 0x6b
mov dword [ebp - 0xb], 0x746e65
mov dword [ebp - 0xf], 0x76457465
mov byte [ebp - 0x10], 0x53
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cc7ac], eax
test eax, eax
je 0x4a1839
push dword [0x4cc790]
call eax
xor edx, edx
push 0
push 0
push 0
lea ecx, [edx + 1]
call fcn.004a16d0
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x4a1900
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x4bf070]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x10], 0x128
push ebx
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a1975
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x4a196e
nop word [eax + eax]
cmp dword [esp + 0x18], edi
je 0x4a1969
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x4a1950
jmp 0x4a196e
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x4a1d60
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5c]
mov word [ebp - 0x1c], 0x4e20
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x19], 0x75435c5c
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x29], 0x74666f73
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x21], 0x776f646e
push eax
lea eax, [ebp - 0x38]
mov word [ebp - 0x31], 0x5c45
push eax
push reloc.WS2_32.dll_bind
mov word [ebp - 0x2e], 0x694d
mov dword [ebp - 0x11], 0x72655674
mov dword [ebp - 0x25], 0x69575c5c
mov word [ebp - 0x34], 0x4157
mov dword [ebp - 0x15], 0x6e657272
mov dword [ebp - 0xd], 0x6e6f6973
mov word [ebp - 0x2b], 0x6f72
mov word [ebp - 0x37], 0x464f
mov byte [ebp - 0x1a], 0x54
mov byte [ebp - 0x2f], 0x5c
mov byte [ebp - 0x35], 0x54
mov byte [ebp - 0x38], 0x53
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 9], 0
mov byte [ebp - 0x2c], 0x63
mov word [ebp - 0x4e], 0x726f
mov dword [ebp - 0x4b], 0x69737265
mov word [ebp - 0x46], 0x4e6e
mov word [ebp - 0x51], 0x614d
mov word [ebp - 0x54], 0x6e65
mov word [ebp - 0x43], 0x626d
mov word [ebp - 0x57], 0x7275
mov byte [ebp - 0x58], 0x43
mov byte [ebp - 0x4f], 0x6a
mov byte [ebp - 0x52], 0x74
mov word [ebp - 0x40], 0x72
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x4c], 0x56
mov byte [ebp - 0x44], 0x75
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x47], 0x6f
mov dword [ebp - 0x64], 4
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x4a3000
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a37db
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4bf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
mov byte [0x4cc785], 1
push 0
push eax
call fcn.004179d0
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 4
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004179d0
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0041e719
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
push str.sc_delete
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x21c], 0
call fcn.0040bf20
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], 0
push ecx
mov edx, eax
lea ecx, [ebp - 0x21c]
call fcn.00408ae0
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp - 0x220]
add esp, 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a312c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4a312a
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4a312c
call ebx
push dword [ebp - 0x21c]
call fcn.0041f591
mov ecx, dword [ebp - 0x21c]
add esp, 4
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x4a3170
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4a316c
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4a3170
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041553e
mov esp, ebp
pop ebp
ret
Function at 0x401830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov cl, 0xd4
aam 0xc6
inc ebp
mov dl, 0xd3
aam 0xc6
inc ebp
mov dl, 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004015b2
loope 0x40182e
adc dword [ebp + 0x50a8458d], ebx
call fcn.004015c2
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00401577
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4018a0
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
invalid

Function at 0x401c89
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne fcn.00401c89
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x401ca7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x401d05
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax - 0x77], al
jge 0x401ce4
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401cec
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401cf5
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401cff
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401ce1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x401c6b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x401d52
dec eax
je 0x401d49
sub eax, 3
je 0x401d40
mov dword [ebp - 4], 0x40
jmp 0x401d6f
mov dword [ebp - 4], 4
jmp 0x401d55
mov dword [ebp - 4], 0x20
jmp 0x401d55
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x401da1
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x401d21
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004015b2
fcom dword [edx + 0x75ffe7c5]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x401dad
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret