joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d124
Capabilities:
Create process on windows
Create process suspended
Get common file path
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd84
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x274], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058d8
xor eax, eax
push ebp
push 0x49d36f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x218]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x218]
push eax
call sub.shlwapi.dll_PathAddBackslashW
push 0x49d380
lea eax, [ebp - 0x218]
push eax
call sub.shlwapi.dll_PathAppendW
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
call fcn.00405b6c
mov eax, dword [ebp - 0x274]
lea ecx, [ebp - 0x270]
mov edx, 1
call fcn.0040a1e8
mov eax, dword [ebp - 0x270]
mov edx, 0x49d39c
call fcn.00405830
je 0x49d1da
lea eax, [ebp - 4]
mov edx, 0x49d3ac
call fcn.00405d04
movzx eax, byte [0x49d3b0]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x49d3c0
mov eax, 0x49d3e8
call fcn.00412544
xor eax, eax
push ebp
push 0x49d32a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
lea eax, [ebp - 0x278]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00405af0
mov ecx, dword [ebp - 0x278]
mov dl, 1
mov eax, dword [0x41ebb0]
call fcn.00424198
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0040597c
mov esi, eax
mov word [ebp - 0xe], 0xfeff
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, ebx
call fcn.00423ee4
mov eax, esi
call fcn.0040cee4
mov ecx, eax
add ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00423ee4
mov eax, ebx
call fcn.00403c94
push 0x49e0d4
lea eax, [ebp - 0x27c]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00405af0
push dword [ebp - 0x27c]
push 0x49e158
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405ea8
lea eax, [ebp - 0x25c]
xor ecx, ecx
mov edx, 0x44
call fcn.004035a0
mov dword [ebp - 0x25c], 0x44
mov dword [ebp - 0x230], 1
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040597c
call fcn.0040d258
push eax
push 0
call sub.kernel32.dll_CreateProcessW
push 0x1388
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x268]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d334
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d376
lea eax, [ebp - 0x27c]
mov edx, 2
call fcn.004058e8
lea eax, [ebp - 0x274]
mov edx, 2
call fcn.00405538
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058e8
ret
Function at 0x49e15c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49e1fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x49e218
call fcn.00405944
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004035a0
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040597c
call fcn.0040d258
push eax
push 0
call sub.kernel32.dll_CreateProcessW
push 0x1388
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e205
lea eax, [ebp - 4]
call fcn.004058e0
ret

Function at 0x49e444
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004058d8
xor eax, eax
push ebp
push 0x49e54f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xf003f
cmp byte [ebp - 5], 0
je 0x49e483
or ebx, 0x100
mov ecx, ebx
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042f030
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.0042f0c8
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042f130
test al, al
je 0x49e4b7
push 0
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegDeleteTreeW
mov eax, ebx
call fcn.00403c94
xor ebx, ebx
cmp byte [ebp - 5], 0
je 0x49e4cb
mov ebx, pe_nt_image_headers32
mov eax, dword [ebp - 4]
test eax, eax
je 0x49e4e8
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x49e4e8
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004050d4
cmp word [eax], 0x5c
jne 0x49e51a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00405b6c
mov eax, dword [ebp - 0x10]
mov ecx, 0x3e8
mov edx, 2
call fcn.0040a23c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405b58
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e556
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405538
lea eax, [ebp - 4]
call fcn.004058e0
ret
Function at 0x49e55c
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xfffffda0
mov ebx, edx
push eax
lea eax, [esp + 0x58]
push eax
call sub.kernel32.dll_lstrcpyW
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.004035a0
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.004035a0
mov dword [esp], 0x44
mov dword [esp + 0x2c], 1
test bl, bl
je 0x49e5aa
mov word [esp + 0x30], 0
jmp 0x49e5b1
mov word [esp + 0x30], 0xa
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x74]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test bl, bl
je 0x49e5e6
push 0xea60
mov eax, dword [esp + 0x48]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [esp + 0x44]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp + 0x48]
push eax
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_Sleep
add esp, 0x260
pop ebx
ret

Function at 0x49e60c
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push ecx
mov eax, 0x49e6a4
mov dl, 1
call fcn.0049e55c
push 0
call sub.kernel32.dll_Sleep
mov eax, 0x49e6d0
mov dl, 1
call fcn.0049e55c
push 0
push 0x49e714
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
je 0x49e69f
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 1
push 0x590
push ebx
call sub.user32.dll_PostMessageW
push 0
push 0
push 0x5b4
push ebx
call sub.user32.dll_PostMessageW
test esi, esi
je 0x49e69f
push 0x1388
push esi
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x49e699
mov eax, 0x49e730
mov dl, 1
call fcn.0049e55c
push esi
call sub.kernel32.dll_CloseHandle
pop edx
pop esi
pop ebx
ret

Function at 0x49e62e
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push ecx
mov eax, 0x49e6a4
mov dl, 1
call fcn.0049e55c
push 0
call sub.kernel32.dll_Sleep
mov eax, 0x49e6d0
mov dl, 1
call fcn.0049e55c
push 0
push 0x49e714
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
je 0x49e69f
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push 1
push 0x590
push ebx
call sub.user32.dll_PostMessageW
push 0
push 0
push 0x5b4
push ebx
call sub.user32.dll_PostMessageW
test esi, esi
je 0x49e69f
push 0x1388
push esi
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x49e699
mov eax, 0x49e730
mov dl, 1
call fcn.0049e55c
push esi
call sub.kernel32.dll_CloseHandle
pop edx
pop esi
pop ebx
ret
Function at 0x49e7cc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x49e8b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042f030
mov ebx, eax
xor ecx, ecx
mov edx, 0x49e8cc
mov eax, ebx
call fcn.0042f130
test al, al
je 0x49e830
lea ecx, [ebp - 4]
mov edx, 0x49e914
mov eax, ebx
call fcn.0042f884
mov eax, dword [ebp - 4]
mov edx, 0x49e938
call fcn.00406094
jne 0x49e830
push 0
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegDeleteTreeW
mov eax, ebx
call fcn.00403c94
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042f030
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0042f0c8
mov edx, 0x49e8cc
xor ecx, ecx
mov eax, ebx
call fcn.0042f130
test al, al
je 0x49e891
lea ecx, [ebp - 8]
mov edx, 0x49e914
mov eax, ebx
call fcn.0042f884
mov eax, dword [ebp - 8]
mov edx, 0x49e938
call fcn.00406094
jne 0x49e891
push 0
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegDeleteTreeW
mov eax, ebx
call fcn.00403c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e8ba
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058e8
ret

Function at 0x4a2588
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a26b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042efec
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, 0x4a26d0
mov eax, dword [ebp - 4]
call fcn.0042f130
test al, al
je 0x4a2614
xor eax, eax
push ebp
push 0x4a260a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x4a2708
mov eax, dword [ebp - 4]
call fcn.0042f884
mov eax, dword [ebp - 8]
mov edx, 0x4a2734
call fcn.00406094
jne 0x4a2600
mov edx, 0x4a274c
mov eax, dword [ebp - 4]
call fcn.0042f5a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2614
mov eax, dword [ebp - 4]
call fcn.00403c94
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042efec
mov ebx, eax
mov cl, 1
mov edx, 0x4a2778
mov eax, ebx
ret
call fcn.0042f130
mov edx, 0x4a27e8
mov eax, ebx
call fcn.0042fa38
test al, al
je 0x4a2654
mov edx, 0x4a27e8
mov eax, ebx
call fcn.0042f5a4
mov eax, ebx
call fcn.00403c94
mov cl, 1
mov edx, 0x4a2814
mov eax, 0x80000001
call fcn.0049e444
mov cl, 1
mov edx, 0x4a2814
mov eax, 0x80000002
call fcn.0049e444
mov cl, 1
mov edx, 0x4a28ac
mov eax, 0x80000001
call fcn.0049e444
mov cl, 1
mov edx, 0x4a28ac
mov eax, 0x80000002
call fcn.0049e444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a26bc
lea eax, [ebp - 8]
call fcn.004058e0
ret
Function at 0x4a47f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058d8
xor eax, eax
push ebp
push 0x4a48ad
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.ole32.dll_CoInitialize
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004035a0
mov dword [ebp - 0x40], 0x3c
test bl, bl
je 0x4a4848
mov eax, 0x4a48bc
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x44]
mov eax, dword [0x4c681c]
mov eax, dword [eax]
call fcn.0049abd0
mov eax, dword [ebp - 0x44]
call fcn.0040597c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.0040597c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0xa
mov dword [ebp - 0x3c], 0x40
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x4a488d
mov ebx, dword [ebp - 8]
jmp 0x4a488f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a48b4
lea eax, [ebp - 0x44]
call fcn.004058e0
lea eax, [ebp - 4]
call fcn.004058e0
ret

Function at 0x4a49b8
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x4a49c8
call sub.user32.dll_FindWindowW
ret

Function at 0x4a49e4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058d8
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x4a4b20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov ecx, 0x1b5
mov edx, 0x800
call fcn.00405458
mov dword [esi], 1
mov eax, ebx
call fcn.004053ec
mov edx, dword [esi]
mov byte [eax + edx - 1], 0
inc dword [esi]
cmp dword [esi], 0x801
jne 0x4a4a21
push 0
push 0
push 0
push 0
push 0x4a4b30
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a4a59
call fcn.0041293c
xor eax, eax
push ebp
push 0x4a4b03
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a4a92
call fcn.0041293c
xor eax, eax
push ebp
push 0x4a4ae5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi], eax
push esi
push 0x800
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x4a4abf
call fcn.0041293c
mov edx, dword [esi]
inc edx
mov eax, ebx
mov ecx, 0x1b5
call fcn.00405458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4aec
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x4a4ccc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4a4d43
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4c681c]
mov eax, dword [eax]
call fcn.0049abd0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040cc44
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4a4d5c
call fcn.00405dc4
push 0xa
push 0
push 0x4a4d7c
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4d4a
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058e8
ret

Function at 0x4a8700
Capabilities:
Find taskbar

Disassembly:
cmp dword [0x4cc248], 0
je 0x4a8725
push 0xffffffffffffffec
push 0
push 0x4a872c
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x400000
jg 0x4a8728
xor eax, eax
ret
mov al, 1
ret

Function at 0x4a870b
Capabilities:
Find taskbar

Disassembly:
cmp dword [0x4cc248], 0
je 0x4a8725
push 0xffffffffffffffec
push 0
push 0x4a872c
call sub.user32.dll_FindWindowW
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x400000
jg 0x4a8728
xor eax, eax
ret
mov al, 1
ret

Function at 0x4ad7c4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058d8
xor eax, eax
push ebp
push 0x4ad840
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc8
lea eax, [ebp - 0x196]
push eax
mov eax, dword [ebp - 4]
call fcn.0040597c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, ebx
ret
mov edx, 0xc8
call fcn.00405c6c
push 0
push 0xc8
mov eax, dword [ebx]
call fcn.0040597c
push eax
lea eax, [ebp - 0x196]
push eax
call sub.shlwapi.dll_SHLoadIndirectString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad847
lea eax, [ebp - 4]
call fcn.004058e0
ret
Function at 0x4b3528
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405364
xor eax, eax
push ebp
push 0x4b35ff
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4b3570
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4b3570
lea eax, [ebp - 4]
mov cx, 0x1b5
mov edx, dword [ebp - 4]
call fcn.00405104
test eax, eax
je 0x4b3579
sub eax, 4
mov eax, dword [eax]
push 0
push 0
lea edx, [ebp - 8]
push edx
push 0
push 1
push eax
mov eax, dword [ebp - 4]
push eax
call sub.crypt32.dll_CryptStringToBinaryA
mov eax, dword [ebp - 8]
push eax
mov eax, ebx
mov ecx, 1
mov edx, dword [0x40a260]
call fcn.004070c4
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4b35c9
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4b35c9
lea eax, [ebp - 4]
mov cx, 0x1b5
mov edx, dword [ebp - 4]
call fcn.00405104
test eax, eax
je 0x4b35d2
sub eax, 4
mov eax, dword [eax]
push 0
push 0
lea edx, [ebp - 8]
push edx
mov edx, dword [ebx]
push edx
push 1
push eax
mov eax, dword [ebp - 4]
push eax
call sub.crypt32.dll_CryptStringToBinaryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3606
lea eax, [ebp - 4]
call fcn.00404f24
ret
Function at 0x4b3980
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4b3ae6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004a4784
test al, al
je 0x4b39b4
push 0x4b3af4
push 0x80000001
call sub.advapi32.dll_RegDeleteTreeW
lea edx, [ebp - 8]
mov ebx, dword [esi + 0x388]
mov eax, ebx
call fcn.0047845c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040bdd8
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00478494
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042f030
mov ebx, eax
call fcn.004a4784
test al, al
je 0x4b3a01
mov edx, 0x80000002
mov eax, ebx
call fcn.0042f0c8
mov byte [ebx + 0xc], 0
mov cl, 1
mov edx, 0x4b3b3c
mov eax, ebx
call fcn.0042f130
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x388]
call fcn.0047845c
lea eax, [ebp - 0xc]
mov edx, 0x4b3b84
call fcn.00405d04
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.0042f76c
mov eax, ebx
call fcn.00403c94
push 0
call sub.kernel32.dll_Sleep
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042f030
mov ebx, eax
call fcn.004a4784
test al, al
je 0x4b3a70
mov edx, 0x80000002
mov eax, ebx
call fcn.0042f0c8
mov edx, 0x4b3b3c
mov cl, 1
mov eax, ebx
call fcn.0042f130
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, ebx
call fcn.0042f884
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x388]
call fcn.0047845c
mov edx, dword [ebp - 0x14]
pop eax
call fcn.00406094
je 0x4b3aac
call fcn.00410a64
mov eax, ebx
call fcn.00403c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3aed
lea eax, [ebp - 0x14]
call fcn.004058e0
lea eax, [ebp - 0x10]
call fcn.004058e0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004058e8
lea eax, [ebp - 4]
call fcn.004058e0
ret
Function at 0x4b42e4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0x100], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058d8
xor eax, eax
push ebp
push 0x4b4509
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c64c8]
mov eax, dword [eax]
call fcn.0040597c
push eax
call sub.kernel32.dll_LoadLibraryW
call fcn.004a9058
lea eax, [ebp - 0xf5]
xor ecx, ecx
mov edx, 0x64
call fcn.004035a0
lea eax, [ebp - 0xf5]
push eax
mov eax, dword [0x4c6690]
mov eax, dword [eax + 0xc]
call eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x100]
lea edx, [ebp - 0xf5]
mov ecx, 0x65
push 0
call fcn.0040521c
mov eax, dword [ebp - 0x100]
mov ecx, 0x20
mov edx, 1
call fcn.0040a218
mov edx, dword [ebp - 0xfc]
lea eax, [ebp - 8]
call fcn.00405b0c
push 0x4b4518
push 0x80000001
call sub.advapi32.dll_RegDeleteTreeW
movzx eax, byte [0x4b4554]
push eax
lea eax, [ebp - 0x104]
push eax
xor ecx, ecx
mov edx, 0x4b4564
mov eax, dword [ebp - 4]
call fcn.00412544
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0xc]
mov ecx, 0x1b5
call fcn.00405b34
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004b3528
xor edx, edx
lea eax, [ebp - 0x90]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx + edx]
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x80
jne 0x4b43f9
mov ecx, 0x20006
mov dl, 1
mov eax, dword [0x42ee80]
call fcn.0042f030
mov ebx, eax
mov cl, 1
mov edx, 0x4b4590
mov eax, ebx
call fcn.0042f130
mov ecx, dword [ebp - 8]
mov edx, 0x4b45d8
mov eax, ebx
call fcn.0042f76c
push 0x80
lea ecx, [ebp - 0x90]
mov edx, 0x4b45fc
mov eax, ebx
call fcn.0042f948
mov eax, ebx
call fcn.00403c94
push 0
push 0x4b461c
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
je 0x4b4483
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0x400
push ebx
call sub.user32.dll_PostMessageW
jmp 0x4b44b1
push 0x40
push 0x4b4638
lea edx, [ebp - 0x108]
mov eax, 0x4b4660
call fcn.004a8854
mov eax, dword [ebp - 0x108]
call fcn.0040597c
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_MessageBoxW
push 0
call sub.kernel32.dll_ExitProcess
Function at 0x4bfa54
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bfbfc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4bfab8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4bfaab
call fcn.0041293c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bfbd9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfc03
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004058e8
lea eax, [ebp - 4]
call fcn.004058e0
ret

Function at 0x4bfdcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058d8
xor eax, eax
push ebp
push 0x4bfe5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 8
mov ebx, 0x4c6478
lea eax, [ebp - 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
call fcn.00405dc4
mov eax, dword [ebp - 0xc]
call fcn.0040597c
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405a9c
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
call fcn.0040597c
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
add ebx, 4
dec esi
jne 0x4bfe00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfe61
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004058e8
ret