joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f530
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x47f54e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 8
jge 0x47f57c
cmp dword [ebp - 4], 0
jne 0x47f57c
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47f573
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x47f57a
mov dword [ebp - 4], 1
jmp 0x47f545
cmp dword [ebp - 4], 0
jne 0x47f59d
push 0x5ae380
call fcn.0041dc70
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x47f606
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x47f5bc
mov dword [ebp - 0xc], 1
jmp 0x47f5c3
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 4], 0
jne 0x47f5ee
push str._Clipboard_copy_failed_
call fcn.0041dc70
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x47f603
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
push ecx
call fcn.0047f450
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4811a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4811de
cmp dword [ebp + 0x10], 0
je 0x4811de
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4811f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00513540
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x483b50
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
je 0x483b65
mov dword [ebp - 8], 0x5aeab8
jmp 0x483b6c
mov dword [ebp - 8], 0x5aeaf8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x20006
push 0
mov edx, dword [ebp - 0x18]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x483b97
mov eax, 1
jmp 0x483c07
cmp dword [ebp + 8], 0
je 0x483ba6
mov dword [ebp - 0xc], 0x14
jmp 0x483bad
mov dword [ebp - 0xc], 0x14
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x483bc5
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x1c]
jge 0x483bf8
mov eax, dword [ebp - 4]
push eax
call fcn.00483b00
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051f0d0
add esp, 4
jmp 0x483bbc
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x484890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0xc], 0xffffffff
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0050e710
add esp, 0xc
mov dword [ebp - 0x60], 0x44
cmp dword [ebp + 0xc], 0
jne 0x4848e2
mov dword [ebp - 0x34], 0x100
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x24], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x20], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.004851c0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x484982
cmp dword [ebp + 0xc], 0
jne 0x48490c
mov dword [ebp - 8], 1
jmp 0x484913
mov dword [ebp - 8], 0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x484967
cmp dword [ebp + 0xc], 0
jne 0x484951
push 0
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.00538e7d
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484974
push str._unable_to_create_win32_process_
call fcn.0041dc70
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.0051f0d0
add esp, 4
jmp 0x48498f
push str.w32_CreateProcess
call fcn.00402630
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4850b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x65a670], 0
jne 0x4850ec
mov dword [0x65a674], 0x80
mov eax, dword [0x65a674]
shl eax, 1
push eax
call fcn.0051f100
add esp, 4
mov dword [0x65a670], eax
cmp dword [0x65a670], 0
je 0x48516b
mov ecx, dword [0x65a674]
push ecx
mov edx, dword [0x65a670]
push edx
call fcn.00405620
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 8], eax
mov eax, dword [0x65a674]
sub eax, 1
cmp dword [ebp - 8], eax
jl 0x485167
mov ecx, dword [0x65a674]
shl ecx, 1
mov dword [0x65a674], ecx
mov edx, dword [0x65a674]
shl edx, 1
push edx
mov eax, dword [0x65a670]
push eax
call fcn.005202a0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48515c
mov ecx, dword [0x65a670]
push ecx
call fcn.0051f0d0
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [0x65a670], edx
jmp 0x485169
jmp 0x48516b
jmp 0x4850ec
cmp dword [ebp - 8], 0
je 0x4851b0
cmp dword [0x65a670], 0
je 0x4851b0
cmp dword [ebp - 4], 0
je 0x48518c
mov eax, dword [ebp - 4]
push eax
call fcn.0051f0d0
add esp, 4
xor ecx, ecx
jne 0x48517a
push 0xffffffffffffffff
mov edx, dword [0x65a670]
push edx
call fcn.00485230
add esp, 8
mov dword [0x65a66c], eax
mov eax, dword [0x65a66c]
mov dword [ebp - 4], eax
jmp 0x4851b7
mov dword [ebp - 4], str.ERROR
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x485c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6554d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x65a67c], 0
jne 0x485d59
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
push 6
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jge 0x485ceb
push 0
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.00484080
add esp, 8
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x485d5e
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.00485e80
add esp, 8
test eax, eax
jne 0x485d13
push 0
push 0
call fcn.00484080
add esp, 8
jmp 0x485d4c
lea edx, [ebp - 0x108]
push edx
call fcn.0045a8f0
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.00403330
add esp, 4
mov dword [0x65a67c], eax
cmp dword [0x65a67c], 0
jne 0x485d4c
push 0x578d20
call fcn.00402630
add esp, 4
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x65a67c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret
Function at 0x487330
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0
mov dword [0x65a688], 0xffffffff
push 1
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00484210
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48737f
push 0x5af044
call fcn.00402630
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x487446
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
call fcn.004851c0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4873a8
push str.exec_shell
call fcn.00402630
add esp, 4
jmp 0x487446
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0050e710
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x100
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x28], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x24], ecx
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
je 0x48740d
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
xor eax, eax
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x487446
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00485df0
add esp, 4
mov edx, dword [ebp - 0x1c]
mov dword [0x65a688], edx
cmp dword [ebp - 8], 0
je 0x487458
mov eax, dword [ebp - 8]
push eax
call fcn.0051f0d0
add esp, 4
xor ecx, ecx
jne 0x487446
cmp dword [ebp - 4], 0
je 0x48746e
mov edx, dword [ebp - 4]
push edx
call fcn.0051f0d0
add esp, 4
xor eax, eax
jne 0x48745c
mov eax, dword [0x65a688]
mov esp, ebp
pop ebp
ret

Function at 0x4879c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x65a6b8], 0
je 0x4879dd
mov eax, dword [0x65a6b8]
push eax
call fcn.0051f0d0
add esp, 4
cmp dword [0x65a6cc], 0
je 0x4879f5
mov ecx, dword [0x65a6cc]
push ecx
call fcn.0051f0d0
add esp, 4
cmp dword [0x65a6c8], 0
je 0x487a6e
cmp dword [0x65a6c4], 0
je 0x487a3a
push 0
mov edx, dword [0x65a6c4]
push edx
call dword [sym.imp.ole32.dll_CoDisconnectObject]
mov eax, dword [0x65a6c4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x487a33
push 1
mov ecx, dword [ebp - 4]
call fcn.004890d0
mov dword [ebp - 8], eax
jmp 0x487a3a
mov dword [ebp - 8], 0
cmp dword [0x65a6bc], 0
je 0x487a50
mov ecx, dword [0x65a6bc]
push ecx
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
cmp dword [0x65a6c0], 0
je 0x487a68
push 0
mov edx, dword [0x65a6c0]
push edx
call dword [sym.imp.OLEAUT32.dll_GetActiveObject]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [ebp + 8]
push eax
call fcn.0051f710
mov esp, ebp
pop ebp
ret
Function at 0x48a5e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 8
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.004851c0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48a621
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.0051f0d0
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x513250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00512e70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x513282
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x5604b0]
call dword [ebp - 8]
jmp 0x51328c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x5493d6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00548dc1

Function at 0x54d1f0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x54d217
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00522540
add esp, 4
or eax, 0xffffffff
jmp 0x54d219
xor eax, eax
pop ebp
ret
Function at 0x401b75
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, 0x49b5e4
cmp dword [esi], 0
jne 0x401bbb
push 0x644
push 0
call sub.KERNEL32.DLL_WriteFile
mov ecx, eax
test ecx, ecx
jne 0x401b98
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x49b5e0]
mov dword [ecx], eax
mov dword [0x49b5e0], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x401ba7
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x4028ed
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x49b5c0], 0
jne 0x40290a
call fcn.00402201
test al, al
je 0x402912
cmp ebx, 0x7ffffff8
jle 0x40291c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402a70
xor ecx, ecx
push ebp
push 0x402a69
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x49b049], 0
je 0x40293d
push 0x49b5c8
call sub.KERNEL32.DLL_LocalAlloc
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x40294d
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x4029ec
mov eax, ebx
test eax, eax
jns 0x402962
add eax, 3
sar eax, 2
mov edx, dword [0x49b620]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x4029ec
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x40299d
mov eax, ebx
test eax, eax
jns 0x40298c
add eax, 3
sar eax, 2
mov ecx, dword [0x49b620]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4029c3
mov ecx, ebx
test ecx, ecx
jns 0x4029a6
add ecx, 3
sar ecx, 2
mov edi, dword [0x49b620]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x49b5b0]
sub ebx, 4
add dword [0x49b5b4], ebx
call fcn.00404899
jmp 0x402a70
cmp ebx, dword [0x49b618]
jg 0x402a3e
sub dword [0x49b618], ebx
cmp dword [0x49b618], 0xc
jge 0x402a10
add ebx, dword [0x49b618]
xor eax, eax
mov dword [0x49b618], eax
mov eax, dword [0x49b61c]
add dword [0x49b61c], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x49b5b0]
sub ebx, 4
add dword [0x49b5b4], ebx
call fcn.00404899
jmp 0x402a70
mov eax, ebx
call fcn.004027f9
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402a70
cmp byte [0x49b049], 0
je 0x402a68
push 0x49b5c8
call sub.KERNEL32.DLL_TlsGetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402a7d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x49b5c4], eax
cmp byte [0x49b5c0], 0
jne 0x402ab5
call fcn.00402201
test al, al
jne 0x402ab5
mov dword [0x49b5c4], 8
mov dword [ebp - 4], 8
jmp 0x402c16
xor ecx, ecx
push ebp
push 0x402c0f
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x49b049], 0
je 0x402ad6
push 0x49b5c8
call sub.KERNEL32.DLL_LocalAlloc
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402af1
mov dword [0x49b5c4], 9
jmp 0x402be6
dec dword [0x49b5b0]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x49b5b4], eax
test bl, 1
je 0x402b51
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402b21
test edx, 0x80000003
je 0x402b30
mov dword [0x49b5c4], 0xa
jmp 0x402be6
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x402b48
mov dword [0x49b5c4], 0xa
jmp 0x402be6
add ebx, edx
mov esi, eax
call fcn.004023a5
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x49b61c]
jne 0x402b91
sub dword [0x49b61c], ebx
add dword [0x49b618], ebx
cmp dword [0x49b618], 0x3c00
jle 0x402b82
call fcn.00402695
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00404899
jmp 0x402c16
mov edx, dword [eax]
test dl, 2
je 0x402bb4
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402baf
mov dword [0x49b5c4], 0xb
jmp 0x402be6
or dword [eax], 1
jmp 0x402bdd
mov eax, edi
cmp dword [eax + 4], 0
je 0x402bc7
cmp dword [eax], 0
je 0x402bc7
cmp dword [eax + 8], 0xc
jge 0x402bd3
mov dword [0x49b5c4], 0xb
jmp 0x402be6
mov edx, dword [eax + 8]
add ebx, edx
call fcn.004023a5
mov edx, ebx
mov eax, esi
call fcn.0040260d
mov eax, dword [0x49b5c4]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c16
cmp byte [0x49b049], 0
je 0x402c0e
push 0x49b5c8
call sub.KERNEL32.DLL_TlsGetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x404cc1
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x49b634
mov esi, section.DATA
mov edi, 0x49b044
cmp byte [ebx + 0x28], 0
jne 0x404cf0
cmp dword [edi], 0
je 0x404cf0
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x404cdf
cmp dword [0x495004], 0
je 0x404d0a
call fcn.00404ba9
call fcn.00404c35
xor eax, eax
mov dword [0x495004], eax
cmp byte [ebx + 0x28], 2
jne 0x404d1a
cmp dword [esi], 0
jne 0x404d1a
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00404a39
cmp byte [ebx + 0x28], 1
jbe 0x404d2a
cmp dword [esi], 0
je 0x404d4b
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x404d4b
call fcn.00406795
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x404d4b
test eax, eax
je 0x404d4b
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.00404a11
cmp byte [ebx + 0x28], 1
jne 0x404d59
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x404d64
call fcn.00404c05
cmp dword [ebx], 0
jne 0x404d80
cmp dword [0x49b024], 0
je 0x404d78
call dword [0x49b024]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReleaseMutex
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x404d0a
Function at 0x406271
Capabilities:
Delete directory
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x406405
call sub.KERNEL32.DLL_SetThreadContext
mov esi, eax
test esi, esi
je 0x4062d9
push 0x406415
push esi
call sub.KERNEL32.DLL_SetThreadLocale
mov ebx, eax
test ebx, ebx
je 0x4062d9
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x4062d9
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
jmp 0x4063fb
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x406319
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x4063fb
mov eax, dword [ebp - 4]
add eax, 2
call fcn.0040625d
mov esi, eax
cmp byte [esi], 0
je 0x4063fb
lea eax, [esi + 1]
call fcn.0040625d
mov esi, eax
cmp byte [esi], 0
je 0x4063fb
jmp 0x40631f
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SuspendThread
jmp 0x4063de
lea eax, [esi + 1]
call fcn.0040625d
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x4063fb
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SuspendThread
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
cmp esi, 0xffffffff
je 0x4063fb
push esi
call sub.KERNEL32.DLL_RemoveDirectoryA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_TerminateProcess
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x4063fb
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SuspendThread
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_TerminateProcess
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x40633d
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406429
Capabilities:
Set file attributes
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_SetFilePointer
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406659
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x4064ac
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406659
push 0x80000002
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x4064ac
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406675
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
jne 0x406535
xor eax, eax
push ebp
push 0x40652e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406271
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x406513
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406695
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x406513
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406535
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SuspendThread
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SizeofResource
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40664f
cmp byte [ebp - 0xd], 0
jne 0x40657c
cmp byte [ebp - 0x12], 0
je 0x40664f
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406595
dec ebx
cmp byte [ebx], 0x2e
je 0x4065a4
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406594
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40664f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4065e1
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SuspendThread
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_Sleep
mov esi, eax
test esi, esi
jne 0x40664f
cmp byte [ebp - 0xd], 0
je 0x40664f
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SuspendThread
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_Sleep
mov esi, eax
test esi, esi
jne 0x40664f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SuspendThread
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_Sleep
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret