joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cae4
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x52fe80
call fcn.004ea774
sub esp, 0x37c
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.004e30ef
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 0x388]
push str._s.
push eax
call fcn.004ec039
add esp, 0xc
lea eax, [ebp - 0x388]
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.004e31b2
test eax, eax
je 0x44cbe5
mov esi, str._s_s
lea ecx, [ebp - 0x2c]
call fcn.004e33d2
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
call fcn.004e3399
test eax, eax
jne 0x44cbdb
lea eax, [ebp + 8]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004e35ca
push 0xc8
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00505f08
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.004eb9e0
and byte [ebp - 4], 0
pop ecx
pop ecx
lea ecx, [ebp + 8]
call fcn.00505ad8
mov eax, dword [ebp - 0x2c]
push 0x10
lea ecx, [ebp - 0x2c]
call dword [eax + 0x38]
test eax, eax
lea eax, [ebp - 0xf4]
push eax
push edi
push esi
je 0x44cbbf
lea eax, [ebp - 0x284]
push eax
call fcn.004ec039
lea eax, [ebp - 0x284]
push eax
call fcn.0044cae4
add esp, 0x14
jmp 0x44cbdb
lea eax, [ebp - 0x1bc]
push eax
call fcn.004ec039
add esp, 0x10
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x10], 0
jne 0x44cb38
lea ecx, [ebp - 0x2c]
call fcn.004e3168
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x44cbfc
xor esi, esi
jmp 0x44cbff
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004e312c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44d61c
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x74], edi
je 0x44d65c
call fcn.0044df71
test eax, eax
je 0x44d662
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x44d9d2
push edi
push edi
call fcn.004ed21f
add esp, 0x18
cmp eax, edi
mov dword [esi + 0x90], eax
je 0x44d65c
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
pop esi
leave
ret
mov eax, dword [esi + 0x98]
cmp eax, edi
je 0x44d65c
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x98]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 4]
push edi
neg edx
push edx
mov eax, dword [esi + 0x98]
push dword [ebp - 8]
mov ecx, dword [eax]
push dword [ebp - 4]
push edi
push dword [esi + 0x50]
push dword [esi + 0x4c]
push edi
push edi
push dword [esi + 0x78]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x44d65c
push edi
push edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
pop eax
jmp 0x44d65e
Function at 0x44d6bf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.00520100
push dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x44d768
call fcn.00520100
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x44d768
call fcn.00520100
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x44d768
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x44d764
test ebx, ebx
je 0x44d764
push edi
push eax
push ebx
call fcn.004eabd0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push edi
push esi
call fcn.0044d1d0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop ebx
jmp 0x44d76a
xor edi, edi
jmp 0x44d758
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x4524a9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 8], ecx
call fcn.00455f71
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 4], eax
ja 0x45259c
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
mov edi, SysReAllocString
push str..htm
push edi
call fcn.004525a6
test eax, eax
jne 0x45259c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x210]
push str._shellopencommand
push eax
call esi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.004525a6
test eax, eax
jne 0x45259c
lea eax, [ebp - 0x210]
push str.__1_
push eax
call fcn.004ecc68
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x452579
lea eax, [ebp - 0x210]
push 0x57ef78
push eax
call fcn.004ecc68
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x452579
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x211]
jmp 0x45257b
mov byte [edi], bl
push 0x57d704
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4525a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4525ff
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x455936
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x53053e
call fcn.004ea774
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0050584d
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.0050584d
mov eax, dword [edi + 0x20]
lea ecx, [esi + 0x40]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.0050584d
mov eax, dword [edi + 0x44]
add edi, 0x74
mov dword [esi + 0x44], eax
mov eax, dword [edi - 0x2c]
mov dword [esi + 0x48], eax
mov eax, dword [edi - 0x28]
mov dword [esi + 0x4c], eax
mov eax, dword [edi - 0x24]
mov dword [esi + 0x50], eax
mov eax, dword [edi - 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [edi - 0x1c]
mov dword [esi + 0x58], eax
mov eax, dword [edi - 0x18]
mov dword [esi + 0x5c], eax
mov eax, dword [edi - 0x14]
mov dword [esi + 0x60], eax
mov eax, dword [edi - 0x10]
mov dword [esi + 0x64], eax
mov eax, dword [edi - 0xc]
mov dword [esi + 0x68], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x6c], eax
mov eax, dword [edi - 4]
push edi
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 2
mov dword [esi + 0x70], eax
call fcn.0050584d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x46dfef
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
call fcn.00505a63
push dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov esi, 0x1000
push esi
push esi
mov dword [ebp - 4], esi
call fcn.00505f08
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, 0x5913bc
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
mov dword [ebp - 8], eax
jge 0x46e04e
push dword [ebp + 8]
add dword [ebp - 4], esi
mov ecx, dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 4]
call fcn.00505f08
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
jmp 0x46e027
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00505f57
mov eax, dword [esi]
cmp dword [eax - 8], 0
je 0x46e08f
mov eax, dword [ebp - 4]
lea ecx, [eax - 1]
cmp dword [ebp - 8], ecx
jl 0x46e08f
push dword [ebp + 8]
add eax, eax
mov ecx, esi
mov dword [ebp - 4], eax
push eax
push eax
call fcn.00505f08
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov dword [ebp - 8], eax
push 0xffffffffffffffff
jmp 0x46e053
mov eax, dword [esi]
xor ecx, ecx
pop edi
pop esi
cmp dword [eax - 8], ecx
pop ebx
setne cl
mov eax, ecx
leave
ret

Function at 0x46e600
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x532a54
call fcn.004ea774
sub esp, 0x418
mov eax, dword [0x58c61c]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
call fcn.004a8ba0
mov edx, dword [eax]
push 0x14
mov esi, str.System
push str.WT_NotiCount
push esi
mov ecx, eax
call dword [edx + 0xa4]
mov ebx, eax
call fcn.004a8ba0
mov edx, dword [eax]
push 0
push str.WT_NotiCurNum
push esi
mov ecx, eax
call dword [edx + 0xa4]
test ebx, ebx
mov esi, eax
jle 0x46e71b
mov dword [ebp - 0x1c], ebx
Function at 0x4794e1
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4dc
push edi
push 0x90
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.004ea940
add esp, 0xc
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47951f
xor eax, eax
jmp 0x47964c
push dword [ebp + 8]
lea eax, [ebp - 0x3d8]
push eax
call fcn.004eb9e0
lea eax, [ebp - 0x3d8]
push 0x5c
push eax
call fcn.004ed444
add esp, 0x10
test eax, eax
je 0x479547
and byte [eax + 1], 0
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004eb9e0
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004eb9f0
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004793a7
add esp, 0x18
test eax, eax
je 0x47962b
push 0x104
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.004ea940
add esp, 0xc
cmp dword [ebp + 0x10], 1
jne 0x479605
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004eb9e0
lea eax, [ebp - 0x194]
push 0x57db40
push eax
call fcn.004eb9f0
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004eb9f0
lea eax, [ebp - 0x194]
push 0x582c80
push eax
call fcn.004eb9f0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004eb9f0
add esp, 0x28
jmp 0x47961a
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004eabd0
add esp, 0xc
lea eax, [ebp - 0x194]
mov ecx, esi
push eax
push dword [esi + 8]
call fcn.0050442b
lea eax, [ebp - 0x2d4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47954b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
pop esi
pop edi
leave
ret
Function at 0x4995ad
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x536c34
call fcn.004ea774
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 0x5cc
call fcn.00509ccf
xor edi, edi
cmp eax, edi
je 0x4995df
cmp dword [esi + 0x864], edi
je 0x4995df
push edi
mov ecx, eax
call fcn.00509fa2
mov eax, dword [esi + 0x528]
push str.CERT
lea ecx, [ebp - 0x10]
mov dword [eax + 0x9e9], 1
call fcn.00505b46
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [eax - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042e2d1
pop ecx
mov ebx, dword [eax]
mov eax, dword [esi + 0x5e0]
push edi
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.00505f08
push eax
push ebx
push 0xb
push dword [ebp - 0x14]
call fcn.004b2d75
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00505ad8
mov eax, dword [esi + 0x528]
push dword [eax + 0x9e9]
call fcn.004b2882
push dword [esi + 0x1c]
mov edi, eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x499710
push 5
push 0x3e9
mov ecx, esi
call fcn.00509ccf
mov ecx, eax
call fcn.00509fa2
push 5
push 0x454
mov ecx, esi
call fcn.00509ccf
mov ecx, eax
call fcn.00509fa2
test edi, edi
je 0x4996af
push 0x455
mov ecx, esi
call fcn.00509ccf
mov ecx, eax
call fcn.0050a00b
mov ecx, esi
call fcn.004998ae
jmp 0x499710
mov ecx, esi
call fcn.0049a159
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 0x1c]
je 0x499710
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, esi
call fcn.0050a00b
push 0
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00505ad8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x49972b
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x536c50
call fcn.004ea774
sub esp, 0xc
push esi
push edi
mov esi, ecx
push 0x5cc
call fcn.00509ccf
xor edi, edi
cmp eax, edi
je 0x49975d
cmp dword [esi + 0x864], edi
je 0x49975d
push 5
mov ecx, eax
call fcn.00509fa2
mov eax, dword [esi + 0x528]
push ebx
push 0x5834ac
lea ecx, [ebp - 0x10]
mov dword [eax + 0x9e9], edi
call fcn.00505b46
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [eax - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042e2d1
pop ecx
mov ebx, dword [eax]
mov eax, dword [esi + 0x5e0]
push edi
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.00505f08
push eax
push ebx
push 0xb
push dword [ebp - 0x14]
call fcn.004b2d75
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00505ad8
mov eax, dword [esi + 0x528]
push dword [eax + 0x9e9]
call fcn.004b2882
test eax, eax
je 0x4997fc
push 0x455
mov ecx, esi
call fcn.00509ccf
mov ecx, eax
call fcn.0050a00b
push 0
push 1
push 0x28
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.004998ae
jmp 0x49985d
mov ecx, esi
call fcn.0049a159
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 0x1c]
je 0x49985d
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, esi
call fcn.0050a00b
push 0
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [esi + 0x860], 0
push 5
pop edi
pop ebx
jne 0x49986c
xor edi, edi
push edi
push 0x3e9
mov ecx, esi
call fcn.00509ccf
mov ecx, eax
call fcn.00509fa2
push edi
push 0x454
mov ecx, esi
call fcn.00509ccf
mov ecx, eax
call fcn.00509fa2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00505ad8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x49bd0c
Capabilities:
Delete file

Disassembly:
mov eax, 0x536ff0
call fcn.004ea774
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x534], ebx
je 0x49be04
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004eb40f
pop ecx
lea edi, [esi + 0x524]
mov ecx, edi
call fcn.00505a63
mov dword [ebp - 0x14], 5
call fcn.004eb41c
push 0xa
cdq
pop ecx
idiv ecx
mov ecx, edi
mov al, byte [edx + str.0123456789]
push eax
call fcn.00505edb
dec dword [ebp - 0x14]
jne 0x49bd4d
push str.authcode.bmp
lea ecx, [ebp - 0x10]
call fcn.00505b46
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 4], ebx
call fcn.0050584d
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.0050584d
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.0049bfe4
push 0x2010
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
push dword [ebp - 0x10]
mov dword [esi + 0x5b8], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5913bc
push 0x3eb
mov ecx, esi
call fcn.00509ccf
mov ecx, eax
call fcn.00509e78
lea eax, [ebp - 0x28]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x28]
push ebx
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00505ad8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4a2ede
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov ebx, ecx
push eax
call fcn.00501e39
push 0
lea ecx, [ebp - 4]
call fcn.00501e4c
mov esi, dword [eax + 0x14]
push 0
lea ecx, [ebp - 4]
add esi, 0x76c
call fcn.00501e4c
mov edi, dword [eax + 0x10]
push 0
lea ecx, [ebp - 4]
inc edi
call fcn.00501e4c
imul esi, esi, 0x64
add esi, edi
mov eax, dword [eax + 0xc]
imul esi, esi, 0x64
mov edx, dword [ebp + 8]
lea ecx, [ebx + 0xf1]
add eax, esi
test edx, edx
mov dword [ecx], 1
jne 0x4a2f3f
and dword [ecx], edx
mov edx, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4a2f48
mov ecx, eax
mov dword [ebx + 0xc7], ecx
lea ecx, [ebx + 0xcb]
mov dword [ebx + 0xc3], edx
call fcn.0046ee69
and dword [ebx + 0xe8], 0
push str.DataDown.Log
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4aa2ec
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, 0x538a60
call fcn.004ea774
sub esp, 0x114
push ebx
push esi
push edi
mov edi, 0x80a1
push edi
mov esi, ecx
push 5
call fcn.004ab849
cmp al, 0x59
je 0x4aa51f
push edi
push 0xc
mov ecx, esi
call fcn.004ab849
cmp al, 0x30
je 0x4aa51f
mov eax, dword [0x58c61c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
mov ecx, esi
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.004a9e86
mov edi, eax
cmp edi, 5
jne 0x4aa440
push 0x80b0
lea ecx, [ebp - 0x10]
call fcn.0050af9e
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x80ae
push eax
call fcn.00501adc
add esp, 0xc
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.00513fc3
push str.VirusScan.dll
lea ecx, [ebp - 0x1c]
call fcn.00505b46
mov byte [ebp - 4], 2
call fcn.00520100
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x120]
push 0x104
push ecx
push dword [eax + 0x68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x120]
lea ecx, [ebp + 0xc]
push eax
call fcn.00505b46
push 0x5c
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.00501721
inc eax
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005016a9
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.00505c11
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00505ad8
lea eax, [ebp + 0xc]
push str.VirusScan.new
push eax
lea eax, [ebp + 8]
push eax
call fcn.00505d6d
push dword [ebp + 8]
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 4
mov ecx, esi
call fcn.004a9e86
lea ecx, [ebp + 8]
mov edi, eax
mov byte [ebp - 4], 3
call fcn.00505ad8
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00505ad8
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00505ad8
mov eax, edi
sub eax, ebx
je 0x4aa48a
sub eax, 3
je 0x4aa459
dec eax
jne 0x4aa4f6
push 0x80ad
jmp 0x4aa45e
push 0x80a9
lea ecx, [ebp - 0x10]
call fcn.0050af9e
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x80a8
push eax
call fcn.00501adc
add esp, 0xc
push ebx
push ebx
push dword [ebp - 0x14]
call fcn.00513fc3
push ebx
call fcn.004ed5e7
push 0x80af
lea ecx, [ebp - 0x10]
call fcn.0050af9e
lea eax, [ebp + 8]
push eax
call fcn.00501e39
lea eax, [ebp + 0xc]
push str._Y__m__d__H:_M:_S
push eax
lea ecx, [ebp + 8]
call fcn.00501ed2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
push ebx
call fcn.005012ce
mov ecx, dword [esi + 0x1c]
cmp ecx, ebx
je 0x4aa4d6
push ebx
push str.error.log
push dword [ebp - 0x10]
call fcn.004433b2
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x80b1
push eax
call fcn.00501adc
add esp, 0xc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00505ad8
cmp edi, 3
je 0x4aa47a
cmp edi, 4
je 0x4aa47a
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00505ad8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00505ad8
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8