joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4a44
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d4c0d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047e1bc
lea eax, [ebp - 0x258]
mov edx, 0x4d4c28
call fcn.00406854
mov eax, dword [ebp - 0x258]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4d4be7
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00406640
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d4ad7
sub eax, 4
mov eax, dword [eax]
cmp eax, 9
jl 0x4d4b0c
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406bec
mov eax, dword [ebp - 0x25c]
mov edx, 0x4d4c4c
call fcn.0040c178
test eax, eax
sete al
jmp 0x4d4b0e
xor eax, eax
test al, al
je 0x4d4b37
mov eax, 0x4d4c58
mov edx, dword [ebp - 4]
movzx esi, word [edx + 0xa]
cmp si, 0x100
jae 0x4d4b2f
mov edx, esi
movzx edx, dl
bt dword [eax], edx
jb 0x4d4b33
xor eax, eax
jmp 0x4d4b39
mov al, 1
jmp 0x4d4b39
xor eax, eax
test al, al
je 0x4d4b62
mov eax, 0x4d4c58
mov edx, dword [ebp - 4]
movzx esi, word [edx + 0xc]
cmp si, 0x100
jae 0x4d4b5a
mov edx, esi
movzx edx, dl
bt dword [eax], edx
jb 0x4d4b5e
xor eax, eax
jmp 0x4d4b64
mov al, 1
jmp 0x4d4b64
xor eax, eax
test al, al
je 0x4d4b8d
mov eax, 0x4d4c58
mov edx, dword [ebp - 4]
movzx esi, word [edx + 0xe]
cmp si, 0x100
jae 0x4d4b85
mov edx, esi
movzx edx, dl
bt dword [eax], edx
jb 0x4d4b89
xor eax, eax
jmp 0x4d4b8f
mov al, 1
jmp 0x4d4b8f
xor eax, eax
test al, al
je 0x4d4bcc
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x4d4bcc
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00406bec
mov eax, dword [ebp - 0x260]
call fcn.0040d0d8
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4d4ab8
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4c14
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4d80fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x12], eax
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0xe], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa], eax
call fcn.004d7fd0
lea eax, [ebp - 0x12]
push eax
push 0
push 0x4a
mov eax, dword [0x50ad18]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [esi]
xor edx, edx
mov dword [esi], edx
call fcn.00404098
cmp ebx, 0x6c840001
jne 0x4d814f
call fcn.00411850
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x4d8173
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4d8228
call fcn.004ad7d0
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x4d81cb
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 6]
call fcn.004d8050
mov esi, eax
mov eax, esi
sub ax, 2
je 0x4d81cb
dec eax
sub ax, 2
jb 0x4d81df
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4d8288
call fcn.004ad7d0
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x4d8180
mov edx, 2
movzx eax, word [ebp - 6]
call fcn.004d8050
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 6]
call fcn.004d8050
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d8894
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4d889e
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x4d8954
push 0x4d8988
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409620
mov ebx, eax
test ebx, ebx
je 0x4d893d
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4d893d
test al, 0x10
je 0x4d88ee
mov ebp, 0x2000000
jmp 0x4d88f0
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4d893d
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jle 0x4d893d
cmp ebx, 0xff0
jge 0x4d893d
mov edx, edi
mov eax, esp
call fcn.004d87ac
jmp 0x4d8946
mov eax, edi
mov edx, esi
call fcn.00406448
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d89a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d8a37
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
mov ebx, eax
test ebx, ebx
jle 0x4d8a0b
cmp ebx, 0x104
jge 0x4d8a0b
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00406640
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.004d8894
jmp 0x4d8a1e
mov eax, 0x4d8a50
call fcn.004ad980
mov eax, esi
xor edx, edx
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8a3e
lea eax, [ebp - 0x20c]
call fcn.00406438
ret

Function at 0x4d8cd4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d8da3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4d8538]
call fcn.004d8dcc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d8d7c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4d8dbc
call fcn.0040e184
mov edx, dword [ebp - 8]
mov eax, dword [0x503e38]
mov eax, dword [eax]
call fcn.0047be54
call fcn.004d85a0
call sub.user32.dll_GetFocus
mov edx, dword [0x503e38]
mov edx, dword [edx]
cmp eax, dword [edx + 0x170]
jne 0x4d8d5f
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4d8d66
call sub.user32.dll_WaitMessage
jmp 0x4d8d39
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8d83
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x4de3bc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4de3c4
push ecx
push ebx
xor eax, eax
push ebp
push 0x4de50e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004adf0c
mov edx, dword [ebp - 0x10]
mov eax, 0x50adc4
call fcn.00406448
lea eax, [ebp - 0x14]
mov ecx, dword [0x50adc4]
mov edx, 0x4de528
call fcn.00406914
mov eax, dword [ebp - 0x14]
call fcn.004b2860
mov eax, dword [0x503f00]
cmp byte [eax], 0
je 0x4de41f
mov eax, dword [0x50adc4]
call fcn.004b1f68
lea edx, [ebp - 0x18]
mov eax, dword [0x50adc4]
call fcn.0047e1bc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x4de570
call fcn.00406914
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4de4b5
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.004ab7d4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0040d088
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.004807a8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x68
call fcn.004ab7a4
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x40aa28]
call fcn.0041185c
call fcn.00404a74
lea eax, [ebp - 8]
call fcn.004b3110
cmp dword [ebp - 8], 0
je 0x4de4e6
lea eax, [ebp - 0xc]
mov ecx, 0x4de58c
mov edx, dword [ebp - 4]
call fcn.00406914
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004de364
mov eax, dword [ebp - 0xc]
call fcn.004b3168
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de515
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00406440
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00406440
ret

Function at 0x4e0e2c
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x50b09d], 1
call fcn.004afd44
test al, al
jne 0x4e0e7e
push 5
mov eax, dword [0x503e38]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x503e38]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x503e48]
mov eax, dword [eax + 0x124]
mov cl, 2
xor edx, edx
call fcn.004e0d10
ret

Function at 0x4e4110
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4e4135
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e5e5c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4e5e88
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x4e5e91
call fcn.004e4b7c
mov eax, 0xa
call fcn.00480bac
call fcn.004e4b7c
call fcn.004e5e28
test al, al
jne 0x4e5e66
pop ebx
ret

Function at 0x4e63b4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x5039dc]
cmp dword [eax], 0
je 0x4e645f
mov eax, dword [0x5039dc]
mov eax, dword [eax]
call fcn.00463ce8
test al, al
je 0x4e645f
mov eax, dword [0x5039dc]
mov eax, dword [eax]
cmp byte [eax + 0x1e2], 0
je 0x4e6409
cmp byte [ebx + 0x389], 0
jne 0x4e6409
mov eax, dword [0x503e38]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4e640d
xor eax, eax
jmp 0x4e640f
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x5039dc]
mov eax, dword [eax]
call fcn.0046393c
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x4e645f
test bl, bl
je 0x4e644b
push 5
mov eax, dword [0x5039dc]
mov eax, dword [eax]
call fcn.0046393c
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e645f
push 0
mov eax, dword [0x5039dc]
mov eax, dword [eax]
call fcn.0046393c
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4e6510
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x50b056], 0
push 0x4e65e8
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
push 0x4e6604
push ebx
call fcn.00409620
test eax, eax
je 0x4e659c
lea edx, [esp + 4]
push edx
call eax
push 0x4e662c
push ebx
call fcn.00409620
mov esi, eax
test esi, esi
je 0x4e65a6
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x4e65a6
cmp dword [esp], 0
je 0x4e65a6
call fcn.004acbe8
test al, al
je 0x4e65a6
push 0x4e664c
push ebx
call fcn.00409620
test eax, eax
je 0x4e65a6
push 0x4e6680
push 0x4e66a0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409620
test eax, eax
je 0x4e65a6
mov byte [0x50b056], 1
jmp 0x4e65a6
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
movzx eax, word [esp + 4]
sub ax, 1
jb 0x4e65bf
sub ax, 5
je 0x4e65c8
sub ax, 3
je 0x4e65d1
jmp 0x4e65da
mov byte [0x5034f0], 1
jmp 0x4e65e1
mov byte [0x5034f0], 3
jmp 0x4e65e1
mov byte [0x5034f0], 2
jmp 0x4e65e1
mov byte [0x5034f0], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x4e66bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e672c
mov edx, 0x80000002
xor eax, eax
call fcn.0047fc4c
test eax, eax
jne 0x4e6725
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4e6780
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4e671c
cmp dword [ebp - 0xc], 4
jne 0x4e671c
cmp dword [ebp - 8], 4
jne 0x4e671c
movzx eax, word [ebp - 0x10]
mov word [0x50b06c], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret

Function at 0x4e6928
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e69d7
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x50b068], eax
cmp byte [0x50b055], 0
je 0x4e69d7
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4e69c8
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e69d7
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x50b06c], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x50b06e], al
movzx eax, word [esp + 0x22c]
mov word [0x50b070], ax
jmp 0x4e69d7
cmp eax, 4
jne 0x4e69d7
call fcn.004e66bc
call fcn.004e6798
add esp, 0x230
ret
Function at 0x4f1cf4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4f1ec6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00406584
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x50396c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.0047fc4c
test eax, eax
jne 0x4f1eab
xor eax, eax
push ebp
push 0x4f1ea0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.0048b1d8
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x4f1d85
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x4f1db2
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x4f1dd4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406eb8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x4f1e4a
sub eax, 0xe9
je 0x4f1dee
sub eax, 0x19
je 0x4f1e89
jmp 0x4f1e43
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4f1e05
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x4f1e18
call fcn.00404b68
jmp 0x4f1eab
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4f1e2f
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406584
jmp 0x4f1d79
call fcn.00404b68
jmp 0x4f1eab
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.0048b1d8
lea eax, [ebp - 4]
call fcn.00406eb8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00406584
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.0049c368
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.00489370
inc ebx
jmp 0x4f1d79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1ea7
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1ecd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4f78e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f796c
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4f7954
mov ebx, esi
test ebx, ebx
je 0x4f791a
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004064d4
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4f7988
call fcn.00406914
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x4f7956
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7973
lea eax, [ebp - 8]
call fcn.00406438
ret

Function at 0x4fb6b8
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fb760
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4fb77c
push ebx
push 0x4fb78c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004069f8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403540
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4fb73e
mov eax, dword [0x503e48]
mov eax, dword [eax + 0x1a8]
call fcn.004fb610
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb767
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4fc100
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fc2ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0047f7f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004add90
test al, al
jne 0x4fc16d
xor eax, eax
push ebp
push 0x4fc163
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.004ae280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fc16d
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [0x50b160]
call fcn.004064d4
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4fc19c
mov eax, dword [0x503e48]
mov eax, dword [eax + 0x1a4]
call fcn.004fb610
push 0x80
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x507b50]
push eax
push 0
mov ecx, 0x4fc2fc
mov edx, 0x4fc300
xor eax, eax
call fcn.0040a124
mov dword [ebp - 8], eax
push 0x4fb7d0
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x50b18c], eax
xor eax, eax
push ebp
push 0x4fc2b7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x503e38]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.0047f1c8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4fc31c
call fcn.0040e184
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.0047f0a8
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00406854
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004fb6b8
mov dword [ebp - 0xc], eax
call fcn.004fb794
test al, al
jne 0x4fc297
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4fc275
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc2be
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x4fd628
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4fd8e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x503e38]
mov eax, dword [eax]
mov edx, 0x4fd8fc
call fcn.0047be54
push 5
mov eax, dword [0x503e38]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x4fd8a9
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004e10b8
lea eax, [ebp - 0x10]
call fcn.0047f66c
mov eax, dword [ebp - 0x10]
call fcn.0040dc30
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0047f1c8
mov edx, dword [ebp - 0x14]
mov eax, 0x50b160
call fcn.00406448
call fcn.004fb9c8
lea ecx, [ebp - 0x18]
mov edx, 0x4fd91c
mov eax, dword [0x50b160]
call fcn.0047e2ac
mov edx, dword [ebp - 0x18]
mov eax, 0x50b164
call fcn.00406448
lea ecx, [ebp - 0x1c]
mov edx, 0x4fd934
mov eax, dword [0x50b160]
call fcn.0047e2ac
mov edx, dword [ebp - 0x1c]
mov eax, 0x50b168
call fcn.00406448
push 2
push 0
push 1
mov ecx, dword [0x50b160]
mov dl, 1
mov eax, dword [0x4aa3c0]
call fcn.004aa700
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fd780
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004aa6c0
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004aa698
cmp dword [ebp - 0xc], 0x67734d49
je 0x4fd75b
mov cl, 1
xor edx, edx
mov eax, dword [0x50b168]
call fcn.004ab984
jmp 0x4fd76a
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x50b160]
call fcn.004ab984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd787
mov eax, dword [ebp - 4]
call fcn.00404098
ret