joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471e34
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x471e3c
push ecx
push ebx
push esi
mov esi, 0x5ee7e0
xor eax, eax
push ebp
push 0x472111
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov byte [0x5eea8c], 1
mov eax, dword [0x5eeae8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x5eeaec]
mov edx, dword [eax]
call dword [edx + 0x44]
call fcn.0045d0ec
call fcn.00470700
xor edx, edx
push ebp
push 0x4720d5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x5ef188]
call fcn.00461d34
xor edx, edx
push ebp
push 0x47209e
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00461e00
xor edx, edx
push ebp
push 0x47205e
push dword fs:[edx]
mov dword fs:[edx], esp
mov bl, 1
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x471ee3
mov al, 1
call fcn.00471d70
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x471ee3
push ebp
call fcn.00471000
pop ecx
and bl, al
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x471f1f
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x471f04
mov eax, dword [esi]
cmp byte [eax + 0x2ee], 0
je 0x471f0b
xor eax, eax
call fcn.00471d70
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x471f1f
push ebp
call fcn.00471c20
pop ecx
and bl, al
test bl, bl
jne 0x471f38
mov eax, dword [esi]
test byte [eax + 0x331], 0x10
je 0x471f38
mov eax, dword [0x5ee8ac]
call fcn.0045d548
mov eax, dword [esi]
test byte [eax + 0x2f1], 2
je 0x471fbb
cmp byte [ebp - 0xd], 0
jne 0x471fbb
test bl, bl
je 0x471f85
push 0x242040
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [esi]
call fcn.00434a7c
mov eax, dword [ebp - 0x14]
call fcn.00405bc0
push eax
lea ecx, [ebp - 0x18]
mov dl, 0x90
mov eax, dword [esi]
call fcn.00434a7c
mov eax, dword [ebp - 0x18]
call fcn.00405bc0
push eax
push 0
call sub.USER32.dll_MessageBoxA_3
jmp 0x471fbb
push 0x242010
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [esi]
call fcn.00434a7c
mov eax, dword [ebp - 0x1c]
call fcn.00405bc0
push eax
lea ecx, [ebp - 0x20]
mov dl, 0x91
mov eax, dword [esi]
call fcn.00434a7c
mov eax, dword [ebp - 0x20]
call fcn.00405bc0
push eax
push 0
call sub.USER32.dll_MessageBoxA_3
mov eax, dword [esi]
test byte [eax + 0x331], 0x20
je 0x47200c
test bl, bl
jne 0x47200c
lea eax, [ebp - 0x24]
call fcn.00470dc4
mov eax, dword [ebp - 0x24]
call fcn.00405bc0
push eax
lea eax, [ebp - 0x28]
call fcn.00461ad0
mov eax, dword [ebp - 0x28]
call fcn.00405bc0
push eax
call sub.kernel32.dll_MoveFileA_1
lea eax, [ebp - 0x30]
call fcn.00470dc4
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040b544
mov eax, dword [ebp - 0x2c]
call fcn.00470e50
lea eax, [ebp - 0x34]
call fcn.00461ad0
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
call fcn.00405bc0
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472065
lea eax, [ebp - 0x3c]
call fcn.00461c7c
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
call fcn.00405bc0
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
ret
Function at 0x472174
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47227d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004619b0
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
call fcn.00405bc0
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
call fcn.004340bc
test al, al
jne 0x472257
mov eax, dword [0x5ee7e0]
cmp byte [eax + 0x324], 0
je 0x472257
mov eax, dword [0x5ee910]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, dword [0x5ee7e0]
cmp eax, dword [edx + 0x328]
jne 0x472257
mov eax, dword [0x5ee910]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0xc]
mov eax, dword [0x5ee910]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0040ef2c
fstp qword [ebp - 0x14]
wait
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [0x5ee910]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040ef2c
fsubr qword [ebp - 0x14]
mov eax, dword [0x5ee7e0]
fild dword [eax + 0x32c]
fdiv dword [0x47228c]
fcompp
wait
fnstsw ax
sahf
jb 0x472257
mov eax, dword [0x5ee7e0]
movzx eax, byte [eax + 0x324]
call fcn.0047dd48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472284
lea eax, [ebp - 0x18]
call fcn.00405704
lea eax, [ebp - 0xc]
call fcn.00405704
lea eax, [ebp - 4]
call fcn.00405704
ret

Function at 0x4739c0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
push 0x473a64
call sub.kernel32.dll_GetModuleHandleA_5
mov ebx, eax
test ebx, ebx
je 0x473a29
push 0x473a74
push ebx
call sub.kernel32.dll_GetProcAddress_3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x473a29
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [ebp - 4]
test eax, eax
je 0x473a29
mov eax, dword [ebp - 0x3c]
mov dword [edi], eax
mov eax, dword [ebp - 0x38]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esi], eax
mov eax, dword [ebp - 0x30]
mov dword [esi + 4], eax
jmp 0x473a5b
mov dword [ebp - 0x64], 0x20
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GlobalMemoryStatus_1
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x68], eax
fild qword [ebp - 0x6c]
fistp qword [edi]
wait
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x68], eax
fild qword [ebp - 0x6c]
fistp qword [esi]
wait
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474748
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4748ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405704
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.00405bc0
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x47488a
mov eax, dword [ebp - 8]
call fcn.00402ffc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x474883
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA_1
test eax, eax
je 0x47486a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4748bc
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA_1
test eax, eax
je 0x47486a
push 0x4748e0
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.0040aed8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.0040aed8
push dword [ebp - 0x20]
push 0x4748fc
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405ac4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405bc0
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA_1
test eax, eax
je 0x47486a
cmp dword [ebp - 0x10], 1
jbe 0x47486a
mov eax, dword [ebp - 0x18]
call fcn.0040ba58
mov ecx, eax
mov eax, esi
mov edx, dword [ebp - 0x18]
call fcn.004057f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47488a
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.00403018
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4748b4
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405728
lea eax, [ebp - 4]
call fcn.00405704
ret
Function at 0x474944
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405bb0
xor eax, eax
push ebp
push 0x474a29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405704
cmp dword [ebp - 4], 0
je 0x474994
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x474994
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00405c68
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00405bc0
push eax
push esi
call sub.ADVAPI32.dll_RegOpenKeyExA_3
test eax, eax
jne 0x474a13
mov eax, ebx
mov edx, 0x400
call fcn.00405e50
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4749cf
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00405bc0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA_1
test eax, eax
jne 0x474a03
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00405e50
jmp 0x474a0a
mov eax, ebx
call fcn.00405704
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey_3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474a30
lea eax, [ebp - 4]
call fcn.00405704
ret

Function at 0x474a38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405bb0
mov eax, dword [ebp - 8]
call fcn.00405bb0
xor eax, eax
push ebp
push 0x474b0e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x474a8a
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x474a8a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00405c68
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00405bc0
push eax
push ebx
call sub.ADVAPI32.dll_RegOpenKeyExA_3
test eax, eax
jne 0x474af3
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405bc0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_3
test eax, eax
jne 0x474aea
cmp dword [ebp - 0x14], 4
jne 0x474aea
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_3
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_RegCloseKey_3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b15
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405728
ret
Function at 0x475374
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x475525
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405704
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess_1
push eax
call sub.ADVAPI32.dll_OpenProcessToken_1
test eax, eax
je 0x475502
xor eax, eax
push ebp
push 0x4754fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_GetTokenInformation_1
mov eax, dword [ebp - 0x10]
call fcn.00402ffc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4754dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_GetTokenInformation_1
test eax, eax
je 0x4754c7
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x4754c7
inc edi
xor ebx, ebx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov eax, dword [edx + eax*4 + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeNameA_1
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405e50
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405bc0
push eax
lea eax, [ebp - 0x20]
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeNameA_1
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405e50
push dword [esi]
lea ecx, [ebp - 0x24]
mov edx, 0x1f
mov eax, dword [ebp - 8]
call fcn.00475330
push dword [ebp - 0x24]
push ebp
lea eax, [ebp - 0x28]
call fcn.004752dc
pop ecx
push dword [ebp - 0x28]
push 0x47553c
mov eax, esi
mov edx, 4
call fcn.00405ac4
inc ebx
dec edi
jne 0x475422
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4754e4
mov eax, dword [ebp - 0x14]
call fcn.00403018
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47552c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405728
lea eax, [ebp - 8]
call fcn.00405704
ret
Function at 0x479d18
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x479e3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5e6830]
mov eax, dword [eax]
call fcn.0045d744
mov ebx, eax
test ebx, ebx
je 0x479d86
lea edx, [ebp - 4]
mov eax, dword [ebx + 4]
call fcn.0040b630
mov eax, dword [ebp - 4]
call fcn.00405bc0
push eax
push 0x479e48
call sub.kernel32.dll_SetEnvironmentVariableA_1
mov eax, dword [ebx + 8]
call fcn.00405bc0
push eax
push 0x479e58
call sub.kernel32.dll_SetEnvironmentVariableA_1
mov eax, dword [ebx + 0xc]
call fcn.00405bc0
push eax
push 0x479e68
call sub.kernel32.dll_SetEnvironmentVariableA_1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x28]
call fcn.0045d800
mov ebx, eax
test ebx, ebx
je 0x479ddb
lea edx, [ebp - 8]
mov eax, dword [ebx + 4]
call fcn.0040b630
mov eax, dword [ebp - 8]
call fcn.00405bc0
push eax
push 0x479e78
call sub.kernel32.dll_SetEnvironmentVariableA_1
mov eax, dword [ebx + 8]
call fcn.00405bc0
push eax
push 0x479e8c
call sub.kernel32.dll_SetEnvironmentVariableA_1
mov eax, dword [ebx + 0xc]
call fcn.00405bc0
push eax
push 0x479ea0
call sub.kernel32.dll_SetEnvironmentVariableA_1
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
call fcn.004738d8
pop ecx
mov eax, dword [ebp - 0xc]
call fcn.00405bc0
push eax
push 0x479eb4
call sub.kernel32.dll_SetEnvironmentVariableA_1
mov eax, dword [0x5ee8ac]
call fcn.00405bc0
push eax
push 0x479ec0
call sub.kernel32.dll_SetEnvironmentVariableA_1
push 0x479ecc
push 0x479ed0
call sub.kernel32.dll_SetEnvironmentVariableA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479e41
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405728
ret
Function at 0x47b260
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47b36c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, pe_nt_image_headers32
push ebx
lea eax, [ebp - 0x104]
push eax
call sub.USER32.dll_GetFocus_1
push eax
call sub.USER32.dll_GetWindowTextA_1
test eax, eax
jle 0x47b33f
mov eax, esi
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00405984
lea eax, [ebp - 0x10c]
call fcn.0047b208
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.0040a298
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 4]
call fcn.0040a8e0
mov edx, dword [ebp - 4]
mov eax, 0x47b384
call fcn.00405d0c
test eax, eax
jle 0x47b346
push 0xfffffffffffffff0
call sub.USER32.dll_GetFocus_1
push eax
call sub.USER32.dll_GetWindowLongA_1
test al, 0x20
je 0x47b346
mov eax, dword [esi]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x47b322
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jbe 0x47b346
mov ebx, 1
mov eax, esi
call fcn.00405c20
mov byte [eax + ebx - 1], 0x2a
inc ebx
dec edi
jne 0x47b32d
jmp 0x47b346
mov eax, esi
call fcn.00405704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b373
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00405728
lea eax, [ebp - 4]
call fcn.00405704
ret

Function at 0x47eabc
Capabilities:
Terminate thread

Disassembly:
call fcn.004340bc
test al, al
jne 0x47eb19
cmp dword [0x5ee880], 0
je 0x47eb19
mov eax, dword [0x5ee880]
call fcn.0042abc0
mov eax, dword [0x5e97fc]
call fcn.0045d814
test al, al
jne 0x47eaf8
push 0xffffffffffffffff
mov eax, dword [0x5ee880]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject_1
jmp 0x47eb08
push 1
mov eax, dword [0x5ee880]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread_1
mov eax, dword [0x5ee880]
call fcn.00404700
xor eax, eax
mov dword [0x5ee880], eax
ret
Function at 0x47fad4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0045ef18
mov edi, eax
mov dl, 1
mov eax, dword [0x41e604]
call fcn.004046d0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x47fbea
push dword fs:[edx]
mov dword fs:[edx], esp
mov al, 0x10
call fcn.00460b60
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x47fb1a
mov dword [ebp - 0x14], 1
jmp 0x47fb25
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00420ff0
mov al, 0x13
call fcn.00460b60
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47fb3e
mov dword [ebp - 0xc], 1
jmp 0x47fb49
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00420ff0
mov al, 0x11
call fcn.00460b60
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47fb62
mov dword [ebp - 0x10], 1
jmp 0x47fb6d
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00420ff0
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x47fb9b
inc esi
xor ebx, ebx
mov eax, dword [edi + 4]
mov eax, dword [eax + ebx*8 + 4]
cmp eax, dword [ebp - 0x10]
je 0x47fb97
cmp eax, dword [ebp - 0xc]
je 0x47fb97
cmp eax, dword [ebp - 0x14]
je 0x47fb97
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00420ff0
inc ebx
dec esi
jne 0x47fb77
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x47fbd4
inc esi
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [edi + 4]
lea eax, [eax + ebx*8 + 4]
call fcn.0047f970
push eax
call sub.kernel32.dll_VirtualProtect_1
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00421198
mov edx, dword [edi + 4]
mov dword [edx + ebx*8 + 4], eax
inc ebx
dec esi
jne 0x47fba5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fbf1
mov eax, dword [ebp - 8]
call fcn.00404700
ret

Function at 0x47fc90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
call fcn.0045ef18
mov esi, eax
mov ebx, dword [esi]
dec ebx
jmp 0x47fca3
dec ebx
test ebx, ebx
jl 0x47fcb0
mov eax, dword [esi + 4]
cmp dword [eax + ebx*8], 0
je 0x47fca2
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx*8]
test eax, eax
je 0x47fcf5
mov dword [0x5ee800], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [esi + 4]
lea eax, [eax + ebx*8]
call fcn.0047f970
push eax
call sub.kernel32.dll_VirtualProtect_1
mov eax, dword [esi + 4]
lea eax, [eax + ebx*8]
call fcn.0047f970
mov dword [0x5ee84c], eax
mov eax, 0x47fbf8
mov edx, dword [0x5ee84c]
mov dword [edx], eax
mov ebx, dword [esi]
dec ebx
jmp 0x47fcfb
dec ebx
test ebx, ebx
jl 0x47fd09
mov eax, dword [esi + 4]
cmp dword [eax + ebx*8 + 4], 0
je 0x47fcfa
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx*8 + 4]
test eax, eax
je 0x47fd3f
mov dword [0x5ee804], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [esi + 4]
lea eax, [eax + ebx*8 + 4]
call fcn.0047f970
push eax
call sub.kernel32.dll_VirtualProtect_1
mov eax, 0x47fc80
mov edx, dword [esi + 4]
mov dword [edx + ebx*8 + 4], eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x484eec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405bc0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_3
test eax, eax
je 0x484f44
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5e6e50]
mov dl, 1
mov eax, dword [0x4848d4]
call fcn.0040f938
call fcn.00405078
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004849dc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x486184
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x48618a
ret
Function at 0x4a4f14
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405bb0
xor eax, eax
push ebp
push 0x4a5049
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.dll_OpenClipboard_1
test eax, eax
je 0x4a501c
xor edx, edx
push ebp
push 0x4a5015
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x4a4f61
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc_1
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a4fea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock_1
mov esi, eax
xor eax, eax
push ebp
push 0x4a4fd9
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4a4fa0
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00405bc0
lea ecx, [ebx + 1]
mov edx, esi
call fcn.0040333c
call sub.USER32.dll_EmptyClipboard_1
mov eax, dword [ebp - 8]
push eax
push 1
call sub.USER32.dll_SetClipboardData_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4fe0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock_1
ret
mov ecx, dword [0x5e6648]
mov dl, 1
mov eax, dword [0x4094f0]
call fcn.0040f8fc
call fcn.00405078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5050
lea eax, [ebp - 4]
call fcn.00405704
ret