joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47be8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.004030b8
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.004030b8
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov ax, word [ebp - 8]
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404c40
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
cmp byte [ebp - 0xa], 0
je 0x47bf25
cmp byte [ebp - 9], 0
je 0x47bf13
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret

Function at 0x47bf2c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030b8
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x440
mov eax, dword [ebp - 4]
call fcn.00404c40
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00404c40
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.00404c40
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
and al, byte [ebp + 8]
je 0x47bfa4
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 8
Function at 0x47bfb8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c0ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x47c0e0
call fcn.00404d84
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x47bff9
mov byte [ebp - 5], 0
jmp 0x47c0af
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404ca0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0x18]
add edx, 2
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.00404ca0
mov edx, dword [ebp - 0xc]
mov eax, 0x47c0ec
call fcn.00404d84
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x47c04f
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00404818
lea eax, [ebp - 0xc]
call fcn.00404780
jmp 0x47c074
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404ca0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov edx, 1
call fcn.00404ce0
push dword [ebp - 0x10]
push 0x47c0ec
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404b00
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404c40
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp dword [ebp - 0xc], 0
jne 0x47c024
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c0d1
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004047a4
ret

Function at 0x47c0f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, 0x104
call fcn.004030b8
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004049f0
mov eax, dword [ebp - 4]
call fcn.0047c140
mov esp, ebp
pop ebp
ret

Function at 0x47c184
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c200
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4976c4]
cmp dword [eax], 2
jne 0x47c1c7
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [ebp - 0x10], eax
jmp 0x47c1ea
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00404978
mov eax, dword [ebp - 0x14]
call fcn.00408e90
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MoveFileA
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c207
lea eax, [ebp - 0x14]
call fcn.00404780
ret
Function at 0x47c210
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030b8
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00404c40
mov dword [ebp - 0x34], eax
mov eax, 0x47c260
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 0xc
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
mov esp, ebp
pop ebp
ret

Function at 0x47d120
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47d2ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00404780
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c40
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47d296
mov eax, dword [ebp - 0x14]
call fcn.00402724
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404c40
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47d28b
cmp dword [ebp - 8], 0
jne 0x47d217
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x47d2b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47d28b
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.00407400
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.00407400
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x47d2c4
call fcn.0047d050
jmp 0x47d28b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x47d2d0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47d28b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.0047d11c
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
lea edx, [ebp - 0x54]
mov ecx, 1
mov eax, 0x47d2f4
call fcn.0047d050
mov eax, dword [ebp - 0x44]
call fcn.00404c40
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47d28b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
call fcn.00404978
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00402744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d2b3
lea eax, [ebp - 0x44]
call fcn.00404780
ret
Function at 0x47d3b8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047d344
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
call fcn.00404a40
inc eax
push eax
mov eax, dword [ebp + 8]
call fcn.00404c40
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret 4

Function at 0x47d408
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.004047d4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047d384
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x47d453
cmp dword [ebp - 0x18], 1
je 0x47d45e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47d4b8
mov eax, dword [ebp - 0x1c]
call fcn.00402724
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x47d48e
cmp dword [ebp - 0x18], 1
je 0x47d499
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47d4b8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
call fcn.00404978
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.00402744
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret 8
Function at 0x4842e8
Capabilities:
Gather total-commander information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48436b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x484380
call fcn.0047b3a0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0047b3e0
test al, al
jne 0x484355
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x484394
mov edx, 0x4843a0
mov eax, 0x80000002
call fcn.0047d408
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x484394
mov edx, 0x4843a0
mov eax, 0x80000001
call fcn.0047d408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484372
lea eax, [ebp - 8]
call fcn.00404780
ret
Function at 0x48ab38
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ff4
add eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x48abd0
cmp byte [ebp - 5], 0
je 0x48ab6c
call fcn.0048ab10
test al, al
jne 0x48ab6c
mov byte [ebp - 6], 0
jmp 0x48abd4
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48abc5
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x48abc5
mov eax, dword [ebp - 4]
call fcn.00404fe4
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.00402920
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 0x14]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
cmp byte [ebp - 5], 0
je 0x48abd0
call sub.user32.dll_CloseClipboard
mov byte [ebp - 6], 1
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret

Function at 0x48abdc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48ad00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a40
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x48acd6
call fcn.0048ab10
test al, al
jne 0x48ac28
mov byte [ebp - 6], 0
jmp 0x48acda
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48ac8a
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x48ac8a
mov eax, dword [ebp - 4]
call fcn.00404c40
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.00402920
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 0x14]
push eax
xor eax, eax
mov al, byte [ebp - 5]
mov eax, dword [eax*4 + 0x497148]
push eax
call sub.user32.dll_SetClipboardData
mov eax, dword [0x4976c4]
cmp dword [eax], 2
jne 0x48acd1
cmp byte [ebp - 5], 0
je 0x48acbc
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0047b578
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00404fd4
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.0048ab38
jmp 0x48acd1
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.00404fd4
mov eax, dword [ebp - 0x24]
xor edx, edx
call fcn.0048ab38
call sub.user32.dll_CloseClipboard
mov byte [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ad07
lea eax, [ebp - 0x24]
call fcn.00404e88
lea eax, [ebp - 0x20]
call fcn.00404780
lea eax, [ebp - 0x1c]
call fcn.00404e88
ret
Function at 0x48c180
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
xor ecx, ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c390
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00482ea4
test al, al
je 0x48c1e0
mov byte [ebp - 9], 0
jmp 0x48c365
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x48c3a8
mov edx, dword [ebp - 4]
call fcn.00404a8c
mov eax, dword [ebp - 0x15c]
call fcn.00404c40
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x48c365
xor eax, eax
push ebp
push 0x48c35e
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x48c3b8
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.004049f0
push dword [ebp - 0x160]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404b00
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 0x14]
call fcn.0040907c
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x18]
call fcn.00408638
test byte [ebp - 0x158], 0x10
jne 0x48c2c5
mov eax, dword [ebp - 0x18]
mov edx, 0x48c3c4
call fcn.00404b8c
je 0x48c2b8
mov eax, dword [ebp - 0x18]
mov edx, 0x48c3d4
call fcn.00404b8c
je 0x48c2b8
mov eax, dword [ebp - 0x18]
mov edx, 0x48c3e4
call fcn.00404b8c
je 0x48c2b8
mov eax, dword [ebp - 0x18]
mov edx, 0x48c3f4
call fcn.00404b8c
jne 0x48c32f
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x48c32f
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.004049f0
mov eax, dword [ebp - 0x168]
mov edx, 0x48c404
call fcn.00404b8c
je 0x48c32f
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.004049f0
mov eax, dword [ebp - 0x16c]
mov edx, 0x48c410
call fcn.00404b8c
je 0x48c32f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0048c180
test al, al
jne 0x48c32f
mov byte [ebp - 9], 0
call fcn.00404248
jmp 0x48c365
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x48c226
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c365
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c397
lea eax, [ebp - 0x16c]
mov edx, 5
call fcn.004047a4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004047a4
ret
Function at 0x48dfe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48e095
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x49b868], 0
je 0x48e01b
cmp dword [0x49b86c], 0
je 0x48e01b
lea edx, [ebp - 8]
mov eax, dword [0x49b86c]
call fcn.0047b3a0
jmp 0x48e023
lea eax, [ebp - 8]
call fcn.0047fe64
push 5
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408ff0
mov eax, dword [ebp - 0xc]
call fcn.00404c40
push eax
push 0x48e0a8
push dword [ebp - 4]
push 0x48e0a8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404b00
mov eax, dword [ebp - 0x10]
call fcn.00404c40
push eax
mov eax, dword [ebp - 8]
call fcn.00404c40
push eax
push 0x48e0ac
mov eax, dword [0x4974f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e09c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004047a4
ret
Function at 0x43739a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4373d5
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4373bc
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4373cd
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4373d7
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4373b2
xor eax, eax
pop edi
pop esi
ret

Function at 0x4379e0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x437a0e
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x437a09
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4379f3
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4379fb
cmp edx, ebx
jne 0x437b49
invalid
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4379ca
add eax, dword [eax + 4]
jmp 0x4379b7
mov dword [ebp + 0xc], ebx
jmp 0x437a19
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x437a31
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
leave
mov edi, 0x60000000
jmp 0x437a4f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x437aad
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x437a94
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x437a9d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x437aa7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x437a89
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x437a13
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x437afa
dec eax
je 0x437af1
sub eax, 3
je 0x437ae8
mov dword [ebp - 4], 0x40
jmp 0x437b17
mov dword [ebp - 4], 4
jmp 0x437afd
mov dword [ebp - 4], 0x20
jmp 0x437afd
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x437b49
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x437ac9
invalid
test dword [eax - 1], edi

Function at 0x4386e2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x4386fc
push dword [ebp + 0x14]
call fcn.0043731f
call dword [eax - 1]
mov ch, 0x88
cld
invalid
Function at 0x43a1d4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5c9030]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x43a219
push 0x56e280
push 4
push eax
call fcn.0053b691
push eax
call fcn.0040224b
add esp, 0x10
jmp 0x43a22f
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43a2af
push edi
call fcn.0053cef7
mov edi, dword [eax]
call fcn.0053cef7
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0053ce94
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0053cef7
cmp dword [eax], 0
je 0x43a283
call fcn.0053cef7
push dword [eax]
call fcn.00438020
pop ecx
jmp 0x43a28a
call fcn.0053cef7
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x43a2af
cmp dword [ebp - 0x234], esi
jae 0x43a2af
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x43a2b1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0053780e
leave
ret