joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470be0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cce18
push 0x488a3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00486e50
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470d90
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x470dd1
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x470e3e
cmp dword [esp + 0x1c], 2
jne 0x470e3e
cmp dword [esp + 0x10], 5
jne 0x470e3e
cmp dword [esp + 0x14], 1
jne 0x470e3e
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x470e28
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x470e19
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x470e21
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x470e3e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret

Function at 0x4781d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47822a
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47822a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, eax
je 0x47823f
mov eax, dword [esp]
test eax, eax
je 0x478239
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x47824e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18
Function at 0x478260
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4782b9
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4782ce
mov eax, dword [esp]
test eax, eax
je 0x4782c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x4782dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x4782f0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
test ecx, ecx
mov dword [esp + 4], 0
je 0x47835b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47835b
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x478324
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret 0xc
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47834c
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x478362
mov eax, dword [esp + 4]
test eax, eax
je 0x47835b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x478371
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x478380
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x398
mov eax, dword [esp + 0x39c]
push esi
test eax, eax
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x378
je 0x47850b
mov ecx, dword [esp + 0x3a8]
test ecx, ecx
je 0x47850b
mov edi, dword [esp + 0x3ac]
test edi, edi
je 0x47850b
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47850b
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4784cc
cmp dword [esp + 0xc], 0x378
jne 0x4784cc
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00488b20
add esp, 8
test eax, eax
je 0x4784ec
cmp dword [esp + 0x154], 1
jne 0x4784ec
cmp dword [esp + 0x178], 2
jne 0x4784ec
mov ecx, dword [esp + 0x150]
lea edx, [esp + 0x10]
push ecx
push 0x5b4d90
push edx
call fcn.00488856
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
push eax
push ecx
push edx
mov ecx, esi
call fcn.00478260
test eax, eax
je 0x4784cc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4784df
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
je 0x4784d6
push eax
call esi
jmp 0x4784d2
mov eax, dword [esp + 0x3b0]
test eax, eax
je 0x4784ec
inc dword [eax]
mov eax, dword [esp + 8]
test eax, eax
je 0x4784fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x398
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x398
ret 0x10
Function at 0x478520
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x47868c
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x47868c
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x47868c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x47868c
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x478670
cmp dword [esp + 0x10], 0x378
jne 0x478670
cmp dword [esp + 0x158], 1
jne 0x478699
cmp dword [esp + 0x17c], 2
jne 0x478699
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x5b4d90
push ecx
call fcn.00488856
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x478670
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.004786d0
test eax, eax
je 0x478670
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.004781d0
test eax, eax
je 0x478670
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x478699
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x478681
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x47868c
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4786aa
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x4786b5
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x4786d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x478791
mov eax, dword [esp + 0x488]
test eax, eax
je 0x478791
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x478791
cmp dword [esp], 0x378
jne 0x478791
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x478791
lea edx, [esp + 4]
push edx
call fcn.00478160
add esp, 4
test eax, eax
je 0x478791
cmp dword [esp + 0x234], 1
jne 0x478783
cmp dword [esp + 0x258], 2
jne 0x478783
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x478791
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x478791
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x4787a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x4787ff
push esi
call fcn.00478160
add esp, 4
test eax, eax
je 0x4787ff
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4787ff
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4787ff
push 0x5b4db4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x478890
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x4788c4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.004787a0
test eax, eax
jne 0x4788dd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00478810
cmp eax, 1
je 0x478a6a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x478916
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x478992
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x478a12
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.004786d0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x478a29
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x478932
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x4789e0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00478380
test eax, eax
je 0x478a12
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x4789ae
cmp dword [esp + 0x18], 1
jb 0x478a12
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00478260
cmp eax, 1
je 0x478a5b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x478a39
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x478a12
push ebp
mov ecx, ebx
call fcn.00478a80
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x478a6a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x478a80
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x478ab2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.00478810
test eax, eax
jne 0x478acf
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x478af6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x478b44
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00478520
test eax, eax
jne 0x478b2d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x478b13
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.004782f0
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x478b67
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x49a697
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49a6cf
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00498721
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004986f9
jmp 0x49a6db
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49bd85
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49bdc7
call fcn.004a1b3d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49bdc7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49bdbe
xor eax, eax
jmp 0x49bdcf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049bdd5
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a206d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a209b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a20b9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a1fd3
jmp 0x4a20b9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a20b9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a1fd3
test edi, edi
mov eax, edi
jne 0x4a20a3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x41001384
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x134
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
sub eax, ecx
mov dword [esi + 4], ecx
sub eax, 5
xor ecx, ecx
mov byte [esi + 0x19], al
mov cl, ah
add esp, 0xc
mov byte [esi + 0x1a], cl
xor ecx, ecx
shr eax, 0x10
mov byte [esi + 0x1b], al
mov cl, ah
lea eax, [ebp + 8]
mov byte [esi + 0x18], 0xe9
push eax
push 0x40
push edi
push esi
mov byte [esi + 0x1c], cl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [esi + 0x30], 0
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4100228d
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push esi
lea eax, [ebp + 0xc]
push edi
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x624]
push 0x400
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x1c
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push 0x41006620
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x410023cd
mov edi, 0x104
lea eax, [ebp - 0x120]
push edi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x410023cd
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 0xfa
pop ecx
jae 0x410023cd
lea eax, [ebp - 0x120]
push str..1.log
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x120]
push 0x41006200
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410023cd
push ebx
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
lea eax, [ebp - 0x624]
push eax
push 0x410061fc
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
cmp ebx, 0x2000
pop ebx
jle 0x410023cd
lea eax, [ebp - 0x120]
push edi
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea eax, [ebp - 0x224]
push 0x31
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x14
test eax, eax
je 0x410023cd
mov byte [eax], 0x32
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
mov al, 1
pop esi
leave
ret

Function at 0x41002401
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.MUTEX_YPATCH
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x4100242d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4100242d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41002463
cmp dword [esp + 8], 1
jne 0x41002450
push 0
push dword [0x41007d4c]
push 0x41002467
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x41007d50], eax
jmp 0x41002463
push dword [0x41007d50]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x41007d50], 0
pop esi
ret 4

Function at 0x41002482
Capabilities:
Create process on windows
Get common file path
Get program files directory
Query or enumerate registry value
Set registry value

Disassembly:
call fcn.410023d3
test eax, eax
je 0x41002497
cmp dword [esp + 4], 1
jne 0x41002497
jmp fcn.41002498
ret
Function at 0x41002d55
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push edi
push 0x140
lea eax, [ebp - 0x140]
push 0
push eax
call sub.MSVCRT.dll_memset
mov al, byte [0x41007d54]
add esp, 0xc
mov byte [ebp - 0x244], al
xor eax, eax
push 0x40
lea edi, [ebp - 0x243]
pop ecx
push dword [ebp + 0xc]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
push str._s_s
lea eax, [ebp - 0x244]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x41002e28
mov eax, dword [ebp - 0x140]
or al, 0x10
cmp dword [ebp - 0x140], eax
jne 0x41002e1f
lea eax, [ebp - 0x140]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push eax
push edi
call esi
test eax, eax
je 0x41002e1a
mov eax, dword [ebp - 0x140]
or al, 0x10
cmp dword [ebp - 0x140], eax
jne 0x41002e0c
lea eax, [ebp - 0x140]
push eax
push edi
jmp 0x41002dec
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop esi
jmp 0x41002e28
push 1
pop esi
jmp 0x41002e0e
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
leave
ret
Function at 0x41002e2b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
cmp dword [ebp + 8], 0
push edi
je 0x41002fcf
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x41002fcf
and byte [ebp - 0x350], 0
push 0x41
pop ecx
xor eax, eax
push dword [ebp + 8]
lea edi, [ebp - 0x34f]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x350]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x350]
push 0x41006424
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x41002fcf
cmp dword [ebp - 0x144], 0x10
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
mov ebx, 0x104
jne 0x41002f27
lea eax, [ebp - 0x118]
push 0x41006368
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x41002f27
lea eax, [ebp - 0x118]
push 0x41006420
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x41002f27
and byte [ebp - 0x248], al
push 0x40
pop ecx
lea edi, [ebp - 0x247]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x248]
push dword [ebp + 8]
push str._s_s
push ebx
push eax
call esi
lea eax, [ebp - 0x248]
push eax
call fcn.41002e2b
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call fcn.41002fd2
pop ecx
pop ecx
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x41002fbe
lea eax, [ebp - 0x118]
push 0x41006368
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x41002f38
lea eax, [ebp - 0x118]
push 0x41006420
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x41002f38
cmp dword [ebp - 0x144], 0x10
jne 0x41002f27
and byte [ebp - 0x248], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x247]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x248]
push dword [ebp + 8]
push str._s_s
push ebx
push eax
call esi
lea eax, [ebp - 0x248]
jmp 0x41002f1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
pop edi
leave
ret