joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483280
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x48332e
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
jbe 0x483313
mov edx, dword [ebp - 8]
add edx, 1
push edx
call fcn.00422e0b
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
add edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.0043ff60
add esp, 0xc
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
je 0x483329
xor eax, eax
jmp 0x483330
mov eax, dword [ebp - 8]
jmp 0x483330
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4833c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48341e
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48341e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48341e
mov ecx, dword [ebp - 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
jmp 0x483420
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x483430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0xa
mov ecx, dword [ebp + 8]
push ecx
call fcn.004833c0
add esp, 0xc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.00440120
add esp, 8
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.00440130
add esp, 8
cmp dword [ebp - 8], 0
je 0x4834ec
push 0
push 0
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
je 0x4834ec
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4834ee
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret

Function at 0x4835b0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4835d4
xor eax, eax
jmp 0x483656
lea ecx, [ebp - 0x14]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x483617
xor eax, eax
jmp 0x483656
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x483634
xor eax, eax
jmp 0x483656
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x483660
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x420], eax
mov byte [ebp - 0x41c], 0
mov byte [ebp - 0x41b], 0
mov byte [ebp - 0x41a], 0
mov byte [ebp - 0x419], 0
mov byte [ebp - 0x418], 0
mov byte [ebp - 0x417], 5
lea ecx, [ebp - 0x414]
push ecx
push 1
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4836fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x4836d9
xor eax, eax
jmp 0x4837d9
lea edx, [ebp - 0x414]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4836fa
xor eax, eax
jmp 0x4837d9
lea eax, [ebp - 0x424]
push eax
push 0x400
lea ecx, [ebp - 0x408]
push ecx
push 2
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x410], 0
jne 0x48373f
xor eax, eax
jmp 0x4837d9
lea ecx, [ebp - 0x40c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea edx, [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x483770
xor eax, eax
jmp 0x4837d9
mov dword [ebp - 0x410], 0
mov dword [ebp - 4], 0
jmp 0x48378c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx]
jae 0x4837c6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx + eax*8 + 4]
push edx
mov eax, dword [ebp - 0x40c]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4837c4
mov dword [ebp - 0x410], 1
jmp 0x4837c6
jmp 0x483783
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret

Function at 0x4837f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0043ff60
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x483855
cmp dword [ebp - 0x110], 2
jne 0x483855
mov eax, 1
jmp 0x483857
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret
Function at 0x4838a0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.0043ff60
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call fcn.0043ff60
add esp, 0xc
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], 0
push 0x4bb140
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4bb144
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__noscan
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4bb154
push SysReAllocStringLen
call fcn.00482d30
add esp, 0x18
test eax, eax
je 0x48397a
movzx edx, byte [ebp + 0x10]
test edx, edx
jne 0x48397a
lea eax, [ebp - 0x118]
push eax
call fcn.0043fbe0
add esp, 4
test eax, eax
je 0x48397a
jmp 0x4839e0
lea ecx, [ebp - 0xc]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x4839ad
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4839d6
lea edx, [ebp - 0x220]
push edx
call fcn.0043fbe0
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret
Function at 0x483a30
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe54
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00404760
mov dword [ebp - 0xd44], eax
mov byte [ebp - 0xc10], 0
push 0x7ff
push 0
lea eax, [ebp - 0xc0f]
push eax
call fcn.0043ff60
add esp, 0xc
push str.___Load_the_MOF_in_RootSecurityCenter_namespace_r_npragma_namespace__.RootSecurityCenter___r_n___Create_the_class_r_n___No_properties_are_specified_r_n___so_the_class_will_have_only_system_properties_r_ninstance_of_AntiVirusProduct_r_n_r_n_instanceGuid___28e00e3b_806e_4533_925c_f4c3d79514b9___r_n_companyName___
lea ecx, [ebp - 0x408]
push ecx
call fcn.00440120
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x408]
push eax
call fcn.00440130
add esp, 8
push 0x4bb048
lea ecx, [ebp - 0x408]
push ecx
call fcn.00440130
add esp, 8
push str._displayName___
lea edx, [ebp - 0x408]
push edx
call fcn.00440130
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.00440130
add esp, 8
push str.___r_n
lea edx, [ebp - 0x408]
push edx
call fcn.00440130
add esp, 8
push str._onAccessScanningEnabled__true__r_n_productUptoDate_
lea eax, [ebp - 0x408]
push eax
call fcn.00440130
add esp, 8
mov ecx, 8
mov esi, str.__r_n_versionNumber___1.0___r_n__r_n
lea edi, [ebp - 0xc34]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0xc10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x483b3a
push str.true
lea ecx, [ebp - 0xc10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x483b4c
push str.false
lea edx, [ebp - 0xc10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xc34]
push eax
lea ecx, [ebp - 0xc10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0xe50]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.4otjesjty.mof
lea eax, [ebp - 0xe50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xe50]
push ecx
lea edx, [ebp - 0xc10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xc10]
push eax
call fcn.00483000
add esp, 0xc
push str.mofcomp
lea ecx, [ebp - 0xd40]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0xe50]
push edx
lea eax, [ebp - 0xd40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push str.net_stop_wscsvc
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.net_stop_winmgmt__y
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.net_start_winmgmt
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.net_start_wscsvc
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
lea ecx, [ebp - 0xd40]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret
Function at 0x483c30
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.004837f0
test eax, eax
jne 0x483c51
xor eax, eax
jmp 0x483c97
lea eax, [ebp - 8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x483c95
lea ecx, [ebp - 4]
push ecx
push 4
lea edx, [ebp - 0xc]
push edx
push 0x12
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 3
jne 0x483c95
mov eax, 1
jmp 0x483c97
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x483ca0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
call fcn.00483660
test eax, eax
je 0x483cb5
call fcn.00483c30
test eax, eax
je 0x483cc7
push 0
push 0x1a
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x483cd7
push 0
push 0x26
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
pop ebp
ret

Function at 0x4843d0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7f91
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x41c], 0
lea ecx, [ebp - 0x418]
call fcn.00404240
mov dword [ebp - 4], 0
push 0
push 0x1a
lea eax, [ebp - 0x3fc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x4bae78
lea ecx, [ebp - 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4bae7c
lea edx, [ebp - 0x3fc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4bae84
lea eax, [ebp - 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4bae88
lea ecx, [ebp - 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x3fc]
push edx
call fcn.0046c690
add esp, 4
test eax, eax
je 0x484499
lea eax, [ebp - 0x3fc]
push eax
lea ecx, [ebp - 0x418]
call fcn.00406300
jmp 0x484506
push 0
push 0x26
lea ecx, [ebp - 0x3fc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x4bae90
lea edx, [ebp - 0x3fc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4bae94
lea eax, [ebp - 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4bae9c
lea ecx, [ebp - 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.avt.exe
lea edx, [ebp - 0x3fc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3fc]
push eax
lea ecx, [ebp - 0x418]
call fcn.00406300
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403690
mov edx, dword [ebp - 0x41c]
or edx, 1
mov dword [ebp - 0x41c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.00401e40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret
Function at 0x484a00
Capabilities:
Delete file
Enumerate files on windows
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8a62
mov eax, dword fs:[0]
push eax
sub esp, 0x5ac
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040dac0
movzx eax, al
test eax, eax
je 0x484a55
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401e40
jmp 0x484c0b
push 0x400
push 0
lea ecx, [ebp - 0x55c]
push ecx
call fcn.0043ff60
add esp, 0xc
push 0x400
lea edx, [ebp - 0x55c]
push edx
lea ecx, [ebp + 8]
call fcn.00401df0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x55c]
push eax
lea ecx, [ebp + 8]
call fcn.00406300
lea ecx, [ebp - 0x154]
push ecx
lea ecx, [ebp + 8]
call fcn.00401df0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xffffffff
je 0x484bfc
lea ecx, [ebp - 0x578]
call fcn.00404240
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push 0x4baed0
lea ecx, [ebp + 8]
call fcn.0040db60
add eax, 1
push eax
push 0
lea edx, [ebp - 0x594]
push edx
lea ecx, [ebp + 8]
call fcn.0040dbc0
mov byte [ebp - 4], 2
push 0x4baed4
lea eax, [ebp - 0x128]
push eax
call fcn.004402a0
add esp, 8
test eax, eax
je 0x484b25
push 0x4baed8
lea ecx, [ebp - 0x128]
push ecx
call fcn.004402a0
add esp, 8
test eax, eax
jne 0x484b2a
jmp 0x484bb5
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x594]
push eax
lea ecx, [ebp - 0x5b0]
push ecx
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0x5b4], eax
mov edx, dword [ebp - 0x5b4]
mov dword [ebp - 0x5b8], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x5b8]
push eax
lea ecx, [ebp - 0x578]
call fcn.004061d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5b0]
call fcn.00401e40
mov ecx, dword [ebp - 0x154]
and ecx, 0x10
jne 0x484bb5
lea ecx, [ebp - 0x578]
call fcn.00401df0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x484bb5
push 4
push 0
lea ecx, [ebp - 0x578]
call fcn.00401df0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x484af5
mov ecx, dword [ebp - 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x594]
call fcn.00401e40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x578]
call fcn.00401e40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401e40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret
Function at 0x484c30
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8a92
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4de880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x60
push 0x5a
mov ecx, dword [ebp + 8]
call fcn.0040d770
push eax
push 0x24
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp - 0x2c], eax
push 0x4bae50
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xf
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403930
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x1c]
call fcn.004016e0
lea ecx, [ebp - 0x1c]
call fcn.004016e0
push eax
call fcn.00401290
mov ecx, dword [eax + 0x20]
call fcn.00401f90
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp + 0xc]
add edx, 2
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0x10]
add eax, 2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x14]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040d6a0
mov dword [ebp - 4], 0
push 1
mov ecx, dword [ebp + 8]
call fcn.00428d4f
push 0x5b5e39
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x30]
call edx
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040d660
push 0xffffff
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x30]
call edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
push 0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d660
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403930
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x484f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a96dc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4de880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0
jne 0x484f85
push 0x4baf04
mov ecx, dword [ebp + 8]
call fcn.00401600
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 8]
jmp 0x48504c
push 0x1000
lea ecx, [ebp - 0x20]
call fcn.0040ddd0
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x24]
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.0040de50
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x484fe8
cmp dword [ebp - 0x10], 0xea
jne 0x484fe4
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040de30
jmp 0x484fe6
jmp 0x484fe8
jmp 0x484fa0
cmp dword [ebp - 0x10], 0
je 0x485018
push 0x4baf08
mov ecx, dword [ebp + 8]
call fcn.00401600
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0040de10
mov eax, dword [ebp + 8]
jmp 0x48504c
mov edx, dword [ebp - 0x24]
shr edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.0040de50
push eax
mov ecx, dword [ebp + 8]
call fcn.0040dc00
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0040de10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4920a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], ecx
push 0x4bea60
lea eax, [ebp - 0x10]
push eax
call fcn.00440120
add esp, 8
lea ecx, [ebp - 4]
push ecx
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x49210a
lea edx, [ebp - 0x10]
push edx
call fcn.0043fbe0
add esp, 4
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.Use_FormSuggest
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x49214c
mov dword [ebp - 0x14], 0
push 4
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push str.1601
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x49218e
mov dword [ebp - 0x18], 0
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.WarnOnZoneCrossing
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret