joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47e7af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x47e618]
call fcn.004068bc
add esp, 4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebx + 0xb0]
mov ecx, 1
mov edx, dword [0x47e57c]
call fcn.004068bc
add esp, 4
mov edi, dword [ebp - 8]
dec edi
test edi, edi
jl 0x47e730
inc edi
xor esi, esi
mov eax, 8
call fcn.00402ec8
mov edx, dword [ebx + 0xb0]
mov dword [edx + esi*4], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [ebx + 0xb0]
mov edx, dword [edx + esi*4]
mov dword [edx], eax
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax + esi*4]
lea edx, [eax + 4]
push edx
push 0
push eax
lea eax, [ebx + 0xe2]
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread_1
test eax, eax
je 0x47e70f
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x47e728
mov eax, dword [ebx + 0xb0]
mov eax, dword [eax + esi*4]
call fcn.00402ee4
mov eax, dword [ebx + 0xb0]
xor edx, edx
mov dword [eax + esi*4], edx
inc esi
dec edi
jne 0x47e6a7
mov eax, dword [0x634bf4]
mov eax, dword [eax]
call fcn.00425bc8
push 0x68
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WaitForMultipleObjects
test eax, eax
jne 0x47e730
mov eax, dword [ebx + 0xa8]
push eax
call sub.kernel32.dll_SetEvent
mov eax, dword [0x634bf4]
mov eax, dword [eax]
call fcn.00425bc8
push 0x64
mov eax, dword [ebx + 0xac]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x47e75d
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x47e618]
call fcn.004068bc
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e7b6
lea eax, [ebp - 4]
mov edx, dword [0x47e618]
call fcn.004068c8
ret
Function at 0x47e8ec
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47e9b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [edi]
call fcn.00469e70
test al, al
je 0x47e968
mov eax, dword [0x6349ec]
cmp byte [eax], 0
jne 0x47e964
push 0x20
mov eax, dword [esi + 4]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [esi + 4]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 4]
mov eax, dword [esi + 4]
call fcn.00423124
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x634ffc]
mov eax, dword [eax]
call eax
mov eax, dword [edi]
mov eax, dword [eax + 8]
mov edx, dword [esi + 4]
call fcn.0042556c
mov bl, 1
jmp 0x47e99d
push dword [esi + 4]
push 0x47e9d0
lea edx, [ebp - 0xc]
mov eax, dword [edi]
mov eax, dword [eax + 0x520]
call fcn.00464944
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040575c
mov edx, dword [ebp - 8]
mov eax, 0x47e9ec
call fcn.00464c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e9bf
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053ec
ret

Function at 0x47f108
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
xor ebx, ebx
push esp
push 0
push 0
add eax, 0xd0
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread_1
test eax, eax
je 0x47f12c
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x47f700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47f866
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x628
call fcn.00403aec
lea edx, [ebp - 8]
mov eax, dword [0x634cc0]
call fcn.0042fb8c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x47f874
call fcn.00406ff0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, 0x47f884
call fcn.00406ff0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405d24
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405d34
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebp - 0x154]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x104
lea eax, [ebx + 0x105]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
lea eax, [ebx + 0x310]
push eax
push 0x104
lea eax, [ebx + 0x20a]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
lea eax, [ebx + 0x620]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
lea eax, [ebx + 0x624]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
lea eax, [ebp - 0x10]
call fcn.00406fac
lea eax, [ebp - 0xc]
call fcn.00406fac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f86d
lea eax, [ebp - 0x14]
call fcn.00405ba4
lea eax, [ebp - 0x10]
call fcn.00406fac
lea eax, [ebp - 0xc]
call fcn.00406fac
lea eax, [ebp - 8]
call fcn.00406fac
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x4802dc
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x30
push 0
push 0
dec ecx
jne 0x4802e4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x480552
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00468348
mov esi, eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x480568
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x14c]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x480527
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
cmp dword [ebp - 0x150], 0
jne 0x4803a0
push dword [ebp - 4]
push 0x480578
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.00464f44
jmp 0x4803df
push dword [ebp - 4]
push 0x480578
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.00464f44
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.004095e8
mov eax, dword [ebp - 0x164]
mov edx, 0x480584
call fcn.004057f0
je 0x48050c
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.004095e8
mov eax, dword [ebp - 0x16c]
mov edx, 0x480598
call fcn.004057f0
je 0x48050c
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.004095e8
mov eax, dword [ebp - 0x174]
mov edx, 0x4805b0
call fcn.004057f0
je 0x48050c
lea eax, [ebp - 0x180]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x17c]
call fcn.004095e8
mov eax, dword [ebp - 0x17c]
mov edx, 0x4805c4
call fcn.004057f0
je 0x48050c
mov eax, dword [ebp - 8]
call fcn.00405858
call fcn.00468284
cmp esi, eax
jbe 0x48050c
push 0x20
mov eax, dword [ebp - 8]
call fcn.00405858
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesA
mov edx, edi
lea eax, [ebp - 0x184]
call fcn.004055c0
mov eax, dword [ebp - 0x184]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x480340
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480559
lea eax, [ebp - 0x184]
mov edx, 0xf
call fcn.004053ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x4805d0
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
mov eax, 0x4807e0
call fcn.00409f70
test al, al
je 0x480609
push 0x20
push 0x48080c
call sub.kernel32.dll_SetFileAttributesA
mov eax, 0x480820
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
push 0x48080c
push 0x48082c
call sub.kernel32.dll_MoveFileA
push 2
mov eax, 0x480858
mov ecx, 0x3ea
mov edx, 0x20
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x63
mov edx, 0x123
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x58
mov edx, 0x1e4
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x64
mov edx, 0x185b823
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x32
mov edx, 0x1182766
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x35
mov edx, 0x11f8400
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x39
mov edx, 0x11fa9f0
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x36
mov edx, 0x11fbe40
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x35
mov edx, 0x11fd510
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x38
mov edx, 0x11fea00
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x36
mov edx, 0x1200c00
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x74
mov edx, 0x102f122
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x42
mov edx, 0x1668703
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x68
mov edx, 0x1870071
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x67
mov edx, 0x197e4c2
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x4c
mov edx, 0x1a0fb84
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x31
mov edx, 0x819181
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x57
mov edx, 0x102f031
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x32
mov edx, 0x1422870
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x32
mov edx, 0x1423cb3
call fcn.00464dec
push 1
mov eax, 0x480864
mov ecx, 0x38
mov edx, 0x18bc451
call fcn.00464dec
ret
Function at 0x480880
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4809db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x634998]
add eax, 0x115
mov edx, 0x4809f4
call fcn.00424770
mov eax, dword [0x634998]
add eax, 0x115
mov edx, 0x480a08
call fcn.00424770
mov eax, dword [0x634998]
add eax, 0x115
mov edx, 0x480a20
call fcn.00424770
mov eax, dword [0x634998]
add eax, 0x115
mov edx, 0x480a38
call fcn.00424770
mov ebx, dword [0x634998]
mov ebx, dword [ebx + 0x135]
dec ebx
test ebx, ebx
jl 0x4809c0
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [0x634998]
add eax, 0x115
mov edx, esi
call fcn.00424758
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004098c8
cmp dword [ebp - 4], 0
je 0x4809b8
mov eax, dword [ebp - 4]
mov edx, 0x480a50
call fcn.004057f0
je 0x4809b8
mov eax, dword [ebp - 4]
mov edx, 0x480a5c
call fcn.004057f0
je 0x4809b8
mov eax, dword [ebp - 4]
call fcn.00405858
mov edi, eax
mov edx, edi
lea eax, [ebp - 0xc]
call fcn.004055c0
mov eax, dword [ebp - 0xc]
call fcn.00409f70
test al, al
je 0x4809b0
mov eax, dword [ebp - 4]
call fcn.00405858
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.004055c0
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004644f8
push 0x20
push edi
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00405858
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.004055c0
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4809b8
mov eax, dword [ebp - 4]
call fcn.004795c8
inc esi
dec ebx
jne 0x480903
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4809e2
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004053ec
ret

Function at 0x483aac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405638
add esp, 0x10c
pop ebx
ret
Function at 0x484a8c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
call sub.ole32.dll_CoInitialize_2
call sub.kernel32.dll_GetProcessHeap
mov dword [ebp - 0x14], eax
push 0x208
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x533970
push 1
push 0
push 0x533960
call sub.ole32.dll_CoCreateInstance_1
mov dword [ebp - 0x10], eax
test eax, eax
js 0x484b7a
mov edx, dword [ebp - 8]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
push eax
push 0x533980
push dword [ebp - 8]
call dword [edx]
mov dword [ebp - 0x10], eax
test eax, eax
js 0x484b6c
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x50]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x44]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [edx + 0x1c]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [edx + 0x24]
mov dword [ebp - 0x10], eax
push 0x104
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push 1
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [edx + 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push dword [ebp - 0xc]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp - 8]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapFree
call sub.ole32.dll_CoUninitialize_1
mov eax, dword [ebp - 0x10]
leave
ret 0x10

Function at 0x484fe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x107]
xor ecx, ecx
mov edx, 0xff
call fcn.00403aec
lea eax, [ebp - 4]
push eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x107]
push eax
push 0
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00405638
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x485054
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48524f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 0x20e]
xor ecx, ecx
mov edx, 0xff
call fcn.00403aec
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x485231
xor esi, esi
push esi
mov esi, 0x485264
lea edi, [ebp - 0x20e]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
push esi
mov esi, 0x485264
lea edi, [ebp - 0x10f]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x10], 0xff
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x10f]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyA
mov ebx, eax
cmp ebx, 0x103
je 0x48521f
test ebx, ebx
jne 0x485217
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x10f]
mov ecx, 0xff
call fcn.00405638
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x214]
mov edx, 0x48536c
call fcn.004056e0
mov eax, dword [ebp - 0x214]
call fcn.00405858
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20e]
push eax
push 0
push 0
push 0x4853a4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp byte [ebp - 0x20d], 0x3a
jne 0x485216
cmp byte [ebp - 0x20c], 0x5c
jne 0x485216
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x20e]
mov ecx, 0xff
call fcn.00405638
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.004235a4
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
mov edx, edi
call fcn.004055c0
mov edx, dword [ebp - 0x224]
lea ecx, [ebp - 1]
mov eax, dword [0x63d9cc]
call fcn.00484e88
lea eax, [ebp - 0x228]
mov edx, edi
call fcn.004055c0
mov edx, dword [ebp - 0x228]
mov eax, dword [0x63d9dc]
call fcn.00424770
cmp byte [ebp - 1], 0
je 0x48521f
inc esi
test ebx, ebx
je 0x4850ca
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485256
lea eax, [ebp - 0x228]
mov edx, 6
call fcn.004053ec
ret
Function at 0x485558
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4856f3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x6349ec]
cmp byte [eax], 0
jne 0x4856d8
cmp dword [ebp - 4], 0
je 0x4856a3
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042316c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
push esi
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x485622
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x485700
mov edx, 0x485704
mov eax, 0x80000002
call fcn.004238fc
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6349e8]
mov edx, dword [ebp - 4]
call fcn.0040541c
jmp 0x4856d8
mov eax, esi
call fcn.004230a4
test al, al
jne 0x48566f
push 0x48571c
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.004055c0
push dword [ebp - 0x1c]
push 0x485730
push 0x485740
push 0x48574c
push 0x485768
push 0x485778
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.0040575c
mov eax, dword [ebp - 0x18]
call fcn.00405858
jmp 0x4856aa
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x485700
mov edx, 0x485704
mov eax, 0x80000002
call fcn.004238fc
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6349e8]
mov edx, dword [ebp - 4]
call fcn.0040541c
jmp 0x4856d8
mov bl, 1
mov eax, 0x4857a0
push 0x10
push 0
push eax
mov eax, dword [0x63d9cc]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
test bl, bl
je 0x4856d8
push 1
push 0
push 0
push 0x485878
push 0
push 0
call sub.shell32.dll_ShellExecuteA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4856fa
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004053ec
ret
Function at 0x489a84
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x489ab9
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x634530]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x489a99
pop edi
pop esi
pop ebx
ret

Function at 0x48a160
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x48a18e
mov eax, dword [esp + 4]
cmp eax, 4
je 0x48a18c
cmp eax, 5
je 0x48a18c
xor ebx, ebx
jmp 0x48a18e
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x402880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402899
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4028d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4028d0
lea ebx, [ebx]
cmp esi, eax
jae 0x4028d4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4028c0
cmp esi, eax
jb 0x4028da
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403220
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403230
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403244
push ebp
sub eax, edx
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403394
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
push str..UIF
push edx
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4032af
mov eax, dword [esp + 0x10]
push 0xe
push str.YingUnInstall2
push 1
push 0
push 0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push str.YingUnInstall2
push eax
call ebx
test eax, eax
jne 0x40338a
mov ecx, dword [esp + 0x10]
push 0xe
push str.Uninstall_File
push 1
push eax
push eax
push ecx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push str.DefaultIcon
push eax
call ebx
test eax, eax
jne 0x403307
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
push ebp
push ecx
push 1
push eax
push eax
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push str.Shell
push edx
call ebx
test eax, eax
jne 0x403383
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push str.Open
push ecx
call ebx
test eax, eax
jne 0x40337c
mov edx, dword [esp + 0x18]
push eax
push 0x46dc24
push 1
push eax
push eax
push edx
call esi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push str.Command
push ecx
call ebx
test eax, eax
jne 0x403375
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push edx
push eax
push 2
push 0
push 0
push ecx
call esi
mov edx, dword [esp + 0x20]
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x1c]
push eax
call edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret