joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439520
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
push str.TMPDIR
call fcn.005201f3
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43957e
mov eax, dword [ebp - 8]
push eax
call fcn.005139f0
add esp, 4
cmp eax, 0x20
jge 0x43957e
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045a2b0
add esp, 4
test eax, eax
je 0x43957e
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 8]
mov dword [eax + 0x5aebcc], ecx
mov dword [ebp - 4], 0
jmp 0x439585
mov dword [ebp - 4], 1
jmp 0x439590
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 2
jae 0x439621
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x5aebcc]
push ecx
call fcn.0045a2b0
add esp, 4
test eax, eax
je 0x43961c
mov dword [ebp - 0x14], 0x3f
push str.vileDXXXXXX
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x5aebcc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00459a80
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.00535390
add esp, 4
test eax, eax
je 0x439614
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x439614
mov edx, dword [ebp + 8]
push edx
call fcn.005353b0
add esp, 4
test eax, eax
jne 0x439607
mov dword [ebp - 0x10], 1
jmp 0x43960e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43961c
jmp 0x439621
jmp 0x439587
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x43bad0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 0xc], 0
je 0x43bb62
cmp dword [ebp + 0xc], 0
je 0x43bb53
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub edx, dword [ecx]
cmp edx, 0x7fffffff
jbe 0x43bb0b
mov dword [ebp - 4], SysReAllocString
jmp 0x43bb16
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [0x65a45c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
push eax
call fcn.00524fe0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x43bb44
jmp 0x43bb53
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
jmp 0x43baec
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x43bb62
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x46eb30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ecx + 0x662a62]
test edx, edx
jne 0x46eb55
call fcn.0046eae0
cmp dword [ebp + 8], 0
jne 0x46eb65
mov eax, 1
jmp 0x46ec12
mov ax, word [ebp + 8]
mov word [ebp - 4], ax
mov dword [ebp - 0xc], 0
jmp 0x46eb7f
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 2
jae 0x46eba3
movzx edx, word [ebp - 4]
and edx, 0xff
xor edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov ax, word [ebp - 4]
shr ax, 8
mov word [ebp - 4], ax
jmp 0x46eb76
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
movsx eax, byte [edx*4 + 0x662a62]
test eax, eax
je 0x46ebf5
mov ecx, dword [ebp - 8]
movzx edx, word [ecx*4 + 0x662a60]
cmp edx, dword [ebp + 8]
jne 0x46ebcd
mov eax, dword [ebp - 8]
jmp 0x46ec12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
jne 0x46ebe3
or eax, 0xffffffff
jmp 0x46ec12
cmp dword [ebp - 8], 0x100
jl 0x46ebf3
mov dword [ebp - 8], 2
jmp 0x46eba9
mov edx, dword [ebp - 8]
mov ax, word [ebp + 8]
mov word [edx*4 + 0x662a60], ax
mov ecx, dword [ebp - 8]
mov byte [ecx*4 + 0x662a62], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x46f6e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x659780]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
push 0x65e048
push 0x5b1330
call fcn.00442ec0
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jne 0x46f814
push 0x65e048
lea eax, [ebp - 0x104]
push eax
call fcn.005138f0
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.004865a0
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jne 0x46f807
call fcn.004867d0
test eax, eax
jne 0x46f7e6
mov ecx, 8
imul edx, ecx, 0x36
cmp dword [edx + 0x662680], 0
je 0x46f7d7
mov eax, dword [ebp - 0x10c]
push eax
push 0
push fcn.00470770
call fcn.00529390
add esp, 0xc
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
jne 0x46f7d5
push str._Cant_create_Win32_write_pipe_
call fcn.0041dcf0
add esp, 4
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.00514120
add esp, 4
mov edx, dword [ebp - 0x110]
push edx
call fcn.00486650
add esp, 4
mov dword [ebp - 0x108], 0
jmp 0x46f7e6
mov eax, dword [ebp - 0x10c]
push eax
call fcn.00470770
add esp, 4
cmp dword [ebp - 0x108], 1
jne 0x46f805
mov ecx, dword [ebp - 0x110]
mov dword [0x65a45c], ecx
mov dword [0x661ef0], 0
jmp 0x46f814
push str._Couldnt_open_pipe_or_command_
call fcn.0041dcf0
add esp, 4
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050d210
mov esp, ebp
pop ebp
ret
Function at 0x4706c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
call fcn.0044b3a0
add esp, 4
movsx ecx, word [0x662006]
imul edx, ecx, 0x14
mov eax, dword [edx + 0x662024]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x470736
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x470700
mov dword [ebp - 0xc], 0x100
jmp 0x470713
movsx edx, word [0x662006]
imul eax, edx, 0x14
mov ecx, dword [eax + 0x662028]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call fcn.00529b40
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x4706e9
mov ecx, dword [ebp - 8]
push ecx
call fcn.00514b00
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.00514120
add esp, 4
mov eax, 8
imul ecx, eax, 0x36
cmp dword [ecx + 0x662680], 0
jne 0x470764
call fcn.00486680
mov esp, ebp
pop ebp
ret

Function at 0x470770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.0046b750
mov dword [ebp - 0xc], eax
mov ecx, dword [0x662a1c]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x4707cb
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00529b40
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
push 0xa
call fcn.00526bd0
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
jmp 0x47078f
mov eax, dword [ebp - 8]
push eax
call fcn.00514b00
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.00514120
add esp, 4
mov edx, 8
imul eax, edx, 0x36
cmp dword [eax + 0x662680], 0
jne 0x4707f9
call fcn.00486680
mov esp, ebp
pop ebp
ret
Function at 0x47f860
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x47f87e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 8
jge 0x47f8ac
cmp dword [ebp - 4], 0
jne 0x47f8ac
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47f8a3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x47f8aa
mov dword [ebp - 4], 1
jmp 0x47f875
cmp dword [ebp - 4], 0
jne 0x47f8cd
push 0x5b24f8
call fcn.0041dcf0
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x47f936
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x47f8ec
mov dword [ebp - 0xc], 1
jmp 0x47f8f3
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 4], 0
jne 0x47f91e
push str._Clipboard_copy_failed_
call fcn.0041dcf0
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x47f933
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
push ecx
call fcn.0047f780
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4814d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48150e
cmp dword [ebp + 0x10], 0
je 0x48150e
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x481520
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
call fcn.005139f0
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x483e70
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
je 0x483e85
mov dword [ebp - 8], 0x5b2c20
jmp 0x483e8c
mov dword [ebp - 8], 0x5b2c60
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x20006
push 0
mov edx, dword [ebp - 0x18]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x483eb7
mov eax, 1
jmp 0x483f27
cmp dword [ebp + 8], 0
je 0x483ec6
mov dword [ebp - 0xc], 0x14
jmp 0x483ecd
mov dword [ebp - 0xc], 0x14
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x483ee5
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x1c]
jge 0x483f18
mov eax, dword [ebp - 4]
push eax
call fcn.00483e20
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051f5a0
add esp, 4
jmp 0x483edc
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x484bb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0xc], 0xffffffff
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0050eb10
add esp, 0xc
mov dword [ebp - 0x60], 0x44
cmp dword [ebp + 0xc], 0
jne 0x484c02
mov dword [ebp - 0x34], 0x100
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x24], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x20], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.004854e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x484ca2
cmp dword [ebp + 0xc], 0
jne 0x484c2c
mov dword [ebp - 8], 1
jmp 0x484c33
mov dword [ebp - 8], 0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x484c87
cmp dword [ebp + 0xc], 0
jne 0x484c71
push 0
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0053935d
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484c94
push str._unable_to_create_win32_process_
call fcn.0041dcf0
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.0051f5a0
add esp, 4
jmp 0x484caf
push str.w32_CreateProcess
call fcn.00402660
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4853d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x65e988], 0
jne 0x48540c
mov dword [0x65e98c], 0x80
mov eax, dword [0x65e98c]
shl eax, 1
push eax
call fcn.0051f5d0
add esp, 4
mov dword [0x65e988], eax
cmp dword [0x65e988], 0
je 0x48548b
mov ecx, dword [0x65e98c]
push ecx
mov edx, dword [0x65e988]
push edx
call fcn.00405680
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 8], eax
mov eax, dword [0x65e98c]
sub eax, 1
cmp dword [ebp - 8], eax
jl 0x485487
mov ecx, dword [0x65e98c]
shl ecx, 1
mov dword [0x65e98c], ecx
mov edx, dword [0x65e98c]
shl edx, 1
push edx
mov eax, dword [0x65e988]
push eax
call fcn.00520770
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48547c
mov ecx, dword [0x65e988]
push ecx
call fcn.0051f5a0
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [0x65e988], edx
jmp 0x485489
jmp 0x48548b
jmp 0x48540c
cmp dword [ebp - 8], 0
je 0x4854d0
cmp dword [0x65e988], 0
je 0x4854d0
cmp dword [ebp - 4], 0
je 0x4854ac
mov eax, dword [ebp - 4]
push eax
call fcn.0051f5a0
add esp, 4
xor ecx, ecx
jne 0x48549a
push 0xffffffffffffffff
mov edx, dword [0x65e988]
push edx
call fcn.00485550
add esp, 8
mov dword [0x65e984], eax
mov eax, dword [0x65e984]
mov dword [ebp - 4], eax
jmp 0x4854d7
mov dword [ebp - 4], str.ERROR
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x485fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x659780]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x65e994], 0
jne 0x486079
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
push 6
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jge 0x48600b
push 0
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.004843a0
add esp, 8
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x48607e
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.004861a0
add esp, 8
test eax, eax
jne 0x486033
push 0
push 0
call fcn.004843a0
add esp, 8
jmp 0x48606c
lea edx, [ebp - 0x108]
push edx
call fcn.0045a9d0
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.00403360
add esp, 4
mov dword [0x65e994], eax
cmp dword [0x65e994], 0
jne 0x48606c
push 0x579d90
call fcn.00402660
add esp, 4
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x65e994]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050d210
mov esp, ebp
pop ebp
ret
Function at 0x487660
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0
mov dword [0x65e9a0], 0xffffffff
push 1
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00484530
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4876af
push 0x5b31c4
call fcn.00402660
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x487776
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
call fcn.004854e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4876d8
push str.exec_shell
call fcn.00402660
add esp, 4
jmp 0x487776
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0050eb10
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x100
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x28], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x24], ecx
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
je 0x48773d
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
xor eax, eax
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x487776
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00486110
add esp, 4
mov edx, dword [ebp - 0x1c]
mov dword [0x65e9a0], edx
cmp dword [ebp - 8], 0
je 0x487788
mov eax, dword [ebp - 8]
push eax
call fcn.0051f5a0
add esp, 4
xor ecx, ecx
jne 0x487776
cmp dword [ebp - 4], 0
je 0x48779e
mov edx, dword [ebp - 4]
push edx
call fcn.0051f5a0
add esp, 4
xor eax, eax
jne 0x48778c
mov eax, dword [0x65e9a0]
mov esp, ebp
pop ebp
ret

Function at 0x487c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x65e9d0], 0
je 0x487cad
mov eax, dword [0x65e9d0]
push eax
call fcn.0051f5a0
add esp, 4
cmp dword [0x65e9e4], 0
je 0x487cc5
mov ecx, dword [0x65e9e4]
push ecx
call fcn.0051f5a0
add esp, 4
cmp dword [0x65e9e0], 0
je 0x487d3e
cmp dword [0x65e9dc], 0
je 0x487d0a
push 0
mov edx, dword [0x65e9dc]
push edx
call dword [sym.imp.ole32.dll_CoDisconnectObject]
mov eax, dword [0x65e9dc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x487d03
push 1
mov ecx, dword [ebp - 4]
call fcn.004893a0
mov dword [ebp - 8], eax
jmp 0x487d0a
mov dword [ebp - 8], 0
cmp dword [0x65e9d4], 0
je 0x487d20
mov ecx, dword [0x65e9d4]
push ecx
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
cmp dword [0x65e9d8], 0
je 0x487d38
push 0
mov edx, dword [0x65e9d8]
push edx
call dword [sym.imp.OLEAUT32.dll_GetActiveObject]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [ebp + 8]
push eax
call fcn.0051fbe0
mov esp, ebp
pop ebp
ret
Function at 0x48a8b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 8
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.004854e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48a8f1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.0051f5a0
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x513700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00513320
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x513732
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x5614b0]
call dword [ebp - 8]
jmp 0x51373c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x5498e6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005492d1

Function at 0x54d700
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x54d727
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00522a10
add esp, 4
or eax, 0xffffffff
jmp 0x54d729
xor eax, eax
pop ebp
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x305c50eb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rdata
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x6599435b
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4026d0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x40ff18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.00402480
xor ebp, ebp
mov ecx, esi
mov dword [esp + 0x14], ebp
call fcn.004026b0
test eax, eax
je 0x402718
mov ecx, esi
call fcn.00404020
mov esi, dword [esi]
cmp esi, ebp
jne 0x402760
mov esi, 0x415f40
jmp 0x402760
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x40272c
push eax
lea ecx, [esp + 0xc]
call fcn.00403ea0
jmp 0x402735
lea ecx, [esp + 8]
call fcn.004029d0
mov esi, dword [esi]
cmp esi, ebp
jne 0x402740
mov esi, 0x415f40
push esi
lea ecx, [esp + 0xc]
call fcn.00402940
mov esi, dword [esp + 8]
cmp esi, ebp
jne 0x402757
mov esi, 0x415f40
lea ecx, [esp + 8]
call fcn.00404020
cmp eax, 0x104
jb 0x402795
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00402490
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push ebx
push edi
push eax
call fcn.00409530
mov dx, word [esi]
mov ecx, eax
mov eax, 0x41305c
add esp, 4
mov dword [esp + 0x24], ecx
mov edi, ecx
cmp dx, word [eax]
mov ebx, 2
jne 0x4027c8
mov ax, word [0x41305c]
lea edi, [ecx + 2]
mov word [ecx], ax
add esi, ebx
mov al, byte [esi]
test al, al
je 0x4027fe
cmp al, 0x5c
jne 0x4027d3
dec ebx
push eax
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
test eax, eax
je 0x4027f0
mov cl, byte [esi]
inc esi
mov byte [edi], cl
inc edi
mov dl, byte [esi]
mov ecx, dword [esp + 0x24]
mov byte [edi], dl
inc esi
inc edi
cmp ebx, ebp
ja 0x4027c8
test ebx, ebx
jne 0x40286d
jmp 0x402808
mov ecx, dword [esp + 0x24]
push 0
push ecx
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
jne 0x40282c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402869
mov ebp, 1
mov ebx, 1
mov al, byte [esi]
test al, al
je 0x402864
cmp al, 0x5c
jne 0x40283d
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
test eax, eax
je 0x40285a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov cl, byte [esi]
inc esi
mov byte [edi], cl
inc edi
test ebx, ebx
jne 0x402831
cmp byte [esi], 0
jne 0x402804
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
test ecx, ecx
je 0x40287c
push ecx
call fcn.0040966a
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00402490
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 4