joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a26
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
cmp dword [ebp + 8], 0
je 0x412acb
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jbe 0x412aa4
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [ebp + eax - 0x219]
cmp ecx, 0x2f
je 0x412a96
mov edx, dword [ebp - 0x21c]
movsx eax, byte [ebp + edx - 0x219]
cmp eax, 0x5c
jne 0x412aa4
mov ecx, dword [ebp - 0x21c]
mov byte [ebp + ecx - 0x219], 0
lea edx, [ebp - 0x218]
push edx
call fcn.0040bbdd
add esp, 4
and eax, 0xff
test eax, eax
jne 0x412acb
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
test edx, edx
jne 0x412ada
jmp 0x412c18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x412b20
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2f
je 0x412b0c
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x412b15
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x412aec
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp + 0xc]
je 0x412b87
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x320]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp + 0xc]
mov byte [ebp + eax - 0x320], 0
lea ecx, [ebp - 0x320]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00412a26
add esp, 8
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x108], 0
cmp dword [ebp + 8], 0
je 0x412bad
push 0x104
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [ebp - 5], 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x110], eax
mov ecx, 0x104
sub ecx, dword [ebp - 0x110]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x110]
lea ecx, [ebp + eax - 0x108]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [ebp - 5], 0
lea edx, [ebp - 0x108]
push edx
call fcn.0040bbdd
add esp, 4
and eax, 0xff
test eax, eax
jne 0x412c18
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x41664c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510eab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x320
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0
mov ecx, 0x5b7890
call fcn.0050f5b0
mov ecx, 0x5b7878
call fcn.0050f5b0
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4166b9
jmp 0x4168a7
push 0x100
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x214]
mov dword [ebp - 0x324], edx
mov eax, dword [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x41689a
push str.S_1_5_21_
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x416717
jmp 0x4166b9
lea ecx, [ebp - 0x10c]
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.ProfileImagePath
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x320]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x32c]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x31c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x320]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x31c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [0x5b84b8], eax
jmp 0x4167c6
mov ecx, dword [0x5b84b8]
sub ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0
jle 0x4167e6
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x31c]
cmp eax, 0x5c
jne 0x4167e4
jmp 0x4167e6
jmp 0x4167b7
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov dword [ebp - 0x210], 0
jmp 0x41681f
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [ebp - 0x210]
add eax, 1
mov dword [ebp - 0x210], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x218]
jge 0x416848
mov edx, dword [ebp - 0x210]
mov eax, dword [0x5b84b8]
mov cl, byte [ebp + eax - 0x31c]
mov byte [ebp + edx - 0x20c], cl
jmp 0x416801
mov edx, dword [ebp - 0x210]
mov byte [ebp + edx - 0x20c], 0
push 0x5b8594
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x416873
jmp 0x4166b9
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, 0x5b7890
call fcn.0050f680
lea edx, [ebp - 0x10c]
push edx
mov ecx, 0x5b7878
call fcn.0050f680
jmp 0x4166b9
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x497e48
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
mov dword [ebp - 0x510], 0
push 0x5b8d6c
lea eax, [ebp - 0x50c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b7cb4
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x561b28
lea edx, [ebp - 0x200]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0050c456
add esp, 4
test eax, eax
je 0x497ec4
push 0x561b38
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x40c], eax
jmp 0x497edc
push 0x561b3c
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x4980a7
mov dword [0x5b84b8], 0
jmp 0x497f02
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x200
jge 0x497f1e
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x400], 0
jmp 0x497ef5
mov edx, dword [ebp - 0x40c]
push edx
push 0x200
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
lea ecx, [ebp - 0x400]
push ecx
call fcn.00401fca
add esp, 4
push str..RUN
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x498078
push str.__0__FALSE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x498078
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x408], eax
mov dword [0x5b84b8], 0
jmp 0x497fb3
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x408]
jge 0x497fd7
mov ecx, dword [0x5b84b8]
movsx edx, byte [ebp + ecx - 0x400]
cmp edx, 0x22
jne 0x497fd5
jmp 0x497fd7
jmp 0x497fa4
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov dword [ebp - 0x404], 0
jmp 0x49802a
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [ebp - 0x404]
add ecx, 1
mov dword [ebp - 0x404], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x408]
jge 0x498076
mov eax, dword [0x5b84b8]
movsx ecx, byte [ebp + eax - 0x400]
cmp ecx, 0x22
jne 0x49805a
mov edx, dword [ebp - 0x404]
mov byte [ebp + edx - 0x50c], 0
jmp 0x498076
mov eax, dword [ebp - 0x404]
mov ecx, dword [0x5b84b8]
mov dl, byte [ebp + ecx - 0x400]
mov byte [ebp + eax - 0x50c], dl
jmp 0x49800e
jmp 0x498097
mov eax, dword [ebp - 0x40c]
mov ecx, dword [eax + 0xc]
and ecx, 0x10
test ecx, ecx
je 0x49808a
jmp 0x498097
mov edx, 1
test edx, edx
jne 0x497ee9
mov eax, dword [ebp - 0x40c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea edx, [ebp - 0x50c]
push edx
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [ebp - 0x510]
or al, 1
mov dword [ebp - 0x510], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4ae964
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5129c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
lea eax, [ebp - 0x210]
push eax
call fcn.00401d93
add esp, 4
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x218]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x210]
call sub.MFC42.DLL_CString::CString
cmp dword [0x5b8514], 1
jne 0x4aea16
push str.__SaltaReg
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
push 0x54
push 0x56aee0
push 0x56aee8
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4aea36
lea edx, [ebp - 0x20c]
push edx
push 0x54
push str.ReEXEc
push 0x56af24
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4aea44
Capabilities:
Copy file
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x404], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x608]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x60c], esp
lea edx, [ebp - 0x608]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x614], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0
jne 0x4aeaab
jmp 0x4aec8f
push ecx
mov ecx, esp
mov dword [ebp - 0x610], esp
lea eax, [ebp - 0x608]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x61c], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x620], eax
mov ecx, dword [ebp - 0x620]
push ecx
lea edx, [ebp - 0x608]
push edx
call fcn.004f9b07
add esp, 8
test eax, eax
jne 0x4aeaf3
jmp 0x4aec8f
mov dword [0x5b84b8], 0
jmp 0x4aeb0c
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x200
jge 0x4aeb28
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x200], 0
jmp 0x4aeaff
lea edx, [ebp - 0x608]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov dword [0x5b84b8], eax
jmp 0x4aeb59
mov ecx, dword [0x5b84b8]
sub ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0xffffffff
jle 0x4aeb79
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x608]
cmp eax, 0x5c
jne 0x4aeb77
jmp 0x4aeb79
jmp 0x4aeb4a
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov dword [ebp - 0x404], 0
jmp 0x4aebb2
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [ebp - 0x404]
add eax, 1
mov dword [ebp - 0x404], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x408]
jge 0x4aebdb
mov edx, dword [ebp - 0x404]
mov eax, dword [0x5b84b8]
mov cl, byte [ebp + eax - 0x608]
mov byte [ebp + edx - 0x200], cl
jmp 0x4aeb94
push 0x5b7ba4
push 0x56af58
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push str.EliStartPage_v50.12
lea edx, [ebp - 0x200]
push edx
push 0x5b7ba4
push str._sMuestras_s.Muestra__s
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 0
lea ecx, [ebp - 0x400]
push ecx
lea edx, [ebp - 0x608]
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x4aec80
lea eax, [ebp - 0x400]
push eax
push str.Por_favor__envienos_el_INFOSAT.TXT_y_una_muestra_del_fichero_n_s_n_a__virus_satinfo.es_.__Gracias._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [0x5b851c], 0
jne 0x4aec71
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x4af96a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512a30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
lea eax, [ebp - 0x418]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4afb3a
mov dword [ebp - 0x414], 0
push 0x400
lea ecx, [ebp - 0x40c]
push ecx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x414]
add edx, 1
mov dword [ebp - 0x414], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4afa22
jmp 0x4afb2d
lea eax, [ebp - 0x40c]
push eax
push 0x56b654
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x56b66c
push 0x5b6504
push 0x80000000
lea ecx, [ebp - 0x41c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x424], eax
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x428], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x428]
push eax
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x41c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::MakeUpper
push str.EPLRR9.DLL
lea ecx, [ebp - 0x410]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4afb17
push 0x5b4d2c
lea ecx, [ebp - 0x410]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4afb17
mov ecx, 0x5b4d28
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x410]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4afb17
push 0x5b4b28
lea ecx, [ebp - 0x410]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4afb28
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f680
jmp 0x4af9de
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4d6b35
Capabilities:
Create process on windows
Delete file
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x308], 0
cmp dword [ebp + 8], 0x80000002
je 0x4d6b69
cmp dword [ebp + 8], 0x80000003
je 0x4d6b69
jmp 0x4d6d0d
lea eax, [ebp - 0x414]
push eax
push 0x20119
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4d6b8e
jmp 0x4d6d0d
push 0x5b7cb4
push 0x594ee4
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x594eec
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jne 0x4d6bd1
jmp 0x4d6d0d
cmp dword [ebp + 8], 0x80000002
jne 0x4d6bef
mov edx, dword [ebp - 0x410]
push edx
push 0x594ef0
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
cmp dword [ebp + 8], 0x80000003
jne 0x4d6c0d
mov eax, dword [ebp - 0x410]
push eax
push 0x594f04
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, dword [ebp - 0x410]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, dword [ebp - 0x410]
push eax
push 0x594f14
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea edx, [ebp - 0x40c]
push edx
push 0x594f28
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [ebp - 0x40c]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x200
lea eax, [ebp - 0x614]
push eax
mov ecx, dword [ebp - 0x308]
mov dword [ebp - 0x618], ecx
mov edx, dword [ebp - 0x618]
push edx
mov eax, dword [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x308]
add ecx, 1
mov dword [ebp - 0x308], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4d6d00
lea edx, [ebp - 0x614]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x594f34
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004d6b35
add esp, 8
jmp 0x4d6c8c
mov ecx, dword [ebp - 0x414]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4d6d11
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0x80000002
je 0x4d6d31
cmp dword [ebp + 8], 0x80000003
je 0x4d6d31
jmp 0x4d6e2f
push 0x5b7cb4
push str._skey
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x594f44
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4d6d74
jmp 0x4d6e2f
cmp dword [ebp + 8], 0x80000002
jne 0x4d6d92
mov edx, dword [ebp - 0x20c]
push edx
push str.RegistryMachine_
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
cmp dword [ebp + 8], 0x80000003
jne 0x4d6db0
mov eax, dword [ebp - 0x20c]
push eax
push str.RegistryUser_
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, dword [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov eax, dword [ebp - 0x20c]
push eax
push str.__1_6_17_30_12__n
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea edx, [ebp - 0x208]
push edx
push str.Regini___s_
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4d99fc
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov ecx, 0x5b7604
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll__chdir]
add esp, 4
test eax, eax
je 0x4d9a22
jmp 0x4d9b56
mov dword [0x5b84b8], 0
jmp 0x4d9a3b
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x104
jae 0x4d9a57
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x114], 0
jmp 0x4d9a2e
lea edx, [ebp - 0x140]
push edx
push 0x596b44
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x140]
and eax, 0x10
test eax, eax
jne 0x4d9aa8
movsx ecx, byte [ebp - 0x114]
test ecx, ecx
jne 0x4d9a89
jmp 0x4d9ac0
push 0
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4d9a6f
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x140]
push ecx
push 0x596b48
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x140]
and edx, 0x10
cmp edx, 0x10
jne 0x4d9b31
movsx eax, byte [ebp - 0x114]
cmp eax, 0x2e
je 0x4d9b31
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [0x5b7604]
push edx
push 0x596b4c
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x248]
push ecx
call fcn.004e6241
add esp, 4
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4d9ae5
mov ecx, dword [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov esp, ebp
pop ebp
ret
Function at 0x4e5e11
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov dword [0x5b84b8], 0x43
jmp 0x4e5e2d
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x5b
jge 0x4e5fb4
mov ecx, dword [0x5b84b8]
sub ecx, 0x40
push ecx
call dword [sym.imp.MSVCRT.dll__chdrive]
add esp, 4
test eax, eax
je 0x4e5e53
jmp 0x4e5e20
mov edx, dword [0x5b84b8]
push edx
push str.._c:con.sys
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov eax, dword [0x5b84b8]
push eax
push str.cmd__c__del_._c:con.sys.__a__q_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov ecx, dword [0x5b84b8]
push ecx
push str.cmd__c__rd_._c:con.sys_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov edx, dword [0x5b84b8]
push edx
push str.._c:con.ini
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov eax, dword [0x5b84b8]
push eax
push str.cmd__c__del_._c:con.ini.__a__q_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov ecx, dword [0x5b84b8]
push ecx
push str.cmd__c__rd_._c:con.ini_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov edx, dword [0x5b84b8]
push edx
push str.._c:con.usb
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov eax, dword [0x5b84b8]
push eax
push str.cmd__c__del_._c:con.usb.__a__q_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov ecx, dword [0x5b84b8]
push ecx
push str.cmd__c__rd_._c:con.usb_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_WinExec]
jmp 0x4e5e20
pop ebp
ret