joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442076
Capabilities:
Delete file

Disassembly:
mov eax, 0x53c424
call fcn.004f8378
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp word [esi + 0x90], 0
je 0x442113
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x4420cb
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x404
jne 0x4420b9
push 0x50
lea ecx, [esi + 0x92]
pop edx
call fcn.004d6510
push 0
add esi, 0x92
push 0
push esi
mov ecx, ebx
call fcn.0043a3c1
mov ecx, dword [ebx + 0x1187]
and dword [ebx + 0xba3], 0
push 0
push str.WT_UpgradeAddr
mov eax, dword [ecx]
lea edx, [ebp + 0x10]
push str.System
push edx
call dword [eax + 0x9c]
mov eax, dword [ebp + 0x10]
cmp dword [eax - 8], 0
je 0x44210b
push 0
push 0x40
push 0x7e5
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [ebp + 0x10]
jmp 0x442286
mov eax, dword [esi + 0x145]
mov edx, dword [ebp + 0x10]
mov ecx, eax
push edi
sub ecx, dword [ebp + 0xc]
lea edi, [ecx + edx]
cmp eax, edi
jge 0x44212b
mov edi, eax
cmp dword [0x5a5604], 0
jne 0x44214a
push 0x809f
mov ecx, ebx
call fcn.0043a36f
mov dword [0x5a5604], 1
mov ecx, dword [ebx + 0x1187]
lea eax, [ebp + 8]
push eax
call fcn.004b75bd
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.005191bd
mov eax, dword [esi + 0x141]
mov byte [ebp - 4], 1
cmp eax, dword [esi + 0x13d]
jl 0x442185
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x442237
test eax, eax
jne 0x4421de
push eax
push 0x3001
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.005192cf
test eax, eax
je 0x442237
lea ecx, [ebp - 0x20]
call fcn.005195c9
cmp eax, edi
mov dword [ebp - 0x10], eax
jge 0x4421d4
mov eax, dword [ebp - 0x20]
push 2
push 0
lea ecx, [ebp - 0x20]
call dword [eax + 0x28]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
sub edi, eax
lea eax, [eax + esi + 0x149]
push edi
push eax
call fcn.00519426
lea ecx, [ebp - 0x20]
call fcn.005194ea
jmp 0x442237
jle 0x442237
push 0
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.005192cf
test eax, eax
je 0x442237
lea ecx, [ebp - 0x20]
call fcn.005195c9
push 0xfffffffffffffff0
mov ebx, eax
pop eax
sub eax, dword [esi + 0x141]
add ebx, eax
cmp ebx, edi
jge 0x44222c
mov eax, dword [ebp - 0x20]
push 2
push 0
lea ecx, [ebp - 0x20]
call dword [eax + 0x28]
sub edi, ebx
lea eax, [ebx + esi + 0x149]
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.00519426
lea ecx, [ebp - 0x20]
call fcn.005194ea
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
pop edi
cmp dword [ebp + 0xc], eax
jne 0x442273
and dword [0x5a5604], 0
mov ecx, dword [ebx + 0xcf9]
lea esi, [ebx + 0xcf9]
test ecx, ecx
je 0x442261
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi], 0
push 0
push 0x24
push 0x7e5
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00519212
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00513730
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x45072b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x4507c9
cmp dword [ebp + 8], ebx
je 0x4507c9
cmp dword [ebp + 0xc], ebx
je 0x4507c9
push esi
push edi
mov edi, 0xf003f
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea ecx, [ebp - 4]
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
push esi
call fcn.0045067c
test eax, eax
je 0x45079c
lea eax, [ebp + 0x10]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x45079c
cmp dword [ebp - 4], ebx
je 0x450796
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 4], ebx
pop edi
pop esi
je 0x4507c9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret

Function at 0x4507cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x53dfa3
call fcn.004f8378
sub esp, 0x118
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 0x20], ebx
je 0x4508cd
cmp dword [ebp + 0xc], ebx
je 0x4508cd
push esi
push edi
mov dword [ebp - 0x10], ebx
mov esi, 0xf003f
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x10]
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push edi
call fcn.0045067c
test eax, eax
je 0x45084d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x45084d
cmp dword [ebp - 0x10], ebx
je 0x450847
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], bl
mov dword [ebp - 0x1c], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov dword [ebp + 0x10], ebx
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x14]
push eax
call fcn.0051379e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
call fcn.005134a5
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], 1
mov byte [ebp - 4], 1
call fcn.00513730
cmp dword [ebp - 0x10], ebx
pop edi
pop esi
je 0x4508da
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4508da
mov ecx, dword [ebp + 8]
push 0x5a4c3c
call fcn.0051379e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4508ea
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x53dfc0
call fcn.004f8378
sub esp, 0x37c
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.004f0cff
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 0x388]
push str._s.
push eax
call fcn.004f9c39
add esp, 0xc
lea eax, [ebp - 0x388]
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.004f0dc2
test eax, eax
je 0x4509eb
mov esi, 0x5942c8
lea ecx, [ebp - 0x2c]
call fcn.004f0fe2
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
call fcn.004f0fa9
test eax, eax
jne 0x4509e1
lea eax, [ebp + 8]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004f11da
push 0xc8
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00513b60
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.004f95e0
and byte [ebp - 4], 0
pop ecx
pop ecx
lea ecx, [ebp + 8]
call fcn.00513730
mov eax, dword [ebp - 0x2c]
push 0x10
lea ecx, [ebp - 0x2c]
call dword [eax + 0x38]
test eax, eax
lea eax, [ebp - 0xf4]
push eax
push edi
push esi
je 0x4509c5
lea eax, [ebp - 0x284]
push eax
call fcn.004f9c39
lea eax, [ebp - 0x284]
push eax
call fcn.004508ea
add esp, 0x14
jmp 0x4509e1
lea eax, [ebp - 0x1bc]
push eax
call fcn.004f9c39
add esp, 0x10
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x10], 0
jne 0x45093e
lea ecx, [ebp - 0x2c]
call fcn.004f0d78
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x450a02
xor esi, esi
jmp 0x450a05
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004f0d3c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x45151d
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x74], edi
je 0x45155d
call fcn.00451e72
test eax, eax
je 0x451563
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x4518d3
push edi
push edi
call fcn.004faf4f
add esp, 0x18
cmp eax, edi
mov dword [esi + 0x90], eax
je 0x45155d
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
pop esi
leave
ret
mov eax, dword [esi + 0x98]
cmp eax, edi
je 0x45155d
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x98]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 4]
push edi
neg edx
push edx
mov eax, dword [esi + 0x98]
push dword [ebp - 8]
mov ecx, dword [eax]
push dword [ebp - 4]
push edi
push dword [esi + 0x50]
push dword [esi + 0x4c]
push edi
push edi
push dword [esi + 0x78]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x45155d
push edi
push edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
pop eax
jmp 0x45155f
Function at 0x4515c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0052dc74
push dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x451669
call fcn.0052dc74
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x451669
call fcn.0052dc74
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x451669
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x451665
test ebx, ebx
je 0x451665
push edi
push eax
push ebx
call fcn.004f87d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push edi
push esi
call fcn.004510d1
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop ebx
jmp 0x45166b
xor edi, edi
jmp 0x451659
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x4563aa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 8], ecx
call fcn.00459e72
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 4], eax
ja 0x45649d
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
mov edi, SysReAllocStringLen
push str..htm
push edi
call fcn.004564a7
test eax, eax
jne 0x45649d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x210]
push str._shellopencommand
push eax
call esi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.004564a7
test eax, eax
jne 0x45649d
lea eax, [ebp - 0x210]
push str.__1_
push eax
call fcn.004fa868
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x45647a
lea eax, [ebp - 0x210]
push 0x591fa8
push eax
call fcn.004fa868
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x45647a
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x211]
jmp 0x45647c
mov byte [edi], bl
push 0x590724
push edi
call esi
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4564a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x456500
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x459837
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x53e67e
call fcn.004f8378
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005134a5
mov eax, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.005134a5
mov eax, dword [edi + 0x20]
lea ecx, [esi + 0x40]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.005134a5
mov eax, dword [edi + 0x44]
add edi, 0x74
mov dword [esi + 0x44], eax
mov eax, dword [edi - 0x2c]
mov dword [esi + 0x48], eax
mov eax, dword [edi - 0x28]
mov dword [esi + 0x4c], eax
mov eax, dword [edi - 0x24]
mov dword [esi + 0x50], eax
mov eax, dword [edi - 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [edi - 0x1c]
mov dword [esi + 0x58], eax
mov eax, dword [edi - 0x18]
mov dword [esi + 0x5c], eax
mov eax, dword [edi - 0x14]
mov dword [esi + 0x60], eax
mov eax, dword [edi - 0x10]
mov dword [esi + 0x64], eax
mov eax, dword [edi - 0xc]
mov dword [esi + 0x68], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x6c], eax
mov eax, dword [edi - 4]
push edi
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 2
mov dword [esi + 0x70], eax
call fcn.005134a5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x47e770
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4dc
push edi
push 0x90
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.004f8540
add esp, 0xc
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47e7ae
xor eax, eax
jmp 0x47e919
push dword [ebp + 8]
lea eax, [ebp - 0x3d8]
push eax
call fcn.004f95e0
lea eax, [ebp - 0x3d8]
push 0x5c
push eax
call fcn.004fb174
add esp, 0x10
test eax, eax
je 0x47e7d6
and byte [eax + 1], 0
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004f95e0
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.004f95f0
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.0047e636
add esp, 0x18
test eax, eax
je 0x47e8f8
push 0x104
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.004f8540
add esp, 0xc
cmp dword [ebp + 0x10], 1
jne 0x47e8d2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x404
jne 0x47e878
lea eax, [ebp - 0x50]
push eax
call fcn.004f8bc0
pop ecx
mov edx, eax
lea ecx, [ebp - 0x50]
call fcn.004d6510
lea eax, [ebp - 0x2a8]
push eax
call fcn.004f8bc0
pop ecx
mov edx, eax
lea ecx, [ebp - 0x2a8]
call fcn.004d6510
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004f95e0
lea eax, [ebp - 0x194]
push 0x590b68
push eax
call fcn.004f95f0
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004f95f0
lea eax, [ebp - 0x194]
push 0x596270
push eax
call fcn.004f95f0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004f95f0
add esp, 0x28
jmp 0x47e8e7
lea eax, [ebp - 0x10]
push 0x10
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004f87d0
add esp, 0xc
lea eax, [ebp - 0x194]
mov ecx, esi
push eax
push dword [esi + 8]
call fcn.005120aa
lea eax, [ebp - 0x2d4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47e7da
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
pop esi
pop edi
leave
ret
Function at 0x4a3cab
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x545a00
call fcn.004f8378
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 0x5cc
call fcn.00517922
xor edi, edi
cmp eax, edi
je 0x4a3cdd
cmp dword [esi + 0x8a0], edi
je 0x4a3cdd
push edi
mov ecx, eax
call fcn.00517bf5
mov eax, dword [esi + 0x564]
push str.CERT
lea ecx, [ebp - 0x10]
mov dword [eax + 0xa61], 1
call fcn.0051379e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [eax - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042fd04
pop ecx
mov ebx, dword [eax]
mov eax, dword [esi + 0x61c]
push edi
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.00513b60
push eax
push ebx
push 0xb
push dword [ebp - 0x14]
call fcn.004bf672
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00513730
mov eax, dword [esi + 0x564]
push dword [eax + 0xa61]
call fcn.004bf08f
push dword [esi + 0x1c]
mov edi, eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a3e0e
push 5
push 0x3e9
mov ecx, esi
call fcn.00517922
mov ecx, eax
call fcn.00517bf5
push 5
push 0x454
mov ecx, esi
call fcn.00517922
mov ecx, eax
call fcn.00517bf5
test edi, edi
je 0x4a3dad
push 0x455
mov ecx, esi
call fcn.00517922
mov ecx, eax
call fcn.00517c5e
mov ecx, esi
call fcn.004a3fac
jmp 0x4a3e0e
mov ecx, esi
call fcn.004a48fc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 0x1c]
je 0x4a3e0e
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, esi
call fcn.00517c5e
push 0
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00513730
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4a3e29
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x545a1c
call fcn.004f8378
sub esp, 0xc
push esi
push edi
mov esi, ecx
push 0x5cc
call fcn.00517922
xor edi, edi
cmp eax, edi
je 0x4a3e5b
cmp dword [esi + 0x8a0], edi
je 0x4a3e5b
push 5
mov ecx, eax
call fcn.00517bf5
mov eax, dword [esi + 0x564]
push ebx
push 0x596bf8
lea ecx, [ebp - 0x10]
mov dword [eax + 0xa61], edi
call fcn.0051379e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [eax - 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0042fd04
pop ecx
mov ebx, dword [eax]
mov eax, dword [esi + 0x61c]
push edi
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.00513b60
push eax
push ebx
push 0xb
push dword [ebp - 0x14]
call fcn.004bf672
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00513730
mov eax, dword [esi + 0x564]
push dword [eax + 0xa61]
call fcn.004bf08f
test eax, eax
je 0x4a3efa
push 0x455
mov ecx, esi
call fcn.00517922
mov ecx, eax
call fcn.00517c5e
push 0
push 1
push 0x28
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.004a3fac
jmp 0x4a3f5b
mov ecx, esi
call fcn.004a48fc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 0x1c]
je 0x4a3f5b
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, esi
call fcn.00517c5e
push 0
call ebx
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [esi + 0x89c], 0
push 5
pop edi
pop ebx
jne 0x4a3f6a
xor edi, edi
push edi
push 0x3e9
mov ecx, esi
call fcn.00517922
mov ecx, eax
call fcn.00517bf5
push edi
push 0x454
mov ecx, esi
call fcn.00517922
mov ecx, eax
call fcn.00517bf5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00513730
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4a66a4
Capabilities:
Delete file

Disassembly:
mov eax, 0x545e20
call fcn.004f8378
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x570], ebx
je 0x4a67da
lea edi, [esi + 0x560]
mov ecx, edi
call fcn.005136bb
mov eax, dword [0x59fe84]
mov dword [ebp - 0x14], eax
push 0xf0c2
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00518bf6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004f900f
cmp dword [esi + 0x8ac], ebx
pop ecx
mov dword [ebp - 0x18], ebx
jle 0x4a6734
call fcn.004f901c
cdq
idiv dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov al, byte [edx + eax]
mov byte [ebp - 0x20], al
push dword [ebp - 0x20]
call fcn.00513b33
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [esi + 0x8ac]
jl 0x4a670a
push str.authcode.bmp
lea ecx, [ebp - 0x10]
call fcn.0051379e
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 1
call fcn.005134a5
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.005134a5
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004a69ba
push 0x2010
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
push dword [ebp - 0x10]
mov dword [esi + 0x5f4], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5a4c3c
push 0x3eb
mov ecx, esi
call fcn.00517922
mov ecx, eax
call fcn.00517acb
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x30]
push ebx
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00513730
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00513730
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
Function at 0x4aef93
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov ebx, ecx
push eax
call fcn.0050f9f9
push 0
lea ecx, [ebp - 4]
call fcn.0050fa0c
mov esi, dword [eax + 0x14]
push 0
lea ecx, [ebp - 4]
add esi, 0x76c
call fcn.0050fa0c
mov edi, dword [eax + 0x10]
push 0
lea ecx, [ebp - 4]
inc edi
call fcn.0050fa0c
imul esi, esi, 0x64
add esi, edi
mov eax, dword [eax + 0xc]
imul esi, esi, 0x64
mov edx, dword [ebp + 8]
lea ecx, [ebx + 0xf1]
add eax, esi
test edx, edx
mov dword [ecx], 1
jne 0x4aeff4
and dword [ecx], edx
mov edx, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4aeffd
mov ecx, eax
mov dword [ebx + 0xc7], ecx
lea ecx, [ebx + 0xcb]
mov dword [ebx + 0xc3], edx
call fcn.00473e29
and dword [ebx + 0xe8], 0
push str.DataDown.Log
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret 8