joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4540
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
jne 0x4c455f
mov dword [ebp - 0x2c], 1
jmp 0x4c4566
mov dword [ebp - 0x2c], 2
push 0x24
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.005533a0
add esp, 0xc
mov dword [ebp - 0x28], 0x24
push 0
push 0x599f14
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4c45a5
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x28]
push edx
push 0xa
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret

Function at 0x4c46b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
push 0
push 1
push 0x1512
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x3f1
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00471a40
test eax, eax
je 0x4c4718
mov byte [0x5e1951], 1
mov edx, dword [ebp - 8]
push edx
push 0
push 0x4c4c10
call fcn.00554077
add esp, 0xc
jmp 0x4c4732
mov byte [0x5e1951], 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0x4c4c10
call fcn.00554077
add esp, 0xc
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x27c], 1
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4c49d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x21c], ecx
push 0x3f2
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 4
call fcn.00465e30
mov ecx, eax
call fcn.00401050
push eax
lea ecx, [ebp - 4]
call fcn.0046e690
mov ecx, dword [0x59a344]
mov dword [ebp - 0x210], ecx
push 0x204
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.005533a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [ebp - 0x210]
push edx
push 0x5e195a
call fcn.00554863
add esp, 8
test eax, eax
je 0x4c4a9c
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x27c], 1
push 0
push 1
push 0x1512
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x21c]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c6940
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.005533a0
add esp, 0xc
mov byte [ebp - 0xc8], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc7]
push ecx
call fcn.005533a0
add esp, 0xc
mov byte [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov byte [ebp - 0x88], 0
xor eax, eax
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov word [ebp - 0x6b], ax
mov byte [ebp - 0x69], al
mov byte [ebp - 0x108], 0
push 0x3f
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005533a0
add esp, 0xc
push 0x40
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004c70c0
add esp, 0xc
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.004c6ea0
add esp, 8
push 0x20
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.005544b0
add esp, 0xc
push 0x20
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.005544b0
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x4c6a55
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x10
jge 0x4c6a7e
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.004c6d00
add esp, 0x10
jmp 0x4c6a46
push 0x20
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.005544b0
add esp, 0xc
push 0x20
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.005544b0
add esp, 0xc
mov dword [ebp - 0x110], 0
jmp 0x4c6ac6
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0x40
jge 0x4c6af1
mov edx, dword [ebp - 0x110]
movsx eax, byte [edx + 0x59ab58]
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp + eax - 0x109]
mov byte [ecx + 0x5e1e28], dl
jmp 0x4c6ab7
push 0x40
push 0x5e1e28
push 0x5e1ddc
call fcn.004c7110
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4c6b20
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.005533a0
add esp, 0xc
mov byte [ebp - 0xc8], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc7]
push ecx
call fcn.005533a0
add esp, 0xc
mov byte [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov byte [ebp - 0x88], 0
xor eax, eax
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov word [ebp - 0x6b], ax
mov byte [ebp - 0x69], al
mov byte [ebp - 0x108], 0
push 0x3f
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005533a0
add esp, 0xc
push 0x40
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004c70c0
add esp, 0xc
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.004c6ea0
add esp, 8
push 0x20
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.005544b0
add esp, 0xc
push 0x20
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.005544b0
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x4c6c35
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x10
jge 0x4c6c63
mov edx, dword [ebp + 0xc]
push edx
mov eax, 0xf
sub eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.004c6d00
add esp, 0x10
jmp 0x4c6c26
push 0x20
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.005544b0
add esp, 0xc
push 0x20
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.005544b0
add esp, 0xc
mov dword [ebp - 0x110], 0
jmp 0x4c6cab
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0x40
jge 0x4c6cd6
mov edx, dword [ebp - 0x110]
movsx eax, byte [edx + 0x59ab58]
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp + eax - 0x109]
mov byte [ecx + 0x5e1de8], dl
jmp 0x4c6c9c
push 0x40
push 0x5e1de8
push 0x5e1dd4
call fcn.004c7110
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret

Function at 0x4c6ea0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x4c6eb6
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jge 0x4c6ed7
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + str.:2_]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x4c6ead
mov esp, ebp
pop ebp
ret
Function at 0x4c6ee0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x4c6ef6
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x30
jge 0x4c6f17
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x59a908]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x4c6eed
mov esp, ebp
pop ebp
ret

Function at 0x4c7080
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x4c7096
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jge 0x4c70b7
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x59ab38]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x4c708d
mov esp, ebp
pop ebp
ret
Function at 0x4c87f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5896c1
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x14]
call fcn.0041d970
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x4c8850
push 0x208
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x4c8861
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4c8995
mov dword [ebp - 0x234], 0
mov edx, dword [ebp - 0x18]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x230]
push eax
push 0x59a43c
mov ecx, dword [ebp - 0x22c]
push ecx
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [ebp - 0x230]
mov eax, dword [edx + 0x10]
shr eax, 0x10
and eax, 0xffff
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0x230]
mov edx, dword [ecx + 0x10]
and edx, 0xffff
mov word [ebp - 0x23a], dx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 0x14]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x238], cx
mov edx, dword [ebp - 0x230]
mov eax, dword [edx + 0x14]
and eax, 0xffff
mov word [ebp - 0x236], ax
movzx ecx, word [ebp - 0x236]
push ecx
movzx edx, word [ebp - 0x238]
push edx
movzx eax, word [ebp - 0x23a]
push eax
movzx ecx, word [ebp - 0x23c]
push ecx
push 0x59a440
lea edx, [ebp - 0x14]
push edx
call fcn.00423c30
add esp, 0x18
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041d990
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041dab0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4c8b90
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d18
call fcn.00555270
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
call fcn.0041e220
mov dword [ebp - 4], 0
jmp 0x4c8bc1
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x4c8cfd
mov dword [ebp - 0x20c], 0
mov ecx, dword [ebp - 4]
push ecx
push str..PhysicalDrive_d
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x4c8c1b
jmp 0x4c8cf8
mov dword [ebp - 0x292c], 0
push 0x2710
push 0
lea ecx, [ebp - 0x2928]
push ecx
call fcn.005533a0
add esp, 0xc
push 0xc
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.005533a0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
push 0x2710
push 0
lea eax, [ebp - 0x2928]
push eax
call fcn.005533a0
add esp, 0xc
push 0
lea ecx, [ebp - 0x292c]
push ecx
push 0x2710
lea edx, [ebp - 0x2928]
push edx
push 0xc
lea eax, [ebp - 0x218]
push eax
push 0x2d1400
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4c8cf6
lea edx, [ebp - 0x2928]
mov dword [ebp - 0x2930], edx
lea eax, [ebp - 0x2d18]
push eax
push 1
mov ecx, dword [ebp - 0x2930]
mov edx, dword [ecx + 0x18]
push edx
lea eax, [ebp - 0x2928]
push eax
call fcn.004c7780
add esp, 0x10
lea ecx, [ebp - 0x2d18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041f760
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c8cfd
jmp 0x4c8bb8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4c8d10
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x30], 0
push 0
push 0
push 0
push 0
push str.Upload
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], 0x59abf8
mov dword [ebp - 0x38], 0
push 0
push 0
push 3
push 0
push 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebp - 0x34], eax
push 0x20200400
push 0
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
push str.POST
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 0x2c], eax
push 0x28
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.005533a0
add esp, 0xc
mov dword [ebp - 0x28], 0x28
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x10], edx
push 0
push 8
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov dword [ebp - 0x30], eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.WININET.dll_HttpEndRequestW]
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x30]
mov esp, ebp
pop ebp
ret
Function at 0x4c9480
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58979c
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x80], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x59afcc
mov ecx, dword [ebp + 0xc]
call fcn.0041daf0
mov dword [ebp - 0x34], 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
push 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4c9510
mov dword [ebp - 0x48c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041dab0
mov eax, dword [ebp - 0x48c]
jmp 0x4c965e
mov dword [ebp - 0x7c], 0x44
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x40], edx
xor eax, eax
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x50], 0x101
lea ecx, [ebp + 8]
push ecx
push str.cmd.exe__c
lea edx, [ebp - 0x14]
push edx
call fcn.0041e090
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.0041e2f0
push eax
lea ecx, [ebp - 0x14]
call fcn.0041e2d0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4c95b5
mov dword [ebp - 0x490], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0041dab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041dab0
mov eax, dword [ebp - 0x490]
jmp 0x4c965e
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0041e330
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x484], 0
push 0x3ff
push 0
lea eax, [ebp - 0x483]
push eax
call fcn.005533a0
add esp, 0xc
mov ecx, 1
test ecx, ecx
je 0x4c9633
push 0
lea edx, [ebp - 0x488]
push edx
push 0x3ff
lea eax, [ebp - 0x484]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4c9614
jmp 0x4c9633
mov edx, dword [ebp - 0x488]
mov byte [ebp + edx - 0x484], 0
lea eax, [ebp - 0x484]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0041db50
jmp 0x4c95e6
mov dword [ebp - 0x494], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0041dab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041dab0
mov eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x80]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4ca2e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5898e1
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x228], str.SoftwareClasses.cdskin_shellopencommand
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x228]
push ecx
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x22c], eax
push 0x104
lea edx, [ebp - 0x224]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 0x22c], 0
je 0x4ca368
mov dword [ebp - 0x14], 0
jmp 0x4ca405
mov dword [ebp - 0x334], 0x100
mov dword [ebp - 0x33c], 0x100
lea ecx, [ebp - 0x338]
call fcn.0041d970
mov dword [ebp - 4], 0
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x330]
push edx
push 0
push 0x59b13c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ca3f3
lea ecx, [ebp - 0x32c]
push ecx
push 0x59b198
lea edx, [ebp - 0x338]
push edx
call fcn.00423c30
add esp, 0xc
push 0
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x338]
call fcn.0041dc30
cmp eax, 0xffffffff
jne 0x4ca3f3
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.0041dab0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x4ca538
lea ecx, [ebp - 0x344]
call fcn.0041d970
mov dword [ebp - 4], 1
lea edx, [ebp - 0x224]
push edx
push str._s_0
lea eax, [ebp - 0x344]
push eax
call fcn.00423c30
add esp, 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x348], esp
push str.cooldock
call fcn.0041d9b0
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x35c]
mov dword [ebp - 0x360], ecx
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x34c], esp
lea edx, [ebp - 0x344]
push edx
call fcn.0041d990
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x368], eax
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x350], esp
push 0x59b1c0
call fcn.0041d9b0
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x36c]
mov dword [ebp - 0x370], ecx
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x354], esp
lea edx, [ebp - 0x224]
push edx
call fcn.0041d9b0
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x378], eax
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x358], esp
push 0x59b1d0
call fcn.0041d9b0
mov dword [ebp - 0x37c], eax
mov byte [ebp - 4], 1
call fcn.004c9c60
add esp, 0x14
mov byte [ebp - 0x37d], al
movzx ecx, byte [ebp - 0x37d]
mov dword [ebp - 0x340], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.0041dab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4cb0b0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589991
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041d990
mov byte [ebp - 4], 1
push 0x59a7a0
lea ecx, [ebp - 0x10]
call fcn.0041db50
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0041e1e0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xffffffff
je 0x4cb29b
lea edx, [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4cb29b
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x270]
call fcn.0041d9b0
mov byte [ebp - 4], 2
push 0x59a7a8
lea ecx, [ebp - 0x274]
call fcn.0041da30
mov byte [ebp - 4], 3
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x278]
push edx
call fcn.0041df30
add esp, 0xc
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x284]
push ecx
lea edx, [ebp - 0x26c]
push edx
call fcn.0041dfe0
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x278]
call fcn.0041dab0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x274]
call fcn.0041dab0
push 0x80
lea ecx, [ebp - 0x26c]
call fcn.0041e1e0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x59a7ac
lea ecx, [ebp - 0x270]
call fcn.0041dbd0
test eax, eax
je 0x4cb278
push 0x59a7b0
lea ecx, [ebp - 0x270]
call fcn.0041dbd0
test eax, eax
je 0x4cb278
lea ecx, [ebp - 0x26c]
call fcn.0041e1e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
je 0x4cb266
push ecx
mov ecx, esp
mov dword [ebp - 0x27c], esp
lea eax, [ebp - 0x26c]
push eax
call fcn.0041d990
mov dword [ebp - 0x288], eax
call fcn.004cb0b0
add esp, 4
lea ecx, [ebp - 0x26c]
call fcn.0041e1e0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4cb278
lea ecx, [ebp - 0x26c]
call fcn.0041e1e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x26c]
call fcn.0041dab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x270]
call fcn.0041dab0
jmp 0x4cb128
mov ecx, dword [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 8]
call fcn.0041e1e0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0041dab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0041dab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret