joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d48a4a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor esi, esi
push esi
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.6d48e410
mov edi, eax
add esp, 0xc
cmp edi, esi
jne 0x6d48a4c7
xor al, al
jmp 0x6d48a536
push esi
push 0x200080
push 1
push esi
push 3
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x6d48a525
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0x50
je 0x6d48a51b
cmp esi, 0xb7
je 0x6d48a51b
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x6d48a51b
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
push str.Could_not_open_file
push dword [esp + 0x10]
call sym.java.dll__JNU_ThrowIOExceptionWithLastError_8
push edi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
jmp 0x6d48a4c3
push edi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
ret 0xc

Function at 0x6d48a53b
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push dword [0x6d49bca0]
xor bl, bl
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.6d4853cb
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x6d48a55f
xor al, al
jmp 0x6d48a59f
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6d48a595
push esi
test al, 0x10
je 0x6d48a584
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x6d48a58a
call dword [sym.imp.kernel32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x6d48a595
mov bl, 1
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
mov al, bl
pop esi
pop ebx
ret 0xc
Function at 0x6d48e410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x6d48e41f
pop dword [ebp - 0x4c]
mov eax, 0xc4c21e51
add eax, 0xa886c5ce
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xc3b7f690
add dword [ebp - 0x5c], 0x8a9a4ebb
mov dword [ebp - 0x58], 0x1141f0dd
add dword [ebp - 0x58], 0x20f15b68
mov dword [ebp - 0x54], 0x7e7296c2
add dword [ebp - 0x54], 0xcdd9ad6c
mov dword [ebp - 0x50], 0x6ad3c519
add dword [ebp - 0x50], 0x952c3ae7
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x77ac7413
add eax, 0xf59cbd0d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x2ca7ddc9
sub dword [ebp - 0x5c], 0xb8357473
mov dword [ebp - 0x58], 0x540efabf
sub dword [ebp - 0x58], 0x12a2994a
mov dword [ebp - 0x54], 0xafeadcf2
add dword [ebp - 0x54], 0xb3848f7a
mov dword [ebp - 0x50], 0xa810b6fd
sub dword [ebp - 0x50], 0xa810b6fd
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xd85cb395
add eax, 0x94ec7d87
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e61b
push 0
call eax
mov ecx, 0x775bee89
sub ecx, 0x775b8b32
xor edx, edx
add edx, eax
mov edi, 0x6d49f400
add edi, dword [ebp - 0x4c]
mov esi, 0x560f6131
sub esi, 0xd0131556
xor dword [ebp - 0x1c], 0x87b8d83e
mov ebx, dword [edi]
mov dword [ebp - 0x18], 0x29ad75ff
xor ebx, esi
xor dword [ebp - 0x10], edi
mov dword [edx], ebx
add dword [ebp - 0x18], ecx
add edx, 0x5128fc8f
sub edx, 0x5128fc8b
add edi, 0x92d0d590
sub edi, 0x92d0d58c
loop 0x6d48e53d
add eax, 0xe8de2c94
add eax, 0x1723539b
xor ebx, ebx
add ebx, eax
add eax, 0xfb5822c3
sub eax, 0xfb5822be
mov ecx, 0x6d480000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x6d491820
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d49bb70]
jne 0x6d49182a
repz ret
jmp fcn.6d491dab

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001a978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001a987
pop dword [ebp - 0x2c]
mov eax, 0xc946aa7f
add eax, 0x46baff08
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x376a2
push 0
mov eax, 0x9e44011b
add eax, 0x71bde049
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x3e925262
add ecx, 0xc16deef0
mov edx, eax
mov ebx, 0x21b9357d
add ebx, 0xee4b0883
add ebx, dword [ebp - 0x2c]
mov esi, 0xfe27a524
add dword [ebp - 0xc], esi
mov edi, dword [ebx]
sub dword [ebp - 0x18], ecx
add edi, esi
mov dword [ebp - 0x24], 0x3405c140
mov dword [edx], edi
xor dword [ebp - 0x24], 0xdde5ac60
add edx, 0xdfe4d8fc
sub edx, 0xdfe4d8f8
add ebx, 4
loop 0x1001a9e0
add eax, 0xf81b
mov ebx, eax
add eax, 0xdbed5731
sub eax, 0xdbed572c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40d21d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a511
mov dword [ebp - 0x14], eax
cmp dword [0x435404], esi
jne 0x40d310
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d29d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d3f0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d3f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d3f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x435404], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x435408], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43540c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x435414], eax
test eax, eax
je 0x40d30d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x435410], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d335
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d328
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d34a
push 4
pop eax
jmp 0x40d3f2
cmp dword [ebp - 0x14], esi
je 0x40d34a
push dword [0x435404]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d32f
mov eax, dword [0x435410]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d3a8
cmp dword [0x435414], edi
je 0x40d3a8
push eax
call ebx
push dword [0x435414]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d3a8
test eax, eax
je 0x40d3a8
call ecx
test eax, eax
je 0x40d39d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d39d
test byte [ebp - 8], 1
jne 0x40d3a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d3d8
mov eax, dword [0x435408]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
call eax
mov esi, eax
test esi, esi
je 0x40d3d5
mov eax, dword [0x43540c]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x435404]
call ebx
test eax, eax
je 0x40d3f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d3f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004045d8
mov esp, ebp
pop ebp
ret
Function at 0x421771
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
call fcn.005423e0
lea ebp, [0x72ab78]
push dword [ebp + 0x34]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4217a1
mov edx, str.http:__sdr.eladit.com_FDM_sw2_20Software_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4217bb
mov edx, str.http:__www.hdsdr.de
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0xc
cmp ebx, dword [esp]
jne 0x4217d8
mov edx, str.http:__napan.ca_ghpsdr3_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0xa
cmp ebx, dword [esp]
jne 0x4217f5
mov edx, str.http:__microtelecom.it_perseus_software.html
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x421812
mov edx, str.https:__github.com_TAPR_OpenHPSDR_PowerSDR_releases
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0xd
cmp ebx, dword [esp]
jne 0x42182f
mov edx, str.http:__sdr_radio.com_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0xe
cmp ebx, dword [esp]
jne 0x42184c
mov edx, str.http:__fyngyrz.com__p915
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0xf
cmp ebx, dword [esp]
jne 0x421869
mov edx, str.http:__airspy.com_download_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0x10
cmp ebx, dword [esp]
je 0x42187d
mov ebx, 0x11
cmp ebx, dword [esp]
jne 0x42188d
mov edx, str.http:__www.sdrplay.com_downloads_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0x12
cmp ebx, dword [esp]
jne 0x4218a7
mov edx, str.http:__www.icomamerica.com_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
mov ebx, 0x13
cmp ebx, dword [esp]
jne 0x4218c1
mov edx, str.http:__www.kenwood.com_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x421908
push edx
call fcn.00542240
pop edx
push eax
mov edx, str.http:__www.winradio.com_home_download_
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72ab78]
push dword [ebp + 8]
call fcn.00540410
pop eax
mov edx, str..htm
push edx
call fcn.00542310
lea eax, [esp + 8]
push eax
call fcn.00542280
pop eax
push 5
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, 0x623e60
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
push dword [esp]
call fcn.00542440
add esp, 4
pop ebx
pop ebp
ret
Function at 0x434120
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
call fcn.005423e0
push 0x50024
mov eax, str.Edit_antenna_file
push eax
mov eax, str.After_editing_and_saving_you_must_re_open_nthis_dialogue_to_make_changes_valid._n_nEdit_file_
push eax
lea ebp, [0x72a860]
push dword [ebp + 0x38]
call fcn.00478149
mov ebx, eax
cmp ebx, 6
jne 0x4342a9
lea ebp, [0x72a988]
push dword [ebp + 0x84]
call fcn.00522fa2
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x43417b
jl 0x434177
cmp ebx, 0
ja 0x43417b
xor eax, eax
jmp 0x434180
mov eax, 1
or eax, eax
jne 0x43427d
lea ebp, [0x72a988]
push dword [ebp + 0x84]
call fcn.00482484
mov dword [esp], eax
cmp dword [esp], 0
je 0x434263
push 2
push dword [esp + 4]
call fcn.00524270
push 2
mov eax, 0x628828
push eax
push dword [esp + 8]
call fcn.005244d0
push 2
mov eax, str._After_editing__re_open_the_recent_window_to_see_changes_r_n
push eax
push dword [esp + 8]
call fcn.005244d0
mov byte [esp + 4], 1
jmp 0x4341e3
mov eax, 0xa
cmp al, byte [esp + 4]
jl 0x434259
push edx
call fcn.00542240
pop edx
push eax
push 2
push edx
call fcn.00542240
pop edx
push eax
mov edx, 0x6211f8
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
movsx eax, byte [esp + 0x18]
cdq
push edx
push eax
call fcn.0053f630
pop eax
mov edx, 0x63b588
push edx
call fcn.00542310
call fcn.00542370
push dword [esp + 0xc]
call fcn.004fa482
add dword [esp + 4], edx
call fcn.005244d0
call fcn.004fa4e0
inc byte [esp + 4]
jno 0x4341e3
push dword [esp]
call fcn.00523a00
jmp 0x43427d
lea ebp, [0x72a988]
push dword [ebp + 0x84]
lea ebp, [0x72a860]
push dword [ebp]
call fcn.004cf57f
push 5
push 0
push 0
lea ebp, [0x72a988]
mov eax, dword [ebp + 0x84]
push eax
mov eax, 0x623e60
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
add esp, 8
pop edi
pop ebx
pop ebp
ret
Function at 0x448bcd
Capabilities:
Get graphical window text

Disassembly:
push ebp
push ebx
push edi
call fcn.005423e0
lea ebp, [0x72a918]
mov ebx, dword [ebp + 0x34]
cmp ebx, 1
jne 0x448c11
lea ebp, [0x72a918]
mov dword [ebp + 0x34], 2
push 1
call fcn.005335a4
push 1
call sub.KERNEL32.dll_Sleep
lea ebp, [0x72a918]
mov ebx, dword [ebp + 0x34]
and ebx, ebx
jne 0x448bf0
push 0x1e6
call fcn.0052708f
mov ebx, eax
push 0x1e8
call fcn.0052708f
mov edi, eax
shl edi, 5
or ebx, edi
push 0x1e7
call fcn.0052708f
mov edi, eax
shl edi, 6
or ebx, edi
push 0x1e9
call fcn.0052708f
mov edi, eax
shl edi, 7
or ebx, edi
push ebx
lea ebp, [0x72b28c]
pop eax
mov dword [ebp + 0x3c], eax
mov ebx, dword [ebp + 0x3c]
push 0x1ea
call fcn.0052708f
mov edi, eax
shl edi, 8
or ebx, edi
push 0x1eb
call fcn.0052708f
mov edi, eax
shl edi, 9
or ebx, edi
push 0x1ec
call fcn.0052708f
mov edi, eax
shl edi, 0xa
or ebx, edi
push ebx
pop eax
mov dword [ebp + 0x3c], eax
mov ebx, dword [ebp + 0x3c]
push 0x1ed
call fcn.0052708f
mov edi, eax
shl edi, 0xb
or ebx, edi
push 0x1ee
call fcn.0052708f
mov edi, eax
shl edi, 0xc
or ebx, edi
push 0x1ef
call fcn.0052708f
mov edi, eax
shl edi, 0xd
or ebx, edi
push ebx
pop eax
mov dword [ebp + 0x3c], eax
push 6
call fcn.005338e3
push eax
pop eax
mov dword [ebp + 0x34], eax
push 6
call fcn.00533952
push eax
pop eax
mov dword [ebp + 0x38], eax
push 6
call fcn.0053300e
lea ebp, [0x72a860]
mov dword [ebp + 0x30], 0
push 0x1e2
call fcn.0053978f
push 0x1e3
call fcn.0053978f
lea ebp, [0x72b25c]
push dword [ebp + 0x1c]
call fcn.0041c1e0
lea ebp, [0x72b25c]
push dword [ebp + 0x20]
call fcn.0041c1e0
lea ebp, [0x72a860]
push dword [ebp]
push 1
push 6
push dword [ebp]
call sub.USER32.dll_SendMessageW
mov eax, 1
push eax
call fcn.0042dc22
push 0
push 0x116
push 0
call fcn.0051f352
xor eax, eax
pop edi
pop ebx
pop ebp
ret
Function at 0x45c6a4
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.005423e0
lea ebp, [0x72abf8]
mov edx, dword [ebp + 0x164]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0xc]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push 2
mov eax, 0x62022a
push eax
mov eax, 0x641c24
push eax
push dword [esp + 0x1c]
call fcn.0053f110
call fcn.004fa4e0
lea ebp, [0x72b250]
push dword [ebp]
push dword [esp + 0xc]
call fcn.0053f8e0
and eax, eax
je 0x45c79f
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x62070e
push eax
mov eax, 0x62070e
push eax
push dword [esp + 0x18]
call fcn.0053f790
mov ebx, eax
inc ebx
push ebx
push dword [esp + 0x18]
call fcn.0053f490
lea eax, [esp + 8]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72b250]
push dword [ebp]
push 1
push dword [esp + 0x18]
call fcn.0053f490
mov edx, 0x61f5d0
push edx
call fcn.00542310
mov edx, dword [esp + 8]
push edx
call fcn.00542310
lea eax, [esp + 0xc]
push eax
call fcn.00542280
call fcn.004c0efb
and eax, eax
je 0x45c7b7
mov edx, str.http:__www.bing.com_search_q
lea ecx, [esp]
call fcn.004fa008
jmp 0x45c7c4
mov edx, 0x63dd3c
lea ecx, [esp]
call fcn.004fa008
mov edx, dword [esp]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.00521ff8
pop eax
lea eax, [esp + 4]
push eax
call fcn.00542280
push 0xa
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, 0x623e60
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
push dword [esp]
call fcn.00542440
push dword [esp + 8]
call fcn.00542440
push dword [esp + 4]
call fcn.00542440
add esp, 0xc
pop ebx
pop ebp
ret
Function at 0x479d8f
Capabilities:
Query or enumerate registry value

Disassembly:
xor eax, eax
push eax
push eax
push eax
call fcn.005423e0
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.004fa000
mov dword [esp + 4], 4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov eax, dword [esp + 8]
jmp 0x479dd6
push dword [esp]
call fcn.00542440
add esp, 0xc
ret 8
Function at 0x4b2410
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push eax
call fcn.005423e0
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push 0x243
call fcn.00528764
call fcn.004fa482
add dword [esp], edx
call fcn.0053fc10
lea eax, [esp + 4]
push eax
call fcn.00542280
mov edx, dword [esp]
xor ecx, ecx
call fcn.004fa4a0
jne 0x4b24cf
push 0x10
call fcn.004b0428
and eax, eax
je 0x4b2499
push 5
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, 0x623e60
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
jmp 0x4b24cf
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 8]
call fcn.00471d08
call fcn.00542370
push 0x257
call fcn.004fa482
add dword [esp + 4], edx
call fcn.00528678
call fcn.004fa4e0
xor eax, eax
push dword [esp]
call fcn.00542440
add esp, 4
ret
Function at 0x4bdc88
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4bdc8f
call fcn.005423e0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.004fa000
lea ebp, [esp + 4]
mov dword [ebp + 4], 3
mov word [ebp + 0x10], 0x444
push dword [esp]
call fcn.00540e80
mov ebx, eax
add ebx, 4
push ebx
call fcn.005410b0
mov dword [esp + 0x24], eax
push dword [esp]
push dword [esp + 0x28]
call fcn.005413f0
push dword [esp + 0x24]
pop eax
mov dword [ebp + 8], eax
lea eax, [esp + 4]
push eax
call sub.SHELL32.dll_SHFileOperationW
push dword [esp + 0x24]
call fcn.00541120
xor eax, eax
push dword [esp]
call fcn.00542440
add esp, 0x28
pop ebx
pop ebp
ret 4
Function at 0x4d925e
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov edx, 0x90
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4d9264
call fcn.005423e0
mov edx, dword [esp + 0x248]
lea ecx, [esp]
call fcn.004fa000
mov edx, dword [esp]
xor ecx, ecx
call fcn.004fa4a0
jne 0x4d9380
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4d9380
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 8]
call fcn.0053f5c0
lea eax, [esp + 4]
push eax
call fcn.00542280
push dword [esp]
call fcn.005405c0
mov dword [esp + 0x23c], eax
lea ebp, [esp + 0x10]
mov dword [ebp], 0x22c
lea eax, [esp + 0x10]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Process32FirstW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4d9377
push dword [esp]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x250]
lea ebp, [esp + 0x28]
lea eax, [ebp + 0x24]
push eax
call fcn.00541480
call fcn.004fa482
add dword [esp], edx
call fcn.0053f5c0
call fcn.004fa4f0
mov edx, eax
pop ecx
call fcn.004fa4a0
je 0x4d9363
mov byte [esp + 4], 1
jmp 0x4d9377
lea eax, [esp + 0x10]
push eax
push dword [esp + 0xc]
call sub.KERNEL32.dll_Process32NextW
mov dword [esp + 0xc], eax
jmp 0x4d9302
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
movsx eax, byte [esp + 4]
movsx eax, al
jmp 0x4d938c
push dword [esp]
call fcn.00542440
add esp, 0x240
pop ebp
ret 4
Function at 0x4dd807
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
call fcn.005423e0
push 0x50021
mov eax, str.Edit_DXCluster_URL_file
push eax
mov eax, str.Please_open_DXCluster_website_parser_again_nafter_editing_and_saving_to_make_changes_valid._n_nEdit_file_
push eax
lea ebp, [0x72a860]
push dword [ebp + 0x14]
call fcn.00478149
mov ebx, eax
cmp ebx, 1
jne 0x4dd865
call fcn.00462693
push 5
push 0
push 0
lea ebp, [0x72a988]
mov eax, dword [ebp + 0x8c]
push eax
mov eax, 0x623e60
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4e42e4
Capabilities:
Query or enumerate registry value

Disassembly:
xor eax, eax
push eax
push eax
call fcn.005423e0
push dword [esp + 0x1c]
call fcn.004fa4e0
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.004fa000
push dword [esp + 0x18]
pop eax
mov dword [esp + 4], eax
push 0
push dword [esp + 0x18]
pop eax
call fcn.004fa410
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x1c]
call fcn.005410d0
pop eax
push eax
call fcn.004fa470
pop edx
add eax, edx
jmp 0x4e4369
push dword [esp]
call fcn.00542440
add esp, 8
ret 0x10