joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dec38
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, 0x4decd4
call fcn.00404e14
jne 0x4dec59
push esp
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x4decb2
mov eax, dword [ebx + 4]
call fcn.00404cfc
test eax, eax
jle 0x4decb2
mov eax, dword [ebx + 4]
call fcn.00404cfc
mov edx, dword [ebx + 4]
cmp word [edx + eax*2 - 2], 0x3a
jne 0x4dec85
lea eax, [ebx + 4]
mov edx, 0x4decec
call fcn.00404d08
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.00404cec
push eax
push 0
push 0
mov eax, dword [0x501e64]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebx + 8]
test eax, eax
je 0x4decbe
call fcn.00403520
mov eax, dword [esp]
call fcn.004de640
mov dword [ebx + 8], eax
add esp, 0xc
pop ebx
ret

Function at 0x4decf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4ded64
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push eax
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00404c54
mov edx, dword [ebp - 0x210]
mov eax, ebx
mov ecx, 0x4ded74
call fcn.00404d68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ded6b
lea eax, [ebp - 0x210]
call fcn.00404aa8
ret

Function at 0x4df76c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4df79c
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4df796
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
jmp 0x4df79c
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4df7a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x4df80e
push 1
push 0
push 0
mov eax, dword [esi + 0x34]
push eax
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4df7db
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageA
test bl, bl
je 0x4df80e
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, edi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4df802
cmp eax, 0xbb8
jbe 0x4df80e
jmp 0x4df804
jle 0x4df80e
call sub.kernel32.dll_GetCurrentProcessId
call fcn.004df76c
mov eax, esi
call fcn.004df3c8
test al, al
jne 0x4df7b7
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x4e0688
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x501e8c
push 0x4e0778
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4e0775
push 0x12
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d440], eax
push 0x13
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d444], eax
push 0x19
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d448], eax
push 0x99
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d44c], eax
push 0x10
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d450], eax
push 0x15
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d464], eax
push 0x11
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d454], eax
push 0x98
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d458], eax
push 0x9b
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51d45c], eax
push 2
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x501e90], eax
push 4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x501e94], eax
push 0x284
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x501e98], eax
push 0x285
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x501e9c], eax
pop ebx
ret

Function at 0x4e16a0
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov esi, eax
cmp byte [0x501ea8], 0
jne 0x4e16f6
push 0x51d474
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4e16ef
mov dword [esp], esi
mov byte [esp + 4], 6
mov dword [esp + 8], ebx
mov byte [esp + 0xc], 0
push esp
push 1
mov ecx, 0x4e1708
mov dl, 1
mov eax, dword [0x4e0bdc]
call fcn.0040d9dc
call fcn.00403cec
mov byte [0x501ea8], 1
mov al, 1
add esp, 0x10
pop esi
pop ebx
ret

Function at 0x4e18bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, eax
mov edi, esp
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x4e1922
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebx + 0x600]
cdq
cmp edx, dword [esp + 4]
jne 0x4e1908
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4e1922
jmp 0x4e190c
pop edx
pop eax
jg 0x4e1922
mov ecx, 0x4e1944
mov dl, 1
mov eax, dword [0x408050]
call fcn.0040d9a0
call fcn.00403cec
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4e18cf
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x4e1d70
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, eax
mov bl, 1
jmp 0x4e1eaa
cmp dword [edi + 0x30], 0xffffffff
jne 0x4e1d92
mov byte [edi + 0x19c], 0
jmp 0x4e1eb2
mov esi, 0xfffffffe
cmp byte [edi + 0x64], 4
jne 0x4e1de6
lea eax, [esp + 4]
push eax
push 0x4004667f
mov eax, dword [edi + 0x30]
push eax
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x4e1dcb
mov byte [edi + 0x19c], 0
mov edx, 0x4e1ec4
mov eax, edi
call fcn.004e3de4
jmp 0x4e1eb2
cmp dword [esp + 4], 0
jle 0x4e1de6
push 0
push 1
lea eax, [esp + 8]
push eax
mov eax, dword [edi + 0x30]
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 1
jne 0x4e1e58
inc dword [edi + 0x1a0]
cmp byte [esp], 0xa
je 0x4e1e1f
cmp byte [esp], 0xd
je 0x4e1e1f
inc dword [edi + 0x198]
mov eax, dword [edi + 0x198]
mov dl, byte [esp]
mov byte [edi + eax + 0x96], dl
mov eax, dword [edi + 0x198]
mov byte [edi + 0x96], al
cmp dword [edi + 0x198], 0xfe
jl 0x4e1e47
mov byte [esp], 0xa
cmp word [edi + 0x5ea], 0
je 0x4e1e47
mov edx, edi
mov eax, dword [edi + 0x5ec]
call dword [edi + 0x5e8]
cmp byte [esp], 0xa
jne 0x4e1eaa
xor ebx, ebx
mov byte [edi + 0x19c], 0
jmp 0x4e1eaa
test esi, esi
jne 0x4e1e6e
xor ebx, ebx
mov byte [edi + 0x19c], 0
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x6c]
jmp 0x4e1eaa
inc esi
jne 0x4e1ea8
call sub.wsock32.dll_WSAGetLastError
mov ebp, eax
cmp ebp, 0x2746
jne 0x4e1e92
xor ebx, ebx
mov byte [edi + 0x19c], 0
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x6c]
jmp 0x4e1eaa
cmp ebp, 0x2733
je 0x4e1eaa
mov edx, 0x4e1ed8
mov eax, edi
call fcn.004e3de4
jmp 0x4e1eb2
xor ebx, ebx
test bl, bl
jne 0x4e1d80
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e2318
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
jmp 0x4e2406
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x7c], edx
xor eax, eax
push ebp
push 0x4e23fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x19c], 0
je 0x4e235d
mov eax, dword [ebp - 4]
call fcn.004e1d70
jmp 0x4e23b4
mov edx, dword [ebp - 8]
mov dx, word [edx + 0xa]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x48]
test al, al
jne 0x4e23b4
push 0
push 0x400
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.wsock32.dll_recv
inc eax
jne 0x4e23b4
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x7c], esi
cmp esi, 0x2733
jne 0x4e23b4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x7c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e240e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x7c], 0
je 0x4e23c1
xor ebx, ebx
jmp 0x4e23f0
lea eax, [ebp - 0xc]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.wsock32.dll_ioctlsocket
inc eax
jne 0x4e23e8
call sub.wsock32.dll_WSAGetLastError
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
xor ebx, ebx
jmp 0x4e23f0
cmp dword [ebp - 0xc], 0
jne 0x4e23f0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2406
test bl, bl
jne 0x4e2331
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e2c38
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040484c
xor eax, eax
push ebp
push 0x4e2d32
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.00409218
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040a3cc
cmp byte [0x501ea8], 0
jne 0x4e2c94
mov eax, 0x4e2d40
call fcn.004e16a0
lea eax, [ebp - 0x10d]
push eax
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x4e2d0e
mov edx, 0x4e2d4c
lea eax, [ebp - 0x10d]
call fcn.0040a410
test eax, eax
jne 0x4e2cbe
or eax, 0xffffffff
jmp 0x4e2d0e
lea eax, [ebp - 0x10d]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4e2d04
mov eax, dword [ebp - 4]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], 0xb
lea eax, [ebp - 0x11c]
push eax
push 0
mov ecx, 0x4e2d64
mov dl, 1
mov eax, dword [0x4e0bdc]
call fcn.0040d9dc
call fcn.00403cec
jmp 0x4e2d0e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2d39
lea eax, [ebp - 0x114]
call fcn.00404370
lea eax, [ebp - 4]
call fcn.00404370
ret
Function at 0x4e4e6c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.004049e8
mov eax, esi
call fcn.004048b4
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.00402e9c
cmp byte [ebp - 1], 0
jne 0x4e4edf
mov eax, esi
call fcn.004048b4
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x4e4ef8
sub al, 2
jb 0x4e4eff
jmp 0x4e4f04
mov ebx, 2
jmp 0x4e4f04
mov ebx, 1
mov eax, esi
call fcn.004048b4
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4e4fe6
test edi, edi
jle 0x4e4f60
mov eax, esi
call fcn.004048b4
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.004048b4
mov byte [eax + ebx - 1], 0
jmp 0x4e4fda
test edi, edi
jge 0x4e4fa6
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.004048b4
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4e4fda
mov eax, esi
call fcn.004048b4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc dword [ebp - 0x10]
inc ebx
mov eax, esi
call fcn.004048b4
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4e4f1c
mov al, byte [ebp - 1]
sub al, 1
jb 0x4e4ff3
sub al, 2
jb 0x4e502b
jmp 0x4e5071
cmp edi, 2
jne 0x4e4ff9
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4e5071
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.004048b4
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, 0x4e508c
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4e5009
jmp 0x4e5071
cmp edi, 2
jne 0x4e5031
dec ebx
test ebx, ebx
jle 0x4e506c
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.004048b4
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, 0x4e50d8
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4e503d
jmp 0x4e506c
inc ebx
mov eax, esi
call fcn.004048b4
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4e505f
mov eax, esi
mov edx, ebx
call fcn.004049e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ed8c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4eda2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x50226c]
cmp byte [eax], 0
jne 0x4ed91b
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404624
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.0043b7ac
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404c70
jmp 0x4eda02
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404cec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4ed94d
mov eax, esi
call fcn.00404aa8
jmp 0x4eda02
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x4ed984
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x5023b8]
call fcn.00406684
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x43b150]
call fcn.0040d9dc
call fcn.00403cec
cmp dword [ebp - 8], 1
jne 0x4ed991
mov dword [ebp - 8], 2
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, esi
call fcn.00405060
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.00404cec
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404cec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4ed9f2
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x5027b8]
call fcn.00406684
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43b150]
call fcn.0040d9dc
call fcn.00403cec
mov eax, dword [esi]
call fcn.00404cec
mov edx, eax
mov eax, esi
call fcn.00404c00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eda31
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404394
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404394
ret
Function at 0x4eda38
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4edb42
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x50226c]
cmp byte [eax], 0
jne 0x4edac3
cmp dword [ebp - 4], 1
jne 0x4eda9e
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404624
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00404624
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.0043b754
jmp 0x4edb1f
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00404624
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404624
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.0043b780
jmp 0x4edb1f
mov eax, esi
call fcn.00404cfc
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.00404cec
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404cec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4edb1f
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x5024c4]
call fcn.00406684
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43b150]
call fcn.0040d9dc
call fcn.00403cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edb49
lea eax, [ebp - 0x20]
call fcn.00404370
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404394
ret
Function at 0x4f5e1c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f5e25
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 8]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4f5ffb
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 6
mov eax, dword [ebx + 0x424]
mov byte [eax + 0x14c], 1
mov edx, dword [ebx + 0x508]
mov dword [eax + 0x150], edx
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004f53f4
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404e14
jne 0x4f5e91
mov esi, 2
jmp 0x4f5fd3
mov eax, dword [ebp - 0xc]
call fcn.00476f6c
test al, al
je 0x4f5eb6
mov eax, 0x4f6010
call fcn.004a958c
cmp eax, 2
jne 0x4f5eb6
mov esi, 2
jmp 0x4f5fd3
mov eax, dword [ebx + 0x424]
mov eax, dword [eax + 0x150]
mov dword [ebx + 0x508], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00477148
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00476f18
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00477148
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00476f18
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00404e14
jne 0x4f5f5c
cmp dword [0x51d65c], 1
jg 0x4f5f25
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404624
mov eax, dword [ebp - 0x20]
call fcn.004aa570
test al, al
jne 0x4f5f5c
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404cec
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404cec
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4f5f53
mov eax, 0x4f6034
call fcn.004a9518
jmp 0x4f5fd3
mov byte [0x51d62d], 0
jmp 0x4f5fd3
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404624
mov eax, dword [ebp - 0x24]
call fcn.004aa570
test al, al
je 0x4f5fc9
cmp byte [ebx + 0x4fc], 0
je 0x4f5fb6
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.00404624
mov eax, dword [ebp - 0x28]
call fcn.004a9bf4
cmp al, 3
jne 0x4f5fb6
mov eax, dword [ebx + 0x428]
call fcn.00499b18
xor edx, edx
mov eax, ebx
call fcn.004f2a90
xor edx, edx
mov eax, dword [ebx + 0x428]
call fcn.00499b20
push 1
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004f5c3c
jmp 0x4f5fd3
mov eax, 0x4f6044
call fcn.004a9518
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6002
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404394
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404ac0
ret
Function at 0x4f6840
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [0x502100]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4f686e
cmp eax, 0x14
jae 0x4f6870
jmp 0x4f68e6
jl 0x4f68e6
xor eax, eax
push ebp
push 0x4f68d2
push dword fs:[eax]
mov dword fs:[eax], esp
sub esi, 7
je 0x4f688e
dec esi
je 0x4f689d
dec esi
je 0x4f68ac
dec esi
je 0x4f68bb
jmp 0x4f68c8
mov edx, dword [ebx + 0x398]
mov eax, ebx
call fcn.004f2c20
jmp 0x4f68c8
mov edx, dword [ebx + 0x394]
mov eax, ebx
call fcn.004f2c20
jmp 0x4f68c8
mov edx, dword [ebx + 0x388]
mov eax, ebx
call fcn.004f3c04
jmp 0x4f68c8
mov edx, dword [ebx + 0x384]
mov eax, ebx
call fcn.004f3c04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f68dc
call sub.kernel32.dll_GetTickCount_1
mov dword [0x502100], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f8d14
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4f8e59
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4f8e68
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x4f8dc1
push 0xff
lea eax, [ebp - 0x204]
push eax
push ebx
call sub.user32.dll_GetClassNameW
test eax, eax
jle 0x4f8db3
mov eax, 0x4f8e78
lea edx, [ebp - 0x204]
mov dword [ebp - 0x208], edx
mov edx, dword [ebp - 0x208]
call fcn.00404e14
jne 0x4f8db3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00476bc8
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.004a9144
test al, al
jne 0x4f8e21
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x4f8d60
push 1
push 0x4f8e8c
push 0x4f8e94
push dword [ebp - 4]
push 0x4f8e94
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.00404dcc
mov eax, dword [ebp - 0x210]
call fcn.00404cec
push eax
mov edx, dword [0x50267c]
mov edx, dword [edx]
lea eax, [ebp - 0x214]
mov ecx, 0x4f8e9c
call fcn.00404d68
mov eax, dword [ebp - 0x214]
call fcn.00404cec
push eax
push 0x4f8e8c
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, esi
call fcn.00456dc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8e60
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00404ac0
lea eax, [ebp - 0x20c]
call fcn.00404370
lea eax, [ebp - 4]
call fcn.00404aa8
ret
Function at 0x4f8f0c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f900f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x428]
mov eax, dword [eax + 0x1b4]
call fcn.0042b208
test eax, eax
je 0x4f8fec
call fcn.004ab890
test al, al
je 0x4f8fec
lea eax, [ebp - 0xc]
call fcn.004a8ffc
push dword [ebp - 0xc]
push 0x4f9020
lea ecx, [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, dword [0x51d654]
call fcn.004aba90
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404dcc
cmp dword [ebp - 8], 0
jne 0x4f8fa5
push 0
mov eax, dword [ebp - 4]
call fcn.00404cec
push eax
mov eax, dword [0x51d654]
call fcn.00404cec
push eax
call sub.kernel32.dll_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4f8fd4
xor edx, edx
mov eax, ebx
call fcn.004f2a90
push 0
push 5
push 0
push 0
mov eax, dword [ebx + 0x428]
mov eax, dword [eax + 0x1b4]
call fcn.0042ab64
mov ecx, 0x5c
mov edx, dword [ebp - 4]
call fcn.004aa954
test al, al
je 0x4f8fe2
mov eax, dword [ebp - 4]
call fcn.004ab9f0
jmp 0x4f8fec
mov eax, 0x4f9030
call fcn.004a9518
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9016
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404ac0
lea eax, [ebp - 4]
call fcn.00404aa8
ret