joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bbb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CreateThread]

Function at 0x46ce20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov edi, 1
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x46ce48
mov eax, dword [esi]
jmp 0x46ce4a
mov eax, esi
xor ecx, ecx
push 0x24
mov word [eax], cx
mov ecx, esi
push str.00000000_0000_0000_0000_000000000000
call fcn.00409380
push 0x500600
push str.kernel32
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x46ce92
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x46ce9e
cmp dword [ebp - 0xc], 0
mov eax, 0x101
cmovne edi, eax
lea eax, [ebp - 4]
push eax
push edi
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46cf57
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push 0
push 0x508a68
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x46cf4e
mov eax, dword [ebp - 8]
test eax, eax
je 0x46cf4e
add eax, 2
push eax
call fcn.004a3e8e
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push 0x508a68
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x46cf4e
mov eax, dword [ebp - 8]
test eax, eax
je 0x46cf4e
xor ecx, ecx
mov word [edi + eax], cx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.0043a3a0
push edi
mov ecx, esi
call fcn.00408d10
test edi, edi
je 0x46cf57
push edi
call fcn.004a2e5c
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46dbd0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x178
mov ebx, ecx
mov dword [ebp - 0x30], 0x178
call fcn.004a3e8e
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], esi
push eax
push esi
push 0
push 0x10
push 2
call edi
cmp eax, 0x6f
jne 0x46dd79
test esi, esi
je 0x46dc27
push esi
call fcn.004a2e5c
add esp, 4
push dword [ebp - 0x30]
call fcn.004a3e8e
mov esi, eax
add esp, 4
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x30]
push eax
push esi
push 0
push 0x10
push 2
call edi
test eax, eax
jne 0x46dd54
mov edi, esi
mov dword [ebp - 0x34], edi
test esi, esi
je 0x46dd61
nop dword [eax]
cmp dword [edi + 0x34], 6
jne 0x46dd41
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 8], 0
movups xmmword [ebp - 0x1c], xmm0
movzx eax, byte [edi + 0x31]
push eax
movzx eax, byte [edi + 0x30]
push eax
movzx eax, byte [edi + 0x2f]
push eax
movzx eax, byte [edi + 0x2e]
push eax
movzx eax, byte [edi + 0x2d]
push eax
movzx eax, byte [edi + 0x2c]
push eax
push str._02X__02X__02X__02X__02X__02X
lea eax, [ebp - 0x2c]
push 0x13
push eax
call fcn.00451f20
add esp, 0x24
cmp dword [edi + 0x40], 0x47
jne 0x46dd41
mov eax, dword [ebx]
mov esi, dword [eax]
cmp esi, eax
je 0x46dce7
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x46dcd0
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.0049cde6
add esp, 8
test eax, eax
je 0x46dce7
mov esi, dword [esi]
cmp esi, dword [ebx]
jne 0x46dcc5
cmp esi, dword [ebx]
je 0x46dd41
mov ecx, dword [esi + 4]
lea edi, [esi + 8]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x46dd16
push 2
inc eax
push eax
push dword [edi]
call fcn.00402ff0
add esp, 0xc
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x46dd2c
mov edi, dword [edi]
push 0x20
xor eax, eax
push 1
push esi
mov word [edi], ax
call fcn.00402ff0
mov edi, dword [ebp - 0x34]
add esp, 0xc
mov eax, dword [edi + 8]
mov edi, eax
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x46dc60
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x46dd61
push esi
call fcn.004a2e5c
add esp, 4
cmp dword [ebx + 4], 1
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x46dc37
test esi, esi
je 0x46dd8e
push esi
call fcn.004a2e5c
add esp, 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004908ad
mov esp, ebp
pop ebp
ret
Function at 0x46e710
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x527064]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x46e816
xor eax, eax
cmp ax, word [esi]
je 0x46e816
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46e746
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x46e816
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00496490
add esp, 0xc
lea eax, [esp + 8]
push 0x50a674
push esi
push 0x4fe7d4
push 0x104
push eax
call fcn.0046e1b0
add esp, 0x14
lea ecx, [esp + 8]
mov edx, edi
call fcn.0046e510
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x46e800
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x46e7cb
cmp eax, 0x91
jne 0x46e800
push ecx
mov ecx, esi
call fcn.0046e830
add esp, 4
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x46e7fe
test eax, eax
je 0x46e7fe
mov edi, 1
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
xor edi, edi
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x214]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
Function at 0x46e830
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x110
xor edi, edi
lea eax, [ebp - 0x328]
push edi
push eax
mov esi, ecx
call fcn.00496490
add esp, 0xc
mov dword [ebp - 0x32c], 0x114
test esi, esi
je 0x46e952
xor eax, eax
cmp ax, word [esi]
je 0x46e952
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x46e8a1
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov ecx, esi
cmp dword [ebp - 0x31c], 2
sete bl
call fcn.0046e970
test eax, eax
jne 0x46e8ca
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test ebx, ebx
je 0x46e8fa
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x46e93f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
mov edi, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.00496490
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edx, 0x50a690
lea ecx, [ebp - 0x214]
call fcn.0046ea10
test eax, eax
jne 0x46e93f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 0x57
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004908ad
mov esp, ebp
pop ebp
ret
Function at 0x471840
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1558
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x23c], 0x22c
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4718a8
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x4718a1
push 2
inc eax
push eax
push dword [ebp + 8]
call fcn.00402ff0
add esp, 0xc
xor eax, eax
jmp 0x471927
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x23c]
push eax
push esi
call ebx
test eax, eax
je 0x471903
nop word [eax + eax]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0049cde6
add esp, 8
test eax, eax
mov eax, 1
cmove edi, eax
lea eax, [ebp - 0x23c]
push eax
push esi
call ebx
test eax, eax
jne 0x4718d0
test esi, esi
je 0x47190e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x471925
push 2
inc ecx
push ecx
push dword [ebp + 8]
call fcn.00402ff0
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret 0x18
Function at 0x476820
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2341
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x23c]
push eax
push esi
call ebx
cmp eax, 1
jne 0x476870
lea eax, [ebp - 0x23c]
push eax
push esi
call edi
cmp eax, 1
jne 0x476870
nop
lea eax, [ebp - 0x218]
push str.Install.exe
push eax
call fcn.0049cde6
add esp, 8
test eax, eax
je 0x4768b9
lea eax, [ebp - 0x23c]
push eax
push esi
call edi
cmp eax, 1
je 0x476890
jmp 0x476870
push dword [ebp - 0x234]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.McDefaultProdReg.cpp
push str.CMcDefaultProductRegistration::GetInstallProcHandle
push 0x156
push 4
lea ecx, [ebp - 0x240]
mov edi, eax
call fcn.00431610
mov dword [ebp - 4], 0
mov edx, str.Got_the_Install_Prcoess_Handle
mov ecx, dword [eax]
call fcn.004333c0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x240]
call fcn.004327d0
mov eax, dword [ebp - 0x240]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
Function at 0x47f700
Capabilities:
Hash data using sha1
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea esi, [edi + 8]
test eax, eax
je 0x47f71b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [esi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x47f74e
cmp dword [edi + 0x98], 0x20000
push esi
push 0
push 0
jne 0x47f742
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret

Function at 0x47f780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e371a
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x90], 0
je 0x47f7c7
mov al, 1
jmp 0x47f8c9
movups xmm0, xmmword [str.winmgmt]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x2c], 0xa
mov dword [ebp - 0x28], 3
push 0
push 0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
push 0x47ebd0
push 0
push 0
call fcn.004a9014
add esp, 0x18
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x34]
call fcn.0047eec0
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x47f829
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
jne 0x47f8c7
push 0x30
call fcn.004a3e8e
mov esi, eax
add esp, 4
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x47f8aa
lea ecx, [esi + 4]
mov dword [esi], vtable.CMcLock.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 3
lea ebx, [esi + 0x28]
mov dword [esi], vtable.CWMIData.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov dword [ebp - 0x3c], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.004831c0
mov dword [ebx], eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00482760
test esi, esi
mov dword [esi + 0x1c], eax
mov dword [edi + 0x90], esi
setne al
jmp 0x47f8c9
xor esi, esi
test esi, esi
mov dword [edi + 0x90], esi
setne al
jmp 0x47f8c9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
Function at 0x480890
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x527064]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp eax, 1
jne 0x480961
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.004d87d0
addsd xmm0, qword [0x50e140]
call fcn.004d9980
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [0x50e148]
call fcn.004d9980
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.004d86a1
mov ebx, eax
shr eax, 0x1f
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x50e180]
call fcn.004d96d0
call fcn.004d86a1
mov edi, eax
lea eax, [edi*2 + 4]
push eax
call fcn.004a3e8e
mov esi, eax
add esp, 4
test esi, esi
je 0x480963
push ebx
push 0x508c08
lea eax, [edi + 2]
push eax
push esi
call fcn.00451f20
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004908ad
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004908ad
mov esp, ebp
pop ebp
ret

Function at 0x481570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push edi
test ebx, ebx
je 0x481588
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [ebp + 0x10]
mov edi, 1
test esi, esi
je 0x481634
cmp dword [ebx + 0x40], 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x20019
mov eax, 0x20119
cmove eax, ecx
push eax
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x4815ce
mov dword [esi], 0
jmp 0x481636
test eax, eax
jne 0x48162e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x48160c
test esi, esi
je 0x48160c
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push ecx
push 0x508a68
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x4815ff
mov dword [esi], 0
jmp 0x481636
test eax, eax
jne 0x48162e
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [esi], eax
jmp 0x481636
mov eax, dword [esi]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ecx
push 0
push 0
push 0x508a68
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x481636
mov dword [esi], 0
xor edi, edi
pop esi
test ebx, ebx
je 0x481645
lea ecx, [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x482240
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
je 0x482347
cmp dword [ebp + 8], 0
je 0x482347
mov eax, dword [esi]
push edi
test eax, eax
je 0x48233c
lea ecx, [ebp + 0xc]
mov dword [ebp - 8], 0
push ecx
push 0
push 0
push 0x8003
push eax
lea edi, [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4822c2
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4822c2
push 0
push 0x20
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4822b9
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edi, dword [ebp - 8]
test edi, edi
je 0x48233c
mov eax, dword [ebx]
xor esi, esi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push 1
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x48232a
mov eax, dword [ebp - 4]
test eax, eax
je 0x482328
push eax
call fcn.004a3e8e
mov esi, eax
add esp, 4
test esi, esi
je 0x48232a
push dword [ebx]
push dword [ebp + 8]
push esi
call fcn.00498140
add esp, 0xc
push dword [ebp - 4]
push ebx
push esi
push 0
push 1
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x48232a
push esi
call fcn.004a2e5c
add esp, 4
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x482360
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
jne 0x482379
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
push edi
xor edi, edi
test eax, eax
je 0x4823f4
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], edi
push ecx
push edi
push edi
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4823d3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4823d3
push edi
push 0x20
lea ecx, [esi + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4823ca
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov esi, dword [ebp - 4]
test esi, esi
je 0x4823f4
push ebx
push dword [ebp + 8]
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x482760
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3a68
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x527064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
call edi
test eax, eax
je 0x4827b0
cmp eax, 1
je 0x4827b0
push 2
push 0
call edi
test eax, eax
je 0x4827b0
cmp eax, 1
jne 0x48285b
lea edi, [esi + 0x20]
mov byte [esi + 0x24], 1
push edi
push 0x4ed4a0
push 1
push 0
push 0x4ed490
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x48285b
push str.ROOTCIMV2
lea ecx, [ebp - 0x10]
call fcn.00433d60
mov dword [ebp - 4], 0
mov eax, dword [eax]
test eax, eax
je 0x4827f2
mov edx, dword [eax]
jmp 0x4827f4
xor edx, edx
mov ecx, dword [edi]
add esi, 0x1c
push esi
push 0
push 0
mov eax, dword [ecx]
push 0
push 0
push 0
push 0
push edx
push ecx
call dword [eax + 0xc]
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
setns bl
call fcn.00433e10
test bl, bl
je 0x48284d
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [esi]
jns 0x48285d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], 0
mov eax, dword [edi]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [edi], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486be0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4068
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x527064]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x288]
mov esi, 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x28c], eax
cmp eax, 0xffffffff
jne 0x486c4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x486d1d
cmp eax, 2
je 0x486d1d
xor eax, eax
jmp 0x486d1f
lea eax, [ebp - 0x28c]
mov dword [ebp - fcn.004896b0], vtable.std::_Func_impl_class__lambda_ea62e6179e5121b40dc024015c2cd1ac___class_std::allocator_int___void___.0
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x294], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 1
call fcn.004896b0
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 2
mov ebx, dword [ebp - 0x294]
test ebx, ebx
je 0x486cc5
mov edx, dword [ebx]
lea eax, [ebp - 0x2b8]
cmp ebx, eax
mov ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0x14]
test dword [ebp - 0x288], 0x400
je 0x486cf1
mov eax, dword [ebp - 0x264]
cmp eax, 0xa0000003
je 0x486ce5
cmp eax, 0xa000000c
jne 0x486cf1
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 0x14]
mov esi, eax
mov dword [ebp - 4], 3
test ecx, ecx
je 0x486d04
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x486d1d
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004908ad
mov esp, ebp
pop ebp
ret