joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44db83
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push edi
mov esi, ecx
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
call fcn.0047d834
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042b335
mov ebx, str._csevent
push ebx
call fcn.0047d834
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004438ae
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x44dbd5
lea eax, [ebp - 0x1c]
mov ebx, 0x1f0003
push ebx
push eax
lea ecx, [esi + 0x3c]
call fcn.0044d236
test eax, eax
je 0x44dd32
push edi
call fcn.0047d834
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042b335
push str._server_resp
call fcn.0047d834
pop ecx
push eax
push str._server_resp
lea ecx, [ebp - 0x1c]
call fcn.004438ae
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x44dc22
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [esi + 0x24], eax
test eax, eax
je 0x44dd32
push edi
call fcn.0047d834
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042b335
push str._client_resp
call fcn.0047d834
pop ecx
push eax
push str._client_resp
lea ecx, [ebp - 0x1c]
call fcn.004438ae
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x44dc6d
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [esi + 0x28], eax
test eax, eax
je 0x44dd32
push edi
call fcn.0047d834
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042b335
mov ebx, str._mutex_client
push ebx
call fcn.0047d834
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004438ae
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x44dcb5
lea eax, [ebp - 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenMutexW]
push eax
push 0
push 0x1f0001
call ebx
push 0
push eax
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call fcn.0047d834
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042b335
mov edi, str._mutex_server
push edi
call fcn.0047d834
pop ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.004438ae
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x44dd04
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x1f0001
call ebx
push 0
push eax
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
inc esi
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0042ad19
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
xor esi, esi
jmp 0x44dd1d
Function at 0x44e0c0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x14], 7
push edi
xor edi, edi
mov dword [esi + 0x10], edi
xor eax, eax
mov word [esi], ax
or dword [esi + 0x24], 0xffffffff
or dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], edi
lea eax, [esi + 0x40]
mov dword [esi + 0x30], edi
or dword [esi + 0x3c], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0x58]
push ecx
lea eax, [ebp - 1]
mov dword [ebp - 8], esp
push eax
call fcn.0044d483
push dword [ebp + 8]
call fcn.0047d834
pop ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0042b335
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x34], edi
inc ebx
mov ecx, esi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x38], edi
call fcn.0044db83
test eax, eax
je 0x44e177
push dword [ebp + 8]
push edi
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 0x34], eax
cmp eax, edi
je 0x44e177
push edi
push edi
push edi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x44e177
mov ecx, esi
call fcn.0044cf13
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov ecx, esi
mov dword [eax], ebx
call fcn.0044cf31
mov dword [esi + 0x20], ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x44e83c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x4afb10
mov edi, ecx
call fcn.0045b781
mov eax, dword [edi + 0x48]
mov esi, dword [eax]
pop ecx
mov dword [ebp - 4], esi
cmp esi, eax
je 0x44e885
cmp dword [ebp + 8], 0
je 0x44e86c
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00441a8f
mov esi, dword [ebp - 4]
cmp esi, dword [edi + 0x48]
jne 0x44e85b
mov ecx, edi
call fcn.0044e634
and dword [edi + 0x1c], 0
pop edi
pop esi
leave
ret 4

Function at 0x45075a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45079f
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x45079a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
jmp 0x4507a1
xor al, al
pop edi
pop ebp
ret

Function at 0x450809
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp word [ecx], ax
je 0x450823
push 5
push eax
push eax
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret

Function at 0x450855
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45088d
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x450a56
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x450ab5
cmp dword [ebp - 4], esi
je 0x450ab5
mov eax, dword [ebp + 0x18]
push eax
push dword [ebp + 0x14]
mov dword [eax], 0x104
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x450ab0
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call esi
pop esi
leave
ret
Function at 0x45105a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
push edi
call fcn.0047d5d0
mov esi, eax
pop ecx
mov ecx, esi
lea eax, [ebp - 4]
call fcn.0045b924
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4510cf
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4a98ac
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4510cf
mov eax, dword [ebp - 8]
test eax, eax
je 0x4510cf
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
xor edi, edi
xor ecx, ecx
or edi, eax
lea eax, [ebp - 4]
or esi, ecx
call fcn.004507b0
mov eax, edi
mov edx, esi
jmp 0x4510db
lea eax, [ebp - 4]
call fcn.004507b0
xor eax, eax
xor edx, edx
pop edi
pop esi
leave
ret

Function at 0x453b2e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], 0x80004005
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x453c15
push ebx
push esi
call fcn.0047d5d0
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x453c14
push ebx
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x453c0d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4add90
push ebx
mov dword [ebp - 4], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x453c0d
xor eax, eax
push 0x62
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.0047e3a0
add esp, 0xc
xor esi, esi
test dword [ebp - 4], 0xfffffffc
jbe 0x453c0d
mov eax, dword [ebp - 0x10]
lea eax, [eax + esi*4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str.StringFileInfo_04x_04xOriginalFilename
lea eax, [ebp - 0x78]
push 0x32
push eax
call fcn.00482c0b
add esp, 0x14
cmp eax, 0xffffffff
je 0x453c02
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x453c02
push dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
call fcn.00407490
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 4]
inc esi
shr eax, 2
cmp esi, eax
jb 0x453bb1
push ebx
call fcn.0047e4a0
pop ecx
pop ebx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret
Function at 0x453d39
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.00481230
mov eax, dword [0x4d5b08]
push ebx
push esi
add eax, 0xfffffff0
push edi
push eax
call fcn.00407c10
add eax, 0x10
mov esi, str.Sparkupdate.exe
push esi
mov dword [ebp - 8], eax
call fcn.0047d834
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0041b0e0
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0x121c]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x453da1
xor esi, esi
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00407c80
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
mov ebx, dword [ebp - 0x10]
and dword [ebp - 4], 0
shr ebx, 2
test ebx, ebx
je 0x453d8d
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x208]
push 0
mov esi, str._unknown_
lea edi, [ebp - 0x21c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0047e3a0
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [ebp + eax*4 - 0x121c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x453e1b
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x453e1b
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0xc]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 8]
call fcn.0040b380
push esi
test eax, eax
je 0x453e46
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jb 0x453daf
jmp 0x453d8d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
jmp 0x453d8f
Function at 0x453e54
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1224
call fcn.00481230
mov eax, dword [0x4d5b08]
push ebx
push esi
add eax, 0xfffffff0
push edi
push eax
call fcn.00407c10
add eax, 0x10
mov esi, str.Sparkupdate.exe
push esi
mov dword [ebp - 8], eax
call fcn.0047d834
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 8]
call fcn.0041b0e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0x1000
lea eax, [ebp - 0x1224]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x453ec5
xor esi, esi
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00407c80
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
mov ebx, dword [ebp - 0x14]
and dword [ebp - 4], 0
shr ebx, 2
test ebx, ebx
je 0x453eb1
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1224]
push 5
pop ecx
push 0x1f4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x210]
push 0
mov esi, str._unknown_
lea edi, [ebp - 0x224]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0047e3a0
mov edi, dword [ebp - 0x18]
add esp, 0xc
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x453f46
lea eax, [ebp - 0x1c]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x453f46
push 0x104
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0xc]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 8]
call fcn.0040b380
test eax, eax
jne 0x453f5e
cmp edi, dword [ebp - 0x10]
jne 0x453f76
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jb 0x453ed3
jmp 0x453eb1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
jmp 0x453eb3
Function at 0x4540df
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x454102
mov eax, 0x80004005
jmp 0x45428d
push esi
call fcn.0047f118
pop ecx
push eax
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4540f8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push 0x4add90
push dword [ebp - 0x14]
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4540f8
push ebx
mov esi, 0x4d2c98
push esi
lea ecx, [ebp - 0xc]
call fcn.00407700
push esi
lea ecx, [ebp - 0x10]
call fcn.00407700
push esi
lea ecx, [ebp - 4]
call fcn.00407700
mov eax, dword [ebp - 8]
movzx eax, word [eax]
push eax
mov esi, str.000_x
lea eax, [ebp - 4]
push esi
push eax
call fcn.00407bb0
add esp, 0xc
push 4
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 4]
call fcn.0040db80
push eax
lea ecx, [ebp - 0x10]
call fcn.004078f0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00407c80
mov eax, dword [ebp - 8]
movzx eax, word [eax + 2]
push eax
lea eax, [ebp - 4]
push esi
push eax
call fcn.00407bb0
add esp, 0xc
push 4
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 4]
call fcn.0040db80
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.0041b0e0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00407c80
mov ebx, dword [ebp - 0x10]
push ebx
lea eax, [ebp - 0xc]
push str.StringFileInfo_sProductVersion
push eax
call fcn.00407bb0
add esp, 0xc
mov esi, 0x100
push esi
lea ecx, [ebp - 0xc]
call fcn.00407ac0
mov edi, dword [ebp - 0xc]
cmp dword [edi - 8], esi
jge 0x454207
push 0x80070057
call fcn.00407be0
xor ecx, ecx
mov dword [edi - 0xc], esi
mov word [edi + 0x200], cx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x45424a
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00407c80
lea ecx, [ebx - 0x10]
call fcn.00407c80
lea ecx, [edi - 0x10]
call fcn.00407c80
mov eax, 0x80004005
jmp 0x45428c
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
call fcn.0041ae80
push dword [ebp - 8]
push 0x4be71c
push dword [ebp + 0xc]
call fcn.00407bb0
push dword [ebp - 0x14]
call fcn.0047e41a
mov ecx, dword [ebp - 4]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00407c80
lea ecx, [ebx - 0x10]
call fcn.00407c80
lea ecx, [edi - 0x10]
call fcn.00407c80
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x454748
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00407520
xor ebx, ebx
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.0040da80
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x454780
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00407c80
inc edi
push edi
push 0x5c
lea ecx, [ebp - 4]
call fcn.0040d780
mov edi, eax
test edi, edi
jns 0x45475f
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00407c80
pop edi
test ebx, ebx
pop esi
setne al
pop ebx
leave
ret

Function at 0x455129
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00407520
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0x104
jl 0x45515b
xor bl, bl
lea ecx, [esi - 0x10]
call fcn.00407c80
pop esi
mov al, bl
pop ebx
leave
ret
xor ebx, ebx
cmp byte [ebp + 0xc], bl
jne 0x455195
lea eax, [ebp - 0x48]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x455186
test byte [ebp - 0x48], 0x10
je 0x455186
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
jmp 0x45514d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x455195
mov bl, 1
jmp 0x45514d
push edi
xor eax, eax
push 0x208
mov word [ebp - 0x254], ax
lea eax, [ebp - 0x252]
push ebx
push eax
call fcn.0047e3a0
push dword [ebp + 8]
lea eax, [ebp - 0x254]
push eax
call fcn.0047fc51
lea eax, [ebp - 0x254]
push eax
call fcn.0047d834
add esp, 0x18
xor ecx, ecx
mov word [ebp + eax*2 - 0x254], cx
push 6
xor eax, eax
pop ecx
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x1c], eax
mov eax, 0x414
mov dword [ebp - 0x20], 3
mov word [ebp - 0x14], ax
pop edi
cmp byte [ebp + 0xc], bl
jne 0x455210
mov eax, 0x1494
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
je 0x455191
cmp eax, 2
je 0x455191
cmp eax, 0x402
je 0x455191
jmp 0x45514d

Function at 0x456bf5
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
mov dword [esi], vtable.CThreadCheckMD5.0
call fcn.00438833
mov ecx, dword [esi + 0x30]
sub ecx, 0x10
call fcn.00407c80
mov ecx, esi
pop esi
jmp fcn.004389df
Function at 0x45d190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x45d1d2
jmp 0x45d217
xor edx, edx
jne 0x45d1c8
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
xchg dword [edx], ecx
cmp dword [ebp - 0xc], 0x8b55ff8b
jne 0x45d200
mov eax, 0x9090c033
mov ecx, dword [ebp - 8]
xchg dword [ecx], eax
mov edx, 0x900004c2
mov eax, dword [ebp - 8]
add eax, 4
xchg dword [eax], edx
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x45e160
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e1d0
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x4d33a4]
xor eax, ebp
mov dword [ebp - 0x24], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push eax
lea ecx, [ebp - 0x1c]
call fcn.0045e100
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004629c0
test eax, eax
jne 0x45e1e0
lea ecx, [ebp - 0x1c]
call fcn.004629c0
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045e130
mov eax, dword [ebp - 0x260]
jmp 0x45e36a
xor eax, eax
jne 0x45e1a6
mov dword [ebp - 0x254], 0x22c
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004629c0
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x258], 0
je 0x45e288
lea edx, [ebp - 0x230]
push edx
push 0x4b33bc
call fcn.0047f5d2
add esp, 8
test eax, eax
jne 0x45e26b
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov dword [ebp - 0x25c], eax
mov edx, dword [ebp - 0x25c]
cmp edx, dword [ebp + 0xc]
jne 0x45e26b
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x20], eax
jmp 0x45e288
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004629c0
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x258], eax
jmp 0x45e210
cmp dword [ebp - 0x20], 0
jne 0x45e2b7
xor edx, edx
cmp dword [ebp - 0x20], 0
setne dl
mov dword [ebp - 0x264], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045e130
mov eax, dword [ebp - 0x264]
jmp 0x45e36a
xor eax, eax
jne 0x45e288
push 0
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [ebp - 0x14]
call fcn.0045e100
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004629c0
test eax, eax
jne 0x45e31e
lea ecx, [ebp - 0x14]
call fcn.004629c0
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0045e130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045e130
mov eax, dword [ebp - 0x268]
jmp 0x45e36a
xor edx, edx
jne 0x45e2db
mov eax, dword [ebp + 8]
push eax
push 0xa
lea ecx, [ebp - 0x14]
call fcn.004629c0
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x258], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x26c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0045e130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0045e130
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0048638c
mov esp, ebp
pop ebp
ret
Function at 0x45e580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x45e590
xor al, al
jmp 0x45e5ee
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x45e5af
xor al, al
jmp 0x45e5ee
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0x4550
je 0x45e5ca
xor al, al
jmp 0x45e5ee
cmp dword [ebp + 0xc], 0
je 0x45e5db
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [eax], edx
cmp dword [ebp + 0x10], 0
je 0x45e5ec
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x50]
mov dword [eax], edx
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x45f9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4d6558], 1
je 0x45f9e3
xor eax, eax
jmp 0x45fa57
xor eax, eax
jne 0x45f9d6
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 4
lea ecx, [ebp - 8]
push ecx
push 1
push 0
call fcn.0045f3c0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45fa22
jmp 0x45fa44
xor edx, edx
jne 0x45fa18
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push str.FullDump
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x45fa54
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret