joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473b80
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473cea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042c3e4
lea eax, [ebp - 0x148]
mov edx, 0x473d00
call fcn.0040357c
mov eax, dword [ebp - 0x148]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x473cc9
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.0040355c
mov eax, dword [ebp - 4]
call fcn.00403574
cmp eax, 9
jl 0x473cae
lea eax, [ebp - 0x148]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 0x148]
mov edx, 0x473d14
call fcn.00406aa4
test eax, eax
jne 0x473cae
mov edx, 0x473d1c
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
call fcn.0042e8e8
test al, al
je 0x473cae
mov edx, 0x473d1c
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
call fcn.0042e8e8
test al, al
je 0x473cae
mov edx, 0x473d1c
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
call fcn.0042e8e8
test al, al
je 0x473cae
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x473cae
lea eax, [ebp - 0x148]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 0x148]
call fcn.00406d78
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x473be9
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473cf1
lea eax, [ebp - 0x148]
call fcn.00403400
lea eax, [ebp - 4]
call fcn.00403400
ret

Function at 0x4742f4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, 0x49b150
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
cmp dword [esi], 0
je 0x474362
jmp 0x474320
mov edx, 0x474370
mov al, 0x41
call fcn.004741a4
test al, al
jne 0x474320
call fcn.00408bc0
mov eax, dword [ebx]
call fcn.00406f30
test al, al
je 0x47430b
jmp 0x474342
mov edx, 0x474384
mov al, 0x40
call fcn.004741a4
test al, al
jne 0x474342
call fcn.00408bc0
mov eax, dword [ebx]
call fcn.00403738
push eax
mov eax, dword [esi]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x47432d
mov eax, esi
call fcn.00403400
pop esi
pop ebx
pop ebp
ret
Function at 0x47638c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0040cc24
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.004762b4
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4a
mov eax, dword [0x49b07c]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
mov eax, esi
call fcn.0042e284
cmp ebx, 0x6c840001
jne 0x4763dc
call fcn.00408be0
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x476400
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4764b0
call fcn.00452700
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x476458
mov ebx, eax
mov edx, 1
mov ax, word [ebp - 6]
call fcn.00476310
mov esi, eax
mov eax, esi
sub ax, 2
je 0x476458
dec eax
sub ax, 2
jb 0x47646c
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4764e4
call fcn.00452700
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x47640d
mov edx, 2
mov ax, word [ebp - 6]
call fcn.00476310
movzx ebx, ax
mov edx, 3
mov ax, word [ebp - 6]
call fcn.00476310
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x476a90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
mov edi, edx
mov esi, eax
push 0x476b3c
push 0x476b58
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x476b26
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x476b26
test al, 0x10
je 0x476ad7
mov ebp, 0x2000000
jmp 0x476ad9
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebp, eax
cmp ebp, 0xffffffff
je 0x476b26
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jle 0x476b26
cmp ebx, 0xff0
jge 0x476b26
mov edx, edi
mov eax, esp
call fcn.004769b8
jmp 0x476b2f
mov eax, edi
mov edx, esi
call fcn.00403494
add esp, 0x1000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x476b68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x476bfa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ebx, eax
test ebx, ebx
jle 0x476bd0
cmp ebx, 0x104
jge 0x476bd0
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.0040355c
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.00476a90
jmp 0x476be1
mov eax, 0x476c10
call fcn.004528b4
mov eax, esi
call fcn.00403400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476c01
lea eax, [ebp - 0x108]
call fcn.00403400
ret

Function at 0x476c24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x476d72
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00476a90
lea eax, [ebp - 0xc]
call fcn.00476b68
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x476d80
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00403738
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
call fcn.00403738
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x476cd0
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x4c7
jne 0x476cc6
call fcn.00408bc0
mov eax, 0x476d90
call fcn.004527fc
cmp dword [ebp - 0x10], 0
jne 0x476ce0
mov eax, 0x476da8
call fcn.004526a4
xor edx, edx
push ebp
push 0x476d50
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004767b0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x476cee
inc eax
jne 0x476d19
mov eax, 0x476dd4
call fcn.004527fc
call fcn.004767b0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x476d39
mov eax, 0x476df8
call fcn.004527fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476d57
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x476e0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x476ed7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x4767a0
call fcn.00476ef8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x476eb0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x476ef0
call fcn.004078d4
mov edx, dword [ebp - 8]
mov eax, dword [0x49a628]
call fcn.004242ac
call fcn.004767b0
call sub.user32.dll_GetFocus
mov edx, dword [0x49a628]
cmp eax, dword [edx + 0x20]
jne 0x476e93
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x476e9a
call sub.user32.dll_WaitMessage
jmp 0x476e72
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476eb7
mov eax, dword [ebp - 4]
call fcn.00402b58
ret

Function at 0x47b174
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47b17c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47b2e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00452d84
mov edx, dword [ebp - 0x10]
mov eax, 0x49b120
call fcn.00403450
mov edx, 0x47b300
lea eax, [ebp - 0x10]
call fcn.00403494
lea eax, [ebp - 0x10]
mov edx, dword [0x49b120]
call fcn.0040357c
mov eax, dword [ebp - 0x10]
call fcn.00456b58
cmp byte [0x49afac], 0
je 0x47b1df
mov eax, dword [0x49b120]
call fcn.0045634c
lea edx, [ebp - 0x10]
mov eax, dword [0x49b120]
call fcn.0042c3e4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47b328
call fcn.004035c0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x47b271
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004507b8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00406d48
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0042e714
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
mov al, 0x60
call fcn.00450788
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, 0x4063e0
call fcn.00408bec
call fcn.0040311c
lea eax, [ebp - 0xc]
mov ecx, 0x47b338
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, 0x47b350
call fcn.0047b11c
lea eax, [ebp - 8]
call fcn.00457780
cmp dword [ebp - 8], 0
je 0x47b2bf
lea eax, [ebp - 0xc]
mov ecx, 0x47b364
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047b11c
mov eax, dword [ebp - 0xc]
call fcn.004577ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b2ee
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403420
ret
Function at 0x47d1c0
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x49b3b5], 1
call fcn.00454800
test al, al
jne 0x47d202
push 5
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov cl, 2
xor edx, edx
mov eax, dword [0x49ad30]
call fcn.0047d0cc
ret

Function at 0x4813c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x4813f0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x4813f9
call fcn.00480624
mov eax, 0xa
call fcn.0042eac0
call fcn.00480624
call fcn.00481390
test al, al
jne 0x4813ce
pop ebx
ret

Function at 0x481878
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x49b048], 0
je 0x48190f
mov eax, dword [0x49b048]
call fcn.00418360
test al, al
je 0x48190f
mov eax, dword [0x49b048]
cmp byte [eax + 0xc7], 0
je 0x4818bf
cmp byte [ebx + 0x1b9], 0
jne 0x4818bf
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4818c3
xor eax, eax
jmp 0x4818c5
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x49b048]
call fcn.004181c8
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x48190f
test bl, bl
je 0x4818fd
push 5
mov eax, dword [0x49b048]
call fcn.004181c8
push eax
call sub.user32.dll_ShowWindow
jmp 0x48190f
push 0
mov eax, dword [0x49b048]
call fcn.004181c8
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4819b8
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x49b370], 0
push 0x481a90
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x481aa0
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x481a44
lea edx, [esp + 4]
push edx
call eax
push 0x481ab4
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x481a4e
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x481a4e
cmp dword [esp], 0
je 0x481a4e
call fcn.00451a7c
test al, al
je 0x481a4e
push 0x481ac4
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x481a4e
push 0x481ae0
push 0x481af0
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x481a4e
mov byte [0x49b370], 1
jmp 0x481a4e
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ax, word [esp + 4]
sub ax, 1
jb 0x481a67
sub ax, 5
je 0x481a70
sub ax, 3
je 0x481a79
jmp 0x481a82
mov byte [0x498c40], 1
jmp 0x481a89
mov byte [0x498c40], 3
jmp 0x481a89
mov byte [0x498c40], 2
jmp 0x481a89
mov byte [0x498c40], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x481b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x481b70
mov edx, 0x80000002
xor eax, eax
call fcn.0042dd1c
test eax, eax
jne 0x481b69
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x481b9c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x481b60
cmp dword [ebp - 0xc], 4
jne 0x481b60
cmp dword [ebp - 8], 4
jne 0x481b60
mov ax, word [ebp - 0x10]
mov word [0x49b384], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x481ce4
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x481d96
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x49b380], eax
cmp byte [0x49b36f], 0
je 0x481d96
mov eax, dword [esp + 4]
cmp eax, 5
jl 0x481d87
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x481d96
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x49b384], ax
mov al, byte [esp + 0x12e]
mov byte [0x49b386], al
mov ax, word [esp + 0x12c]
mov word [0x49b388], ax
jmp 0x481d96
cmp eax, 4
jne 0x481d96
call fcn.00481b00
call fcn.00481ba8
add esp, 0x130
ret
Function at 0x48bd18
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x48beb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
mov ecx, 0x200
xor edx, edx
call fcn.004034e0
push 0
xor eax, eax
mov al, byte [ebp + 8]
mov eax, dword [eax*4 + 0x499080]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0042dd1c
test eax, eax
jne 0x48be9e
xor edx, edx
push ebp
push 0x48be93
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [esi + 4]
call fcn.00436114
xor ebx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov dword [ebp - 0x18], eax
cmp byte [ebp + 8], 0
je 0x48bdd0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
jmp 0x48bdef
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
sub eax, 1
jb 0x48be3d
sub eax, 0xe9
je 0x48be02
sub eax, 0x19
je 0x48be7c
jmp 0x48be36
mov eax, dword [ebp - 0x10]
call fcn.00403574
cmp eax, 0x10000
jl 0x48be1b
call fcn.004031bc
jmp 0x48be9e
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.004034e0
jmp 0x48bd9e
call fcn.004031bc
jmp 0x48be9e
lea ecx, [ebx + 1]
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.00436114
lea eax, [ebp - 0x10]
call fcn.00403744
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004034e0
lea ecx, [ebp - 0x24]
mov eax, esi
mov edx, ebx
call fcn.00442b34
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00435064
inc ebx
jmp 0x48bd9e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48be9a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bec0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403420
ret
Function at 0x494630
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4946d3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4946ec
push ebx
push 0x4946f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403634
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402934
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4946b1
mov eax, dword [0x49adb0]
call fcn.00494588
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4946da
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x494ee0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4950b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042d918
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00452c1c
test al, al
jne 0x494f47
xor eax, eax
push ebp
push 0x494f3d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00452f6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x494f47
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
mov eax, dword [0x49b450]
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x494f70
mov eax, dword [0x49adac]
call fcn.00494588
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov eax, dword [0x49a014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4950c0
push 0x4950c4
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push 0x494738
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x49b47c], eax
xor eax, eax
push ebp
push 0x495084
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d3f0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4950d4
call fcn.004078d4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d2d0
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040357c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00494630
mov dword [ebp - 0xc], eax
call fcn.004946fc
test al, al
jne 0x495064
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x495044
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49508b
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x496058
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4962bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4962d4
mov eax, dword [0x49a628]
call fcn.004242ac
push 5
mov eax, dword [0x49a628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x496289
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0047d408
lea eax, [ebp - 0x10]
call fcn.0042d868
mov eax, dword [ebp - 0x10]
call fcn.00407288
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d3f0
mov edx, dword [ebp - 0x10]
mov eax, 0x49b450
call fcn.00403450
call fcn.004948d8
lea ecx, [ebp - 0x10]
mov edx, 0x4962e8
mov eax, dword [0x49b450]
call fcn.0042c49c
mov edx, dword [ebp - 0x10]
mov eax, 0x49b454
call fcn.00403450
lea ecx, [ebp - 0x10]
mov edx, 0x4962f8
mov eax, dword [0x49b450]
call fcn.0042c49c
mov edx, dword [ebp - 0x10]
mov eax, 0x49b458
call fcn.00403450
push 2
push 0
push 1
mov ecx, dword [0x49b450]
mov dl, 1
mov eax, 0x44f830
call fcn.0044fa8c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4961a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.0044fa50
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.0044fa28
cmp dword [ebp - 0xc], 0x67734d49
je 0x49617b
mov cl, 1
xor edx, edx
mov eax, dword [0x49b458]
call fcn.00450910
jmp 0x49618a
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x49b450]
call fcn.00450910
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4961a7
mov eax, dword [ebp - 4]
call fcn.00402b58
ret