Function at 0x4627b0
Capabilities:
Create pipe
Create process on windows
Delete file
Get common file path
Query environment variable
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x42b4
call fcn.004c2ee0
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.yara.exe
mov edx, str.yara
mov ecx, 0xab
call fcn.004618a0
add esp, 4
test eax, eax
jne 0x462ce2
push str.rules.yar
mov edx, str.rules
mov ecx, 0xac
call fcn.004618a0
add esp, 4
test eax, eax
jne 0x462ce2
push 0x54ed60
push str._syara.exe
push 0x1000
push 0x552d60
call fcn.004bb50e
add esp, 0x10
mov edx, 0x528b00
mov ecx, 0x552d60
call fcn.0045d5f0
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x4218]
push 0xfff
push eax
push str.SystemRoot
call esi
push 0xfff
lea eax, [ebp - 0x2218]
push eax
push str.ProgramData
call esi
mov esi, dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
lea eax, [ebp - 0x4230]
push eax
push 0
call esi
lea eax, [ebp - 0x4230]
push eax
lea eax, [ebp - 0x218]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x4218]
mov ebx, dword [sym.imp.PGPsdk.dll_PGPCFBEncrypt]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x42b0], eax
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x42ac], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x42a8], eax
xor eax, eax
mov dword [ebp - 0x42a4], eax
mov edi, edi
mov edx, dword [ebp + eax*4 - 0x42b0]
mov ecx, 0x44
lea eax, [ebp - 0x42a0]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x4628d2
mov dword [ebp - 0x42a0], 0x44
lea eax, [ebp - 0x4258]
mov ecx, 0x10
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x4628f0
or dword [ebp - 0x4274], 0x100
cmp byte [0x53eb80], 1
push edx
jne 0x462930
push 0x54ed60
push 0x54ed60
push str.__syara.exe___s__f__r__w__p_1__C___srules.yar____s_
push 0x6000
push 0x552d60
call fcn.00471b60
add esp, 0x18
jmp 0x462957
push dword [0x53ec34]
push 0x54ed60
push 0x54ed60
push str.__syara.exe___s__f__r__w__p_1___s_S____s_
push 0x6000
push 0x552d60
call fcn.00471b60
add esp, 0x1c
push 0x552d60
push str.acquireYara4:_Executing___s__n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
push 0
lea eax, [ebp - 0x4248]
mov dword [ebp - 0x4238], 0
push eax
lea eax, [ebp - 0x423c]
mov dword [ebp - 0x423c], 0
push eax
lea eax, [ebp - 0x4238]
mov dword [ebp - 0x4248], 0xc
push eax
mov dword [ebp - 0x4240], 1
mov dword [ebp - 0x4244], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4629dc
mov ecx, str.acquireYara4:_error_with_StdoutRd_CreatePipe_n
call fcn.00458190
push 0
push 1
push dword [ebp - 0x4238]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x4629fa
mov ecx, str.acquireYara4:_error_with_Stdout_SetHandleInformation_n
call fcn.00458190
mov eax, dword [ebp - 0x423c]
mov ecx, str.Acquiring_yara4_n
mov dword [ebp - 0x4264], eax
call fcn.00458190
lea eax, [ebp - 0x4258]
push eax
lea eax, [ebp - 0x42a0]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
push 0x552d60
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x462cb8
push dword [ebp - 0x423c]
call esi
push 0x4000
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x462cf8
mov ecx, 0x4000
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x462a70
push str.yara4
push 0x561208
push 0x561418
push str._S__s__S.log.z
push 0x1000
push 0x547d60
call fcn.00471220
push 0x1000
push 0x547d60
call fcn.004bbd22
mov dword [ebp - 0x4220], eax
lea eax, [ebp - 0x422c]
push eax
push 2
lea eax, [ebp - 0x4220]
mov dword [ebp - 0x422c], 0
push eax
push dword [0x53ebb8]
call ebx
mov ecx, eax
call fcn.00455680
push 1
mov edx, 2
lea ecx, [ebp - 0x422c]
call fcn.00457880
push 0x548d60
push dword [ebp - 0x4220]
push 0x547d60
push dword [0x53ebb8]
call ebx
add esp, 0x44
mov ecx, eax
call fcn.00455680
push dword [ebp - 0x4220]
mov edx, 1
mov ecx, 0x548d60
call fcn.00457880
add esp, 4
push 0
lea eax, [ebp - 0x421c]
push eax
push 0x4000
push edi
push dword [ebp - 0x4238]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov dword [ebp - 0x4224], 0
mov eax, dword [ebp - 0x421c]
add dword [0x560d60], eax
lea eax, [ebp - 0x4224]
push eax
adc dword [0x560d64], 0
lea eax, [ebp - 0x421c]
push 2
push eax
push dword [0x53ebb8]
call ebx
push 1
mov edx, 2
lea ecx, [ebp - 0x4224]
call fcn.00457880
push 0x548d60
push dword [ebp - 0x421c]
push edi
push dword [0x53ebb8]
call ebx
push dword [ebp - 0x421c]
mov edx, 1
mov ecx, 0x548d60
call fcn.00457880
add esp, 0x28
test esi, esi
jne 0x462b26
push 0xffffffffffffffff
push dword [ebp - 0x4258]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x4258]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4254]
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [ebp - 0x4228]
mov dword [ebp - 0x4228], 0
push eax
push 2
lea eax, [ebp - 0x4234]
mov dword [ebp - 0x4234], 0xffffffff
push eax
push dword [0x53ebb8]
call ebx
push 1
mov edx, 2
lea ecx, [ebp - 0x4228]
call fcn.00457880
mov eax, dword [ebp - 0x42a4]
add esp, 0x14
inc eax
mov dword [ebp - 0x42a4], eax
cmp eax, 3
jl 0x4628c0
mov ecx, str.Yara4_acquired__delete_temp_yara_binary_and_rules_n
call fcn.00458190
push 0x54ed60
push str._syara.exe
push 0xffffffffffffffff
push 0x1000
push 0x552d60
call fcn.004bb4ef
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x14
push 0x552d60
call esi
push 0x54ed60
push str._srules.yar
push 0xffffffffffffffff
push 0x1000
push 0x552d60
call fcn.004bb4ef
add esp, 0x14
push 0x552d60
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.acquireYara4:_CreateProcess_failed___d_._n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
mov ecx, 0x545d60
call fcn.00458190
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push str.Failed_to_allocate_memory_on_process_heap_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
int3