joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x46a00f
mov esi, dword [esp + 0x10]
movsx ecx, word [eax]
mov dword [esi], ecx
movsx edx, word [eax + 2]
mov dword [esi + 4], edx
movsx ecx, word [eax + 4]
mov dword [esi + 8], ecx
movsx edi, word [eax + 6]
mov dword [esi + 0xc], edi
movsx edx, word [eax + 8]
mov dword [esi + 0x10], edx
mov cl, byte [eax + 0xa]
mov byte [esi + 0x14], cl
mov dl, byte [eax + 0xb]
mov byte [esi + 0x15], dl
mov cl, byte [eax + 0xc]
mov byte [esi + 0x16], cl
mov dl, byte [eax + 0xd]
mov byte [esi + 0x17], dl
mov cl, byte [eax + 0xe]
mov byte [esi + 0x18], cl
push 0x20
mov dl, byte [eax + 0xf]
add eax, 0x12
push eax
mov byte [esi + 0x19], dl
mov cl, byte [eax - 2]
mov edi, 1
mov byte [esi + 0x1a], cl
lea ecx, [esi + 0x1c]
mov dl, byte [eax - 1]
push ecx
mov byte [esi + 0x1b], dl
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x46a013
mov esi, dword [esp + 0x10]
test edi, edi
je 0x46a02e
cmp dword [0x50928c], 0
je 0x46a02e
cmp byte [esi + 0x17], 0
jne 0x46a02e
call fcn.004c7f80
mov byte [esi + 0x17], al
mov eax, edi
pop edi
pop esi
ret

Function at 0x46a690
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
mov ecx, dword [eax]
mov esi, 0xffffffff
push 0
push ecx
call fcn.0046c4f0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
add esp, 8
cmp dword [esp + 4], 0
je 0x46a6d6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push ecx
push eax
call fcn.0046b820
add esp, 8
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x46a740
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
push ebx
push esi
push edi
xor esi, esi
push ebp
xor edi, edi
lea eax, [esp + 0x10]
push 0x105
mov ecx, dword [esp + 0x228]
push eax
push ecx
call fcn.00470a10
add esp, 0xc
test eax, eax
je 0x46a779
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x210
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ebp, ebp
inc edi
lea eax, [esp + 0x118]
lea ecx, [esp + 0x10]
push eax
push edi
push str.untit
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x46a7e0
lea eax, [esp + 0x118]
push ebp
push 0x4000080
push 1
push ebp
push 2
push 0x40000000
push eax
call ebx
cmp eax, 0xffffffff
jne 0x46a7d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov esi, eax
jne 0x46a7e0
cmp edi, 3
jge 0x46a7e0
mov ebp, 1
jmp 0x46a7e0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x46a77f
cmp esi, 0x6c
je 0x46a800
cmp esi, 5
je 0x46a800
cmp esi, 0x13
je 0x46a800
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x210
ret
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x210
ret
Function at 0x46ba80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x24
mov ecx, dword [esp + 0x3c]
push ebx
mov edx, dword [esp + 0x2c]
push esi
push edi
push ebp
push eax
push ecx
mov eax, dword [esp + 0x44]
push eax
push edx
call fcn.0046b8a0
mov esi, dword [esp + 0x48]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x46bab9
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x3c]
and eax, 0xffff0000
jne 0x46bb1a
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.0049add0
lea eax, [esp + 0x10]
push 0
mov ecx, dword [esp + 0x48]
push eax
mov edx, dword [esp + 0x48]
push ecx
mov dword [esp + 0x1c], 0
push edx
push esi
mov esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46bafd
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push esi
call fcn.0049ae60
lea ecx, [esp + 0x14]
call fcn.0049ae40
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
test eax, eax
je 0x46bbc2
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push ecx
push eax
call fcn.0046c430
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x46bba9
mov ebx, dword [ebp + 0x14]
mov eax, dword [esp + 0x44]
sub ebx, dword [ebp + 0x18]
cmp ebx, eax
jl 0x46bb4a
mov ebx, eax
test ebx, ebx
jg 0x46bb54
xor ebx, ebx
test ebx, ebx
jle 0x46bb88
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x46bb88
mov esi, dword [ebp + 0x18]
mov edi, dword [esp + 0x40]
add esi, eax
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebp + 0x18], ebx
mov eax, dword [ebp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
call ebp
push 0x50e188
call fcn.004db850
add esp, 4
push 0
call fcn.0046c420
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
mov ebx, 0xffffffff
push 2
call fcn.0046c420
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x46bbd0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 4
mov ecx, dword [esp + 0x1c]
push ebx
mov edx, dword [esp + 0xc]
push esi
push edi
push ebp
push eax
push ecx
mov eax, dword [esp + 0x24]
push eax
push edx
call fcn.0046b8a0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x46bc09
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0x1c]
and eax, 0xffff0000
jne 0x46bc51
lea eax, [esp + 0x10]
push 0
mov ebx, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x28]
push ebx
mov dword [esp + 0x1c], 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46bc44
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
test eax, eax
je 0x46bd1d
push 0
call fcn.0046c420
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 4
push ecx
push eax
call fcn.0046c430
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x46bd04
mov ebx, dword [esp + 0x24]
mov esi, dword [ebp + 0x18]
add esi, ebx
cmp dword [ebp + 0x14], esi
jge 0x46bccc
cmp dword [ebp + 0x1c], esi
jl 0x46bca2
mov eax, dword [ebp + 0x10]
push eax
call fcn.00489000
add esp, 4
cmp eax, esi
jge 0x46bcc9
push 2
mov eax, dword [ebp + 0x10]
push esi
push eax
call fcn.00488df0
add esp, 0xc
test eax, eax
jne 0x46bcc6
mov ebx, 0xffffffff
push 0x70
call fcn.0046c420
add esp, 4
jmp 0x46bccc
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], esi
test ebx, ebx
jle 0x46bced
mov eax, dword [ebp + 0x10]
mov esi, dword [esp + 0x20]
mov ecx, ebx
mov edi, dword [eax]
shr ecx, 2
add edi, dword [ebp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebp + 0x18], ebx
push 0x50e188
call fcn.004db850
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebx, 0xffffffff
push 2
call fcn.0046c420
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x46bd80
Capabilities:
Move file

Disassembly:
sub esp, 0x210
push esi
push edi
mov edi, dword [esp + 0x21c]
push edi
call fcn.00470e60
add esp, 4
test eax, eax
jne 0x46bdb7
push 0x45e
call fcn.0046c420
add esp, 4
mov eax, 0x45e
pop edi
pop esi
add esp, 0x210
ret
mov esi, dword [esp + 0x220]
push esi
call fcn.00470e60
add esp, 4
test eax, eax
jne 0x46bde6
push 0x45e
call fcn.0046c420
add esp, 4
mov eax, 0x45e
pop edi
pop esi
add esp, 0x210
ret
lea eax, [esp + 8]
push 0x105
push eax
push esi
call fcn.00470b30
lea eax, [esp + 0x11c]
add esp, 0xc
push 0x105
push eax
push edi
call fcn.00470b30
lea eax, [esp + 0x14]
lea ecx, [esp + 0x11c]
add esp, 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x46be34
call sub.KERNEL32.dll_GetLastError
pop edi
pop esi
add esp, 0x210
ret
xor eax, eax
pop edi
pop esi
add esp, 0x210
ret
Function at 0x46be40
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
sub esp, 0x108
push esi
mov esi, dword [esp + 0x110]
push esi
call fcn.00470f80
add esp, 4
test eax, eax
jne 0x46beec
push esi
call fcn.00470e60
add esp, 4
test eax, eax
jne 0x46be86
push 0x45e
call fcn.0046c420
add esp, 4
mov eax, 0x45e
pop esi
add esp, 0x108
ret
lea eax, [esp + 4]
push 0x105
push eax
push esi
call fcn.00470b30
lea eax, [esp + 0x10]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x46bee2
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x46bed5
test al, 0x10
je 0x46bed5
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x46bed5
xor eax, eax
pop esi
add esp, 0x108
ret
call sub.KERNEL32.dll_GetLastError
pop esi
add esp, 0x108
ret
xor eax, eax
pop esi
add esp, 0x108
ret
xor eax, eax
pop esi
add esp, 0x108
ret

Function at 0x46c0d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, dword [esp + 0x114]
push edi
push ebp
push esi
call fcn.0046bd50
add esp, 4
test eax, eax
jne 0x46c0fe
mov eax, 0x3ed
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
lea eax, [esp + 0x10]
push 0x105
push eax
push esi
call fcn.00470a10
add esp, 0xc
push esi
call fcn.00470d70
lea ebp, [esp + 0x14]
add esp, 4
test eax, eax
jne 0x46c12f
push esi
call fcn.00470d50
lea ebp, [esp + eax + 0x14]
add esp, 4
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
xor ebx, ebx
push 0x5c
push ebp
call fcn.004c7e90
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x46c211
lea eax, [esp + 0x10]
cmp ebp, eax
je 0x46c1cb
cmp dword [0x50928c], ebx
jne 0x46c17a
mov eax, ebp
lea ecx, [esp + 0x10]
sub eax, ecx
cmp eax, 1
jle 0x46c174
lea eax, [ebp - 1]
jmp 0x46c182
lea eax, [esp + 0x10]
jmp 0x46c182
lea eax, [esp + 0x10]
push ebp
push eax
call edi
cmp byte [eax], 0x3a
je 0x46c1cb
cmp dword [0x50928c], ebx
jne 0x46c1a7
mov eax, ebp
lea ecx, [esp + 0x10]
sub eax, ecx
cmp eax, 1
jle 0x46c1a1
lea eax, [ebp - 1]
jmp 0x46c1af
lea eax, [esp + 0x10]
jmp 0x46c1af
lea eax, [esp + 0x10]
push ebp
push eax
call edi
cmp byte [eax], 0x2e
je 0x46c1cb
lea eax, [esp + 0x10]
mov byte [ebp], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x46c1e3
mov byte [ebp], 0x5c
cmp dword [0x50928c], ebx
jne 0x46c1d9
inc ebp
jmp 0x46c13d
push ebp
call esi
mov ebp, eax
jmp 0x46c13d
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x46c201
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
call sub.KERNEL32.dll_GetLastError
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x46c2d0
Capabilities:
Set current directory

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x108
lea eax, [esp]
push 0x105
push eax
push ecx
call fcn.00470a10
lea ecx, [esp + 0xc]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x46c305
xor eax, eax
add esp, 0x108
ret
call sub.KERNEL32.dll_GetLastError
add esp, 0x108
ret

Function at 0x46c360
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x114
push esi
mov esi, dword [esp + 0x11c]
mov eax, dword [esi]
push eax
call fcn.00470e60
add esp, 4
test eax, eax
jne 0x46c397
push 0x45e
call fcn.0046c420
add esp, 4
mov eax, 0x45e
pop esi
add esp, 0x114
ret
lea eax, [esp + 0x10]
push 0x105
push eax
mov ecx, dword [esi]
push ecx
call fcn.00470b30
mov ecx, dword [esp + 0x12c]
lea edx, [esp + 0x1c]
mov dword [esp + 0x16], 0
mov dword [esp + 0x12], ecx
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [esp + 4], ax
lea eax, [esp + 4]
push eax
push 0x4710b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
cmp dword [esp + 0xa], 1
mov eax, 0
pop esi
adc eax, 0xffffffff
add esp, 0x114
and eax, 0x20
ret

Function at 0x46c820
Capabilities:
Get disk information

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x108
lea eax, [esp]
push 0x105
push eax
push ecx
call fcn.00470a70
add esp, 0xc
test eax, eax
jne 0x46c853
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 0x108
ret
xor eax, eax
add esp, 0x108
ret
Function at 0x46d960
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x14
cmp dword [ecx + 0x194], 0
mov dword [esp], ecx
push ebx
mov dword [esp + 8], 0
push esi
push edi
push ebp
je 0x46dacc
lea eax, [ecx + 0x19c]
push eax
call fcn.004dae00
add esp, 4
test eax, eax
je 0x46d9a9
mov ecx, dword [esp + 0x10]
call fcn.0046dca0
mov ecx, dword [esp + 0x10]
call fcn.0046d910
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
jne 0x46dacc
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x46dacc
mov ebx, 0x640
push 2
mov dword [esp + 0x20], 0xffffffff
push ebx
call fcn.00488d30
add esp, 8
mov edi, eax
test edi, edi
je 0x46d9ff
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
jmp 0x46da03
mov esi, dword [esp + 0x18]
test edi, edi
je 0x46dac4
test esi, esi
je 0x46dac4
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
mov edx, dword [esp + 0x20]
push eax
mov dword [esp + 0x1c], ebx
push esi
push ecx
push edx
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x46da59
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 2
push ebx
push edi
call fcn.00488da0
add esp, 0xc
test eax, eax
je 0x46da8b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
jmp 0x46da13
test eax, eax
jne 0x46da93
xor bp, bp
cmp word [esp + 0x1c], bp
jle 0x46da13
movsx eax, bp
shl eax, 5
add eax, esi
inc bp
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
push ecx
push edx
mov ecx, dword [esp + 0x18]
call fcn.0046dae0
cmp bp, word [esp + 0x1c]
jl 0x46da67
jmp 0x46da13
mov dword [esp + 0x14], 8
mov eax, dword [esp + 0x20]
push eax
call sub.MPR.dll_WNetCloseEnum
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call fcn.00488e40
add esp, 4
cmp dword [esp + 0x14], 0
jne 0x46dacc
mov eax, dword [esp + 0x10]
mov dword [eax + 0x194], 0
jmp 0x46dacc
mov dword [esp + 0x14], 8
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x470240
Capabilities:
Get disk information

Disassembly:
sub esp, 0x114
push ebx
push esi
push edi
xor ebx, ebx
test byte [ecx + 0x14], 4
mov edi, ecx
je 0x4702bb
lea eax, [esp + 0x18]
push 0x105
mov byte [esp + 0x1c], bl
push eax
mov esi, dword [edi]
call dword [esi + 0x2c]
lea eax, [esp + 0x14]
push ebx
lea ecx, [esp + 0x10]
push ebx
lea edx, [esp + 0x18]
push eax
push ecx
mov eax, 0
lea ecx, [esp + 0x28]
push edx
cmp byte [esp + 0x2c], 1
adc eax, 0xffffffff
push ebx
push ebx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4702c0
lea eax, [esp + 0x18]
push 0x105
push eax
mov ecx, edi
call dword [esi + 0x38]
test eax, eax
jne 0x4702c0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, dword [esp + 0xc]
jg 0x4702c0
mov ebx, 1
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x114
ret

Function at 0x475710
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov ecx, dword [esp + 4]
cmp byte [ecx], al
je 0x475732
mov edx, eax
inc ecx
shl edx, 0x18
shr eax, 8
or edx, eax
movsx eax, byte [ecx - 1]
xor edx, eax
cmp byte [ecx], 0
mov eax, edx
jne 0x47571a
ret
Function at 0x4779c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx]
inc ecx
add al, byte [esp + 8]
xor al, byte [0x4ffc90]
cmp byte [ecx], 0
je 0x4779e9
xor edx, edx
inc ecx
mov dl, al
mov al, byte [edx + 0x4ffc90]
xor al, byte [ecx - 1]
cmp byte [ecx], 0
jne 0x4779d6
ret

Function at 0x479f10
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x50e208]
test eax, eax
jne 0x479f43
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x10c]
push eax
push ecx
push edx
call fcn.004c6fe0
add esp, 0x114
ret
lea ecx, [esp]
push 0x105
push ecx
push eax
call fcn.00470b30
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
add esp, 0xc
push eax
push ecx
mov eax, dword [esp + 0x124]
push edx
mov ecx, dword [esp + 0x124]
push eax
mov edx, dword [esp + 0x124]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0x108
ret

Function at 0x47a140
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x510
lea eax, [esp + 8]
push 0x1f
mov dword [esp + 8], 0x400
push 0x5f0
push 0x105
push eax
call fcn.004c8000
lea eax, [esp + 0x10]
add esp, 0x10
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47a1c6
lea eax, [esp + 4]
lea ecx, [esp + 0x110]
mov edx, dword [esp]
push eax
push ecx
push 0
push 0
push str.AppData
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47a1c6
cmp dword [esp + 0x518], 0
je 0x47a1c6
lea eax, [esp + 8]
lea ecx, [esp + 0x110]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x110]
mov edx, dword [esp + 0x514]
push ecx
push edx
call fcn.004709b0
add esp, 0x518
ret

Function at 0x47a230
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx ecx, ax
cmp byte [esp + ecx - 1], 0x5c
je 0x47a25f
mov byte [esp + ecx], 0x5c
inc ax
movsx ecx, ax
mov byte [esp + ecx], 0
lea eax, [esp]
mov ecx, dword [esp + 0x10c]
push eax
push ecx
call fcn.004709b0
add esp, 0x110
ret

Function at 0x47a280
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movsx ecx, ax
cmp byte [esp + ecx - 1], 0x5c
je 0x47a2af
mov byte [esp + ecx], 0x5c
inc ax
movsx ecx, ax
mov byte [esp + ecx], 0
lea eax, [esp]
mov ecx, dword [esp + 0x10c]
push eax
push ecx
call fcn.004709b0
add esp, 0x110
ret

Function at 0x47a480
Capabilities:
Print debug messages

Disassembly:
cmp dword [0x507288], 2
jne 0x47a48e
jmp 0x4fd9e0
ret
call fcn.004fd990
jmp fcn.004fd920
Function at 0x47f770
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x294
push ebx
push esi
mov esi, dword [esp + 0x2a0]
push edi
push ebp
push 0
mov eax, dword [esi]
push eax
call fcn.00471010
add esp, 8
test eax, eax
je 0x47f79f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x294
ret
lea eax, [esp + 0x10]
push 0x20a
push eax
mov ecx, dword [esi]
cmp dword [esi + 4], 0
push ecx
je 0x47f7b9
call fcn.00470b30
jmp 0x47f7be
call fcn.00470ad0
lea eax, [esp + 0x1c]
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call ebp
lea edi, [esp + eax + 0x10]
push 0x4000
lea eax, [esp + 0x220]
lea ecx, [esp + 0x14]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_OpenFile]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x47f846
push 0
mov eax, dword [esi]
push eax
call fcn.00471040
add esp, 8
test eax, eax
je 0x47f839
push str..EXE
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call ebp
add edi, eax
push 0x4000
lea eax, [esp + 0x220]
lea ecx, [esp + 0x14]
push eax
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x47f846
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x294
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x294
ret
cmp dword [esi + 0x10], 0
je 0x47f867
mov byte [edi], 0x20
inc edi
lea eax, [esp + 0x21a]
mov ecx, dword [esi + 8]
sub eax, edi
push eax
push edi
push ecx
call fcn.00470b30
add esp, 0xc
cmp esi, 0xffffffe4
je 0x47f899
lea eax, [esp + 0x10]
push 0x20c
push 0x5052f4
add esi, 0x1c
push eax
call fcn.004c6f60
lea eax, [esp + 0x1c]
add esp, 0xc
push 0x20c
push esi
push eax
call fcn.004c6f60
add esp, 0xc
lea eax, [esp + 0x10]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov cx, 0x20
pop ebp
cmp cx, ax
pop edi
mov eax, 1
pop esi
adc eax, 0xffffffff
pop ebx
add esp, 0x294
ret

Function at 0x488d00
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
mov dword [esp], 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
add esp, 0x20
sub eax, 0x300000
mov dword [0x50e358], eax
ret

Function at 0x489050
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
xor eax, eax
mov ecx, 8
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov dword [esp + 4], 0x20
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [0x5081a0]
cmp dword [esp + 0x18], eax
ja 0x489083
mov eax, dword [esp + 0x18]
pop edi
add esp, 0x20
ret
Function at 0x48dc10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push eax
call fcn.0048dfa0
add esp, 8
mov edi, eax
cmp dword [0x50928c], 0
mov eax, 1
je 0x48dc3d
push edi
call fcn.004c8040
add esp, 4
test eax, eax
je 0x48dc47
movzx ax, byte [edi]
jmp 0x48dc4a
mov ax, word [edi]
cmp ax, 0x30
jb 0x48dc6b
cmp ax, 0x39
ja 0x48dc6b
cmp dword [0x50928c], 0
jne 0x48dc62
inc edi
jmp 0x48dc6b
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x48dc8b
mov eax, dword [esp + 0xc]
push edi
push esi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, 1
pop edi
pop esi
ret
mov eax, dword [esp + 0xc]
push esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x48dca9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop esi
ret
mov eax, 1
pop edi
pop esi
ret
Function at 0x48dce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x264
test byte [0x508abc], 0x40
push ebx
push esi
push edi
push ebp
je 0x48dd03
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x264
ret
mov esi, dword [esp + 0x278]
push 0x100
movzx eax, si
push eax
mov ecx, dword [0x50e328]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov ecx, dword [0x50e328]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x48de3a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x10], eax
test eax, eax
je 0x48de3a
lea ebx, [eax + 2]
push 5
mov dword [esp + 0x1c], 0x12c
push ebx
call fcn.0048dfa0
add esp, 8
push eax
lea eax, [esp + 0x280]
push eax
push 4
push ebx
call fcn.0048dfa0
lea ecx, [esp + 0x2c]
add esp, 8
push eax
lea eax, [esp + 0x24]
push eax
push ecx
call fcn.0048dec0
mov ecx, dword [esp + 0x290]
lea edx, [esp + 0x30]
lea eax, [esp + 0x15c]
add esp, 0x14
push ecx
push edx
push 0x12c
push eax
call fcn.00401920
mov ecx, dword [esp + 0x20]
add esp, 0x10
movsx eax, word [ecx]
cmp eax, 3
ja case.default.0x48ddb6
jmp dword [eax*4 + 0x48dea4]
push 0
jmp 0x48ddcf
push 0x40
jmp 0x48ddcf
push 0x30
jmp 0x48ddcf
push 0x10
jmp 0x48ddcf
push 0x20
call fcn.004d7a20
lea eax, [esp + 0x14c]
add esp, 4
mov dword [esp + 0x14], eax
push 2
push 8
call fcn.00488d30
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x48de3a
lea ebx, [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebx]
push ebp
mov dword [eax], ecx
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
mov ecx, dword [0x50e324]
push 0x48d920
push ecx
push 0xe5
call fcn.004198c0
add esp, 0x10
mov ebx, eax
push ebp
call fcn.00488e40
add esp, 4
cmp ebx, 0xffffffff
jne 0x48de8d
cmp esi, 0xcf
je 0x48de55
push esi
push 0xcf
call fcn.0048dcc0
add esp, 8
cmp eax, 2
jne 0x48de7d
push 0x12c
mov eax, dword [str._s___d]
push str.message
push eax
call fcn.004c8c90
add esp, 0xc
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x264
ret
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x264
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x264
ret