joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e81a
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [0x88f9ec]
mov esi, eax
call fcn.0042876e
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, eax
mov dword [esp + 0x18], ecx
xor ebx, ebx
jmp 0x44e84a
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
call fcn.0049fe15
mov ecx, dword [esp + 0x10]
push 0x7c
pop edx
mov dword [esp + 0x14], eax
call fcn.00428816
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp word [eax], cx
je 0x44e874
push eax
inc ebx
push ebx
push ecx
jmp 0x44e87b
push ecx
push ecx
push 0x800
push esi
call edi
cmp dword [esp + 0x14], 0
jne 0x44e846
push 0
push 0
push 0x800
push esi
call edi
push dword [0x895e98]
inc ebx
inc ebx
push ebx
push 0
push esi
call edi
mov eax, dword [0x88f9f0]
xor edi, edi
push edi
inc eax
push eax
push ebx
push 1
push esi
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov ecx, dword [esp + 0x18]
mov dl, 1
call fcn.00479b79
push edi
push dword [0x56bf9c]
push edi
push dword [ebp + 4]
push dword [ebp]
push 0x18a
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp ebp, ebx
jne 0x44e904
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x44e8fa
push 0x10
pop ecx
call fcn.004eb0a0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp ebp, edi
je 0x44e8fa
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x44e8fa
mov eax, ebp
jmp 0x44e8fc

Function at 0x44ea58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
push ebx
push esi
mov esi, ecx
mov ecx, edx
mov dword [ebp - 4], edx
call fcn.004b6995
mov ecx, eax
call fcn.004b6b8d
xor ebx, ebx
test al, al
jne 0x44ea9c
mov eax, esi
shr eax, 1
test al, 1
je 0x44ea9c
cmp byte [0x88f996], bl
je 0x44ea9c
xor ecx, ecx
inc ecx
call fcn.004e5827
test al, al
jne 0x44eb30
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ebx
push ebx
push dword [ebp - 4]
push ebx
push ebx
call esi
cmp eax, 0x20
jg 0x44eb28
push dword [ebp - 4]
push 0x519f60
call fcn.0049f9e2
pop ecx
pop ecx
push 1
push ebx
push eax
push 0x519f44
push ebx
push ebx
mov dword [ebp - 8], eax
call esi
cmp eax, 0x20
jg 0x44eb20
push 0x519f00
call fcn.004263e6
push dword [ebp - 4]
lea eax, [ebp - 0x488]
push dword [0x895f44]
push 0x230
push eax
call fcn.0049f973
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x28]
push 0x50fa44
push eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x30
call fcn.00477c73
add esp, 0x20
lea ecx, [ebp - 8]
call fcn.004a0cb3
lea ecx, [ebp - 4]
call fcn.004a0cb3
pop esi
pop ebx
leave
ret
Function at 0x44f755
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.005017e0
push esi
mov eax, edx
push edi
mov edi, ecx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x44f76b
sub eax, esi
sar eax, 1
mov esi, eax
mov eax, 0x7d0
cmp esi, eax
jl 0x44f786
mov esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x2000]
call fcn.00428b90
lea edx, [esi + esi]
mov eax, 0x51a224
lea ecx, [ebp + edx - 0x2000]
sub ecx, eax
movzx esi, word [eax]
mov word [ecx + eax], si
inc eax
inc eax
test si, si
jne 0x44f7a6
push 0x82d
lea eax, [ebp + edx - 0x1ffa]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2000]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
leave
ret

Function at 0x44fad3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
inc dword [0x890254]
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.0044e919
mov dword [ebp - 4], eax
test eax, eax
je 0x44fbfa
xor ecx, ecx
cmp word [eax], cx
sete cl
test cl, cl
jne 0x44fbfa
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov edx, 0x51a2b8
mov ecx, eax
call fcn.0049fc24
test al, al
jne 0x44fb39
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov edx, 0x51a2a4
mov ecx, eax
call fcn.0049fc24
test al, al
je 0x44fbfa
mov ecx, esi
call fcn.004a0308
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.004a1005
dec eax
cmp eax, 0x3ff
jae 0x44fbf2
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov edx, 0x51a270
mov ecx, eax
call fcn.0049fbbd
test al, al
je 0x44fba7
mov ecx, dword [0x567de0]
mov eax, 0x2710
test ecx, ecx
je 0x44fb83
call fcn.0047cf3f
push eax
lea eax, [ebp - 0x10]
push 0x51a234
push eax
call fcn.004a1618
add esp, 0xc
push dword [eax]
lea ecx, [ebp - 4]
call fcn.004a101e
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
lea ecx, [ebp - 8]
call fcn.004a0ff9
xor edx, edx
mov ecx, eax
call fcn.00428a18
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.004a0e99
push eax
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
push 0x51a22c
call fcn.0049f9ab
add esp, 0xc
push 1
push 0
push 0
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
lea ecx, [ebp - 8]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop edi
pop esi
leave
ret 4

Function at 0x44fc32
Capabilities:
Create directory

Disassembly:
cmp dword [0x56b6d0], 0
jne 0x44fc8a
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x44fc55
mov ecx, eax
call fcn.0044fc08
mov dword [0x56b6d0], eax
jmp 0x44fc5c
and dword [0x56b6d0], 0
mov ecx, 0x51a2c8
call fcn.0049a53c
mov ecx, dword [0x56b6d0]
push eax
add ecx, 0x24
call fcn.004a101e
mov ecx, dword [0x56b6d0]
add ecx, 0x24
call fcn.004a0ff9
mov ecx, eax
jmp fcn.004b9537
mov al, 1
ret
Function at 0x44fc8d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push ebx
mov ecx, edx
mov dword [ebp - 0x10], edx
call fcn.004a0eb9
mov eax, dword [ebp + 8]
mov byte [eax], bl
mov ecx, dword [0x89016c]
mov dword [ebp - 8], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 2], bl
cmp ecx, ebx
je 0x44fd00
mov edx, 0x510208
call fcn.0049fa55
test al, al
je 0x44fcd3
mov byte [ebp - 2], 1
mov byte [ebp - 1], 1
mov ecx, dword [0x89016c]
cmp ecx, ebx
je 0x44fcf6
call fcn.0049e604
mov ecx, 0x519850
call fcn.0042a25c
test eax, eax
je 0x44fd0a
mov ecx, dword [0x89016c]
cmp byte [ebp - 2], bl
je 0x44fd00
cmp byte [ebp - 1], bl
je 0x44fd0a
call fcn.0042897a
mov dword [ebp - 8], eax
jmp 0x44fd52
mov eax, dword [esi + 0x28]
cmp eax, ebx
jne 0x44fd14
mov eax, dword [esi + 0x24]
mov ecx, eax
call fcn.004b6995
mov esi, eax
mov edi, 0x517834
cmp esi, ebx
je 0x44fdab
push ebx
lea eax, [ebp - 0xc]
push eax
lea ecx, [esi - 2]
xor edx, edx
call fcn.00469055
test al, al
je 0x44fda4
mov ecx, dword [ebp - 0xc]
call fcn.0049ff51
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov dword [ebp - 8], eax
call fcn.00479b79
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
push ebx
push dword [ebp - 8]
call esi
lea edi, [eax + 1]
mov ecx, edi
call fcn.00479b81
push edi
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call esi
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.004a0c86
cmp dword [0x89016c], ebx
je 0x44fd90
cmp byte [ebp - 1], bl
je 0x44fd90
cmp byte [ebp - 2], bl
jne 0x44fd93
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
mov byte [eax], bl
call fcn.004a0cb3
mov al, 1
jmp 0x44fde8
mov eax, 0x510424
jmp 0x44fdad
mov eax, edi
cmp esi, ebx
jne 0x44fdb3
mov esi, edi
push eax
push esi
push dword [0x895f50]
call fcn.0049f9e2
mov esi, eax
lea eax, [ebp - 0x30]
push esi
push eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0x30
call fcn.00477c73
add esp, 0x14
mov dl, 1
mov ecx, esi
call fcn.00479b79
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x450196
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, ecx
test byte [edi + 0x1cc], 0x40
mov dword [ebp - 0xc], edx
je 0x45037e
test byte [edi + 0x1be], 2
jne 0x45037e
push esi
mov esi, dword [edi + 0x168]
lea ecx, [ebp - 8]
call fcn.004a0e93
mov ecx, dword [ebp - 0xc]
mov esi, dword [esi]
imul ecx, ecx, 0x7c
lea eax, [ebp - 0x14]
push eax
add ecx, esi
lea edx, [ebp - 8]
call fcn.0044fc8d
test al, al
jne 0x4501f2
lea ecx, [ebp - 8]
call fcn.004a0c7d
jmp 0x45037d
push ebx
lea ecx, [ebp - 0x10]
call fcn.004a0e93
lea ecx, [ebp - 8]
call fcn.004a0e99
mov edx, 0x51a320
mov ecx, eax
call fcn.0049fac5
mov byte [ebp - 1], al
call fcn.004a2796
movzx eax, word [eax + 4]
mov edx, dword [ebp - 0xc]
xor ebx, ebx
push ebx
movzx esi, ax
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
mov ecx, edi
push esi
call fcn.00450100
push 0x31
pop eax
lea ecx, [ebp - 0x10]
mov word [ebp - 0x20], ax
call fcn.004a0ff9
mov dword [ebp - 0x1c], eax
cmp byte [ebp - 1], bl
je 0x4502a0
lea ecx, [ebp - 8]
call fcn.004a0e99
mov ecx, eax
add ecx, 4
call fcn.0042897a
mov esi, eax
push 0x518ff4
push esi
call sub.msvcrt.dll_strstr
pop ecx
pop ecx
cmp eax, ebx
je 0x450272
mov byte [eax], bl
lea ecx, [ebp - 0x10]
call fcn.004a0ff9
mov ecx, eax
call fcn.0049e64a
push eax
push 0x51a318
call fcn.0049f991
pop ecx
pop ecx
lea edx, [ebp - 0xc]
mov ecx, esi
mov dword [ebp - 0xc], eax
call fcn.004def24
jmp 0x45035b
push 1
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 8]
lea ecx, [ebp - 0x18]
call fcn.004a1636
mov ecx, eax
call fcn.004a0ff9
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0049e56b
lea ecx, [ebp - 0x18]
call fcn.004a0c7d
lea ecx, [ebp - 0xc]
cmp byte [ebp - 0x14], bl
je 0x450311
push 1
call fcn.004a0ff9
mov ecx, eax
call fcn.0049e64a
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jg 0x450364
mov esi, dword [0x895f48]
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
push esi
call fcn.0049f9e2
pop ecx
pop ecx
mov edx, eax
mov ecx, 0x132
call fcn.004c9f62
jmp 0x450364
push esi
call fcn.004a0ff9
push eax
push 0x51a300
call fcn.0049f991
add esp, 0xc
push 1
push ebx
push ebx
lea ecx, [ebp - 0xc]
mov esi, eax
call fcn.004a0ff9
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x45035b
push esi
push dword [0x895f4c]
call fcn.0049f9e2
pop ecx
pop ecx
mov edx, eax
mov ecx, 0x132
call fcn.004c9f62
mov dl, 1
mov ecx, esi
call fcn.00479b79
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
lea ecx, [ebp - 8]
call fcn.004a0c7d
pop ebx
pop esi
pop edi
leave
ret
Function at 0x450a1f
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
push ebx
push esi
xor ebx, ebx
test byte [0x56b744], 1
push edi
mov esi, edx
mov dword [ebp - 8], ecx
jne 0x450a5f
or dword [0x56b744], 1
push 7
pop ecx
xor eax, eax
mov dword [0x56b724], ebx
mov edi, 0x56b728
push 0x50df0b
rep stosd dword es:[edi], eax
call fcn.00501866
pop ecx
lea ecx, [ebp - 4]
call fcn.004a0e93
cmp dword [ebp + 8], ebx
je 0x450a85
push 0x2e
push dword [ebp + 8]
call sub.msvcrt.dll_wcsrchr
pop ecx
pop ecx
cmp eax, ebx
je 0x450a85
push eax
lea ecx, [ebp - 4]
call fcn.004a101e
lea eax, [ebp - 4]
push eax
mov ecx, 0x56b724
call fcn.004509ca
mov edi, eax
mov eax, dword [edi]
cmp eax, ebx
je 0x450aa9
push 3
push ebx
push ebx
push 0x20
push 0x20
push eax
jmp 0x450b47
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x450abc
xor eax, eax
cmp word [ecx], bx
sete al
cmp al, bl
je 0x450af5
lea eax, [ebp - 0x4c4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x450ad9
mov word [ebp - 0x4c4], ax
push 0x130
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0x10
lea eax, [ebp - 0x4c4]
push eax
jmp 0x450b0e
push 0x130
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0x80
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp eax, ebx
je 0x450b55
cmp dword [ebp - 0x2bc], ebx
je 0x450b55
push 0x5162f4
lea ecx, [ebp - 4]
call fcn.004a1101
test al, al
jne 0x450b39
mov eax, dword [ebp - 0x2bc]
mov dword [edi], eax
push 3
push ebx
push ebx
push 0x20
push 0x20
push dword [ebp - 0x2bc]
push dword [esi + 4]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DrawIconEx]
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x450cda
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, edx
cmp edx, 4
jb 0x450cfd
shr edx, 2
push edi
mov edi, edx
mov edx, dword [ecx]
xor edx, eax
add ecx, 4
rol edx, 0xd
sub esi, 4
dec edi
mov eax, edx
jne 0x450cea
pop edi
test esi, esi
je 0x450d0d
movzx edx, byte [ecx]
xor eax, edx
rol eax, 8
inc ecx
dec esi
jne 0x450d01
pop esi
ret
Function at 0x4518e9
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
test byte [0x56b7b0], 1
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0xc], ecx
mov esi, 0x56b7ac
jne 0x451920
or dword [0x56b7b0], 1
mov ecx, esi
call fcn.004a0e93
push 0x50df1f
call fcn.00501866
pop ecx
cmp byte [0x56b7a8], 0
je 0x451937
mov ecx, dword [ebp - 0xc]
push esi
call fcn.004a1682
jmp 0x451a89
lea ecx, [ebp - 0x140]
mov byte [0x56b7a8], 1
call fcn.00448893
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x140]
call fcn.00448914
mov ecx, eax
call fcn.004a0e99
push eax
lea eax, [ebp - 0x18]
push 0x50fb84
push eax
call fcn.004a1618
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.004a0c7d
test byte [0x56b7b0], 2
jne 0x45199e
or dword [0x56b7b0], 2
mov ecx, 0x56b794
call fcn.004828ce
push 0x50df15
call fcn.00501866
pop ecx
push edi
push 0x56b7a4
lea ecx, [ebp - 0x14]
call fcn.004a1664
lea ecx, [ebp - 4]
call fcn.004a0e93
push 0x51a4f0
lea ecx, [ebp - 0x14]
call fcn.004a0f85
mov edi, 0x517834
test al, al
je 0x4519d1
push 0x51a4d4
jmp 0x4519e2
call fcn.004b8fc2
test al, al
je 0x4519e1
push 0x51a4c4
jmp 0x4519e2
push edi
lea ecx, [ebp - 4]
call fcn.004a101e
push edi
lea ecx, [ebp - 0x10]
call fcn.004a0fd9
pop edi
test ebx, ebx
je 0x451a23
mov ecx, ebx
call fcn.004a0ff9
push eax
lea eax, [ebp - 8]
push 0x50fa44
push eax
call fcn.004a1618
add esp, 0xc
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.004a101e
lea ecx, [ebp - 8]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 0x18]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 0x10]
call fcn.004a0ff9
push eax
lea eax, [ebp - 8]
push 0x51a480
push eax
call fcn.004a1618
add esp, 0x14
push dword [eax]
mov ecx, esi
call fcn.004a101e
lea ecx, [ebp - 8]
call fcn.004a0c7d
mov ecx, dword [ebp - 0xc]
push esi
call fcn.004a1682
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
lea ecx, [ebp - 0x14]
call fcn.004a0c7d
lea ecx, [ebp - 0x18]
call fcn.004a0c7d
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret
Function at 0x459523
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0xc], 0
push ebx
push esi
push 4
pop ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov esi, ecx
push 0x20000013
push dword [esi]
mov dword [ebp - 4], ebx
call dword [0x56b8f0]
test eax, eax
je 0x45958d
cmp dword [ebp - 8], 0xc8
je 0x45958d
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push 0x51c10c
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
push eax
mov ecx, esi
call fcn.004592d1
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
jmp 0x45964f
push edi
xor eax, eax
mov byte [ebp - 0x30], 0
lea edi, [ebp - 0x2f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x1d
push dword [esi]
mov dword [ebp - 4], 0x14
call dword [0x56b8f0]
test eax, eax
je 0x4595d7
lea eax, [ebp - 0x30]
push 0x51a898
push eax
call sub.msvcrt.dll__strcmpi
pop ecx
pop ecx
test eax, eax
jne 0x4595d7
or byte [esi + 0x25], 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 5]
push eax
push 1
push dword [esi]
xor edi, edi
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x14], edi
call dword [0x56b8f0]
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x20000005
push dword [esi]
mov dword [ebp - 0x18], ebx
call dword [0x56b8f0]
test eax, eax
je 0x45961f
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], edi
lea edx, [esi + 0x2c]
push 0xa
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, 0x2000
mov ecx, edi
mov dword [edx], 0x28
call fcn.00479b81
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edi
mov byte [esi + 4], 1
call fcn.004594e0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x459b16
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x88]
call fcn.00466ca2
mov ecx, esi
pop esi
jmp fcn.0040370c
Function at 0x465aac
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test byte [esi + 0x18], 1
je 0x465ac1
xor eax, eax
inc eax
jmp 0x465c06
cmp byte [ebp + 8], 0
je 0x465acf
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0x50
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x465b04
mov edx, dword [esi + 0x1c]
movzx ecx, byte [edx + 0x3c]
push 0
push 0xffffffffffffffff
push ecx
lea ecx, [edx + 0x38]
push ecx
mov cl, byte [esi + 0x18]
shr cl, 1
and cl, 1
movzx ecx, cl
add edx, 0x2c
push edx
push ecx
mov ecx, eax
call fcn.004656ce
jmp 0x465b06
xor eax, eax
push edi
push eax
lea ecx, [ebp + 8]
lea edi, [esi + 8]
call fcn.0045aa31
push eax
mov ecx, edi
call fcn.00463b6e
mov eax, dword [ebp + 8]
test eax, eax
je 0x465b28
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
mov ecx, dword [esi + 4]
push ebx
mov dword [eax + 0x20], ecx
push dword [esi + 4]
mov ebx, dword [edi]
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, 0x51e184
mov dword [ebx + 0x24], eax
call fcn.0049a53c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, 0x51e178
call fcn.0049a53c
mov edx, 0x519bec
mov ecx, eax
call fcn.004b7368
lea ebx, [esi + 0x10]
mov ecx, ebx
mov dword [ebp + 8], eax
call fcn.00472fe7
push eax
push 0
push 0x4001012
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StgCreateDocfile]
mov ecx, dword [ebp + 8]
mov dl, 1
mov dword [ebp - 4], eax
call fcn.00479b79
cmp dword [ebp - 4], 0
jl 0x465bdf
mov eax, dword [edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [edi]
mov ebx, dword [ebx]
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.00472fe7
push eax
push ebx
push dword [ebp + 8]
xor ebx, ebx
push 0
inc ebx
push ebx
push 0x54f628
push 0x54f618
call dword [sym.imp.ole32.dll_OleCreate]
test eax, eax
jl 0x465bdf
mov edi, dword [edi]
push ebx
push edi
call dword [sym.imp.ole32.dll_OleSetContainedObject]
test eax, eax
jge 0x465be3
xor eax, eax
jmp 0x465c04
push esi
push 0xffffffffffffffeb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push ebx
mov ecx, esi
call fcn.004641c6
mov ecx, esi
call fcn.004647de
or byte [esi + 0x18], 1
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x466ca3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
mov ebx, ecx
lea ecx, [ebp - 4]
call fcn.004a0e93
push 0x20019
push 0x51e788
push 0x80000001
lea ecx, [ebp - 4]
call fcn.0044f7df
test al, al
je 0x466d7e
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x51e76c
lea ecx, [ebp - 4]
call fcn.0044e711
cmp dword [ebp - 8], 0
je 0x466d7e
push 0
push 0x1a
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x466d7e
push esi
push 0x51c608
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push 0x51e74c
push eax
call fcn.004a1618
add esp, 0x10
push 0x50fbbc
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
mov ecx, eax
call fcn.0049e64a
push eax
call sub.msvcrt.dll_fopen
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x466d75
mov ecx, ebx
call fcn.0049e604
push eax
call sub.msvcrt.dll__getpid
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x51e740
push esi
call sub.msvcrt.dll_fprintf
push esi
call sub.msvcrt.dll_fclose
add esp, 0x18
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
pop esi
lea ecx, [ebp - 4]
call fcn.0044f7da
pop ebx
leave
ret
Function at 0x468ce9
Capabilities:
Create pipe
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov edi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call esi
push eax
push dword [ebp - 0x14]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
mov edx, edi
push ebx
xor esi, esi
call fcn.004355ad
test al, al
je 0x468e14
mov ecx, 0x104
call fcn.00479b81
mov edi, eax
mov byte [ebp - 1], bl
jmp 0x468dce
cmp dword [ebp - 8], ebx
jne 0x468d95
cmp byte [ebp - 1], bl
jne 0x468de3
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x468dce
mov byte [ebp - 1], 1
jmp 0x468dce
push ebx
lea eax, [ebp - 8]
push eax
mov eax, 0x103
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x468db8
cmp dword [ebp - 8], ebx
jne 0x468dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x468de3
cmp esi, 0x103
je 0x468de3
add esi, dword [ebp - 8]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x468d70
mov ecx, edi
mov byte [esi + edi], bl
call fcn.0049ffbe
mov dl, 1
mov ecx, edi
mov esi, eax
call fcn.00479b79
cmp dword [ebp + 0xc], ebx
je 0x468e09
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x468e1e
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x468e1e
or dword [eax], 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x46930a
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
mov esi, eax
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0x51c608
mov edx, 0x520710
mov ecx, 0x80000001
call fcn.0044f8a9
test al, al
je 0x4693b9
test esi, esi
je 0x4693b7
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x469343
sub eax, edx
sar eax, 1
je 0x4693b7
cmp dword [ebp + 8], 0
je 0x469382
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x46935f
sub eax, edx
sar eax, 1
je 0x469382
push dword [ebp + 8]
push esi
push 0x510a30
call fcn.0049f9e2
add esp, 0xc
jmp 0x46938f
push esi
push 0x50fa44
call fcn.0049f9e2
pop ecx
pop ecx
mov esi, eax
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call sub.msvcrt.dll__wcsicmp
mov ebx, eax
neg ebx
pop ecx
pop ecx
sbb bl, bl
mov dl, 1
mov ecx, esi
inc bl
call fcn.00479b79
mov al, bl
pop ebx
jmp 0x4693b9
mov al, 1
pop esi
leave
ret 4

Function at 0x4693be
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
test edi, edi
jne 0x4693dc
push 0x51c608
mov edx, 0x520710
mov ecx, 0x80000001
call fcn.0044faa6
jmp 0x469440
cmp dword [ebp + 8], 0
push esi
je 0x46940c
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4693e9
sub eax, edx
sar eax, 1
je 0x46940c
push dword [ebp + 8]
push edi
push 0x510a30
call fcn.0049f9e2
add esp, 0xc
jmp 0x469419
push edi
push 0x50fa44
call fcn.0049f9e2
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x469421
mov eax, edi
push eax
push 0x51c608
mov edx, 0x520710
mov ecx, 0x80000001
call fcn.0044fa2c
mov dl, 1
mov ecx, esi
call fcn.00479b79
pop esi
leave
ret 4