joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483a50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push 0x100
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.0047afc7
add esp, 4
mov esi, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], esi
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x434f04
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x128]
push ecx
lea eax, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push 0
push ecx
push esi
push edx
push eax
mov dword [ebp - 0x1c], 0x80
mov dword [ebp - 0x24], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x434f04
mov edx, ebx
lea edi, [ebp - 0x128]
shl edx, 8
or ecx, 0xffffffff
xor eax, eax
add edx, 0x6309bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0xff
rep movsb byte es:[edi], byte [esi]
jle 0x434ef5
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x434e70
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov dword [0x65cd50], ebx
call fcn.0047afbc
add esp, 4
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4353e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483aa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x100
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], esi
call fcn.0047afc7
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], edi
push eax
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetServices
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xf003f
push esi
push esi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4354c4
mov edx, dword [ebp - 0x24]
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push 0
push ecx
push ebx
push esi
push edx
mov dword [ebp - 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edx, eax
cmp edx, 0x103
je 0x4354b0
mov ecx, dword [ebp + 8]
mov esi, edi
shl esi, 6
add esi, ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x14]
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov edi, eax
inc esi
cmp esi, 0x3fe
mov dword [ebp - 0x18], esi
ja 0x4354c4
cmp edx, 0x103
jne 0x43544e
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ecx], edi
call fcn.0047afbc
add esp, 4
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4357b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 0xf003f
push ebx
push ecx
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4358b9
push ebx
push ebx
mov ecx, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, eax
cmp esi, 0xea
je 0x435858
test esi, esi
je 0x435858
cmp esi, 0x103
jne 0x435842
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x41
push eax
lea edi, [ebp - 0x120]
push eax
push eax
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x120]
push edx
push eax
push ebx
push ecx
mov dword [ebp - 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
inc ebx
cmp esi, 0xea
je 0x43589b
test esi, esi
jne 0x435816
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x120]
push edx
push eax
call fcn.004357b0
add esp, 8
jmp 0x435816
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483ae0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push 0x100
mov dword [ebp - 4], ebx
call fcn.0047afc7
mov dword [ebp - 0x18], eax
mov edi, 0x48b9fc
or ecx, 0xffffffff
xor eax, eax
add esp, 4
lea edx, [ebp - 0x220]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov cl, byte [eax + esi]
cmp cl, 0x5c
je 0x435b0f
mov byte [ebp + eax - 0xa0], cl
inc eax
jmp 0x435afd
mov byte [ebp + eax - 0xa0], bl
inc eax
xor edx, edx
mov cl, byte [eax + esi]
cmp cl, bl
je 0x435b2b
mov byte [ebp + edx - 0x120], cl
inc eax
inc edx
jmp 0x435b19
lea ecx, [ebp - 0xa0]
push str.HKEY_LOCAL_MACHINE
push ecx
mov byte [ebp + edx - 0x120], bl
mov dword [ebp - 0x20], 0x100
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x435bb3
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x120]
push edx
push 0x20019
push ebx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x435bef
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x14]
push edi
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x435bb3
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x220]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x18]
push edx
call fcn.0047afbc
add esp, 4
lea eax, [ebp - 0x220]
push eax
call fcn.00483565
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 0x48b9fc
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435c10
Capabilities:
Delete registry value
Get common file path
Set registry value

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x24], 0
call ebx
test eax, eax
jne 0x435c56
lea ecx, [esp + 0x10]
push ecx
push str.CLSID20D04FE0_3AEA_1069_A2D8_08002B30309D_shell_findcommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.CLSID20D04FE0_3AEA_1069_A2D8_08002B30309D_shell_findcommand
push closesocket
call ebx
test eax, eax
je 0x435c8a
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x104
ret
lea ecx, [esp + 0x94]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x94]
lea eax, [esp + 0x14]
push edx
push str._sExplorer.exe
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x20]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x20]
add esp, 0x10
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 2
push eax
push eax
mov eax, dword [esp + 0x24]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 0x20006
push 0
push 0
push closesocket
call ebx
test eax, eax
jne 0x435d23
lea eax, [esp + 0x10]
push eax
push str.CLSID871C5380_42A0_1069_A2EA_08002B30309D_shellOpenHomePageCommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.CLSID871C5380_42A0_1069_A2EA_08002B30309D_shellOpenHomePageCommand
push closesocket
call ebx
test eax, eax
je 0x435d51
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x104
ret
lea eax, [esp + 0x94]
lea ecx, [esp + 0x14]
push eax
push str._sProgram_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa2], 0
mov byte [esp + 0x20], 0
call fcn.0047a8f8
lea edx, [esp + 0x20]
push edx
call fcn.00483565
add esp, 0x10
mov ebx, eax
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push 2
push eax
push eax
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
Function at 0x435dc0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483af0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
xor edi, edi
push eax
push 2
push edi
push str.SOFTWAREClientsStartMenuInternet
push closesocket
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
call ebx
test eax, eax
jne 0x435f12
push str.iexplore.exe
call fcn.00483565
mov ecx, dword [ebp - 0x14]
add esp, 4
mov esi, eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push 0x200
call fcn.0047afc7
add esp, 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
push ecx
call fcn.0042c0f0
add esp, 4
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
push 0x57d044
push reloc.WS2_32.dll_closesocket
call ebx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
add ecx, 0x100
push eax
push 0xf003f
push 0
push ecx
push edx
call ebx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SOFTWAREClientsStartMenuInternet
push ecx
call ebx
test eax, eax
jne 0x435ed2
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [ebp - 0x14]
not ecx
push ecx
push esi
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
push eax
call edi
mov ecx, dword [ebp - 0x14]
push ecx
call edi
mov edx, dword [ebp - 0x14]
push edx
call edi
mov eax, dword [ebp - 0x14]
push eax
call edi
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0047afbc
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435f30
Capabilities:
Delete registry value
Get common file path
Set registry value

Disassembly:
sub esp, 0x104
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x435f74
lea ecx, [esp + 8]
push ecx
push str.SOFTWAREClassesDrive_shell_findcommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 2
push 0
push str.SOFTWAREClassesDrive_shell_findcommand
push closesocket
call esi
test eax, eax
je 0x435fa6
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x104
ret
push edi
lea ecx, [esp + 0x10]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x90]
push edx
push str._sExplorer.exe
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x9c]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x1c]
add esp, 0x10
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 2
push eax
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret
Function at 0x449260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483be0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x290
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push eax
lea ecx, [ebp - 0x29c]
push str.SYSTEMCurrentControlSetServices_s
push ecx
mov dword [ebp - 4], 0
call fcn.0047a8f8
push 0x100
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 4], 1
call fcn.0047afc7
mov ebx, eax
mov edi, 0x48b9fc
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
lea edx, [ebp - 0x19c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x29c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [ebp - 0x18], 0x100
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x449449
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
push ebx
push ecx
push 0
push str.Group
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x449356
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x19c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push edx
push eax
push 0
push str.Start
push ecx
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44938f
mov edi, dword [ebp - 0x9c]
and edi, 0xff
jmp 0x449392
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0047afbc
add esp, 4
xor ebx, ebx
xor esi, esi
cmp esi, 0xa
jge 0x4493d4
mov eax, esi
lea ecx, [ebp - 0x19c]
shl eax, 6
add eax, str.Base
push eax
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4493d1
mov ebx, 1
inc esi
jmp 0x4493a9
test edi, edi
jne 0x4493eb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 1
jne 0x449406
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x44941e
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
sub eax, 2
neg eax
sbb eax, eax
and al, 0xfc
add eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4499a0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x2004
call fcn.0047bda0
push ebx
lea eax, [esp + 8]
push esi
xor esi, esi
push eax
push 0x1ffe
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0xc]
lea ebx, [esp + 0xc]
test al, al
je 0x449a32
push ebp
mov ebp, dword [esp + 0x2014]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add ebp, 0xc
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [esp + 0x18]
call fcn.0047bce0
add esp, 8
inc eax
mov ebx, eax
cmp byte [ebx], 0
jne 0x4499d7
mov eax, dword [esp + 0x201c]
mov ecx, dword [esp + 0x10]
pop edi
pop ebp
mov dword [eax], ecx
pop esi
mov ax, 1
pop ebx
add esp, 0x2004
ret
mov edx, dword [esp + 0x2014]
mov ax, 1
mov dword [edx], esi
pop esi
pop ebx
add esp, 0x2004
ret

Function at 0x449a50
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
movsx ecx, byte [eax]
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x449a63
jmp dword [ecx*4 + 0x449b3c]
mov byte [eax], 0x41
mov ax, 1
ret
mov byte [eax], 0x42
mov ax, 1
ret
mov byte [eax], 0x43
mov ax, 1
ret
mov byte [eax], 0x44
mov ax, 1
ret
mov byte [eax], 0x45
mov ax, 1
ret
mov byte [eax], 0x46
mov ax, 1
ret
mov byte [eax], 0x47
mov ax, 1
ret
mov byte [eax], 0x48
mov ax, 1
ret
mov byte [eax], 0x49
mov ax, 1
ret
mov byte [eax], 0x4a
mov ax, 1
ret
mov byte [eax], 0x4b
mov ax, 1
ret
mov byte [eax], 0x4c
mov ax, 1
ret
mov byte [eax], 0x4d
mov ax, 1
ret
mov byte [eax], 0x4e
mov ax, 1
ret
mov byte [eax], 0x4f
mov ax, 1
ret
mov byte [eax], 0x50
mov ax, 1
ret
mov byte [eax], 0x51
mov ax, 1
ret
mov byte [eax], 0x52
mov ax, 1
ret
mov byte [eax], 0x53
mov ax, 1
ret
mov byte [eax], 0x54
mov ax, 1
ret
mov byte [eax], 0x55
mov ax, 1
ret
mov byte [eax], 0x56
mov ax, 1
ret
mov byte [eax], 0x57
mov ax, 1
ret
mov byte [eax], 0x58
mov ax, 1
ret
mov byte [eax], 0x59
mov ax, 1
ret
mov byte [eax], 0x5a
mov ax, 1
ret
Function at 0x449d50
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483c20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x758]
xor edi, edi
push eax
push ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00449bb0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 8
cmp edi, dword [ebp - 0x18]
jge 0x449e42
mov edx, edi
push 0x49f318
shl edx, 6
lea esi, [ebp + edx - 0x758]
push esi
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x449e15
push 0x49f314
push esi
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x449e15
push esi
call fcn.0042cff0
add esp, 4
cmp eax, 1
jne 0x449dfd
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x449dfd
lea eax, [ebp - 0x118]
push eax
push esi
call fcn.00449e60
add esp, 8
mov dword [ebp - 0x14], 1
push 0x80
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.0047c159
add esp, 4
inc edi
jmp 0x449d98
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ae90
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483cd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x294
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push 1
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.00479b69
push 1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.00479b69
mov eax, dword [0x4853bc]
lea ecx, [ebp - 0x58]
push eax
push 1
push str.c:endpcache_runonce_info.txt
mov byte [ebp - 4], 2
call fcn.00479c3d
mov ecx, dword [ebp - 0x58]
xor esi, esi
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x54]
cmp dword [eax + 0x30], 0xffffffff
je 0x44af6a
mov eax, dword [ebp - 0x54]
push 0xa
inc eax
push 0x200
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x2a0], 0
call fcn.00479fff
lea edi, [ebp - 0x2a0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 5
jle 0x44af54
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x2a0]
push ecx
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x44af54
mov ebx, 1
inc esi
cmp esi, 0xfa
jg 0x44af6a
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 4]
test byte [ebp + ecx - 0x50], 1
je 0x44aeff
lea ecx, [ebp - 0x58]
call fcn.00479c84
cmp esi, 0xfa
jle 0x44af95
push 0x80
push str.c:endpcache_runonce_info.txt
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.c:endpcache_runonce_info.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp ebx, 1
jne 0x44afda
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], bl
call fcn.00479c2a
lea ecx, [ebp - 0x8c]
call fcn.00479b11
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00479c2a
lea ecx, [ebp - 0x44]
call fcn.00479b11
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4853bc]
lea ecx, [ebp - 0xa0]
push edx
push 8
push str.c:endpcache_runonce_info.txt
call fcn.00479c3d
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x9c]
cmp dword [eax + 0x30], 0xffffffff
je 0x44b02d
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x94]
push edx
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
lea ecx, [ebp - 0xa0]
call fcn.00479c84
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.00479c2a
lea ecx, [ebp - 0x8c]
call fcn.00479b11
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00479c2a
lea ecx, [ebp - 0x44]
call fcn.00479b11
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b0a0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483ce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x57d044
push 0
push str.SOFTWAREMicrosoftCommand_Processor
push closesocket
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44b12b
mov edx, dword [ebp - 0x14]
push str.Autorun
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x44b12b
push str.defeat..........
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret