joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494fd3
Capabilities:
Persist via run registry key

Disassembly:
push 0x6c
mov eax, 0x600825
call fcn.004e1c06
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 7
mov byte [edi], bl
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
call fcn.00496d7e
mov esi, eax
test esi, esi
js 0x4950d2
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push 0x631e64
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.0040ab57
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
call fcn.0040ab57
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x60]
push eax
push reloc.WS2_32.dll_accept
call fcn.00498dcc
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.00405a95
lea ecx, [ebp - 0x78]
call fcn.00405a95
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004355f3
pop ecx
pop ecx
test eax, eax
jne 0x495097
mov byte [edi], 1
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x4950d2
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x4950c9
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405a41
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.00419529
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x49510d
mov ecx, dword [ebp - 0x44]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x495104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00405a41
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.00419529
pop ecx
pop ecx
mov eax, esi
call fcn.004e1bb5
ret 4

Function at 0x495aed
Capabilities:
Delete file

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
xor edi, edi
cmp dword [esi + 0x14], 8
jb 0x495b11
mov eax, dword [esi]
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x495b52
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi + 0x14], 8
jb 0x495b33
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x495b52
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004192c5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x495aeb
Function at 0x4962b3
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x228
mov eax, 0x600b30
call fcn.004e1c06
mov eax, dword [ebp + 0x14]
mov ecx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
call fcn.00445fb5
xor ecx, ecx
mov eax, 0x200
cmp dword [ebp + 0x10], 1
mov edx, 0x100
cmove ecx, eax
xor eax, eax
cmp dword [ebp + 0x10], 2
cmove eax, edx
and dword [ebp - 0x230], 0
or ecx, eax
or ecx, 0x20019
cmp dword [esi + 0x14], 8
jb 0x49630b
mov esi, dword [esi]
lea eax, [ebp - 0x230]
push eax
push ecx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4963c9
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x4963a0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040ab57
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
and dword [ebp - 4], edi
push eax
call fcn.00446267
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00405a95
jmp 0x4963a8
cmp edi, 0x103
jne 0x4963af
inc ebx
test edi, edi
je 0x496335
jmp 0x4963bd
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.004e1bb5
ret 0x10

Function at 0x49738a
Capabilities:
Get common file path

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
xor esi, esi
mov dword [ebp - 0x210], 0x104
push esi
push eax
call fcn.0041ab50
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USERENV.dll_GetDefaultUserProfileDirectoryW]
test eax, eax
je 0x4973eb
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0040aaa9
jmp 0x4973ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004192c5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x497388
Function at 0x4978f5
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x14]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
shl eax, 8
push esi
add eax, 0x20019
cmp dword [ecx + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x49792b
mov ecx, dword [ecx]
lea esi, [ebp - 0x830]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x82c], 0x820
test eax, eax
cmovle esi, eax
and dword [ebp - 0x828], 0
test esi, esi
js 0x4979d3
cmp dword [edi + 0x14], 8
jb 0x497968
mov edi, dword [edi]
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push edi
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4979c7
cmp dword [ebp - 0x828], 1
je 0x4979b7
cmp dword [ebp - 0x828], 2
je 0x4979b7
mov esi, 0x8007065d
jmp 0x4979c7
lea eax, [ebp - 0x824]
mov ecx, ebx
push eax
xor esi, esi
call fcn.0040aaa9
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004192c5
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x4978f3

Function at 0x498548
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
push 0x208
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.0041ab50
add esp, 0xc
mov dword [ebp - 0x210], 0x104
lea eax, [ebp - 0x210]
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
call fcn.0049843d
mov esi, eax
test esi, esi
js 0x4985c1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x498604
push 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x214]
push ebx
call fcn.0049843d
mov esi, eax
test esi, esi
js 0x49861c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49861c
test edi, edi
je 0x498621
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x1c]
push edi
call fcn.0043db25
mov esi, eax
jmp 0x498621
mov esi, 0x80070490
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004192c5
leave
ret 0x18
Function at 0x498a25
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
xor esi, esi
push esi
push eax
call fcn.0041ab50
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Version
push str.SoftwareMicrosoftOneDrive
call fcn.00498337
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x498aa7
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0040aaa9
jmp 0x498aac
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004192c5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x498a23

Function at 0x49b1c0
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 4
xor ebx, ebx
cmp dword [eax + 0x14], 8
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
jb 0x49b1ea
mov eax, dword [eax]
push eax
push str.SoftwareMicrosoftOneDriveAccounts
lea eax, [ebp - 0x28]
push eax
call fcn.004a3c32
cmp dword [eax + 0x14], 8
jb 0x49b201
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x10
push str.IsGoSov
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00405a95
test esi, esi
pop esi
jne 0x49b237
cmp dword [ebp - 8], 1
sete bl
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004192c5
leave
ret 4
push ebp
mov ebp, esp
pop ebp
jmp 0x49b1be

Function at 0x49c15d
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
inc esi
xor ebx, ebx
push esi
push 8
push str.SoftwareClasses
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49c1e8
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x49c1df
cmp dword [ebp - 8], ebx
jne 0x49c1df
cmp dword [ebp - 0xc], esi
jne 0x49c1df
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x1000ffff
push str.SymbolicLinkValue
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x49c1df
cmp dword [ebp - 0x10], 6
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004192c5
leave
ret
jmp 0x49c15b
Function at 0x49c9bf
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x49c9cf
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [eax + 0x10]
mov edx, 0x811c9dc5
push 0
pop esi
add edi, edi
je 0x49c9f1
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x49c9e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x49ec9d
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x49ecd4
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x49ed16
cmp dword [esi + 0x10], eax
jne 0x49ecf2
xor esi, esi
jmp 0x49ecfa
cmp dword [esi + 0x14], 8
jb 0x49ecfa
mov esi, dword [esi]
push 4
push ebx
push 4
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004192c5
leave
ret 0x14
push ebp
mov ebp, esp
pop ebp
jmp 0x49ec9b

Function at 0x49f00f
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x20006
cmp byte [ebp + 0x18], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x102
cmovne ecx, edi
cmp dword [eax + 0x14], 8
jb 0x49f046
mov eax, dword [eax]
lea edi, [ebp - 8]
push edi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x49f09e
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
lea ecx, [eax*2 + 2]
jb 0x49f06d
mov ebx, dword [ebx]
movzx eax, byte [ebp + 0x1c]
inc eax
cmp dword [esi + 0x10], 0
jne 0x49f07c
xor esi, esi
jmp 0x49f084
cmp dword [esi + 0x14], 8
jb 0x49f084
mov esi, dword [esi]
push ecx
push ebx
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004192c5
leave
ret 0x18
push ebp
mov ebp, esp
pop ebp
jmp 0x49f00d
Function at 0x49f0be
Capabilities:
Set registry value

Disassembly:
nop
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
lea edx, [eax*2 + 2]
jb 0x49f0d6
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x49f0e1
mov eax, dword [eax]
push edx
push ecx
push 2
push eax
push 0x627350
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movzx ecx, ax
mov edx, 0x80070000
or ecx, edx
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovle edx, ecx
shr edx, 0x1f
xor dl, 1
mov al, dl
pop ebp
ret 0xc
push ebp
mov ebp, esp
pop ebp
jmp 0x49f0bc

Function at 0x49f7eb
Capabilities:
Query or enumerate registry value

Disassembly:
nop
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
push 0x653c34
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x240], eax
call fcn.0040aaa9
mov eax, dword [ebp - 0x240]
xor ecx, ecx
push 0x118
push ecx
mov dword [eax], ecx
lea eax, [ebp - 0x238]
mov dword [ebx], ecx
mov bl, cl
push eax
mov dword [edi], ecx
call fcn.0041ab50
add esp, 0xc
mov dword [ebp - 0x23c], 0x11c
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49f8ce
mov ecx, dword [ebp - 0x120]
mov bl, 1
mov eax, dword [ebp - 0x238]
mov dword [edi], eax
mov eax, dword [ebp - 0x234]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x120], 0x118
mov dword [ecx], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 2
push str.BuildLab
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push dword [0x68df18]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
js 0x49f8ce
push esi
lea eax, [ebp - 0x11c]
push eax
call fcn.0049f473
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004192c5
leave
ret 0x10
push ebp
mov ebp, esp
pop ebp
jmp 0x49f7e9

Function at 0x4a1682
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0x28]
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
pop ebp
ret 4

Function at 0x4a17b2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004a3e46
cmp dword [eax + 0x14], 8
jb 0x4a17cc
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00405a95
mov eax, esi
pop esi
leave
ret 8
Function at 0x4a1932
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004a3e46
cmp dword [eax + 0x14], 8
jb 0x4a194c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00405a95
mov eax, esi
pop esi
leave
ret 4

Function at 0x4a1b52
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004a3e46
cmp dword [eax + 0x14], 8
jb 0x4a1b6c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00405a95
mov eax, esi
pop esi
leave
ret 4

Function at 0x4a2072
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCheckConnectionW]

Function at 0x4a2452
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004a3e46
cmp dword [eax + 0x14], 8
jb 0x4a246c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00405a95
mov eax, esi
pop esi
leave
ret 4

Function at 0x4a2792
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push dword [ebp + 8]
push eax
call fcn.004a3e46
cmp dword [eax + 0x14], 8
jb 0x4a27ac
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00405a95
mov eax, esi
pop esi
leave
ret 8

Function at 0x4a2852
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x4a29d2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e97fc
add esp, 0xc
pop ebp
ret 0xc
Function at 0x4a87fe
Capabilities:
Get user security identifier

Disassembly:
push 0x34
mov eax, 0x603205
call fcn.004e1c06
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, esi
mov dword [ebp - 0x14], esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
jb 0x4a8828
mov eax, dword [esi]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, dword [ebp - 0x18]
mov word [ebp - 0x3a], ax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
add edi, 1
je 0x4a8886
cmp edi, 0x7fffffff
ja 0x4a893b
push edi
lea ecx, [ebp - 0x28]
call fcn.0044b130
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3a]
push eax
push edi
push dword [ebp - 0x28]
call fcn.004a807a
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x34]
mov byte [ebp - 0x39], bl
stosd dword es:[edi], eax
lea ecx, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x39]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.004a303e
cmp dword [esi + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4a88bb
mov esi, dword [esi]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x4a88e9
push dword [ebp - 0x28]
mov ecx, dword [ebp - 0x40]
call fcn.0040aaa9
mov bl, 1
test esi, esi
je 0x4a891b
mov eax, dword [ebp - 0x2c]
sub eax, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], eax
cmp eax, 0x1000
jb 0x4a8912
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00405a41
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x3c]
push eax
push esi
call fcn.00419529
pop ecx
pop ecx
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4a8931
mov ecx, dword [ebp - 0x20]
sub ecx, eax
and ecx, 0xfffffffe
push ecx
push eax
call fcn.00405ac3
mov al, bl
call fcn.004e1bb5
ret 8
call fcn.0040a385
int3
Function at 0x4a8a26
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xdc
mov eax, 0x6032b2
call fcn.004e1c06
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xa8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x98
push ebx
mov dword [ebp - 0xb8], ebx
push eax
mov dword [edi], ebx
call fcn.0041ab50
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
call fcn.0045805d
mov dword [ebp - 4], ebx
cmp byte [ebp + 0x10], bl
je 0x4a8a80
push str.Wow6432Node_
lea eax, [ebp - 0xa8]
push eax
call fcn.00414600
push str.LocalServer32
push esi
push str.CLSID_
lea eax, [ebp - 0xa8]
push eax
call fcn.00414600
push eax
call fcn.00414600
push eax
call fcn.00414600
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0xa4]
call fcn.004134b6
cmp dword [ebp - 0xd4], 8
lea ecx, [ebp - 0xb0]
push 5
pop eax
push ecx
mov dword [ebp - 0xac], eax
mov esi, SysReAllocString
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xe8]
cmovae eax, dword [ebp - 0xe8]
push 0x20019
push ebx
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4a8b48
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xa4]
call fcn.004134b6
cmp dword [ebp - 0xbc], 8
lea ecx, [ebp - 0xb0]
push 0xf
pop eax
push ecx
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xd0]
push 0x20119
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0xb1], bl
test eax, eax
jne 0x4a8b4f
mov byte [ebp - 0xb1], 1
mov eax, dword [ebp - 0xac]
test al, 2
je 0x4a8b73
and eax, 0xfffffffd
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xac], eax
call fcn.00405a95
mov eax, dword [ebp - 0xac]
test al, 1
je 0x4a8b82
lea ecx, [ebp - 0xe8]
call fcn.00405a95
cmp byte [ebp - 0xb1], 0
je 0x4a8bf6
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], ebx
push eax
push ebx
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4a8bea
push dword [ebp - 0xac]
call fcn.00422fd8
mov esi, eax
pop ecx
test esi, esi
je 0x4a8bea
lea eax, [ebp - 0xac]
push eax
push esi
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4a8be3
mov dword [edi], esi
mov bl, 1
jmp 0x4a8bea
push esi
call fcn.00422c50
pop ecx
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa8]
call fcn.0045821e
mov al, bl
call fcn.004e1bb5
ret 0xc