joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0a38
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x56edc6
call fcn.004e715b
xor esi, esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.004440c4
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.004440f8
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4b0a71
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b0ae1
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x571890
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4b0aae
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b0ae1
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x38]
call fcn.004440d7
call fcn.004e7124
ret 8

Function at 0x4b0af1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor esi, esi
push esi
push 0x1a
push eax
push esi
call fcn.004b2f62
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
pop ecx
test eax, eax
je 0x4b0ba6
push ebx
mov ebx, 0x57190c
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004d2a28
lea eax, [ebp - 0x20c]
push 0x571890
push eax
call fcn.004d2a28
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004d2a28
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x4b0b7f
lea eax, [ebp - 0x20c]
push eax
call fcn.004b36a9
pop ecx
cmp word [ebp - 0x20c], si
je 0x4b0b97
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00419cc0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4
Function at 0x4b0bb8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor esi, esi
push esi
push 0x1a
push eax
push esi
call fcn.004b2f62
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
pop ecx
test eax, eax
je 0x4b0c6d
push ebx
mov ebx, 0x57190c
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004d2a28
lea eax, [ebp - 0x20c]
push str.PuddingZip.users
push eax
call fcn.004d2a28
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004d2a28
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x4b0c46
lea eax, [ebp - 0x20c]
push eax
call fcn.004b36a9
pop ecx
cmp word [ebp - 0x20c], si
je 0x4b0c5e
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00419cc0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4
Function at 0x4b11b8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x56ee8a
call fcn.004e715b
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.004440c4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004440f8
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4b11f8
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b125a
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x571890
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4b1235
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b125a
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.004440d7
call fcn.004e7124
ret 8

Function at 0x4b14b9
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x56eec7
call fcn.004e718f
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.004bf1c0
lea eax, [edi + 0x9c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4b1516
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.0041ff90
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x4b155c
mov eax, dword [esi]
jmp 0x4b155e
mov eax, esi
push ebx
push eax
call fcn.004d518c
pop ecx
pop ecx
test eax, eax
jne 0x4b15aa
cmp byte [edi + 1], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x4b158e
call fcn.004b12c2
jmp 0x4b1593
call fcn.004b137c
push eax
mov ecx, esi
call fcn.004241f0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00430390
mov eax, esi
call fcn.004e7139
ret 0x10
Function at 0x4b1716
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x24]
cmp dword [eax + 0x14], 8
jb 0x4b1737
mov eax, dword [eax]
push 0x571934
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0041ee30
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b176f
lea eax, [ebp - 0x20c]
push eax
call fcn.004b36a9
pop ecx
lea eax, [ebp - 0x20c]
push str.Related.ini
push eax
call fcn.004d2a28
cmp word [ebp - 0x20c], 0
pop ecx
pop ecx
jne 0x4b1790
xor eax, eax
jmp 0x4b179d
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x84]
call fcn.00419cc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b17bf
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc3c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc34]
push esi
push edi
push 0x208
xor edi, edi
mov esi, ecx
push edi
push eax
mov dword [ebp - 0xc3c], esi
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004bf1c0
add esp, 0x48
lea eax, [ebp - 0xc34]
mov ecx, esi
push edi
push 0x1a
push eax
push edi
call fcn.004b2f62
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a59
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004bf40d
add esp, 0x14
test eax, eax
jne 0x4b189e
mov ecx, esi
jmp 0x4b19e0
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.004d2a59
lea eax, [ebp - 0x824]
push 0x589b78
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.004d2a59
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.004d2a59
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x4b19da
cmp dword [ebp - 0xc38], edi
je 0x4b19da
test ecx, ecx
je 0x4b19da
push 0x571890
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x5772cc
push eax
call fcn.0041ee30
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b19b1
lea eax, [ebp - 0x414]
push eax
call fcn.004b36a9
pop ecx
cmp word [ebp - 0x414], di
je 0x4b19c9
lea eax, [ebp - 0x414]
push eax
call fcn.004d2a7b
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00419cc0
jmp 0x4b19e6
mov ecx, dword [ebp - 0xc3c]
push ebx
call fcn.004b0af1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4
Function at 0x4b19f9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc3c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc34]
push esi
push edi
push 0x208
xor edi, edi
mov esi, ecx
push edi
push eax
mov dword [ebp - 0xc3c], esi
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004bf1c0
add esp, 0x48
lea eax, [ebp - 0xc34]
mov ecx, esi
push edi
push 0x1a
push eax
push edi
call fcn.004b2f62
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a59
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004bf40d
add esp, 0x14
test eax, eax
jne 0x4b1ad8
mov ecx, esi
jmp 0x4b1c1a
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.004d2a59
lea eax, [ebp - 0x824]
push 0x589b78
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.004d2a59
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.004d2a59
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.004d2a28
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x4b1c14
cmp dword [ebp - 0xc38], edi
je 0x4b1c14
test ecx, ecx
je 0x4b1c14
push str.PuddingZip.users
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x5772cc
push eax
call fcn.0041ee30
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b1beb
lea eax, [ebp - 0x414]
push eax
call fcn.004b36a9
pop ecx
cmp word [ebp - 0x414], di
je 0x4b1c03
lea eax, [ebp - 0x414]
push eax
call fcn.004d2a7b
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00419cc0
jmp 0x4b1c20
mov ecx, dword [ebp - 0xc3c]
push ebx
call fcn.004b0bb8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1cc4
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x20c], di
je 0x4b1d1b
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x20c]
add esi, 0xfc
push eax
mov ecx, esi
call fcn.00419cc0
mov edi, 0x57190c
push edi
call fcn.004d2a7b
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0041e910
cmp dword [esi + 0x14], 8
jb 0x4b1d4f
mov eax, dword [esi]
jmp 0x4b1d51
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b1d71
mov edi, str.C:Program_Files_
push edi
call fcn.004d2a7b
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00419cc0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b2832
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x5e9adc]
test al, al
jne 0x4b28cb
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4b28c2
lea eax, [ebp - 0x20c]
push eax
call fcn.004c8113
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
jne 0x4b28ba
lea eax, [ebp - 0x20c]
push str.cocuments_and_settingslocalService
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
je 0x4b28c2
mov byte [0x5e9adc], bl
jmp 0x4b28c8
mov bl, byte [0x5e9adc]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b2d14
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x56ef64
call fcn.004e718f
mov ebx, ecx
call fcn.004b126a
lea edi, [ebx + 0xb4]
push eax
mov ecx, edi
call fcn.00443cb5
mov esi, str.PuddingZip.ini
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0041e910
mov esi, 0x589de0
lea eax, [ebp - 0x248]
push esi
push str.Spreader
push str.AppInfo
push eax
mov ecx, ebx
call fcn.004b1352
and dword [ebp - 4], 0
lea eax, [ebp - 0x248]
push eax
call fcn.004b6b8c
cmp dword [ebp - 0x238], 0
pop ecx
jne 0x4b2d99
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00419cc0
lea esi, [ebx + 0xcc]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x4b2db5
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00419ba0
push 0x589de0
mov ecx, esi
call fcn.004b331f
test eax, eax
jne 0x4b2e31
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004bf1c0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4b2de2
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, 0x589de0
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x4b2e13
xor eax, eax
jmp 0x4b2e20
lea eax, [ebp - 0x218]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00419cc0
jmp 0x4b2e36
mov edi, 0x589de0
push edi
mov ecx, esi
call fcn.004b331f
test eax, eax
jne 0x4b2ef9
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebx + 0x54]
lea ecx, [ebp - 0x230]
push eax
call fcn.004436ab
push str.PuddingZip.ini
mov byte [ebp - 4], 1
call fcn.004d2a7b
pop ecx
push eax
push str.PuddingZip.ini
lea ecx, [ebp - 0x230]
call fcn.0041e910
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x4b2eca
xor eax, eax
jmp 0x4b2ed7
lea eax, [ebp - 0x218]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00419cc0
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00430390
push edi
mov ecx, esi
call fcn.004b331f
test eax, eax
jne 0x4b2f35
push edi
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004b14b9
push eax
mov ecx, esi
call fcn.004241f0
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00430390
push esi
call fcn.004b6b8c
cmp dword [ebx + 0xdc], 0
pop ecx
jne 0x4b2f4d
push edi
mov ecx, esi
call fcn.00443cb5
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00430390
call fcn.004e7139
ret
Function at 0x4b3528
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xfa4]
push edi
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
push 0x58a140
call fcn.004d2a7b
pop ecx
lea ecx, [ebp - 0xfa4]
lea eax, [ecx + eax*2]
push eax
call fcn.004d2a59
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.004d2a28
push 0x3c
xor edi, edi
lea eax, [ebp - 0xfe0]
push edi
push eax
call fcn.004bf1c0
add esp, 0x1c
mov dword [ebp - 0xfdc], 0x200
xor eax, eax
mov dword [ebp - 0xfcc], esi
inc eax
mov ecx, str.open
mov dword [ebp - 0xfd4], ecx
push eax
push edi
push edi
push esi
push ecx
push edi
mov dword [ebp - 0xfc4], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4b35d9
push edi
push edi
lea eax, [ebp - 0xfa4]
push edi
push eax
call fcn.004b3842
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret

Function at 0x4b3682
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004d2a7b
pop ecx
test eax, eax
je 0x4b36a7
call fcn.004b5fe3
test eax, eax
je 0x4b36a1
pop ebp
jmp fcn.004b3528
pop ebp
jmp fcn.004b35e9
pop ebp
ret

Function at 0x4b36a9
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004d2a7b
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437c34
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.004d2a59
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x4b3723
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x4b371a
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b3710
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4b3721
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x4b36ed
jmp 0x4b3723
xor edi, edi
push esi
call fcn.00437c3d
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3842
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x56eff2
call fcn.004e718f
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.004bf1c0
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.004bf1c0
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x4b3920
cmp word [edi], dx
jne 0x4b38b1
mov eax, edx
jmp 0x4b38b8
push edi
call fcn.004d2a7b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00419cc0
cmp dword [ebp - 0x30], 0
je 0x4b3920
mov edi, 0x575d04
push edi
call fcn.004d2a7b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00419cc0
xor edi, edi
cmp word [esi], di
jne 0x4b38e9
mov eax, edi
jmp 0x4b38f0
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0041e910
mov esi, 0x575d08
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0041e910
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041e800
jmp 0x4b393c
xor edi, edi
cmp word [esi], di
jne 0x4b392b
mov eax, edi
jmp 0x4b3932
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00419cc0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4b3968
mov esi, edi
jmp 0x4b3993
cmp byte [ebp + 0x10], 0
je 0x4b3980
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00430390
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00430390
mov eax, esi
call fcn.004e7139
ret
Function at 0x4b39d5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
xor edi, edi
push str.EXPLORER.EXE
mov esi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
call fcn.004b4dcc
pop ecx
push eax
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4b3b08
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4b3b08
lea eax, [ebp - 4]
inc esi
push eax
push esi
push esi
push edi
push 0xf01ff
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4b3b06
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4b3a89
push str.WTSGetActiveConsoleSessionId
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b3a82
call eax
push 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x4b3a82
xor esi, esi
jmp 0x4b3b08
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.004bf1c0
push 0x10
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.004bf1c0
add esp, 0x18
mov dword [ebp - 0x64], edi
xor edi, edi
mov dword [ebp - 0x5c], str.WinSta0Default
mov dword [ebp - 0x38], esi
mov dword [ebp - 8], edi
push 5
pop eax
push edi
push dword [ebp - 4]
mov word [ebp - 0x34], ax
lea eax, [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4b3b06
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push edi
push dword [ebp - 8]
push 0x430
push edi
push edi
push edi
push dword [ebp + 8]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4b3b06
cmp dword [ebp - 8], edi
je 0x4b3b08
push dword [ebp - 8]
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x4b3b08
mov esi, edi
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4b3b1d
cmp eax, 0xffffffff
je 0x4b3b1d
push eax
call edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4b3b2c
cmp eax, 0xffffffff
je 0x4b3b2c
push eax
call edi
test ebx, ebx
jne 0x4b3b33
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret