joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0fd4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d119d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea edx, [ebp - 0x258]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0047dce4
lea eax, [ebp - 0x258]
mov edx, 0x4d11b8
call fcn.00406844
mov eax, dword [ebp - 0x258]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4d1177
lea eax, [ebp - 4]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00406630
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d1067
sub eax, 4
mov eax, dword [eax]
cmp eax, 9
jl 0x4d109c
lea eax, [ebp - 0x25c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406bdc
mov eax, dword [ebp - 0x25c]
mov edx, 0x4d11dc
call fcn.0040c3f8
test eax, eax
sete al
jmp 0x4d109e
xor eax, eax
test al, al
je 0x4d10c7
mov eax, 0x4d11e8
mov edx, dword [ebp - 4]
movzx esi, word [edx + 0xa]
cmp si, 0x100
jae 0x4d10bf
mov edx, esi
movzx edx, dl
bt dword [eax], edx
jb 0x4d10c3
xor eax, eax
jmp 0x4d10c9
mov al, 1
jmp 0x4d10c9
xor eax, eax
test al, al
je 0x4d10f2
mov eax, 0x4d11e8
mov edx, dword [ebp - 4]
movzx esi, word [edx + 0xc]
cmp si, 0x100
jae 0x4d10ea
mov edx, esi
movzx edx, dl
bt dword [eax], edx
jb 0x4d10ee
xor eax, eax
jmp 0x4d10f4
mov al, 1
jmp 0x4d10f4
xor eax, eax
test al, al
je 0x4d111d
mov eax, 0x4d11e8
mov edx, dword [ebp - 4]
movzx esi, word [edx + 0xe]
cmp si, 0x100
jae 0x4d1115
mov edx, esi
movzx edx, dl
bt dword [eax], edx
jb 0x4d1119
xor eax, eax
jmp 0x4d111f
mov al, 1
jmp 0x4d111f
xor eax, eax
test al, al
je 0x4d115c
mov eax, dword [ebp - 4]
cmp word [eax + 0x10], 0x2e
jne 0x4d115c
lea eax, [ebp - 0x260]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00406bdc
mov eax, dword [ebp - 0x260]
call fcn.0040d358
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4d1048
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d11a4
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4d3f04
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x12], eax
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0xe], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa], eax
call fcn.004d3dd8
lea eax, [ebp - 0x12]
push eax
push 0
push 0x4a
mov eax, dword [0x504cb8]
push eax
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, dword [esi]
xor edx, edx
mov dword [esi], edx
call fcn.00404098
cmp ebx, 0x6c840001
jne 0x4d3f57
call fcn.00411a58
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x4d3f7b
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4d4030
call fcn.004ab328
mov word [ebp - 6], bx
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call dword [ebp - 4]
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x4d3fd3
mov ebx, eax
mov edx, 1
movzx eax, word [ebp - 6]
call fcn.004d3e58
mov esi, eax
mov eax, esi
sub ax, 2
je 0x4d3fd3
dec eax
sub ax, 2
jb 0x4d3fe7
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4d4090
call fcn.004ab328
push 0xff
push 0xa
push 0
push 0
push 0
call sub.user32.dll_MsgWaitForMultipleObjects
jmp 0x4d3f88
mov edx, 2
movzx eax, word [ebp - 6]
call fcn.004d3e58
movzx ebx, ax
mov edx, 3
movzx eax, word [ebp - 6]
call fcn.004d3e58
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d469c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4d46a6
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x4d475c
push 0x4d4790
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409600
mov ebx, eax
test ebx, ebx
je 0x4d4745
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4d4745
test al, 0x10
je 0x4d46f6
mov ebp, 0x2000000
jmp 0x4d46f8
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4d4745
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call fcn.004093f0
test ebx, ebx
jle 0x4d4745
cmp ebx, 0xff0
jge 0x4d4745
mov edx, edi
mov eax, esp
call fcn.004d45b4
jmp 0x4d474e
mov eax, edi
mov edx, esi
call fcn.00406448
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d47ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d483f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
mov ebx, eax
test ebx, ebx
jle 0x4d4813
cmp ebx, 0x104
jge 0x4d4813
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00406630
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.004d469c
jmp 0x4d4826
mov eax, 0x4d4858
call fcn.004ab4d8
mov eax, esi
xor edx, edx
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4846
lea eax, [ebp - 0x20c]
call fcn.00406438
ret

Function at 0x4d4adc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d4bab
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4d4340]
call fcn.004d4bd4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d4b84
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4d4bc4
call fcn.0040e38c
mov edx, dword [ebp - 8]
mov eax, dword [0x4fed7c]
mov eax, dword [eax]
call fcn.0047b97c
call fcn.004d43a8
call sub.user32.dll_GetFocus
mov edx, dword [0x4fed7c]
mov edx, dword [edx]
cmp eax, dword [edx + 0x170]
jne 0x4d4b67
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4d4b6e
call sub.user32.dll_WaitMessage
jmp 0x4d4b41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4b8b
mov eax, dword [ebp - 4]
call fcn.00404098
ret

Function at 0x4dc468
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x504fd1], 1
call fcn.004ad6f8
test al, al
jne 0x4dc4ba
push 5
mov eax, dword [0x4fed7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4fed7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x4fed8c]
mov eax, dword [eax + 0x108]
mov cl, 2
xor edx, edx
call fcn.004dc34c
ret

Function at 0x4df680
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4df6a5
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e10ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4e1118
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x4e1121
call fcn.004e00ec
mov eax, 0xa
call fcn.004804f8
call fcn.004e00ec
call fcn.004e10b8
test al, al
jne 0x4e10f6
pop ebx
ret

Function at 0x4e1628
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x4fe954]
cmp dword [eax], 0
je 0x4e16d3
mov eax, dword [0x4fe954]
mov eax, dword [eax]
call fcn.00463810
test al, al
je 0x4e16d3
mov eax, dword [0x4fe954]
mov eax, dword [eax]
cmp byte [eax + 0x1e2], 0
je 0x4e167d
cmp byte [ebx + 0x389], 0
jne 0x4e167d
mov eax, dword [0x4fed7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4e1681
xor eax, eax
jmp 0x4e1683
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x4fe954]
mov eax, dword [eax]
call fcn.00463464
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x4e16d3
test bl, bl
je 0x4e16bf
push 5
mov eax, dword [0x4fe954]
mov eax, dword [eax]
call fcn.00463464
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e16d3
push 0
mov eax, dword [0x4fe954]
mov eax, dword [eax]
call fcn.00463464
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4e1784
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x504f8c], 0
push 0x4e185c
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
push 0x4e1878
push ebx
call fcn.00409600
test eax, eax
je 0x4e1810
lea edx, [esp + 4]
push edx
call eax
push 0x4e18a0
push ebx
call fcn.00409600
mov esi, eax
test esi, esi
je 0x4e181a
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x4e181a
cmp dword [esp], 0
je 0x4e181a
call fcn.004aa740
test al, al
je 0x4e181a
push 0x4e18c0
push ebx
call fcn.00409600
test eax, eax
je 0x4e181a
push 0x4e18f4
push 0x4e1914
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409600
test eax, eax
je 0x4e181a
mov byte [0x504f8c], 1
jmp 0x4e181a
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
movzx eax, word [esp + 4]
sub ax, 1
jb 0x4e1833
sub ax, 5
je 0x4e183c
sub ax, 3
je 0x4e1845
jmp 0x4e184e
mov byte [0x4fe4b4], 1
jmp 0x4e1855
mov byte [0x4fe4b4], 3
jmp 0x4e1855
mov byte [0x4fe4b4], 2
jmp 0x4e1855
mov byte [0x4fe4b4], 0
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x4e1b9c
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e1c4b
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x504f9c], eax
cmp byte [0x504f8b], 0
je 0x4e1c4b
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4e1c3c
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4e1c4b
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x504fa0], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x504fa2], al
movzx eax, word [esp + 0x22c]
mov word [0x504fa4], ax
jmp 0x4e1c4b
cmp eax, 4
jne 0x4e1c4b
call fcn.004e1930
call fcn.004e1a0c
add esp, 0x230
ret

Function at 0x4f62bc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f6364
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f6380
push ebx
push 0x4f6390
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004069e8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403540
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4f6342
mov eax, dword [0x4fed8c]
mov eax, dword [eax + 0x188]
call fcn.004f6214
mov eax, dword [ebp - 0x54]
push eax
call fcn.004093f0
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f636b
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4f6d04
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f6ef2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0047f214
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004ab8e8
test al, al
jne 0x4f6d71
xor eax, eax
push ebp
push 0x4f6d67
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.004abc84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6d71
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [0x50507c]
call fcn.004064d4
push eax
call fcn.00409410
test eax, eax
jne 0x4f6da0
mov eax, dword [0x4fed8c]
mov eax, dword [eax + 0x184]
call fcn.004f6214
push 0x80
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x501b50]
push eax
push 0
mov ecx, 0x4f6f00
mov edx, 0x4f6f04
xor eax, eax
call fcn.0040a0fc
mov dword [ebp - 8], eax
push 0x4f63d4
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x5050a8], eax
xor eax, eax
push ebp
push 0x4f6ebb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4fed7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.0047ec9c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4f6f20
call fcn.0040e38c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.0047eb7c
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00406844
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004f62bc
mov dword [ebp - 0xc], eax
call fcn.004f6398
test al, al
jne 0x4f6e9b
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4f6e79
mov eax, dword [ebp - 0xc]
push eax
call fcn.004093f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6ec2
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x4f82f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4f85aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4fed7c]
mov eax, dword [eax]
mov edx, 0x4f85c4
call fcn.0047b97c
push 5
mov eax, dword [0x4fed7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x4f8571
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004dc6f4
lea eax, [ebp - 0x10]
call fcn.0047f140
mov eax, dword [ebp - 0x10]
call fcn.0040de38
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0047ec9c
mov edx, dword [ebp - 0x14]
mov eax, 0x50507c
call fcn.00406448
call fcn.004f65cc
lea ecx, [ebp - 0x18]
mov edx, 0x4f85e4
mov eax, dword [0x50507c]
call fcn.0047dd80
mov edx, dword [ebp - 0x18]
mov eax, 0x505080
call fcn.00406448
lea ecx, [ebp - 0x1c]
mov edx, 0x4f85fc
mov eax, dword [0x50507c]
call fcn.0047dd80
mov edx, dword [ebp - 0x1c]
mov eax, 0x505084
call fcn.00406448
push 2
push 0
push 1
mov ecx, dword [0x50507c]
mov dl, 1
mov eax, dword [0x4a7f18]
call fcn.004a8258
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f8448
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004a8218
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004a81f0
cmp dword [ebp - 0xc], 0x67734d49
je 0x4f8423
mov cl, 1
xor edx, edx
mov eax, dword [0x505084]
call fcn.004a94dc
jmp 0x4f8432
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x50507c]
call fcn.004a94dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f844f
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x4f8754
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f8897
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x4f88b0
mov edx, ebx
call fcn.00406904
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4f8871
xor eax, eax
push ebp
push 0x4f886a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4f88cc
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0040e0b8
test eax, eax
jne 0x4f883b
test byte [ebp - 0x258], 0x10
jne 0x4f883b
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00406630
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406904
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x4f882d
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4f87c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8871
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f889e
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4f88d8
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f89d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00406448
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0047e224
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4f89f4
call fcn.0040e38c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406904
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4f8978
test esi, 0x10
jne 0x4f89a8
test esi, 1
je 0x4f8978
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4f89a2
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406448
jmp 0x4f89b5
inc edi
cmp edi, 0xa
je 0x4f89b5
inc ebx
cmp ebx, 0x3e8
jne 0x4f8919
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f89df
lea eax, [ebp - 0x14]
call fcn.00406438
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x406060
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bda6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x57e7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x40609c
xor eax, eax
jmp 0x406105
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005020d0
add esp, 0xc
call fcn.00406bc0
push 0x5399e0
test al, al
lea eax, [ebp - 0x218]
push esi
push eax
je 0x406121
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x21c]
call fcn.00407da0
push edi
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
push str.TabXTray
lea ecx, [ebp - 0x21c]
call fcn.00409490
lea ecx, [ebp - 0x21c]
mov ebx, eax
call fcn.00408a60
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf660
mov esp, ebp
pop ebp
ret
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406103
call fcn.004067b0
mov ecx, eax
test ecx, ecx
je 0x40623d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
test edi, edi
je 0x40618f
push edi
push eax
lea eax, [ebp - 0x21c]
push 0x539a6c
push eax
call fcn.004066c0
add esp, 0x10
jmp 0x4061a4
push eax
lea eax, [ebp - 0x21c]
push str.__s_
push eax
call fcn.004066c0
add esp, 0xc
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 4], 1
mov edi, dword [esi - 0xc]
jle 0x4061c5
push edi
lea ecx, [ebp - 0x21c]
call fcn.00406630
mov esi, dword [ebp - 0x21c]
lea eax, [edi + edi]
push eax
push esi
push 1
push 0
push str.TabXTray
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esi - 8]
mov ebx, eax
push esi
call fcn.005057c5
add esp, 8
test eax, eax
js 0x406233
cmp eax, dword [esi - 8]
jg 0x406233
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x406103
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x406103
push 0x80070057
call fcn.00406380
push 0x80004005
call fcn.00406380
int3
Function at 0x4064e0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bdd8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x57e7c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40651d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
call fcn.00406890
add esp, 8
test eax, eax
jne 0x40654a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
call fcn.00406bc0
test al, al
je 0x40658b
lea ecx, [ebp + 8]
call fcn.00407da0
push 1
push str.TabXTray
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.00409db0
lea ecx, [ebp + 8]
mov esi, eax
call fcn.00408a60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4065ba
push str.TabXTray
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret