joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c514
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0040580c
xor eax, eax
push ebp
push 0x47c5b9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 8]
call fcn.00461f80
mov esi, dword [ebx + 0x1c]
mov dword [esi + 0x53c], ebx
mov dword [esi + 0x538], 0x47c47c
mov dword [esi + 0x544], ebx
mov dword [esi + 0x540], 0x47c4dc
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x47c494
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 4], eax
push ebp
call fcn.0047c4f0
pop ecx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 0xc], 0
je 0x47c5a3
mov eax, ebx
call fcn.0047c378
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c5c0
lea eax, [ebp - 8]
call fcn.0040538c
ret

Function at 0x47e760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040580c
xor eax, eax
push ebp
push 0x47e8c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x628
call fcn.00403ab0
lea edx, [ebp - 8]
mov eax, dword [0x651ca8]
call fcn.00426fc8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x47e8d4
call fcn.00406fb4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, 0x47e8e4
call fcn.00406fb4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405ce8
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405cf8
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebp - 0x154]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x104
lea eax, [ebx + 0x105]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
lea eax, [ebx + 0x310]
push eax
push 0x104
lea eax, [ebx + 0x20a]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
lea eax, [ebx + 0x620]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
lea eax, [ebx + 0x624]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
lea eax, [ebp - 0x10]
call fcn.00406f70
lea eax, [ebp - 0xc]
call fcn.00406f70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e8cd
lea eax, [ebp - 0x14]
call fcn.00405b68
lea eax, [ebp - 0x10]
call fcn.00406f70
lea eax, [ebp - 0xc]
call fcn.00406f70
lea eax, [ebp - 8]
call fcn.00406f70
lea eax, [ebp - 4]
call fcn.0040538c
ret
Function at 0x47f3c0
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x30
push 0
push 0
dec ecx
jne 0x47f3c8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040580c
xor eax, eax
push ebp
push 0x47f61d
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00468de4
mov esi, eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x47f634
mov edx, dword [ebp - 4]
call fcn.004056a4
mov eax, dword [ebp - 0x14c]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47f5f2
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004055fc
cmp dword [ebp - 0x150], 0
jne 0x47f483
push dword [ebp - 4]
push 0x47f644
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004055fc
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.00464b90
jmp 0x47f4c2
push dword [ebp - 4]
push 0x47f644
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.004055fc
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00405720
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.00464b90
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004055fc
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.00422358
mov eax, dword [ebp - 0x164]
mov edx, 0x47f650
call fcn.004057b4
je 0x47f5d7
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004055fc
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.00422358
mov eax, dword [ebp - 0x16c]
mov edx, 0x47f664
call fcn.004057b4
je 0x47f5d7
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004055fc
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00422358
mov eax, dword [ebp - 0x174]
mov edx, 0x47f67c
call fcn.004057b4
je 0x47f5d7
lea eax, [ebp - 0x180]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004055fc
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x17c]
call fcn.00422358
mov eax, dword [ebp - 0x17c]
mov edx, 0x47f690
call fcn.004057b4
je 0x47f5d7
mov eax, dword [ebp - 8]
call fcn.0040581c
call fcn.00468d20
cmp esi, eax
jbe 0x47f5d7
push 0x20
mov eax, dword [ebp - 8]
call fcn.0040581c
mov edi, eax
push edi
call sub.kernel32.dll_SetFileAttributesA
push edi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x47f423
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f624
lea eax, [ebp - 0x180]
mov edx, 0xe
call fcn.004053b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053b0
ret
Function at 0x47f69c
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
mov eax, 0x47f8a0
call fcn.00422d78
test al, al
je 0x47f6cf
push 0x20
push 0x47f8cc
call sub.kernel32.dll_SetFileAttributesA
push 0x47f8cc
call sub.kernel32.dll_DeleteFileA
push 0x47f8cc
push 0x47f8a0
call sub.kernel32.dll_MoveFileA
push 2
mov eax, 0x47f8d8
mov ecx, 0x3ea
mov edx, 0x20
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x63
mov edx, 0x123
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x58
mov edx, 0x1e4
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x64
mov edx, 0x185b823
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x32
mov edx, 0x1182766
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x35
mov edx, 0x11f8400
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x39
mov edx, 0x11fa9f0
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x36
mov edx, 0x11fbe40
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x35
mov edx, 0x11fd510
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x38
mov edx, 0x11fea00
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x36
mov edx, 0x1200c00
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x74
mov edx, 0x102f122
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x42
mov edx, 0x1668703
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x68
mov edx, 0x1870071
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x67
mov edx, 0x197e4c2
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x4c
mov edx, 0x1a0fb84
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x31
mov edx, 0x819181
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x57
mov edx, 0x102f031
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x32
mov edx, 0x1422870
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x32
mov edx, 0x1423cb3
call fcn.00464a38
push 1
mov eax, 0x47f8e4
mov ecx, 0x38
mov edx, 0x18bc451
call fcn.00464a38
ret
Function at 0x47f900
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47fa29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65197c]
add eax, 0x115
mov edx, 0x47fa40
call fcn.00424410
mov eax, dword [0x65197c]
add eax, 0x115
mov edx, 0x47fa54
call fcn.00424410
mov eax, dword [0x65197c]
add eax, 0x115
mov edx, 0x47fa6c
call fcn.00424410
mov eax, dword [0x65197c]
add eax, 0x115
mov edx, 0x47fa84
call fcn.00424410
mov ebx, dword [0x65197c]
mov ebx, dword [ebx + 0x135]
dec ebx
test ebx, ebx
jl 0x47fa0e
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [0x65197c]
add eax, 0x115
mov edx, esi
call fcn.004243f8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00422398
cmp dword [ebp - 4], 0
je 0x47fa06
mov eax, dword [ebp - 4]
mov edx, 0x47fa9c
call fcn.004057b4
je 0x47fa06
mov eax, dword [ebp - 4]
mov edx, 0x47faa8
call fcn.004057b4
je 0x47fa06
mov eax, dword [ebp - 4]
call fcn.0040581c
mov edi, eax
mov eax, edi
call fcn.00422d78
test al, al
je 0x47f9fe
mov edx, edi
lea eax, [ebp - 0xc]
call fcn.00405584
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00464144
push 0x20
push edi
call sub.kernel32.dll_SetFileAttributesA
push edi
call sub.kernel32.dll_DeleteFileA
jmp 0x47fa06
mov eax, dword [ebp - 4]
call fcn.0046b290
inc esi
dec ebx
jne 0x47f982
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fa30
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053b0
ret
Function at 0x482ffc
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
call sub.ole32.dll_CoInitialize_2
call sub.kernel32.dll_GetProcessHeap
mov dword [ebp - 0x14], eax
push 0x208
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x550954
push 1
push 0
push 0x550944
call sub.ole32.dll_CoCreateInstance_1
mov dword [ebp - 0x10], eax
test eax, eax
js 0x4830ea
mov edx, dword [ebp - 8]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
push eax
push 0x550964
push dword [ebp - 8]
call dword [edx]
mov dword [ebp - 0x10], eax
test eax, eax
js 0x4830dc
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x50]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x44]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [edx + 0x1c]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [edx + 0x24]
mov dword [ebp - 0x10], eax
push 0x104
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push 1
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [edx + 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push dword [ebp - 0xc]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp - 8]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapFree
call sub.ole32.dll_CoUninitialize_1
mov eax, dword [ebp - 0x10]
leave
ret 0x10

Function at 0x483550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x107]
xor ecx, ecx
mov edx, 0xff
call fcn.00403ab0
lea eax, [ebp - 4]
push eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x107]
push eax
push 0
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.004055fc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4835c4
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4837bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 0x20e]
xor ecx, ecx
mov edx, 0xff
call fcn.00403ab0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4837a1
xor esi, esi
push esi
mov esi, 0x4837d4
lea edi, [ebp - 0x20e]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
push esi
mov esi, 0x4837d4
lea edi, [ebp - 0x10f]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x10], 0xff
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x10f]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyA
mov ebx, eax
cmp ebx, 0x103
je 0x48378f
test ebx, ebx
jne 0x483787
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x10f]
mov ecx, 0xff
call fcn.004055fc
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x214]
mov edx, 0x4838dc
call fcn.004056a4
mov eax, dword [ebp - 0x214]
call fcn.0040581c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20e]
push eax
push 0
push 0
push 0x483914
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp byte [ebp - 0x20d], 0x3a
jne 0x483786
cmp byte [ebp - 0x20c], 0x5c
jne 0x483786
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x20e]
mov ecx, 0xff
call fcn.004055fc
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0042329c
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
mov edx, edi
call fcn.00405584
mov edx, dword [ebp - 0x224]
lea ecx, [ebp - 1]
mov eax, dword [0x65a9c4]
call fcn.004833f8
lea eax, [ebp - 0x228]
mov edx, edi
call fcn.00405584
mov edx, dword [ebp - 0x228]
mov eax, dword [0x65a9d4]
call fcn.00424410
cmp byte [ebp - 1], 0
je 0x48378f
inc esi
test ebx, ebx
je 0x48363a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4837c6
lea eax, [ebp - 0x228]
mov edx, 6
call fcn.004053b0
ret
Function at 0x483ac8
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040580c
xor eax, eax
push ebp
push 0x483c63
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x6519d0]
cmp byte [eax], 0
jne 0x483c48
cmp dword [ebp - 4], 0
je 0x483c13
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00422e40
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004056a4
mov eax, dword [ebp - 8]
call fcn.0040581c
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
push esi
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x14]
call fcn.0040581c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x483b92
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x483c70
mov edx, 0x483c74
mov eax, 0x80000002
call fcn.004234fc
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6519cc]
mov edx, dword [ebp - 4]
call fcn.004053e0
jmp 0x483c48
mov eax, esi
call fcn.00422d78
test al, al
jne 0x483bdf
push 0x483c8c
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00405584
push dword [ebp - 0x1c]
push 0x483ca0
push 0x483cb0
push 0x483cbc
push 0x483cd8
push 0x483ce8
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.00405720
mov eax, dword [ebp - 0x18]
call fcn.0040581c
jmp 0x483c1a
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x483c70
mov edx, 0x483c74
mov eax, 0x80000002
call fcn.004234fc
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6519cc]
mov edx, dword [ebp - 4]
call fcn.004053e0
jmp 0x483c48
mov bl, 1
mov eax, 0x483d10
push 0x10
push 0
push eax
mov eax, dword [0x65a9c4]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
test bl, bl
je 0x483c48
push 1
push 0
push 0
push 0x483df0
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483c6a
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004053b0
ret
Function at 0x48800c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x488041
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x651514]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x488021
pop edi
pop esi
pop ebx
ret

Function at 0x4885a4
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x488640
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or ebx, 2
mov dword [esp + 0x1c], ebx
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x30
pop ebx
ret

Function at 0x4886dc
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x48870a
mov eax, dword [esp + 4]
cmp eax, 4
je 0x488708
cmp eax, 5
je 0x488708
xor ebx, ebx
jmp 0x48870a
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x40de49
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0041b457
test eax, eax
jne 0x40de82
push str.Fatal_Error:_MFC_initialization_failed_n
call fcn.0040df87
xor eax, eax
pop ecx
inc eax
jmp 0x40df7e
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x26c
call fcn.0040e4c9
pop ecx
test eax, eax
je 0x40dea3
mov ecx, eax
call fcn.0040addc
mov esi, eax
jmp 0x40dea5
mov esi, ebx
xor edi, edi
inc edi
call fcn.0042f869
cmp dword [eax], edi
jle 0x40df40
call fcn.0042f86f
lea ecx, [esp + 0xc]
mov eax, dword [eax]
push dword [eax + edi*4]
call fcn.00401fad
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x260], ebx
jne 0x40df17
mov edx, str.____
mov ecx, eax
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x40df03
test bx, bx
je 0x40defd
mov bx, word [ecx + 2]
cmp bx, word [edx + 2]
jne 0x40df03
add ecx, 4
add edx, 4
test bx, bx
jne 0x40dedb
xor ebx, ebx
mov ecx, ebx
jmp 0x40df0a
sbb ecx, ecx
or ecx, 1
xor ebx, ebx
test ecx, ecx
jne 0x40df17
mov byte [esi + 0x220], 1
jmp 0x40df2a
lea ecx, [esi + 0x258]
push eax
push dword [ecx + 8]
call fcn.0040ea54
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0x10]
call fcn.00402052
inc edi
call fcn.0042f869
cmp edi, dword [eax]
jl 0x40deb5
mov ecx, esi
call fcn.0040b6a5
cmp byte [esi + 0x220], 0
jne 0x40df6f
mov eax, dword [esi + 0x23c]
cmp dword [eax - 0xc], ebx
je 0x40df6f
mov eax, dword [esi + 0x240]
cmp dword [eax - 0xc], ebx
je 0x40df6f
mov ecx, esi
call fcn.0040b419
jmp 0x40df7e
push esi
call fcn.004085e5
mov ecx, eax
call fcn.004087e6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x64002970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6401c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x6401cf28]
push edi
xor edi, edi
test esi, esi
jne 0x64002a70
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push str._sdriversetchosts
push edx
call fcn.64004b03
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea esi, [ebp - 0x210]
call fcn.64002550
test eax, eax
jne 0x64002ab0
mov esi, dword [ebp - 0x210]
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
jne 0x64002a2b
mov edi, dword [ebp - 0x210]
call fcn.64001930
test eax, eax
je 0x64002a13
mov ecx, dword [0x6401cf28]
mov dword [edi + 0x10], ecx
mov dword [0x6401cf28], edi
jmp 0x64002a1a
mov eax, edi
call fcn.64001a60
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
je 0x640029f3
mov eax, dword [esi + 4]
test eax, eax
je 0x64002a42
push eax
call fcn.64003b3b
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x64002a59
push eax
call fcn.640041a3
add esp, 4
mov dword [esi + 8], 0
push esi
call fcn.64003b3b
mov esi, dword [0x6401cf28]
add esp, 4
test esi, esi
je 0x64002a85
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.64001990
test eax, eax
jne 0x64002a99
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x64002a70
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4

Function at 0x64003b2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6401c014]
jne 0x64003b36
repz ret
jmp fcn.64006f23

Function at 0x6400b7ba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid