joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b0c0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x190
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
call fcn.0044e664
test eax, eax
mov ebx, eax
je 0x44b212
xor eax, eax
mov ecx, 0x64
mov edi, ebx
test byte [esp + 0x40], 2
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x140], ebx
mov dword [ebx], esi
mov dword [ebx + 4], eax
je 0x44b1f2
lea eax, [esi + 1]
mov dword [esp + 4], 4
add esi, esi
mov dword [esp], eax
call fcn.0044e48c
mov dword [ebx + 0x144], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], 4
mov dword [esp], esi
mov dword [ebx + 0x15c], 0
mov dword [ebx + 0x160], 0
mov dword [ebx + 0x150], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x168], 0
mov dword [ebx + 0x16c], 0
mov dword [ebx + 0x178], esi
mov dword [ebx + 0x164], eax
call fcn.0044e48c
mov dword [esp], str.POSIXLY_CORRECT
mov dword [ebx + 0x170], eax
mov dword [ebx + 0x184], 1
mov dword [ebx + 0x18c], 0
call sub.cygwin1.dll_getenv
test eax, eax
je 0x44b200
or dword [ebx + 0x164], 4
test ebp, ebp
je 0x44b1db
mov dword [esp], ebp
call sub.cygwin1.dll_strlen
lea esi, [eax + 1]
mov dword [esp], esi
call fcn.0044e664
test eax, eax
mov edi, eax
je 0x44b1db
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.cygwin1.dll_strlcpy
mov dword [ebx + 0x158], edi
mov edx, dword [ebx + 0x150]
mov eax, ebx
call fcn.0044a380
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 0xc], 1
jmp 0x44b10a
mov dword [esp], str.POSIX_ME_HARDER
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x44b1a1
jmp 0x44b1a8
xor eax, eax
jmp 0x44b1ea
Function at 0x44ca60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x158]
test eax, eax
je 0x44caf0
mov dword [esp + 4], str._etc_popt
mov dword [esp], ebx
call fcn.0044c870
test eax, eax
je 0x44ca92
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.HOME
call sub.cygwin1.dll_getenv
test eax, eax
mov esi, eax
je 0x44caf0
mov dword [esp], eax
call sub.cygwin1.dll_strlen
lea ecx, [eax + 0x14]
add eax, 0x32
and eax, 0xfffffff0
call fcn.0044e3e0
sub esp, eax
lea edi, [esp + 0x1f]
mov dword [esp + 0xc], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], str._s_.popt
and edi, 0xfffffff0
mov dword [esp], edi
call sub.cygwin1.dll_snprintf
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0044c870
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4034db
pop dword [ebp - 0x20]
mov eax, 0x300f1333
sub eax, 0x2fcede58
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x1879a309
sub dword [ebp - 0x30], 0xca275dbe
mov dword [ebp - 0x2c], 0x3d205888
add dword [ebp - 0x2c], 0xf512f3bd
mov dword [ebp - 0x28], 0x808e1d05
sub dword [ebp - 0x28], 0x3441d8d7
mov dword [ebp - 0x24], 0x61416ca0
add dword [ebp - 0x24], 0x9ebe9360
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x54597504
sub dword [ebp - 0x30], 0xdfe70bae
mov dword [ebp - 0x2c], 0x8f35e335
add dword [ebp - 0x2c], 0xb2367e40
mov dword [ebp - 0x28], 0xf5b42eb8
add dword [ebp - 0x28], 0x6dbb3db4
mov dword [ebp - 0x24], 0x2f75189d
sub dword [ebp - 0x24], 0x2f75189d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xcca1e874
add eax, 0x339e57dc
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35a88
push 0
call eax
mov ecx, 0x4317
xor edx, edx
add edx, eax
mov esi, 0x7e3fed4b
add esi, 0x820096b5
add esi, dword [ebp - 0x20]
mov ebx, 0x98a70950
xor dword [ebp - 0x1c], 0x1f9a1f1b
mov edi, dword [esi]
sub dword [ebp - 0xc], 0x94d72064
xor edi, ebx
add dword [ebp - 0x1c], edi
mov dword [edx], edi
sub dword [ebp - 0x18], ebx
add edx, 0x8dc5ae7c
sub edx, 0x8dc5ae78
add esi, 4
loop 0x4035ee
add eax, 0xff2f
mov ebx, eax
add eax, 5
mov ecx, 0xcf770135
add ecx, 0x30c8fecb
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x444710
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
push ebx
push esi
mov esi, dword [eax + 0x28]
push edi
mov edi, dword [ecx]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
lea ebx, [ebx]
mov ebx, dword [eax + 0x40]
mov eax, dword [eax + 0x28]
test esi, esi
je 0x44473e
cmp esi, eax
je 0x444743
call fcn.00492f40
cmp edi, ebx
je 0x4447ae
test esi, esi
jne 0x444767
call fcn.00492f40
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x44475c
call fcn.00492f40
cmp dword [edi + 0x40], 8
jb 0x44476b
mov ebx, dword [edi + 0x2c]
jmp 0x44476e
mov eax, dword [esi]
jmp 0x444752
lea ebx, [edi + 0x2c]
test esi, esi
jne 0x44478c
call fcn.00492f40
cmp edi, dword [esi + 0x18]
jne 0x444781
call fcn.00492f40
cmp dword [edi + 0x24], 8
jb 0x444790
mov edi, dword [edi + 0x10]
jmp 0x444793
mov esi, dword [esi]
jmp 0x444777
add edi, 0x10
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea esi, [ebp - 0xc]
call fcn.00416060
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
jmp 0x444730
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444ba0
Capabilities:
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x4e9688]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffff9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x444bdd
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491281
mov esp, ebp
pop ebp
ret
push 0x4cf75c
push esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x444bcb
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x418]
push edx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x444c96
inc edi
cmp word [ebp - 0x63c], 0x2e
jne 0x444c3c
mov ax, word [ebp - 0x63a]
test ax, ax
je 0x444c75
cmp ax, 0x2e
jne 0x444c3c
cmp word [ebp - 0x638], 0
je 0x444c75
test byte [ebp - 0x668], 2
je 0x444c75
lea eax, [ebp - 0x63c]
push eax
push esi
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x444c75
mov edx, dword [ebp - 0x668]
and edx, 0xfffffff9
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x668]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x444c8f
cmp edi, 0x1388
jl 0x444c15
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00491281
mov esp, ebp
pop ebp
ret

Function at 0x444e10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4e9688]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00497780
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x4cf760
lea eax, [ebp - 0x20c]
push eax
call esi
push str.psapi.dll
lea ecx, [ebp - 0x20c]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea edx, [ebp - 0x20c]
push edx
call edi
test eax, eax
jne 0x444ebd
push 0x4cf774
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x4cf774
lea ecx, [ebp - 0x20c]
push ecx
call esi
push str.psapi.dll
lea edx, [ebp - 0x20c]
push edx
call esi
lea eax, [ebp - 0x20c]
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00491281
mov esp, ebp
pop ebp
ret
Function at 0x445020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4e9688]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x802]
push ecx
mov dword [ebp - 0x808], 1
mov word [ebp - 0x804], ax
call fcn.00497780
add esp, 0xc
lea edx, [ebp - 0x80c]
push edx
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x808]
push ecx
push str.ImagePath
push str.SYSTEMCurrentControlSet_servicesQHActiveDefense
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80c], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor al, al
cmp word [ebp - 0x804], 0x22
jne 0x44509d
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491281
mov esp, ebp
pop ebp
ret

Function at 0x4450b0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [0x4e9688]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xc12]
push ecx
mov word [ebp - 0xc14], ax
call fcn.00497780
add esp, 0xc
push 0x208
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0xc14]
push str.__s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x800
lea edx, [ebp - 0xc14]
push edx
push 1
push str.ImagePath
push str.SYSTEMCurrentControlSet_servicesQHActiveDefense
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491281
mov esp, ebp
pop ebp
ret
Function at 0x445150
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4e9688]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x208
lea eax, [ebp - 0x414]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x824]
push str.__s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4451bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491281
mov esp, ebp
pop ebp
ret
push esi
push 2
push str.QHActiveDefense
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4451f2
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491281
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x824]
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x445229
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop esi
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00491281
mov esp, ebp
pop ebp
ret

Function at 0x445250
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00445020
test al, al
jne 0x445264
call fcn.004450b0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push str.Start
push str.SYSTEMCurrentControlSet_servicesQHActiveDefense
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, 2
cmp dword [ebp - 4], eax
jne 0x4452aa
xor eax, eax
mov esp, ebp
pop ebp
ret
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSet_servicesQHActiveDefense
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00445150
mov esp, ebp
pop ebp
ret
Function at 0x459cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push str.UserExperience
push str.Software360TotalSecurityExperience
mov edi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
cmp dword [ebp - 4], 0
je 0x459d0c
lea eax, [edi - 3]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push str.EnableUE
push str.Software360Safe
push SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x464a40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bad58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4e9688]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
xor ebx, ebx
cmp eax, ebx
je 0x464a7a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 0x24]
push eax
call fcn.00432fb0
lea eax, [esi + 0x28]
mov dword [ebp - 4], ebx
cmp dword [eax], ebx
je 0x464a96
push eax
lea edi, [ebp - 0x24]
call fcn.004126d0
cmp dword [esi + 0x104], ebx
lea eax, [esi + 0x104]
je 0x464aad
push eax
lea edi, [ebp - 0x24]
call fcn.004126d0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, ebx
jbe 0x464b13
push 0x7d0
push 1
sub edx, ecx
sar edx, 2
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, dword [ebp - 0x18]
cmp eax, 0x102
jne 0x464b13
mov eax, dword [ebp - 0x14]
sub eax, ecx
sar eax, 2
xor esi, esi
cmp eax, ebx
jbe 0x464b13
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp esi, eax
jb 0x464afc
call fcn.00492f40
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
push ebx
push ecx
call edi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
inc esi
sar eax, 2
cmp esi, eax
jb 0x464afc
cmp ecx, ebx
je 0x464b20
push ecx
call fcn.00491276
add esp, 4
mov edx, dword [ebp - 0x24]
push edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00491276
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x24], 0
jne 0x4651a8
push 0
push SysReAllocString
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x4651a8
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x28], 0
mov dword [ebp - 4], 0
jne 0x4651d4
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4651e0
push 0
push 0
call fcn.00492054
add esp, 0x18
mov dword [esi + 0x28], eax
test eax, eax
je 0x4651a2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4654f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4e9688]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x4f3988], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
jne 0x46552a
or dword [0x4f3988], 1
call fcn.00467570
push 0x4bfca0
call fcn.004914a4
add esp, 4
cmp dword [0x4f39a4], 0
jne 0x4655c2
mov ecx, str.safemonUDiskScanEngine.dll
lea eax, [ebp - 0x20c]
call fcn.0042c480
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4655c2
test byte [0x4f3988], 1
jne 0x46557a
or dword [0x4f3988], 1
call fcn.00467570
push 0x4bfca0
call fcn.004914a4
add esp, 4
lea eax, [ebp - 0x20c]
mov esi, 0x4f3990
call fcn.00467660
test eax, eax
je 0x4655c2
lea ecx, [ebp - 0x210]
push ecx
mov dword [ebp - 0x210], 0xb
call fcn.00464280
mov ecx, eax
call fcn.00467700
test eax, eax
je 0x4655c2
mov edx, dword [edi + 4]
push edx
call fcn.00464280
mov esi, eax
call fcn.004678c0
mov dword [edi + 0x14], eax
xor eax, eax
cmp dword [edi + 0x14], eax
je 0x4655fa
test byte [0x4f3988], 1
jne 0x4655eb
or dword [0x4f3988], 1
call fcn.00467570
push 0x4bfca0
call fcn.004914a4
add esp, 4
push ebx
add ebx, 8
push ebx
mov esi, 0x4f3990
call fcn.00467950
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00491281
mov esp, ebp
pop ebp
ret 4

Function at 0x465ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x100], 0
jne 0x465aee
push 0
push SysReAllocString
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 0x100], eax
test eax, eax
jne 0x465aee
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x104], 0
mov dword [ebp - 4], 0
jne 0x465b20
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x465b30
push 0
push 0
call fcn.00492054
add esp, 0x18
mov dword [esi + 0x104], eax
test eax, eax
je 0x465ae8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x465ea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
movzx eax, word [esi + 0xdc]
push edi
lea edi, [esi + 0xdc]
push eax
mov byte [ebp - 1], 0
call fcn.004447f0
add esp, 4
test eax, eax
jne 0x465f0d
mov eax, dword [esi + 0xc]
cmp eax, 3
je 0x465fdb
cmp eax, 2
je 0x465fdb
cmp eax, 4
je 0x465fe0
cmp eax, 5
je 0x465fdb
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x465f18
mov dword [esi + 0x2f4], 1
mov dword [esi + 0x10], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test al, 0x10
je 0x465f4a
mov esi, edi
call fcn.00444ba0
test eax, eax
je 0x465fce
mov eax, dword [ebp + 8]
push edi
add eax, 0x540
call fcn.00466820
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x10], 0x46
jge 0x465f57
mov ecx, edi
call fcn.004448b0
call fcn.00464280
cmp dword [eax + 0x14], 0
je 0x465fce
mov ecx, dword [esi + 0x2fc]
push ecx
call fcn.00464280
mov edx, 3
call fcn.004679f0
test eax, eax
je 0x465fce
mov ebx, 1
mov dword [esi + 0x2f4], ebx
mov byte [ebp - 1], bl
mov ebx, dword [ebp + 8]
push edi
mov dword [esi + 0x10], 0
add ebx, 0x940
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
push str..vbs
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x465fb8
or dword [ebx], 2
jmp 0x465fbe
push ebx
call fcn.004668f0
mov edx, dword [ebp + 8]
push edi
add edx, 0x140
push edx
call fcn.00466770
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 4
jne 0x465fe7
mov ecx, edi
call fcn.004448b0
mov ebx, 1
test byte [0x4f3988], bl
jne 0x46600c
or dword [0x4f3988], ebx
call fcn.00467570
push 0x4bfca0
call fcn.004914a4
add esp, 4
mov ecx, dword [0x4f39a4]
mov eax, dword [esi + 0x2fc]
test ecx, ecx
je 0x466033
mov edx, dword [ecx]
push 5
push eax
mov eax, dword [edx + 0x14]
call eax
test eax, eax
jne 0x466033
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x10], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a8300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4a831b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004a802d
and cl, ch
int3

Function at 0x4a8756
Capabilities:
Inspect section memory permissions

Disassembly:
adc byte gs:[eax], al
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4

Function at 0x4a878d
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4a8704
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4a8722
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4a8780
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
adc byte gs:[eax], al
add byte [eax], al
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4a8767
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4a8770
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4a877a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4a875c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4a86e6
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4a87cd
dec eax
je 0x4a87c4
sub eax, 3
je 0x4a87bb
mov dword [ebp - 4], 0x40
jmp 0x4a87ea
mov dword [ebp - 4], 4
jmp 0x4a87d0
mov dword [ebp - 4], 0x20
jmp 0x4a87d0
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4a879c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004a802d
shl byte [ecx + 0x75ff505a], 1
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x4a8828
pop edi
pop esi
pop ebx
leave
ret