joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472387
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x55f005
call fcn.004a9932
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x26c]
xor ebx, ebx
push 0x22c
push ebx
push eax
mov edi, ebx
call fcn.00485370
add esp, 0xc
lea ecx, [ebp - 0x40]
push esi
call fcn.00419540
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.00473083
pop ecx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4723dc
jmp 0x47247d
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x472468
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x472412
mov eax, ebx
jmp 0x47241f
lea eax, [ebp - 0x248]
push eax
call fcn.00488e51
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00419ff0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00473083
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00433da0
lea ecx, [ebp - 0x28]
push ebx
push 1
test eax, eax
je 0x47246e
mov byte [ebp - 4], bl
call fcn.00419c20
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4723f5
jmp 0x472476
xor edi, edi
inc edi
call fcn.00419c20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00419c20
mov eax, edi
call fcn.004a98dc
ret

Function at 0x472490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x4725c3
test edi, edi
je 0x4725c3
xor eax, eax
xor ebx, ebx
inc eax
mov dword [ebp - 0x418], ebx
push 0x208
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00485370
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00485370
push esi
lea eax, [ebp - 0x20c]
push 0x56d4d8
push eax
call fcn.00473ed5
push esi
push edi
lea eax, [ebp - 0x414]
push str._s._s
push eax
call fcn.00473ed5
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x418]
add esp, 0x34
push eax
push ebx
lea eax, [ebp - 0x41c]
push eax
push 0x563a30
lea eax, [ebp - 0x20c]
push eax
push connect
call edi
test eax, eax
jne 0x4725bf
push dword [ebp - 0x418]
call fcn.0048dd00
mov esi, eax
pop ecx
test esi, esi
je 0x4725c3
push dword [ebp - 0x418]
push ebx
push esi
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x41c], 1
lea eax, [ebp - 0x418]
push eax
push esi
lea eax, [ebp - 0x41c]
push eax
push 0x563a30
lea eax, [ebp - 0x20c]
push eax
push connect
call edi
push esi
call fcn.00488e51
pop ecx
test eax, eax
je 0x4725b8
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.0048efc8
pop ecx
pop ecx
test eax, eax
movzx ebx, bl
push 1
pop eax
cmove ebx, eax
push esi
call fcn.0048dcfb
pop ecx
mov al, bl
jmp 0x4725c5
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464e95
mov esp, ebp
pop ebp
ret
Function at 0x472898
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x620], ebx
call fcn.00485370
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00485370
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.0048dcd9
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0048dcd9
lea eax, [ebp - 0x61c]
push eax
call fcn.0048f7cc
lea eax, [ebp - 0x414]
push eax
call fcn.0048f7cc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0048efc8
add esp, 0x38
test eax, eax
je 0x4729ec
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4729ec
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor esi, esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00485370
add esp, 0xc
lea eax, [ebp - 0x20c]
test esi, esi
jne 0x472975
push edi
push 0x56d114
push eax
call fcn.00473ed5
add esp, 0xc
jmp 0x472985
push esi
push edi
push str._s.bak_d
push eax
call fcn.00473ed5
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4729a3
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0048f483
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
test eax, eax
lea eax, [ebp - 0x20c]
push 0
push eax
jne 0x4729ea
call ebx
cmp esi, 0xa
jge 0x4729ec
inc esi
jmp 0x472944
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464e95
mov esp, ebp
pop ebp
ret

Function at 0x4729fd
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str..del
push esi
call fcn.00486ed0
pop ecx
pop ecx
test eax, eax
je 0x472a35
push 5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x472ac4
push edi
xor edi, edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00485370
add esp, 0xc
lea eax, [ebp - 0x20c]
test edi, edi
jne 0x472a69
push esi
push str._s.del
push eax
call fcn.00473ed5
add esp, 0xc
jmp 0x472a79
push edi
push esi
push str._s.del_d
push eax
call fcn.00473ed5
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x472aa3
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x472aa3
cmp edi, 0xa
jge 0x472ac3
inc edi
jmp 0x472a38
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0048f483
pop ecx
pop ecx
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00464e95
mov esp, ebp
pop ebp
ret
Function at 0x472bae
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
mov ebx, 0xf013f
push ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x472c86
lea eax, [ebp - 8]
push eax
push ebx
push edi
push str.SoftWare
push dword [ebp - 4]
call esi
test eax, eax
je 0x472c07
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472c86
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0xc]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x472c2b
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472c7c
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x472c49
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472c77
push dword [ebp + 0x18]
call fcn.00488e51
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472c8d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov ebx, 0xf013f
mov dword [ebp - 0xc], edi
push ebx
push edi
push str.SoftWare
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472d4a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x472ceb
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472d49
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x472d11
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x472d47
push dword [ebp + 0x14]
call fcn.00488e51
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472d50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov ebx, 0xf013f
mov dword [ebp - 0xc], edi
push ebx
push edi
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472e0d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x472dae
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472e0c
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x472dd4
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x472e0a
push dword [ebp + 0x14]
call fcn.00488e51
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472f67
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
pop esi
jg 0x472fca
cmp dword [ebp - 0x118], 2
jg 0x472fca
xor eax, eax
inc eax
jmp 0x472fcc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e95
mov esp, ebp
pop ebp
ret
Function at 0x47416c
Capabilities:
Check if file exists
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00464ee0
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x3e8
lea eax, [ebp - 0xc10]
push esi
xor edi, edi
push edi
push eax
call fcn.00485370
push esi
lea eax, [ebp - 0xffc]
push edi
push eax
call fcn.00485370
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xc10]
push 0x1f3
push 0x1f4
push eax
call fcn.004745e4
xor eax, eax
mov word [ebp - 0x82a], ax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0xffc]
push str._zip__s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
add esp, 0x3c
mov word [ebp - 0xc16], ax
lea eax, [ebp - 0xffc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, 0x208
lea eax, [ebp - 0x61c]
push esi
push edi
push eax
call fcn.00485370
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004982eb
push str.FYunZip
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.0046f169
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.00485370
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00485370
add esp, 0x40
lea eax, [ebp - 0x20c]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00486c4a
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x47438d
lea eax, [ebp - 0x20c]
push eax
call fcn.00488e51
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004982eb
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.0046f169
add esp, 0x20
lea eax, [ebp - 0x414]
push eax
call esi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x56d538
push eax
cmovne edi, ebx
call fcn.0048e125
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47438d
test edi, edi
jne 0x474333
push esi
push 2
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1004], 0xfeff
push ebx
push eax
call fcn.0048ee3e
add esp, 0x10
lea eax, [ebp - 0xc10]
push eax
call fcn.00488e51
push esi
add eax, eax
push eax
lea eax, [ebp - 0xc10]
push ebx
push eax
call fcn.0048ee3e
push esi
push 2
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x1000], 0xd
push ebx
push eax
call fcn.0048ee3e
push esi
push 2
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x1000], 0xa
push ebx
push eax
call fcn.0048ee3e
push esi
call fcn.0048decd
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464e95
mov esp, ebp
pop ebp
ret
Function at 0x47439e
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.00464ee0
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.00485370
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004982eb
push 0x800
lea eax, [ebp - 0x1028]
push esi
push eax
call fcn.00485370
push str.FYunZip
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.0046f169
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.00485370
add esp, 0x40
lea eax, [ebp - 0x20c]
push edi
push esi
push eax
call fcn.00485370
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00486c4a
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call edi
test eax, eax
je 0x4745d3
lea eax, [ebp - 0x20c]
push eax
call fcn.00488e51
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004982eb
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.0046f169
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1028]
push 0x3ff
push 0x400
push eax
call fcn.004745e4
push esi
call fcn.0048919c
mov dword [ebp - 0x2038], eax
lea eax, [ebp - 0x2038]
push eax
mov dword [ebp - 0x2034], edx
call fcn.004890f6
add esp, 0x40
lea ecx, [ebp - 0x1028]
push ecx
push dword [eax]
mov ecx, dword [eax + 0x10]
push dword [eax + 4]
inc ecx
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x2028]
push str.__d__d__d__d__d__d_:_s
push eax
call fcn.0047414e
xor eax, eax
add esp, 0x24
mov word [ebp - 0x82a], ax
lea eax, [ebp - 0x414]
push eax
call edi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x56d538
push eax
cmovne esi, ebx
call fcn.0048e125
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4745d3
test esi, esi
jne 0x474579
push edi
push 2
lea eax, [ebp - 0x2030]
mov dword [ebp - 0x2030], 0xfeff
push ebx
push eax
call fcn.0048ee3e
add esp, 0x10
lea eax, [ebp - 0x2028]
push eax
call fcn.00488e51
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2028]
push ebx
push eax
call fcn.0048ee3e
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xd
push ebx
push eax
call fcn.0048ee3e
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xa
push ebx
push eax
call fcn.0048ee3e
push edi
call fcn.0048decd
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464e95
mov esp, ebp
pop ebp
ret
Function at 0x477247
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x64
push esi
mov dword [ebp - 4], esi
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
jne 0x47727e
mov eax, dword [ebp - 4]
push eax
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
movzx ecx, si
shl ecx, 0x10
movzx eax, di
or eax, ecx
jmp 0x4772e1
push 2
push esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4772df
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4772d8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4772d8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4772d7
push 0x56d5f4
lea eax, [ebx + 6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4772d7
cmp word [ebx + 2], si
jbe 0x4772d7
mov esi, dword [ebx + 0x30]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x477401
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x55f750
call fcn.004a98fe
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0047f774
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0047f7c9
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x477441
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4774a1
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x47747c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4774a1
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0047f787
call fcn.004a98c7
ret 0xc
Function at 0x477d8d
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x55f835
call fcn.004a9932
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.00485370
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x477e84
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x477e09
lea eax, [ebp - 0x218]
push eax
call fcn.00488e51
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00419ff0
and dword [ebp - 4], 0
push 0x56ca38
call fcn.00488e51
pop ecx
push eax
push 0x56ca38
lea ecx, [ebp - 0x230]
call fcn.00419e50
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00477a4f
mov edi, eax
lea ecx, [ebp - 0x230]
push 0
push 1
test edi, edi
je 0x477e75
call fcn.00419c20
mov eax, edi
jmp 0x477f36
or dword [ebp - 4], 0xffffffff
call fcn.00419c20
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x477f34
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x477ecb
lea eax, [ebp - 0x218]
push eax
call fcn.00488e51
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00419ff0
mov esi, 0x56ca38
mov dword [ebp - 4], 1
push esi
call fcn.00488e51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00419e50
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00477a4f
push 0
lea ecx, [ebp - 0x248]
mov esi, eax
push 1
call fcn.00419c20
test esi, esi
je 0x477f34
mov eax, esi
jmp 0x477f36
xor eax, eax
call fcn.004a98dc
ret 4
Function at 0x477f3e
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x428], eax
xor edi, edi
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], edi
push eax
push 9
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov esi, edi
mov dword [ebp - 0x41c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x477f91
xor eax, eax
jmp 0x478090
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00485370
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ebx, edi
push 0x104
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47807d
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x478063
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.00485370
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47805b
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.00486ed0
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x477fcd
push dword [ebp - 0x418]
call edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00464e95
mov esp, ebp
pop ebp
ret 4