joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ce70
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x503750
push 0x4a8cf0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x50b0c0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x46d037
cmp dword [ebx + 8], 0
je 0x46d037
test edi, edi
je 0x46d037
xor esi, esi
xorps xmm0, xmm0
movups xmmword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 4], esi
push ecx
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.0046ce00
add esp, 8
test eax, eax
je 0x46d01a
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
mov edx, edi
mov ecx, dword [ebp - 0x2c]
call fcn.0046cd70
add esp, 8
test eax, eax
je 0x46d01a
xor eax, eax
mov dword [ebp - 0x28], eax
xor edi, edi
mov dword [ebp - 0x30], edi
mov esi, dword [ebx + 8]
nop dword [eax]
mov dl, byte [ebp + eax - 0x3c]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 8
jb 0x46cf43
mov byte [ebp - 0x21], 0
jmp 0x46cf4e
mov cl, byte [ebp + eax - 0x3c]
mov byte [ebp - 0x21], cl
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 8
jb 0x46cf59
mov byte [ebp - 0x22], 0
jmp 0x46cf64
mov cl, byte [ebp + eax - 0x3c]
mov byte [ebp - 0x22], cl
inc eax
mov dword [ebp - 0x28], eax
movzx edx, dl
mov ecx, edx
shr ecx, 2
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + edi*2], cx
movzx esi, byte [ebp - 0x21]
mov ecx, esi
shr ecx, 4
and edx, 3
shl edx, 4
or ecx, edx
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebx + 8]
mov word [edx + edi*2 + 2], cx
movzx edx, byte [ebp - 0x22]
mov ecx, edx
shr ecx, 6
and esi, 0xf
shl esi, 2
or ecx, esi
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, dword [ebx + 8]
mov word [esi + edi*2 + 4], cx
and edx, 0x3f
movzx ecx, word [edx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + edi*2 + 6], cx
add edi, 4
mov dword [ebp - 0x30], edi
cmp eax, 8
jb 0x46cf30
mov dword [esi + edi*2 - 2], 0x3d
mov esi, 1
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x46ef90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd1a0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x50b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5201a0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esi + 0x34], 0x5201a0
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x34]
cmp dword [eax + 4], 0x18
ja 0x46f04a
mov dword [eax], 0
mov eax, dword [esi + 0x34]
mov byte [eax + 8], 0
jmp 0x46f061
mov dword [esi + 0x34], 0x5201a0
cmp eax, 0x5201a0
je 0x46f061
push eax
call fcn.004a6aa8
add esp, 4
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46f090
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x46f0cc
cmp byte [esi + 0x2c], bl
jne 0x46f1b2
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46f0c0
jmp 0x46f198
mov edi, dword [esi + 0x18]
test edi, edi
je 0x46f0e2
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x46f0d3
push 2
push 0
push ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.004bc176
push ebx
call fcn.004bc89a
push 0
push 0
push ebx
mov edi, eax
call fcn.004bc176
add esp, 0x1c
test edi, edi
jg 0x46f14a
cmp byte [esi + 0x2c], 0
jne 0x46f1b2
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46f141
jmp 0x46f198
lea eax, [edi + 1]
push eax
call fcn.004a6f26
push dword [ebp + 8]
mov ebx, eax
push 1
push edi
push ebx
mov byte [ebx], 0
call fcn.004bcaa3
add esp, 0x14
cmp eax, 1
je 0x46f1bb
push ebx
call fcn.004a6aa8
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x46f1b2
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46f191
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.0046e110
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [ebx + edi], 0
mov eax, ebx
mov dl, byte [ebx]
mov ecx, ebx
test dl, dl
je 0x46f1fc
nop dword [eax]
lea edi, [ecx + 1]
mov dword [ebp + 8], edi
lea edi, [eax + 1]
cmp dl, 0xd
jne 0x46f1eb
mov eax, edi
mov byte [ecx], 0xa
cmp byte [eax], 0xa
jne 0x46f1f1
inc eax
jmp 0x46f1f1
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
mov dl, byte [eax]
mov edi, dword [ebp + 8]
mov ecx, edi
test dl, dl
jne 0x46f1d0
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push 0
push ebx
call dword [eax + 8]
push ebx
call fcn.004a6aa8
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4759e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x475a3f
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x475a48
test ecx, ecx
je 0x475a3f
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x475a00
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x478990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4789b0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 4], edx
nop dword [eax]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4789d9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4789d6
inc esi
cmp esi, edx
jb 0x4789c7
mov ecx, dword [ebp - 8]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x478aef
cmp ecx, 3
jbe 0x478a18
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x478a56
cmp cl, 0xff
je 0x478a56
mov edx, dword [ebp - 4]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x4789c0
dec ecx
shl eax, cl
and eax, 7
je 0x4789f0
cmp byte [eax + 0x4ed478], 0
je 0x478a43
movzx ecx, byte [eax + 0x4ed480]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x478a40
cmp cl, 0xff
jne 0x4789f0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4789c0
movzx ebx, cl
movzx ecx, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
sub ebx, edi
sub ebx, 5
test eax, eax
je 0x478aba
nop dword [eax]
movzx edx, byte [eax + 0x4ed480]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x478aa1
cmp dl, 0xff
jne 0x478aba
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor ebx, edx
sub ebx, edi
sub ebx, 5
jmp 0x478a80
mov edx, dword [ebp - 4]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
neg cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x4789c0
pop esi
pop ebx
cmp ecx, 3
jbe 0x478b04
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x479a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd61b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x228], ebx
mov eax, dword [0x520db0]
test al, 1
jne 0x479ad6
or eax, 1
mov dword [0x520db0], eax
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x479c6b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x4e1d10
mov dword [0x520db4], eax
call fcn.004a68ab
add esp, 4
mov eax, dword [0x520db4]
cmp dword [eax - 0xc], 0
jne 0x479c36
mov esi, dword [0x5208b8]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
test esi, esi
je 0x479b0d
lock inc dword [esi + 4]
mov esi, dword [0x5208b8]
mov ecx, dword [0x5208b4]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], esi
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
mov eax, dword [ecx]
push edx
call dword [eax + 0x34]
or edi, 0xffffffff
mov byte [ebp - 4], 2
test esi, esi
je 0x479b5c
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x479b5c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x479b5c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
push 0x201
push 0
push dword [ebp - 0x224]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x479c14
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004a8730
add esp, 0xc
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x479bf3
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, 0x520db4
call fcn.00409c60
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x479c36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x520db4]
add ecx, 0xfffffff0
push ecx
call fcn.00409760
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409e30
int3
Function at 0x47b1f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004a8730
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x47b25c
mov eax, dword [ebp - 0x118]
cmp eax, 2
je 0x47b249
cmp eax, 3
jne 0x47b25c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret

Function at 0x47b550
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd95b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, dword [0x5208b8]
test esi, esi
je 0x47b59b
lock inc dword [esi + 4]
mov esi, dword [0x5208b8]
mov ecx, dword [0x5208b4]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x21c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xf0]
or edi, 0xffffffff
mov byte [ebp - 4], 4
test esi, esi
je 0x47b5ea
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x47b5ea
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x47b5ea
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a8730
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push 0x104
push eax
push 0x4f2db4
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x47b665
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x47b640
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00409c60
mov esi, 1
jmp 0x47b667
xor esi, esi
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47b688
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47b6a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x47b6c5
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret
Function at 0x47d4e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
cmp dword [eax - 0xc], 0
jne 0x47d4f1
xor ebx, ebx
jmp 0x47d50d
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
mov eax, dword [ebp + 8]
setg bl
add eax, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47d525
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x47d730
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x47d7a0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x47d794
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret
Function at 0x47e3c0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dddbd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x50b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 1
push dword [ebp + 8]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x47e515
cmp dword [ebp - 0x10], 0
je 0x47e515
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x47e552
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
test edx, edx
js 0x47e548
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x47e463
push edx
lea ecx, [ebp - 0x14]
call fcn.00409bc0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push esi
push 1
push dword [ebp + 8]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
push dword [esi - 8]
push esi
test eax, eax
jne 0x47e4ea
call fcn.004b30c6
add esp, 8
test eax, eax
js 0x47e548
cmp eax, dword [esi - 8]
jg 0x47e548
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x47e53e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47e52a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004b30c6
add esp, 8
test eax, eax
js 0x47e548
cmp eax, dword [esi - 8]
jg 0x47e548
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
add esi, 0xfffffff0
push esi
call fcn.00409760
add esp, 4
add eax, 0x10
jmp 0x47e4b8
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x47e552
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409e30
push 0x80070057
call fcn.00409e30
push 0x80004005
call fcn.00409e30
int3
Function at 0x47e560
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dde06
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x50b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0
push 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 8]
push ecx
push 0
push edx
mov dword [ebp - 0x10], 0
push dword [eax - 0xc]
mov dword [ebp - 0x14], 1
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x47e64b
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x47e64b
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
cmp edi, ecx
jae 0x47e5f9
lea eax, [edx + edi]
jmp 0x47e620
jbe 0x47e623
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x47e60f
push ecx
push edi
mov ecx, esi
call fcn.0047eb30
jmp 0x47e623
sub edi, ecx
push edi
push 0
push ebx
call fcn.004a8730
add esp, 0xc
lea eax, [ebx + edi]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push 0
push 0
push ecx
push dword [esi]
push dword [ebp - 0x18]
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x47e64b
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x47e64b
mov dword [esi + 4], eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e66d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ed90
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ddefd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x50b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x20], ecx
mov esi, dword [0x5208b8]
test esi, esi
je 0x47edd1
lock inc dword [esi + 4]
mov esi, dword [0x5208b8]
mov ecx, dword [0x5208b4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x20]
or edi, 0xffffffff
mov byte [ebp - 4], 2
test esi, esi
je 0x47ee17
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x47ee17
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x47ee17
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
call fcn.004864c0
mov byte [ebp - 4], 3
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x47ee49
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test ebx, ebx
je 0x47eed2
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x47ef3a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004099b0
test al, al
jne 0x47ee9a
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47ee81
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x14]
call fcn.00409c60
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 5
mov ecx, esi
call fcn.00485a30
mov byte [ebp - 4], 3
add esp, 4
mov edx, dword [ebp - 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47eee9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x47eee9
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00409760
mov esi, dword [ebp - 0x20]
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
mov eax, edi
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47ef07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x47ef26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409e30
int3