joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472a90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push esi
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x28], esi
je 0x472c4f
cmp dword [esp + 0x2c], esi
je 0x472c4f
push edi
push 0x200
call fcn.0048d9cf
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x472adb
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x10]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472c3b
mov edx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x472bd1
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x472b34
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x472baa
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x472b9f
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.00472a00
cmp edx, ebx
jb 0x472b9f
ja 0x472b99
cmp eax, dword [esp + 0x24]
jbe 0x472b9f
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x472b27
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
test ebx, ebx
ja 0x472be8
cmp dword [esp + 0x20], 0
jbe 0x472c3b
mov ecx, dword [esp + 0x20]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.0046fb20
add esp, 0x10
test eax, eax
jne 0x472c20
push edi
mov dword [esp + 0x18], 0xffffffff
call fcn.0048de66
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push edi
push edx
push str.MAC:
call fcn.00472650
add esp, 0xc
mov dword [esp + 0x14], eax
push edi
call fcn.0048de66
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret
Function at 0x477dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0770
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4f51d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x515378]
xor edi, edi
cmp ecx, edi
jne 0x477e1b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x477e28
mov dword [ebp - 0x14], edi
jmp 0x477e40
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x477ed6
mov ecx, dword [0x515378]
mov eax, dword [ecx]
cmp eax, edi
je 0x477e07
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x477e07
mov ebx, 0x515378
mov dword [ebp - 4], edi
call fcn.00477ef0
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x477e7e
push 0x4e7958
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.00493a94
mov ecx, dword [0x515378]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x477e98
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x477ec2
push 0x4e7958
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.00493a94
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x477eb9
call fcn.00478330
mov eax, 0x477ebf
ret
mov eax, dword [0x515378]
mov eax, dword [eax]
test eax, eax
je 0x477ed4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477ef0
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x477f1d
xor ecx, ecx
jmp 0x477f29
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x477fdd
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x477f50
mov dword [esp + 0xc], esi
jmp 0x477fb0
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x477fa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x477f9c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x477fb0
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x477fb0
push 0x4e1ea0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x477fb0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x477fd3
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x477f42
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x477ff1
mov ecx, dword [ebx]
add ecx, 8
call fcn.00478260
test eax, eax
je 0x477ff1
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x478000
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x4c0abb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4f51d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.00492200
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x478098
push 0x4e7958
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.00493a94
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x4792b2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x50f3c8], 0
push esi
jne 0x479220
call fcn.00479134
test eax, eax
je 0x479263
mov eax, dword [0x50f3c8]
cmp eax, 1
jne 0x479241
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x479263
pop esi
ret
push eax
call dword [0x50f3d0]
test eax, eax
jne 0x4792ab
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x479267
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x50f3c8]
call dword [0x50f3d0]
mov edi, eax
test edi, edi
je 0x47928c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4792a8
mov edi, esi
add esi, 0xff0
push edi
push dword [0x50f3c8]
call dword [0x50f3cc]
add edi, 0x10
cmp edi, esi
jb 0x479294
mov eax, edi
pop edi
pop esi
ret
jmp 0x47920d

Function at 0x479c15
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x479c2c
xor al, al
leave
ret
push ebx
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x479cab
push esi
push edi
mov byte [ebp - 1], bl
call fcn.0048d9cf
mov esi, eax
pop ecx
cmp esi, ebx
je 0x479c9e
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x479c9e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4d8dcc
push esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x479c9e
push 0x34
push dword [ebp - 8]
lea eax, [ebp - 0x44]
push eax
call fcn.00492530
add esp, 0xc
cmp dword [ebp - 0x44], 0xfeef04bd
sete byte [ebp - 1]
push esi
call fcn.0048de66
pop ecx
pop esi
cmp byte [ebp - 1], bl
jne 0x479caf
xor al, al
jmp 0x479cd9
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
shr eax, 0x10
mov dword [ecx], eax
movzx eax, word [ebp - 0x3c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + 0x14]
shr eax, 0x10
mov dword [ecx], eax
movzx eax, word [ebp - 0x38]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov al, 1
pop edi
pop ebx
leave
ret
Function at 0x479d8b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
call edi
test eax, eax
je 0x479db5
xor eax, eax
inc eax
jmp 0x479e14
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00492200
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004928c3
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x479e14
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x479e0b
lea eax, [ebp - 0x20c]
push eax
call fcn.00479d8b
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048c64c
leave
ret

Function at 0x479e22
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x479e48
xor al, al
jmp 0x479ec1
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00492200
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push edi
push str._s_d.tmp
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0048e74d
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x479e44
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0048c64c
leave
ret
Function at 0x479ece
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x5ec]
sub esp, 0x66c
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x5e8], eax
push ebx
push esi
mov esi, dword [ebp + 0x5f4]
push edi
xor edi, edi
push 0x24c
lea eax, [ebp - 0x74]
push edi
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], edi
call fcn.00492200
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp + 0x1d8], ax
lea eax, [ebp + 0x1da]
push edi
push eax
call fcn.00492200
push 0x4db344
push esi
mov edi, 0x4d8598
push edi
mov esi, 0x103
lea eax, [ebp + 0x1d8]
push esi
push eax
call fcn.0048e74d
add esp, 0x2c
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
jne 0x479f66
xor eax, eax
jmp 0x47a02a
lea eax, [ebp - 0x4c]
push 0x4daccc
push eax
call fcn.004928e2
pop ecx
pop ecx
test eax, eax
je 0x479ff8
lea eax, [ebp - 0x4c]
push 0x4d8df0
push eax
call fcn.004928e2
pop ecx
pop ecx
test eax, eax
je 0x479ff8
xor eax, eax
push ebx
push eax
mov word [ebp + 0x3e0], ax
lea eax, [ebp + 0x3e2]
push eax
call fcn.00492200
test byte [ebp - 0x78], 0x10
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x7c]
lea eax, [ebp + 0x3e0]
push edi
push esi
push eax
je 0x479fd1
call fcn.0048e74d
lea eax, [ebp + 0x3e0]
push eax
call fcn.00479ece
add esp, 0x24
jmp 0x479ff8
call fcn.0048e74d
add esp, 0x20
push 0xa0
lea eax, [ebp + 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x479f66
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp + 0x5e8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c64c
add ebp, 0x5ec
leave
ret

Function at 0x47a042
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a09a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
xor eax, eax
push 0x50
mov dword [ebp - 0x14], eax
pop ecx
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], esi
mov word [ebp - 0x10], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x47a098
push dword [ebp - 0xa]
call dword [sym.imp.SHELL32.dll_SHFreeNameMappings]
mov eax, esi
pop esi
leave
ret
Function at 0x47a21d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x5f8]
sub esp, 0x678
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x5f4], eax
mov eax, dword [ebp + 0x604]
push ebx
push esi
mov esi, dword [ebp + 0x600]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x608]
push edi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x60c]
xor edi, edi
push 0x24c
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x68]
push edi
push eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
call fcn.00492200
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp + 0x1e4], ax
lea eax, [ebp + 0x1e6]
push edi
push eax
call fcn.00492200
push 0x4db344
push esi
mov edi, 0x4d8598
push edi
mov esi, 0x103
lea eax, [ebp + 0x1e4]
push esi
push eax
call fcn.0048e74d
add esp, 0x2c
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1e4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x80], eax
test eax, eax
je 0x47a3ea
cmp eax, 0xffffffff
je 0x47a3ea
lea eax, [ebp - 0x40]
push 0x4daccc
push eax
call fcn.004928e2
pop ecx
pop ecx
test eax, eax
je 0x47a3b6
lea eax, [ebp - 0x40]
push 0x4d8df0
push eax
call fcn.004928e2
pop ecx
pop ecx
test eax, eax
je 0x47a3b6
xor eax, eax
push ebx
push eax
mov word [ebp + 0x3ec], ax
lea eax, [ebp + 0x3ee]
push eax
call fcn.00492200
test byte [ebp - 0x6c], 0x10
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x70]
lea eax, [ebp + 0x3ec]
push edi
push esi
push eax
je 0x47a367
call fcn.0048e74d
push dword [ebp - 0x78]
lea eax, [ebp + 0x3ec]
push eax
call fcn.0048c804
add esp, 0x28
test eax, eax
je 0x47a3b6
push dword [ebp - 0x78]
lea eax, [ebp + 0x3ec]
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
push eax
call fcn.0047a21d
add esp, 0x10
jmp 0x47a3b6
call fcn.0048e74d
push dword [ebp - 0x7c]
lea eax, [ebp + 0x3ec]
push eax
call fcn.0048c804
add esp, 0x28
test eax, eax
je 0x47a3b6
push dword [ebp - 0x74]
lea eax, [ebp + 0x3ec]
push eax
call fcn.0048c804
pop ecx
pop ecx
test eax, eax
je 0x47a3b6
push 0xa0
lea eax, [ebp + 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x47a2d5
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x47a3ec
xor eax, eax
mov ecx, dword [ebp + 0x5f4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c64c
add ebp, 0x5f8
leave
ret
Function at 0x47b340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x207
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x47b3bf
cmp eax, esi
ja 0x47b3bf
lea eax, [ebp - 0x20c]
push eax
call fcn.00492919
cmp word [ebp + eax*2 - 0x20e], 0x5c
pop ecx
je 0x47b39a
lea eax, [ebp - 0x20c]
push 0x4d8dcc
push eax
call fcn.00492895
pop ecx
pop ecx
push str.wininit.ini
lea eax, [ebp - 0x20c]
push eax
push 0x4d8de4
push ebx
push edi
call fcn.0048e74d
xor eax, eax
add esp, 0x14
mov word [edi + ebx*2 - 2], ax
inc eax
jmp 0x47b3c1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048c64c
leave
ret

Function at 0x47b5cb
Capabilities:
Delete file
Move file

Disassembly:
cmp dword [esp + 8], 0
jne 0x47b5ec
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x47b5e4
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47b5ef
push 5
pop eax
cmp eax, 5
je 0x47b5fd
cmp eax, 0x20
je 0x47b5fd
xor eax, eax
inc eax
ret
cmp dword [0x50f610], 0
je 0x47b61e
push 0
push dword [esp + 8]
call fcn.0047b3ce
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov eax, ecx
ret
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 2
pop eax
ret

Function at 0x47b630
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1604]
mov eax, 0x1684
call fcn.004933d0
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x1600], eax
mov eax, dword [ebp + 0x160c]
push ebx
push esi
mov esi, dword [ebp + 0x1610]
mov dword [ebp - 0x60], eax
xor ebx, ebx
xor eax, eax
cmp esi, ebx
je 0x47b73c
push edi
push 0x144e
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x56]
push ebx
push eax
call fcn.00492200
lea eax, [ebp - 0x5c]
push eax
push esi
mov dword [ebp - 0x5c], 0x7c
call fcn.0048e83f
add esp, 0x14
xor esi, esi
jmp 0x47b6fd
xor eax, eax
push 0x206
mov word [ebp + 0x13f8], ax
lea eax, [ebp + 0x13fa]
push ebx
push eax
call fcn.00492200
push edi
push dword [ebp - 0x60]
lea eax, [ebp + 0x13f8]
push 0x4cd188
push 0x103
push eax
call fcn.0048e74d
lea eax, [ebp + 0x13f8]
push eax
call fcn.00492919
mov edi, eax
lea eax, [ebp + 0x13f8]
push eax
lea eax, [ebp + esi*2 - 0x58]
push eax
call fcn.00492895
lea eax, [ebp - 0x5c]
push eax
push ebx
lea esi, [esi + edi + 1]
call fcn.0048e83f
add esp, 0x34
mov edi, eax
cmp edi, ebx
jne 0x47b698
push 0x1e
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00492200
lea eax, [ebp - 0x58]
mov dword [ebp - 0x78], eax
mov eax, 0x454
mov word [ebp - 0x70], ax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x6a], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x66], ebx
mov dword [ebp - 0x7c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
mov ecx, dword [ebp + 0x1600]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c64c
add ebp, 0x1604
leave
ret
Function at 0x47bb0a
Capabilities:
Get common file path
Get program files directory

Disassembly:
xor eax, eax
push esi
mov esi, 0x50f640
cmp ax, word [0x50f640]
jne 0x47bb33
push eax
push 0x26
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4cd1a0
push esi
call fcn.00492895
pop ecx
pop ecx
mov eax, esi
pop esi
ret

Function at 0x47bb57
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push esi
call fcn.0047bb0a
push eax
call fcn.0047eb72
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x47bba7
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x47bba7
cmp ax, word [esi]
je 0x47bba7
inc edi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x47c047
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
je 0x47c147
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0x40000
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x47c138
push dword [ebp + 0x10]
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x47c138
cmp dword [ebp + 0x14], edi
je 0x47c135
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x47c138
push edi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x47c138
push 0x20a
call fcn.0048bc2e
pop ecx
mov esi, eax
cmp dword [ebp - 8], edi
jbe 0x47c12e
push 0x105
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, edi
jne 0x47c121
push 1
push dword [ebp + 0x10]
push esi
push dword [ebp - 4]
call fcn.0047c047
add esp, 0x10
jmp 0x47c128
cmp eax, 0x103
je 0x47c12e
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x47c0fa
push esi
call fcn.0048cd90
pop ecx
xor ebx, ebx
inc ebx
pop esi
cmp dword [ebp - 4], edi
je 0x47c147
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x47c9cc
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x2a0]
sub esp, 0x320
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x29c], eax
push esi
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
xor esi, esi
inc esi
cmp dword [ebp - 0x70], 2
mov dword [0x50f610], eax
mov dword [0x50f61c], eax
mov dword [0x50f614], eax
mov dword [0x50f618], eax
jne 0x47ca61
cmp dword [ebp - 0x7c], 5
jne 0x47ca38
cmp dword [ebp - 0x78], eax
jne 0x47ca2b
mov dword [0x50f61c], esi
jmp 0x47ca6c
cmp dword [ebp - 0x78], esi
jne 0x47ca6c
mov dword [0x50f614], esi
jmp 0x47ca6c
cmp dword [ebp - 0x7c], 6
jne 0x47ca6c
cmp dword [ebp - 0x78], eax
je 0x47ca48
cmp dword [ebp - 0x78], esi
jne 0x47ca6c
mov dword [0x50f614], esi
mov dword [0x50f618], esi
cmp dword [ebp - 0x78], esi
jne 0x47ca6c
mov dword [0x50f620], esi
jmp 0x47ca6c
cmp dword [ebp - 0x70], esi
jne 0x47ca6c
mov dword [0x50f610], esi
push 0x206
push eax
lea eax, [ebp + 0x96]
xor ecx, ecx
push eax
mov word [ebp + 0x94], cx
call fcn.00492200
lea eax, [ebp + 0x94]
push 0x103
push eax
call fcn.0047bb57
add esp, 0x14
push 0x37
pop eax
cmp ax, word [ebp + 0x94]
jne 0x47caaf
mov dword [0x50f624], esi
jmp 0x47cad5
push 0x36
pop eax
cmp ax, word [ebp + 0x94]
jne 0x47cac3
mov dword [0x50f628], esi
jmp 0x47cad5
push 0x38
pop eax
cmp ax, word [ebp + 0x94]
jne 0x47cad5
mov dword [0x50f62c], esi
mov ecx, dword [ebp + 0x29c]
xor ecx, ebp
pop esi
call fcn.0048c64c
add ebp, 0x2a0
leave
ret