joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460310
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x671580]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.004cf790
add esp, 0xc
cmp dword [edi + 0x14], 7
jbe 0x46034e
mov edi, dword [edi]
cmp dword [esi + 0x14], 7
jbe 0x460356
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4603b6
xor eax, eax
lea edx, [esp + 0xc]
mov word [esp + 0x216], ax
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x460380
sub edx, esi
lea eax, [esp + 0xc]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.0044def0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004c4309
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c4309
add esp, 0x210
ret

Function at 0x460880
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x671580]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, dword [esp + 0x148]
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.004cf790
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4609c7
cmp dword [esi + 4], 6
push edi
ja 0x4608db
jne 0x460963
cmp dword [esi + 8], 2
jb 0x460963
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x460963
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x460963
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x460963
movups xmm0, xmmword [0x6561f4]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x656204]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x460963
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x460963
cmp word [edi + 2], ax
jbe 0x460963
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4609ae
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004cf790
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x4609ae
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.004c4309
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.004c4309
add esp, 0x140
ret
Function at 0x460b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov edx, esi
mov ecx, esi
shr edx, 4
and ecx, 0xf
movzx eax, byte [esp + edx + 4]
shl al, 4
or al, byte [esp + ecx + 0x14]
mov byte [esi + 0x67c1c0], al
movzx eax, byte [esp + edx + 0x24]
shl al, 4
or al, byte [esp + ecx + 0x34]
mov byte [esi + 0x67bec0], al
movzx eax, byte [esp + edx + 0x44]
shl al, 4
or al, byte [esp + ecx + 0x54]
mov byte [esi + 0x67c0c0], al
movzx eax, byte [esp + edx + 0x64]
shl al, 4
or al, byte [esp + ecx + 0x74]
mov byte [esi + 0x67bfc0], al
inc esi
cmp esi, 0x100
jl 0x460c90
pop esi
add esp, 0x80
ret
Function at 0x472ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc41f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x671580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.00490d37
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x472f51
push eax
push esi
call fcn.004910a7
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.00490cea
int3
Function at 0x477300
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd2b5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x671580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
lea ecx, [ebx + 0x68]
mov dword [ebx], 0x658edc
mov dword [ebx + 0x10], 0x658ec4
call fcn.00478a70
mov dword [ebp - 4], 0
lea edi, [ebx + 0x18]
mov eax, dword [ebx]
push 0
push edi
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.00478d30
mov dword [ebp - 4], 3
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx + 0xc], eax
mov dword [ebp - 4], 5
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + ebx - 4], eax
mov dword [ebp - 4], 6
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], edi
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004c4317
add esp, 4
mov esi, eax
xorps xmm0, xmm0
push 1
movq qword [esi], xmm0
call fcn.00490fa9
add esp, 4
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00478df0
mov byte [ebp - 4], 7
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x477f60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd3cf
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x671580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x477fb6
lea ecx, [ebx + 0x50]
mov dword [ebx], 0x658ed4
call fcn.00478a70
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebx]
lea edi, [ebx + 4]
push 0
push edi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.00478d30
mov dword [ebp - 4], 2
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebp + 8], edi
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004c4317
mov esi, eax
xorps xmm0, xmm0
push 1
movq qword [esi], xmm0
call fcn.00490fa9
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00478df0
mov byte [ebp - 4], 3
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 4
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4785f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
push 0x40
mov dword [esp + 0x18], esi
call fcn.004c4b2b
lea edi, [esi + 0x6c]
mov dword [edi], eax
push 0x40
call fcn.004c4b2b
push 0x40
push 0
push dword [edi]
lea ebx, [esi + 0x70]
mov dword [ebx], eax
call fcn.004cf790
push 0x40
push 0
push dword [ebx]
call fcn.004cf790
mov ebp, dword [esp + 0x40]
add esp, 0x20
cmp ebp, 0x40
jbe 0x478691
mov eax, dword [esi + 4]
add esi, 4
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi]
mov ecx, esi
push ebp
push dword [esp + 0x14]
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [edi]
mov edx, 0x40
mov ebp, dword [ebx]
mov dword [esp + 0x10], eax
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x4786aa
mov eax, edx
dec edx
test eax, eax
jle 0x4786aa
movzx eax, byte [ecx]
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
mov byte [ebp], al
inc ebp
mov eax, dword [esp + 0x10]
cmp ecx, dword [eax + 4]
jne 0x478671
jmp 0x4786aa
mov esi, dword [esp + 0x10]
push ebp
push esi
push dword [edi]
call fcn.004cf210
push ebp
push esi
push dword [ebx]
call fcn.004cf210
add esp, 0x18
mov eax, dword [edi]
xor ecx, ecx
mov edx, dword [ebx]
lea ebp, [eax + 0x3f]
lea esi, [edx + 0x3f]
cmp edx, ebp
ja 0x4786be
cmp esi, eax
jae 0x4786e0
cmp edx, edi
ja 0x4786c6
cmp esi, edi
jae 0x4786e0
cmp edx, ebx
ja 0x4786ce
cmp esi, ebx
jae 0x4786e0
cmp eax, edi
ja 0x4786d6
cmp ebp, edi
jae 0x4786e0
cmp eax, ebx
ja 0x478705
cmp ebp, ebx
jb 0x478705
nop
mov eax, dword [edi]
xor byte [eax + ecx], 0x36
mov eax, dword [ebx]
xor byte [eax + ecx], 0x5c
inc ecx
cmp ecx, 0x40
jl 0x4786e0
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
movups xmm0, xmmword [eax]
mov ecx, dword [esp + 0x14]
movaps xmm2, xmmword [0x659710]
movaps xmm3, xmmword [0x659720]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax], xmm1
movups xmm0, xmmword [edx]
movaps xmm1, xmm2
xorps xmm0, xmm3
movups xmmword [edx], xmm0
movups xmm0, xmmword [eax + 0x10]
xorps xmm1, xmm0
movups xmmword [eax + 0x10], xmm1
movups xmm0, xmmword [edx + 0x10]
movaps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
movups xmm0, xmmword [eax + 0x20]
xorps xmm0, xmm2
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [edx + 0x20]
xorps xmm0, xmm3
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
xorps xmm2, xmm0
movups xmmword [eax + 0x30], xmm2
movups xmm0, xmmword [edx + 0x30]
xorps xmm3, xmm0
movups xmmword [edx + 0x30], xmm3
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x478880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd4cd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x671580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004c4317
mov esi, eax
xorps xmm0, xmm0
push 1
movq qword [esi], xmm0
call fcn.00490fa9
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00478df0
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
not ecx
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [edi + 0x38], 0
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
test bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47a9d0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x665740
push 0x4cece0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x671580]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00450800
mov edx, esi
call fcn.0047a7a0
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x47a704
test bl, bl
jne 0x47a77a
mov eax, esi
cmp dword [esi + 0x14], 7
jbe 0x47a712
mov eax, dword [esi]
mov dword [esi + 0x10], 0
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp]
push eax
call fcn.004cf790
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47a750
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0044def0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004c4309
lea esp, [ebp + 0x414]
pop ebp
ret
mov edx, dword [esp + 4]
jmp 0x47a680
Function at 0x47be60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cdbfd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x671580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x67beb8], 0
jne 0x47c031
call fcn.00459e00
push str.Advapi32.dll
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.0044ddd0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00459ec0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0044dd70
test edi, edi
je 0x47c0e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x658f7c
push edi
call esi
push 0x658fa8
push edi
mov dword [0x67c2c4], eax
call esi
push 0x658f8c
push edi
mov dword [0x67c2cc], eax
call esi
push str.GetSecurityInfo
push edi
mov dword [0x67c2c0], eax
call esi
push str.InitializeAcl
push edi
mov dword [0x67c2ec], eax
call esi
push str.GetAclInformation
push edi
mov dword [0x67c2dc], eax
call esi
push str.GetAce
push edi
mov dword [0x67c2d4], eax
call esi
push str.AddAce
push edi
mov dword [0x67c2f8], eax
call esi
push str.DeleteAce
push edi
mov dword [0x67c2e8], eax
call esi
push str.SetSecurityInfo
push edi
mov dword [0x67c2d0], eax
call esi
push str.OpenProcessToken
push edi
mov dword [0x67c2d8], eax
call esi
push str.GetTokenInformation
push edi
mov dword [0x67c2f0], eax
call esi
push str.CopySid
push edi
mov dword [0x67c2e4], eax
call esi
push str.GetLengthSid
push edi
mov dword [0x67c2f4], eax
call esi
push str.EqualSid
push edi
mov dword [0x67c2e0], eax
call esi
cmp dword [0x67c2c4], 0
mov dword [0x67c2c8], eax
je 0x47c044
cmp dword [0x67c2cc], 0
je 0x47c044
cmp dword [0x67c2c0], 0
je 0x47c044
cmp dword [0x67c2ec], 0
je 0x47c044
cmp dword [0x67c2dc], 0
je 0x47c044
cmp dword [0x67c2d4], 0
je 0x47c044
cmp dword [0x67c2f8], 0
je 0x47c044
cmp dword [0x67c2e8], 0
je 0x47c044
cmp dword [0x67c2d0], 0
je 0x47c044
cmp dword [0x67c2d8], 0
je 0x47c044
cmp dword [0x67c2f0], 0
je 0x47c044
cmp dword [0x67c2e4], 0
je 0x47c044
cmp dword [0x67c2f4], 0
je 0x47c044
cmp dword [0x67c2e0], 0
je 0x47c044
test eax, eax
je 0x47c044
mov byte [0x67beb8], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x67beb8], 0
mov dword [0x67c2c4], 0
mov dword [0x67c2cc], 0
mov dword [0x67c2c0], 0
mov dword [0x67c2ec], 0
mov dword [0x67c2dc], 0
mov dword [0x67c2d4], 0
mov dword [0x67c2f8], 0
mov dword [0x67c2e8], 0
mov dword [0x67c2d0], 0
mov dword [0x67c2d8], 0
mov dword [0x67c2f0], 0
mov dword [0x67c2e4], 0
mov dword [0x67c2f4], 0
mov dword [0x67c2e0], 0
mov dword [0x67c2c8], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47ec90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cdf6d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x671580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], esi
test esi, esi
je 0x47ecd8
mov eax, dword [esi]
test eax, eax
je 0x47ecd8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x1c]
cmp eax, 0x7530
jb 0x47ed74
mov eax, dword [esi + 4]
lea ebx, [esi + 4]
mov ecx, dword [ebx + 4]
cmp eax, ecx
je 0x47ed10
push ebx
push ecx
push eax
call fcn.0044e400
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x10]
mov ecx, dword [edi + 4]
cmp eax, ecx
je 0x47ed2d
push edi
push ecx
push eax
call fcn.0044e400
mov eax, dword [edi]
add esp, 0xc
mov dword [edi + 4], eax
push ebx
mov ecx, esi
call fcn.0047edb0
push edi
push 0
push 0
mov ecx, esi
call fcn.0047efc0
push edi
push 1
push 0
mov ecx, esi
call fcn.0047efc0
push edi
push 0
push 1
mov ecx, esi
call fcn.0047efc0
push edi
push 1
push 1
mov ecx, esi
call fcn.0047efc0
push edi
call fcn.0047fc80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x47ed88
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c4309
mov esp, ebp
pop ebp
ret
Function at 0x483f40
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.0044dcc0
movzx eax, al
test eax, eax
jne 0x483fa2
mov ecx, dword [ebp + 8]
push ecx
call fcn.004522c0
add esp, 4
movzx edx, al
test edx, edx
je 0x483fa2
mov eax, dword [ebp + 8]
push eax
call fcn.0045b060
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.004522c0
add esp, 4
movzx edx, al
test edx, edx
je 0x483fa2
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
call fcn.0044dcd0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret 4
Function at 0x4868d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x671580]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004cf790
add esp, 0xc
mov dword [ebp - 0x418], 0
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
je 0x48691d
xor al, al
jmp 0x486976
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x48694f
cmp dword [ebp - 0x418], 0
je 0x48694b
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
jmp 0x486976
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0044dd10
cmp dword [ebp - 0x418], 0
je 0x486974
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c4309
mov esp, ebp
pop ebp
ret
Function at 0x487980
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push 0x3c
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.004cf790
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x40], ecx
cmp dword [ebp + 0x20], 0
je 0x4879b1
mov edx, dword [ebp + 0x20]
mov dword [ebp - 4], edx
jmp 0x4879ba
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x487a10
cmp dword [ebp - 0x24], 0x20
jbe 0x487a02
mov dword [ebp - 8], 1
jmp 0x487a09
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
jmp 0x487a23
cmp dword [ebp + 0x18], 0
je 0x487a21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor al, al
mov esp, ebp
pop ebp
ret