joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e148
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
push ebx
push esi
push edi
xor esi, esi
push 0x40
lea eax, [ebp - 0x64]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x68], 0x44
call fcn.004954a0
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
mov dword [ebp - 0xc], esi
call fcn.0047ee75
add esp, 0x10
test eax, eax
je 0x47e232
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0047ef23
push 0x7fe
lea eax, [ebp - 0x866]
push esi
push eax
mov word [ebp - 0x868], si
call fcn.004954a0
push dword [ebp + 0xc]
lea eax, [ebp - 0x868]
push dword [ebp + 8]
push str.__s___s
push 0x400
push eax
call fcn.004953bf
add esp, 0x28
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x47e213
push str.CreateProcessWithTokenW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x47e213
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x868]
push ecx
push esi
push esi
push dword [ebp - 4]
call eax
jmp 0x47e22f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x868]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x47e245
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], esi
je 0x47e252
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], esi
je 0x47e25f
push dword [ebp - 0x18]
call edi
mov dword [ebp - 0x18], esi
cmp ebx, esi
je 0x47e26a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47e272
Capabilities:
Check os version
Create process on windows

Disassembly:
mov eax, 0x4ce301
call fcn.004cc790
sub esp, 0x178
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x47e291
xor eax, eax
jmp 0x47e448
mov eax, dword [0x50ec24]
push esi
mov ecx, 0x50ec24
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push str.__s___s
call fcn.00432808
push 0x110
lea eax, [ebp - 0x180]
push ebx
push eax
call fcn.004954a0
add esp, 0x18
lea eax, [ebp - 0x184]
push eax
mov dword [ebp - 0x184], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47e2f7
cmp dword [ebp - 0x180], 6
jne 0x47e2f7
inc esi
cmp esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x10]
jne 0x47e30b
call fcn.0044e601
jmp 0x47e310
call fcn.0044e5b1
cmp eax, ebx
jne 0x47e42b
push edi
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], 0x44
call fcn.004954a0
push dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 5
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], ax
call fcn.0044e66c
add esp, 0x10
test al, al
jne 0x47e376
cmp dword [ebp - 0x10], ebx
je 0x47e36c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0044e7e6
pop ecx
push str.userenv.dll
mov dword [ebp - 0x68], str.Winsta0Default
mov dword [ebp - 0x14], 0x30
mov dword [ebp + 8], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x47e3d5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov esi, eax
call edi
cmp esi, ebx
mov edi, eax
je 0x47e3d5
push ebx
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x47e3d2
mov dword [ebp - 0x14], 0x430
jmp 0x47e3d5
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
je 0x47e405
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x47e413
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x47e41c
push dword [ebp + 8]
call edi
cmp dword [ebp - 0x1c], ebx
pop edi
je 0x47e42b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x10], ebx
pop esi
je 0x47e43a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47e455
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cf922
call fcn.004cc790
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub esp, 0xc
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x47e64b
mov eax, dword [0x50ec24]
push ebx
push esi
mov esi, 0x50ec24
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
mov eax, dword [0x50ec24]
mov ecx, esi
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
cmp dword [ebx - 0xc], edi
jne 0x47e611
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x14]
call fcn.004013c9
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47e4cd
mov esi, edi
call fcn.00401477
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
jne 0x47e611
lea esi, [ebp - 0x10]
call fcn.00401477
lea edi, [ebp - 0x18]
call fcn.0047e909
mov edi, esi
mov byte [ebp - 4], 5
call fcn.004013c9
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x47e56f
push eax
lea esi, [ebp - 0x18]
call fcn.0047e65a
pop ecx
mov byte [ebp - 4], 6
call fcn.004013c9
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00415236
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.004013c9
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47e56f
mov esi, edi
call fcn.00401477
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
jne 0x47e611
lea esi, [ebp - 0x10]
call fcn.00401477
lea edi, [ebp - 0x18]
call fcn.0047e9b9
mov edi, esi
mov byte [ebp - 4], 8
call fcn.004013c9
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x47e60d
push eax
lea esi, [ebp - 0x18]
call fcn.0047e65a
pop ecx
mov byte [ebp - 4], 9
call fcn.004013c9
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00415236
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.004013c9
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47e60d
mov esi, edi
call fcn.00401477
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
je 0x47e62d
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47e62d
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x47e636
mov eax, dword [ebp + 8]
push dword [eax]
call esi
mov edi, eax
lea eax, [ebx - 0x10]
call fcn.004011c0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004011c0
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x47e6e7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], eax
je 0x47e74a
push ebx
push edi
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004954a0
add esp, 0xc
mov ebx, str._ALLUSERSPROFILE_
push ebx
xor ecx, ecx
call fcn.00401336
or edi, 0xffffffff
cmp eax, edi
je 0x47e74d
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.0047ec34
pop ecx
test eax, eax
pop ecx
jne 0x47e85d
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
mov ebx, str._APPDATA_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
jne 0x47e72f
mov ebx, str._TEMP_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
jne 0x47e72f
mov ebx, str._SYSTEM_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e79b
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x47e746
jmp 0x47e85d
mov ebx, str._WINDOWS_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e7c0
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47e792
mov ebx, str._CUR_MODULE_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e7e2
lea eax, [ebp - 0x210]
push eax
call fcn.0047eb8d
jmp 0x47e73d
mov ebx, str._CUR_EXE_MODULE_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e811
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x47e746
jmp 0x47e850
mov ebx, str._CUR_DIR_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e746
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004954a0
add esp, 0xc
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call fcn.00479ef4
push 0x3f
xor ecx, ecx
call fcn.0043269f
mov ebx, eax
cmp ebx, edi
je 0x47e8ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004999d4
pop ecx
jmp 0x47e8e0
and word [ebp + 8], 0
xor eax, eax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.004999e1
and eax, 0x8000000f
jns 0x47e8a6
dec eax
or eax, 0xfffffff0
inc eax
push eax
lea eax, [ebp + 8]
push 0x4ed99c
push eax
call fcn.004801e8
movzx edi, word [ebp + 8]
add esp, 0xc
test ebx, ebx
jl 0x47e8fe
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp ebx, eax
mov dword [ebp - 4], eax
jge 0x47e8fe
call fcn.0044edbe
mov word [eax + ebx*2], di
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.004011d8
inc ebx
mov ecx, ebx
mov eax, esi
call fcn.0048023a
cmp ax, 0x3f
je 0x47e889
mov eax, esi
call fcn.0047d817
xor eax, eax
inc eax
jmp 0x47e748
push 0x80070057
call fcn.0040131e
int3
Function at 0x47e909
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
xor esi, esi
test byte [0x510d94], 1
mov dword [ebp - 4], esi
jne 0x47e948
mov eax, dword [0x50ec24]
or dword [0x510d94], 1
mov ecx, 0x50ec24
call dword [eax + 0xc]
add eax, 0x10
push 0x4d319a
mov dword [0x510d90], eax
call fcn.00494fb4
pop ecx
mov eax, dword [0x510d90]
cmp dword [eax - 0xc], esi
jne 0x47e9a2
push ebx
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.004954a0
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
call fcn.004953a9
pop ecx
lea ecx, [ebp - 0x210]
mov ebx, eax
push ecx
mov eax, 0x510d90
call fcn.0040140a
pop ebx
mov eax, dword [0x510d90]
add eax, 0xfffffff0
call fcn.00401367
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
leave
ret

Function at 0x47e9b9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
xor esi, esi
test byte [0x510d8c], 1
mov dword [ebp - 4], esi
jne 0x47e9f8
mov eax, dword [0x50ec24]
or dword [0x510d8c], 1
mov ecx, 0x50ec24
call dword [eax + 0xc]
add eax, 0x10
push 0x4d31a7
mov dword [0x510d88], eax
call fcn.00494fb4
pop ecx
mov eax, dword [0x510d88]
cmp dword [eax - 0xc], esi
jne 0x47ea52
push ebx
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.004954a0
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
call fcn.004953a9
pop ecx
lea ecx, [ebp - 0x210]
mov ebx, eax
push ecx
mov eax, 0x510d88
call fcn.0040140a
pop ebx
mov eax, dword [0x510d88]
add eax, 0xfffffff0
call fcn.00401367
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
leave
ret

Function at 0x47ea69
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x4ce47e
call fcn.004cc790
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x50ec24
mov dword [ebp - 0x10], edi
call fcn.004014d2
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.004954a0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x47eaeb
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00432867
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x47ec34
Capabilities:
Query environment variable

Disassembly:
push 0x14
push 0x4f9398
call fcn.004cc5fc
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], eax
je 0x47ece2
cmp dword [ebp + 0xc], eax
je 0x47ece2
push eax
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
mov esi, eax
cmp esi, 1
jb 0x47ece2
mov ebx, 0x103
cmp esi, ebx
ja 0x47ece2
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00493c3c
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x47ecde
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.004954a0
add esp, 0xc
push esi
push dword [ebp - 0x24]
push dword [ebp + 8]
call edi
test eax, eax
je 0x47ecde
cmp eax, ebx
ja 0x47ecde
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0xc]
call fcn.00499d46
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x47ecde
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x47ecf1
push dword [ebp - 0x1c]
call fcn.0049551a
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.004cc637
ret

Function at 0x47eddd
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4ce47e
call fcn.004cc790
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x206
mov dword [ebp - 4], edi
lea eax, [ebp - 0x216]
push edi
mov dword [ebp - 0x10], edi
push eax
mov word [ebp - 0x218], di
call fcn.004954a0
add esp, 0xc
mov ecx, 0x50ec24
call fcn.004014d2
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 4], edi
push 0x104
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
je 0x47ee65
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00432867
push str.kinst.log
push esi
call fcn.004325c9
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x47ee75
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push edi
push str.explorer.exe
lea eax, [ebp - 4]
push eax
xor esi, esi
xor edi, edi
call fcn.0043288d
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x230], esi
call fcn.004954a0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x47ef12
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x47eef7
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call fcn.00497c14
test eax, eax
pop ecx
pop ecx
je 0x47eefd
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47eed5
jmp 0x47ef0b
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ecx], eax
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x47f22e
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, 0x4cd585
call fcn.004cc790
push esi
push edi
and dword [ebp - 4], 0
push str._access
lea eax, [ebp + 8]
push eax
call fcn.004325c9
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
test edi, edi
je 0x47f270
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x47f277
call esi
cmp eax, 5
je 0x47f27a
xor edi, edi
inc edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x47f695
Capabilities:
Move file

Disassembly:
mov eax, 0x4cf8d8
call fcn.004cc790
sub esp, 0x38
push esi
push edi
and dword [ebp - 4], 0
lea esi, [ebp + 8]
call fcn.0044edbe
push eax
lea eax, [ebp - 0x44]
call fcn.0041e380
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 1
call fcn.0044f645
lea eax, [ebp - 0x28]
call fcn.0044fe53
movzx edi, al
test edi, edi
jne 0x47f705
cmp dword [ebp - 0x14], 0x104
jb 0x47f6e6
xor al, al
jmp 0x47f702
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x47f6f2
lea eax, [ebp - 0x24]
push 5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
movzx edi, al
push 0
push 1
lea esi, [ebp - 0x28]
call fcn.0041a5aa
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0041a5aa
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x47f738
Capabilities:
Check if file exists

Disassembly:
push ecx
push edi
push 3
xor edi, edi
push edi
push edi
push esi
push dword [esp + 0x1c]
call fcn.00480614
add esp, 0x14
test eax, eax
jne 0x47f75e
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47f75e
inc edi
mov eax, edi
pop edi
pop ecx
ret
Function at 0x47fba7
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x4cdc8f
call fcn.004cc790
push ecx
push ecx
push esi
push edi
xor edi, edi
and dword [ebp - 0x10], edi
and dword [ebp - 4], edi
mov eax, dword [0x50ec24]
mov ecx, 0x50ec24
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0044e320
test eax, eax
je 0x47fbfb
lea eax, [ebp - 0x14]
push eax
mov eax, esi
push eax
call fcn.0044e394
test eax, eax
je 0x47fbfb
inc edi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004011c0
cmp dword [ebp - 0x10], 0
je 0x47fc15
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x47fc25
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4ce6e5
call fcn.004cc790
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
mov esi, ecx
mov eax, dword [esi]
xor ecx, ecx
push ecx
push ecx
push eax
mov ebx, str.open
push ebx
push ecx
call edi
cmp eax, 0x20
jle 0x47fc58
xor esi, esi
inc esi
jmp 0x47fc95
mov eax, dword [esi]
push 1
push 0
push eax
push str.IEXPLORE.EXE
push ebx
push 0
call edi
cmp eax, 0x20
jg 0x47fc53
lea eax, [ebp - 0x10]
push eax
call fcn.0047ea69
pop ecx
and dword [ebp - 4], 0
push dword [esi]
push dword [ebp - 0x10]
call fcn.0047e148
mov esi, eax
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x47fdef
Capabilities:
Get file size

Disassembly:
mov eax, 0x4cf8be
call fcn.004cc790
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.0047c10c
pop ecx
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
cmp eax, ebx
jle 0x47fe6b
lea esi, [ebp - 0x10]
call fcn.0044edbe
push eax
call fcn.00491be5
mov edi, eax
cmp edi, ebx
pop ecx
je 0x47fe6b
mov eax, dword [edi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, edi
call dword [eax + 0x18]
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x47fe49
mov eax, dword [eax + 4]
jmp 0x47fe4c
add eax, 4
push eax
push dword [ebp + 8]
call fcn.00432867
push ebx
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.0041a5aa
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x47fec9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
jbe 0x47fec2
test eax, eax
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
jge 0x47fea7
fadd dword [0x4ef8b0]
fmul qword [0x4efa38]
mov eax, dword [ebp + 0xc]
push ecx
push ecx
fstp qword [esp]
push str._0.2f_MB
call fcn.00432808
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret