joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4718b8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040555c
xor eax, eax
push ebp
push 0x471a14
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
xor edx, edx
call fcn.004055c8
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x471a30
call fcn.00405f58
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405c40
mov eax, dword [ebp - 0x20]
call fcn.00471178
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x47193c
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x47193c
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00404f08
mov ebx, eax
test ebx, ebx
je 0x471947
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
push eax
push 8
push 0
lea eax, [ebp - 0x24]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x471a30
call fcn.00405f58
mov edx, eax
inc edx
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00405c40
mov eax, dword [ebp - 0x24]
call fcn.00405600
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov dword [ebp - 0x14], 0xff
mov eax, dword [ebp - 0x14]
call fcn.00402fcc
mov ebx, eax
xor esi, esi
jmp 0x4719bb
push dword [ebp - 8]
lea eax, [ebp - 0x28]
mov edx, ebx
call fcn.004056f0
push dword [ebp - 0x28]
push 0x471a40
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405a90
inc esi
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
je 0x471991
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00405574
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471a1b
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040556c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040556c
ret
Function at 0x472608
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x472794
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
mov edx, 0x200
call fcn.004058a8
mov eax, 0x2000
call fcn.004725e8
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x472777
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], 0x2000
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov ebx, eax
test ebx, ebx
jne 0x4726be
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push esi
call sub.advapi32.dll_RegDeleteValueW
test ebx, ebx
je 0x472657
xor edi, edi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], 0x2000
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyExW
mov ebx, eax
test ebx, ebx
jne 0x472759
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCreateKeyW
mov ebx, eax
test ebx, ebx
jne 0x472759
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push esi
call sub.advapi32.dll_RegCreateKeyW
mov ebx, eax
test ebx, ebx
jne 0x472750
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.00472608
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyW
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x4726c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47277e
mov eax, dword [ebp - 0x1c]
call fcn.00402fe8
ret
Function at 0x472818
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040555c
mov eax, dword [ebp - 8]
call fcn.0040555c
xor eax, eax
push ebp
push 0x4728b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405600
mov esi, eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x47289a
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405600
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyW
test eax, eax
jne 0x472881
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00472608
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4728bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040556c
ret

Function at 0x473668
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040555c
xor eax, eax
push ebp
push 0x4736e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2b8]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00403464
push 0x400
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, ebx
lea edx, [ebp - 0xa4]
mov ecx, 0x50
call fcn.0040572c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4736ef
lea eax, [ebp - 4]
call fcn.00405564
ret

Function at 0x473ba8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x473cae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00405574
lea eax, [ebp - 0x102]
push eax
push 0x102
call sub.kernel32.dll_GetLogicalDriveStringsW
test eax, eax
je 0x473c95
lea esi, [ebp - 0x102]
xor eax, eax
push ebp
push 0x473c8b
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x473c7b
lea eax, [ebp - 0x108]
mov edx, esi
call fcn.004056f0
mov edx, dword [ebp - 0x108]
mov eax, ebx
call fcn.00405940
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x473c34
dec eax
je 0x473c42
dec eax
je 0x473c50
dec eax
je 0x473c5e
jmp 0x473c6c
mov eax, ebx
mov edx, 0x473cc8
call fcn.00405940
jmp 0x473c78
mov eax, ebx
mov edx, 0x473cdc
call fcn.00405940
jmp 0x473c78
mov eax, ebx
mov edx, 0x473cf0
call fcn.00405940
jmp 0x473c78
mov eax, ebx
mov edx, 0x473d04
call fcn.00405940
jmp 0x473c78
mov eax, ebx
mov edx, 0x473cdc
call fcn.00405940
add esi, 8
cmp word [esi], 0
jne 0x473c04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473c95
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473cb5
lea eax, [ebp - 0x108]
call fcn.00405564
ret
Function at 0x47420c
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040555c
xor eax, eax
push ebp
push 0x4742e3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x4742c2
cmp edi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x47425f
mov esi, 0x10
jmp 0x474264
mov esi, 0x20
or esi, 4
push esi
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x4742bc
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4742ac
cmp edi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4742a0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
jmp 0x4742ac
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
call fcn.00473fac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4742ea
lea eax, [ebp - 4]
call fcn.00405564
ret
Function at 0x4742f4
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4742fd
mov eax, dword [ebp - 4]
add esp, 0xfffff7dc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4824], edx
mov dword [ebp - 0x4828], edx
mov dword [ebp - 0x481c], edx
mov dword [ebp - 0x4820], edx
mov dword [ebp - 0x4818], edx
mov esi, eax
xor eax, eax
push ebp
push 0x474474
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00405574
push 4
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x474456
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4800
lea eax, [ebp - 0x4814]
push eax
push 3
push 0x30
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EnumServicesStatusW
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x47443d
inc edi
lea ebx, [ebp - 0x4814]
lea eax, [ebp - 0x4818]
mov edx, dword [ebx]
call fcn.004056f0
mov edx, dword [ebp - 0x4818]
mov eax, esi
call fcn.00405940
push dword [esi]
push 0x474490
lea eax, [ebp - 0x4820]
mov edx, dword [ebx]
call fcn.004056f0
mov eax, dword [ebp - 0x4820]
lea edx, [ebp - 0x481c]
call fcn.0047413c
push dword [ebp - 0x481c]
mov eax, esi
mov edx, 3
call fcn.00405a90
push dword [esi]
push 0x474490
lea eax, [ebp - 0x4824]
push eax
lea eax, [ebp - 0x4828]
mov edx, dword [ebx]
call fcn.004056f0
mov eax, dword [ebp - 0x4828]
xor ecx, ecx
xor edx, edx
call fcn.0047420c
push dword [ebp - 0x4824]
push 0x4744a0
mov eax, esi
mov edx, 4
call fcn.00405a90
add ebx, 0x24
dec edi
jne 0x4743a1
cmp dword [ebp - 0xc], 0
jne 0x474369
cmp dword [ebp - 8], 0
jbe 0x474456
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47447b
lea eax, [ebp - 0x4828]
mov edx, 5
call fcn.0040556c
ret

Function at 0x474eec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x474f1e
inc ecx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, 0xff
mov esi, dword [0x4837d8]
mov ebx, dword [esi + ebx*4]
shr eax, 8
and eax, 0xffffff
xor ebx, eax
mov eax, ebx
inc edx
dec ecx
jne 0x474efa
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4752a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
movzx edx, dl
mov ecx, dword [eax + 4]
xor edx, ecx
and edx, 0xff
mov ebx, dword [0x4837d8]
mov ebx, dword [ebx + edx*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [eax + 4], ebx
and ebx, 0xff
add dword [eax + 8], ebx
imul edx, dword [eax + 8], 0x8088405
inc edx
mov dword [eax + 8], edx
shr edx, 0x18
mov ecx, dword [eax + 0xc]
xor edx, ecx
and edx, 0xff
mov ebx, dword [0x4837d8]
mov edx, dword [ebx + edx*4]
shr ecx, 8
and ecx, 0xffffff
xor edx, ecx
mov dword [eax + 0xc], edx
pop ebx
ret
Function at 0x479250
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov byte [ebp - 0xd], dl
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040555c
xor eax, eax
push ebp
push 0x47932b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xe], 0
call fcn.0041282c
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00412308
mov eax, dword [ebp - 0xc]
call fcn.0040692c
mov esi, eax
lea ebx, [esi + 6]
push ebx
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x479230]
call fcn.00406af4
add esp, 4
mov eax, dword [ebp - 8]
mov byte [eax], 1
mov eax, dword [ebp - 8]
mov dword [eax + 1], esi
mov eax, dword [ebp - 8]
movzx edx, byte [ebp - 0xd]
mov byte [eax + 5], dl
mov eax, dword [ebp - 0xc]
call fcn.0040692c
mov edx, dword [ebp - 8]
add edx, 6
mov ecx, dword [ebp - 0xc]
xchg ecx, eax
call fcn.00403184
push 0
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.wsock32.dll_send
cmp ebx, eax
jne 0x4792f9
mov byte [ebp - 0xe], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479332
lea eax, [ebp - 0xc]
mov edx, dword [0x40930c]
call fcn.00406b00
lea eax, [ebp - 8]
mov edx, dword [0x479230]
call fcn.00406b00
lea eax, [ebp - 4]
call fcn.00405564
ret

Function at 0x479c40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x479cfd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x479cd8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
mov eax, ebx
call fcn.00405600
push eax
call sub.kernel32.dll_GetVolumeInformationW
movzx eax, word [ebp - 0xc]
xor edx, edx
push edx
push eax
push 0
push 4
lea eax, [ebp - 0x10]
call fcn.0047bfc8
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
xor edx, edx
push edx
push eax
push 0
push 4
lea eax, [ebp - 0x14]
call fcn.0047bfc8
mov edx, dword [ebp - 0x14]
mov eax, esi
pop ecx
call fcn.004059c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x479ce2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479d04
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040556c
ret
Function at 0x479d0c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
xor eax, eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x479e5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
call fcn.0047bc50
test al, al
je 0x479e2c
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x489508], eax
cmp dword [0x489508], 0xffffffff
je 0x479e2c
xor eax, eax
push ebp
push 0x479e25
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a8]
mov edx, dword [0x489514]
mov ecx, 0
call fcn.00405770
mov eax, dword [ebp - 0x1a8]
call fcn.00405130
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x479e0c
mov word [ebp - 0x1a4], 2
movzx eax, word [0x48950c]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1a2], ax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1a0], eax
push 0x10
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [0x489508]
push eax
call sub.wsock32.dll_connect
test eax, eax
jne 0x479e0c
lea eax, [ebp - 4]
call fcn.0047c514
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x489508]
call fcn.00479250
test al, al
je 0x479e0c
mov eax, dword [0x489508]
call fcn.0047a358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479e2c
mov eax, dword [0x489508]
push eax
call sub.wsock32.dll_closesocket
ret
mov eax, dword [0x489510]
push eax
call sub.kernel32.dll_Sleep_1
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479e64
lea eax, [ebp - 0x1a8]
call fcn.00404d58
lea eax, [ebp - 4]
call fcn.00405564
ret
Function at 0x47b4a8
Capabilities:
Create thread

Disassembly:
mov dword [0x48963c], eax
mov dl, 1
mov eax, dword [0x46bd84]
call fcn.00403b74
mov dword [0x489640], eax
mov eax, dword [0x489640]
call fcn.0046c0a8
push 0x489644
push 0
push 0
push 0x47b470
push 0
push 0
call sub.kernel32.dll_CreateThread_1
ret

Function at 0x47bc50
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47bc8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 7
push 0
lea eax, [ebp - 4]
push eax
call sub.WININET.DLL_InternetGetConnectedState
test eax, eax
je 0x47bc7f
mov bl, 1
jmp 0x47bc81
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47bc97
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x47c16c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c1e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004058a8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x47c1c4
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405c40
jmp 0x47c1d0
mov eax, ebx
mov edx, 0x47c200
call fcn.00405574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c1ed
lea eax, [ebp - 4]
call fcn.00405564
ret

Function at 0x47c208
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xfffffeec
mov ebx, eax
mov eax, ebx
mov edx, 0x47c350
call fcn.00405574
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x47c33c
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x47c2e1
dec ecx
jne 0x47c33c
cmp eax, 4
jg 0x47c262
mov eax, ebx
mov edx, 0x47c37c
call fcn.00405574
jmp 0x47c33c
cmp eax, 5
jne 0x47c27c
test edx, edx
jne 0x47c27c
mov eax, ebx
mov edx, 0x47c398
call fcn.00405574
jmp 0x47c33c
cmp eax, 5
jne 0x47c297
cmp edx, 1
jne 0x47c297
mov eax, ebx
mov edx, 0x47c3b8
call fcn.00405574
jmp 0x47c33c
cmp eax, 6
jne 0x47c2b1
test edx, edx
jne 0x47c2b1
mov eax, ebx
mov edx, 0x47c3d4
call fcn.00405574
jmp 0x47c33c
cmp eax, 6
jne 0x47c2c9
cmp edx, 1
jne 0x47c2c9
mov eax, ebx
mov edx, 0x47c3f4
call fcn.00405574
jmp 0x47c33c
cmp eax, 6
jne 0x47c33c
cmp edx, 2
jne 0x47c33c
mov eax, ebx
mov edx, 0x47c40c
call fcn.00405574
jmp 0x47c33c
cmp eax, 4
jne 0x47c2f8
test edx, edx
jne 0x47c2f8
mov eax, ebx
mov edx, 0x47c42c
call fcn.00405574
jmp 0x47c33c
cmp eax, 4
jne 0x47c326
cmp edx, 0xa
jne 0x47c326
cmp word [esp + 0x16], 0x41
jne 0x47c318
mov eax, ebx
mov edx, 0x47c448
call fcn.00405574
jmp 0x47c33c
mov eax, ebx
mov edx, 0x47c468
call fcn.00405574
jmp 0x47c33c
cmp eax, 4
jne 0x47c33c
cmp edx, 0x5a
jne 0x47c33c
mov eax, ebx
mov edx, 0x47c48c
call fcn.00405574
add esp, 0x114
pop ebx
ret
Function at 0x47c49c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x47c4cd
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040572c
jmp 0x47c4d6
mov eax, ebx
xor edx, edx
call fcn.00405574
add esp, 0x204
pop ebx
ret

Function at 0x47c4e0
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040572c
add esp, 0x20c
pop ebx
ret

Function at 0x47c62c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040555c
xor eax, eax
push ebp
push 0x47c695
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [ebp - 5], 0
je 0x47c65f
mov esi, 1
jmp 0x47c661
xor esi, esi
push esi
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jbe 0x47c67f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c69c
lea eax, [ebp - 4]
call fcn.00405564
ret

Function at 0x47c6a4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040555c
mov eax, dword [ebp - 8]
call fcn.0040555c
mov eax, dword [ebp - 0xc]
call fcn.0040555c
xor eax, eax
push ebp
push 0x47c730
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004059c0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004059c0
lea eax, [ebp - 0xc]
call fcn.00405f0c
push eax
lea eax, [ebp - 8]
call fcn.00405f0c
push eax
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x47c715
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c737
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040556c
ret

Function at 0x47c79c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
xor edx, edx
push ebp
push 0x47c7da
push dword fs:[edx]
mov dword fs:[edx], esp
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x47c7d0
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x47c7d0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c7e6
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x47c7f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47c895
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47c878
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, esi
call fcn.00405600
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x47c855
mov edx, ebx
dec edx
lea eax, [ebp - 4]
call fcn.004058a8
push ebx
mov eax, dword [ebp - 4]
call fcn.00405600
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
jmp 0x47c85f
lea eax, [ebp - 4]
xor edx, edx
call fcn.004055c8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c87f
ret