joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474aa2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5e8259
call fcn.00470b96
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0046671d
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004667e3
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x474ae2
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x474b44
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x5e9c5c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x474b1f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x474b44
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00466730
call fcn.00470b5f
ret 8

Function at 0x474b6c
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x5e790b
call fcn.00470bca
mov esi, ecx
mov ebx, 0x5e9b88
lea eax, [ebp - 0x230]
push ebx
push str.InstallTime
push str.AppInfo
push eax
call fcn.00475015
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
push ebx
call fcn.00428850
test eax, eax
jne 0x474c1c
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00483520
lea eax, [esi + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x474bd0
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
push str.InstallTime
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x474bfc
xor eax, eax
jmp 0x474c09
lea eax, [ebp - 0x218]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402b90
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00486d93
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.0041ed70
mov eax, esi
call fcn.00470b74
ret
Function at 0x474e4f
Capabilities:
Read .ini file

Disassembly:
push 0x844
mov eax, 0x5e79a9
call fcn.00470bca
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
and dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x844], eax
call fcn.00404170
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00404140
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0x84c], 1
jne 0x474f28
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00483520
lea eax, [ebx + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x474ede
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x848]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x474f0c
xor eax, eax
jmp 0x474f19
lea eax, [ebp - 0x810]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00402b90
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.004562f1
test eax, eax
jne 0x474f6c
push edi
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
mov ecx, ebx
push dword [ebp - 0x848]
push eax
call fcn.00475015
push eax
mov ecx, esi
call fcn.00404380
push 0
push 1
lea ecx, [ebp - 0x840]
call fcn.0041ed70
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ed70
mov eax, esi
call fcn.00470b74
ret 0x14

Function at 0x475069
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x5e688f
call fcn.00470bca
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x475094
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x475172
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5e9978
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00402b90
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00483520
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5e9b60
push eax
call fcn.00407e80
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x475127
call fcn.00474f85
jmp 0x47512c
call fcn.0047503f
push eax
lea ecx, [ebp - 0x828]
call fcn.00404380
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.0041ed70
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00486d93
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.0041ed70
mov eax, esi
call fcn.00470b74
ret 0xc
Function at 0x47517c
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5e79f3
call fcn.00470bca
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.00483520
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4751d9
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00404170
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x47521f
mov eax, dword [esi]
jmp 0x475221
mov eax, esi
push ebx
push eax
call fcn.00491c35
pop ecx
pop ecx
test eax, eax
jne 0x47526d
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x475251
call fcn.00474f85
jmp 0x475256
call fcn.0047503f
push eax
mov ecx, esi
call fcn.00404380
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ed70
mov eax, esi
call fcn.00470b74
ret 0x10
Function at 0x475e1f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00483520
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x475e58
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5eeb20
push eax
call fcn.00407e80
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x475e90
lea eax, [ebp - 0x20c]
push eax
call fcn.0045a078
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00483520
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5ecf50
push eax
call fcn.00407e80
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x475ecf
mov eax, esi
jmp 0x475edc
lea eax, [ebp - 0x414]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00402b90
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00483520
push str.Cache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5ecf50
push eax
call fcn.00407e80
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x475f2e
mov eax, esi
jmp 0x475f3b
lea eax, [ebp - 0x61c]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00402b90
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.00483520
lea eax, [ebp - 0xa44]
push 0x5e9bb0
push eax
call fcn.0045b425
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x475f7c
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5eba04
push eax
call fcn.00407e80
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.0041ed70
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x475fbd
lea eax, [ebp - 0x824]
push eax
call fcn.0045a078
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.00483520
push str.Cache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5ecf50
push eax
call fcn.00407e80
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x476007
lea eax, [ebp - 0xa2c]
push eax
call fcn.00491bc7
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00402b90
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x476683
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x5e7af8
call fcn.00470bca
mov ebx, ecx
call fcn.00474b54
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.004535ac
mov esi, str.WanNengWBInfo.ini
push esi
call fcn.00491bc7
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00405d30
push str.guanf
push 0x5eaaa4
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00475015
and dword [ebp - 4], 0
lea esi, [ebx + 0xec]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x4766f9
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00402a70
push str.guanf
mov ecx, esi
call fcn.00428850
test eax, eax
jne 0x476775
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00483520
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x476726
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.guanf
push eax
push edi
push 0x5eaaa4
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x476757
xor eax, eax
jmp 0x476764
lea eax, [ebp - 0x218]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402b90
jmp 0x47677a
mov edi, str.guanf
push edi
mov ecx, esi
call fcn.00428850
test eax, eax
jne 0x47683d
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00483520
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00404140
push str.WanNengWBInfo.ini
mov byte [ebp - 4], 1
call fcn.00491bc7
pop ecx
push eax
push str.WanNengWBInfo.ini
lea ecx, [ebp - 0x230]
call fcn.00405d30
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5eaaa4
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x47680e
xor eax, eax
jmp 0x47681b
lea eax, [ebp - 0x218]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402b90
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.0041ed70
push edi
mov ecx, esi
call fcn.00428850
test eax, eax
jne 0x476879
push edi
push 0x5eaaa4
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0047517c
push eax
mov ecx, esi
call fcn.00404380
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0041ed70
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0041ed70
call fcn.00470b74
ret
Function at 0x477203
Capabilities:
Encode data using xor

Disassembly:
push 0x3c
mov eax, 0x5e7b7e
call fcn.00470b96
lea ecx, [ebp - 0x48]
call fcn.00476e92
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0047730a
lea ecx, [ebp - 0x48]
call fcn.00477a0a
test al, al
je 0x4772f3
cmp dword [ebp + 0xc], 0
je 0x4772f3
cmp dword [ebp + 0x10], 0
je 0x4772f3
lea ecx, [ebp - 0x48]
call fcn.00477a0e
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov dword [ebp - 0x10], ecx
je 0x4772f3
call fcn.004538be
test al, al
je 0x477287
sbb byte [0x68d0e66], bh
cmpsb byte [esi], byte es:[edi]
adc ecx, ecx
or eax, 0x31024ffc
sub ecx, 0x24684290
dec esi
inc ebx
cmpsd dword [esi], dword es:[edi]
push 0xa7434e24
and eax, 0xd9e8c0b9
invalid
call fcn.00453765
test al, al
je 0x4772ae
sbb bl, cl
xor esp, 0xffffff99
xchg ecx, eax
xor eax, 0xe9b3abde
dec esi
push eax
jle 0x47727f
mov dword [0xabf92b8b], eax
mov dword [0xfe28025b], eax
pop ecx
inc ebp
stc
aad 0x6a
mov edi, dword [ebp - 0x10]
lea esi, [edi + 1]
push esi
call fcn.0047071d
push esi
xor ebx, ebx
mov dword [ebp - 0x10], eax
push ebx
push eax
call fcn.00483520
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov ecx, dword [edx + 4]
sub ecx, dword [edx]
mov ecx, dword [ebp - 0x10]
je 0x4772e9
mov eax, dword [edx]
mov al, byte [ebx + eax]
mov byte [ebx + ecx], al
inc ebx
mov eax, dword [edx + 4]
sub eax, dword [edx]
cmp ebx, eax
jb 0x4772d7
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
lea ecx, [ebp - 0x48]
call fcn.00476f2c
call fcn.00470b5f
ret

Function at 0x477ac4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x477b43
push ebx
push edi
xor edi, edi
push str.c335b80a32136330ebfa2439bf4cbfcb
mov dword [ebp + 8], edi
call fcn.00491c80
mov ebx, dword [ebp + 0xc]
mov edx, edi
pop ecx
test ebx, ebx
je 0x477b00
mov cl, byte [edi + str.c335b80a32136330ebfa2439bf4cbfcb]
xor byte [edx + esi], cl
inc edi
xor ecx, ecx
cmp edi, eax
cmovge edi, ecx
inc edx
cmp edx, ebx
jb 0x477aea
cmp ebx, 1
jle 0x477b37
cmp byte [esi], 0x37
jne 0x477b37
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x477b15
cmp al, 0x5a
jne 0x477b37
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.0044cc20
test eax, eax
je 0x477b37
mov edx, dword [ebp + 8]
test edx, edx
je 0x477b37
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x477b41
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4785d6
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.004538be
test al, al
je 0x478604
xchg edx, eax
test byte [esi], bl
jecxz 0x47864d
out dx, eax
mov ebx, 0x5cbfbfee
adc al, 0x19
jae 0x47866e
aaa
lcall 0x6570, 0x836b7d89
outsd dx, dword [esi]
cwde
call fcn.00453765
test al, al
je 0x47862b
mov ebx, 0x8ae19cd4
or al, byte [eax - 0x62b6ac28]
xchg edi, eax
mov dh, 0xcb
dec ebx
adc ecx, dword [edi]
sub dword [ecx + 0x3d], 0x54fbd39f
dec ecx
invalid
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
pop edi
sbb eax, eax
rol byte [eax - 0x77], 0x46
add al, 0x5e
inc eax
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add eax, 0x8228e682
mov al, byte [0x38f326f7]
push ecx
insb byte es:[edi], dx
in al, 0xb7
sub eax, ebp
cmp al, 0xb2
std
inc dword [eax + eax*8 - 0x4558e08c]
out dx, eax
push edx
mov word [ecx], cs
movsb byte es:[edi], byte [esi]
jno 0x47864c
and eax, 0x114356cf
or dword [edx + 0x65], esp
arpl word [esi + 0x1c21986d], dx
arpl di, cx
push esp
adc eax, 0xffffffc2
insd dword es:[edi], dx
call fcn.004536db
test al, al
je 0x4786c4
invalid
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x4786df
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478725
Capabilities:
Encode data using base64

Disassembly:
outsb dx, byte [esi]
pop es
push eax
lodsd eax, dword [esi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047876d
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
push ebx
call fcn.00453765
test al, al
je 0x478751
or al, 0xa5
dec ecx
imul esp
xchg bh, ah
imul byte [esi]
pop ss
jno 0x478798
xchg esi, eax
adc bh, byte [edx + 0x269130d2]
xor dword [ebx - 0x5c12d36f], edx
xor dword es:[ebx - 0x5c12d36f], edx
aad 0xa9
loope 0x478703
invalid
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004788e1
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop ebx
pop ebp
ret
in al, dx
push ecx
push ebx
push esi
push edi
call fcn.00453bb5
test al, al
je 0x47878e
mov es, word [esi]
sahf
jo 0x4787ce
clc
xchg dword [ecx], eax
int3
call fcn.004538be
test al, al
je 0x4787b6
sub byte [esi], 0x41
inc ecx
mov al, byte [0x3e4a5839]
mov ebx, 0xfeac7109
wait
sbb bh, byte [esi + 0x2f]
movsd dword es:[edi], dword [esi]
push edx
aas
pop ecx
xchg ecx, eax
jae 0x478744
or dword [esi + 0xa94a290], esp
call fcn.004536db
call fcn.004536db
test al, al
je 0x4787d5
pop ss
push edi
jge 0x47876f
mov ch, 0xa7
jo 0x478817
pop ebp
mov edx, 0xfc01b0f7
dec ebp
pop edi
sti
jle 0x4787b6
mov edx, 0xc933a5b6
xor ecx, ecx
xor edx, edx
xor ebx, ebx
cmp dword [ebp + 0xc], ecx
jle 0x4788d8
mov esi, dword [ebp + 8]
mov al, byte [ebx + esi]
cmp al, 0x3d
jne 0x4787f4
inc edx
cmp edx, 2
jg 0x478835
cmp al, 0x7f
ja 0x478835
movzx eax, al
mov al, byte [eax + 0x5f2a58]
cmp al, 0x7f
je 0x478835
cmp al, 0x40
jae 0x47880d
test edx, edx
jne 0x478835
inc ecx
inc ebx
mov dword [ebp - 4], ebx
cmp ebx, dword [ebp + 0xc]
jl 0x4787e7
test ecx, ecx
je 0x4788d8
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x47883d
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x478837
push 0xffffffffffffffee
pop eax
jmp 0x4788da
call fcn.00453b70
test al, al
je 0x47885e
salc
cli
dec esp
invalid
and dword [ebp - 4], 0
xor eax, eax
mov edx, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
push 3
pop esi
test ebx, ebx
jle 0x4788d3
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov cl, byte [eax + 0x5f2a58]
xor eax, eax
cmp cl, 0x40
sete al
sub esi, eax
movzx eax, cl
mov ecx, dword [ebp - 4]
and eax, 0x3f
shl ecx, 6
or ecx, eax
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
cmp eax, 4
jne 0x4788ca
xor eax, eax
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x4788b5
mov eax, ecx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp esi, 1
jle 0x4788c2
mov eax, ecx
shr eax, 8
mov byte [edx], al
inc edx
cmp esi, 2
jle 0x4788ca
mov byte [edx], cl
inc edx
dec ebx
inc edi
test ebx, ebx
jg 0x478874
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4788e1
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x4788f5
xor eax, eax
jmp 0x478a33
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x47891e
dec edx
sub edx, 1
jne 0x478920
add eax, 2
jmp 0x478920
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x478933
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x478a32
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x4789c9
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x5f2a18]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x5f2a18]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x5f2a18]
mov byte [edi + 2], al
mov al, byte [esi + 0x5f2a18]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x47895e
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x4789cc
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x478a25
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x4789e1
movzx ecx, byte [eax + 1]
jmp 0x4789e3
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x5f2a18]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x5f2a18]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x478a1a
and ecx, 0xf
mov al, byte [ecx*4 + 0x5f2a18]
mov byte [edi + 2], al
jmp 0x478a1e
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478bfb
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.00483520
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5f286c
call fcn.00491bc7
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00492485
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.00483520
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.00483520
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.00483520
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x478cf9
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.00408a80
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00406430
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4
Function at 0x47b512
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5e8259
call fcn.00470b96
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0046671d
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004667e3
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x47b552
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47b5b2
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x47b58d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47b5b2
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00466730
call fcn.00470b5f
ret 0xc