joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426c20
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ced97
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0
lea eax, [esi + 0x70]
mov dword [esi], 0x4f0e3c
mov dword [ebp - 0x18], eax
mov dword [eax], 0x4f0e30
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [eax], 0x4f0e34
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov word [eax + 0x40], cx
mov dword [ebp - 4], 1
lea ebx, [esi + 0x10]
mov eax, dword [esi]
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x4f0e38
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, esi
push ecx
push ebx
call fcn.00427940
mov dword [ebp - 4], 3
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x4f0e44
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov ecx, ebx
call fcn.00427740
mov byte [ebp - 4], 4
lea eax, [esi + 0x10]
lea ebx, [eax + 4]
mov dword [eax], 0x4f0e84
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov byte [eax + 0x48], 0
lea edi, [eax + 0x14]
mov byte [eax + 0x3e], 0
lea ecx, [eax + 0x18]
mov dword [eax + 0x10], esi
lea edx, [eax + 0x24]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x40], eax
mov ebx, dword [ebp - 0x18]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ebx, dword [ebp - 0x10]
mov eax, dword [0x5182ac]
lea ecx, [ebx + 0x10]
mov edx, dword [0x5182b0]
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], edx
mov dword [ecx + 0x38], 0
mov byte [ebp - 4], 5
sub esp, 8
push dword [ebp + 8]
call fcn.00427450
test eax, eax
jne 0x426e01
mov eax, dword [ebx]
push 0
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, ebx
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.0042aa00
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42ca50
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf9ab
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x515080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, eax
cmp eax, 0x208
jae 0x42cc05
xor ecx, ecx
lea esi, [ebp - 0x218]
mov word [ebp + eax - 0x218], cx
cmp word [ebp - 0x218], cx
je 0x42cac8
nop dword [eax + eax]
add esi, 2
cmp word [esi], cx
jne 0x42cac0
mov ecx, str.ADVINST_LOGS
mov eax, 0x41
sub ecx, esi
mov word [esi], ax
add esi, 2
movzx eax, word [ecx + esi]
test ax, ax
jne 0x42cad4
xor eax, eax
push eax
mov word [esi], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42cb1a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1cf0
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x28]
mov eax, 0x5c
mov word [esi], ax
add esi, 2
cmp dword [ecx - 0xc], 0
jne 0x42cbaa
lea ecx, [ebp - 0x21c]
call fcn.0042cc10
mov dword [ebp - 4], 0
cmp word [esi], 0
mov ecx, dword [eax]
je 0x42cb59
nop dword [eax + eax]
add esi, 2
cmp word [esi], 0
jne 0x42cb50
movzx eax, word [ecx]
test ax, ax
je 0x42cb72
sub ecx, esi
mov word [esi], ax
add esi, 2
movzx eax, word [ecx + esi]
test ax, ax
jne 0x42cb63
xor eax, eax
mov word [esi], ax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x42cbd7
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
jmp 0x42cbd7
cmp word [esi], 0
je 0x42cbb9
add esi, 2
cmp word [esi], 0
jne 0x42cbb0
movzx eax, word [ecx]
test ax, ax
je 0x42cbd2
sub ecx, esi
mov word [esi], ax
add esi, 2
movzx eax, word [ecx + esi]
test ax, ax
jne 0x42cbc3
xor eax, eax
mov word [esi], ax
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x42cbe0
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00403890
mov al, 1
jmp 0x42cafc
call fcn.004a21c2
int3
Function at 0x4351e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0f2d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp byte [ebx + 0x40], 0
mov dword [ebp - 0x1c], eax
je 0x435247
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
mov byte [ebx + 0x10], 1
mov dword [ebp - 0x20], eax
call fcn.004046f0
mov dword [ebp - 0x14], eax
test eax, eax
je 0x435324
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4e2514]
mov ecx, dword [ebp - 0x14]
call esi
add eax, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push dword [ebp + 8]
call fcn.00434f90
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x10], 0
test ecx, ecx
je 0x4352b1
cmp dword [ebp - 0x10], ecx
je 0x4352b1
mov ebx, 0x2ee2
jmp 0x4352d3
test ebx, ebx
jne 0x4352d3
mov ebx, dword [eax + 4]
cmp ebx, dword [edi + 4]
je 0x4352d1
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov dword [edi + 4], ebx
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x43530e
mov edi, dword [ecx]
push ecx
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402720
int3
Function at 0x436c60
Capabilities:
Connect to http server

Disassembly:
push esi
mov esi, ecx
push edi
push dword [esi + 0x68]
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
jne 0x436ce4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x436cdb
cmp byte [esi + 0x38], 0
jne 0x436cf0
lea ecx, [esi + 0xc]
call fcn.004382f0
test al, al
jne 0x436cd1
push 0xa
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 0x38], 0
je 0x436cb2
jmp 0x436cf0
pop edi
mov eax, 0xe0000008
pop esi
ret 0x1c
test eax, eax
je 0x436cf0
pop edi
pop esi
ret 0x1c
push dword [esi + 0x68]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [esi + 4], 0
jne 0x436cfe
mov eax, dword [esi + 0x2c]
pop edi
pop esi
ret 0x1c
pop edi
xor eax, eax
pop esi
ret 0x1c
Function at 0x444630
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x20]
cmp dword [eax - 0xc], 0
jne 0x444646
mov eax, dword [ebx + 0x24]
cmp dword [eax - 0xc], 0
je 0x4446c0
cmp byte [ebx + 0x50], 0
jne 0x4446c0
mov eax, dword [ebx + 4]
push esi
push edi
mov esi, dword [eax + 0x1c]
lea eax, [esp + 0xc]
push eax
lea eax, [ebx + 0x58]
mov ecx, esi
push eax
push 5
call dword [0x4e2514]
lea ecx, [ebx + 4]
call esi
test al, al
je 0x444677
cmp dword [esp + 0xc], 0
je 0x4446be
call fcn.00421fe0
test al, al
je 0x44468d
pop edi
pop esi
mov ecx, ebx
pop ebx
add esp, 4
jmp fcn.00446390
push 0
push 0
push ebx
push 0x447730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, dword [ebx + 0x64]
je 0x4446be
mov ecx, dword [ebx + 0x60]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x4e2514]
lea ecx, [ebx + 0x60]
call esi
mov dword [ebx + 0x64], edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x445c00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3f6e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor ebx, ebx
movzx eax, word [ebp + 0xc]
xor edi, edi
push 0xa
mov dword [ebp - 0x14], 0
mov esi, dword [0x516d44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x445c7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x445c7a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x445c7a
push dword [ebp - 0x10]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
call fcn.004046f0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x445d98
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x4e2514]
mov ecx, dword [ebp - 0x10]
call esi
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
call fcn.004046f0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x445d98
test ebx, ebx
jne 0x445cce
test edi, edi
jne 0x445da7
mov eax, dword [eax]
push 1
push edi
mov esi, dword [eax]
mov ecx, esi
call dword [0x4e2514]
mov ecx, dword [ebp - 0x10]
call esi
test eax, eax
je 0x445da2
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
test edi, edi
js 0x445da7
cmp edi, dword [esi - 8]
jg 0x445da7
mov dword [esi - 0xc], edi
mov byte [esi + edi], 0
test edi, edi
je 0x445d3c
test esi, esi
je 0x445d2c
push edi
test ebx, ebx
je 0x445d21
push ebx
push esi
call fcn.004a3750
add esp, 0xc
jmp 0x445d3c
push 0
push esi
call fcn.004a3cd0
add esp, 0xc
call fcn.004a715d
mov dword [eax], 0x16
call fcn.004a705f
mov dword [ebp - 4], 3
mov ecx, esi
mov ebx, dword [ebp + 8]
mov edx, ebx
push 0xfde9
call fcn.0040dfe0
add esp, 4
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x445d82
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00402720
call fcn.00402740
push 0x80070057
call fcn.00402720
int3
Function at 0x449e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4c56
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 4
lea esi, [edi + 0x30]
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], 0x4ef308
mov dword [edi + 0x24], 0x4f2e74
mov dword [edi], 0x4f2ea8
mov dword [edi + 0x20], 0x4f2e7c
mov dword [edi + 0x24], 0x4f2e78
mov dword [edi + 0x2c], 0
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00402750
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
mov dword [edi + 0x34], eax
mov eax, dword [ebp + 0x10]
mov byte [edi + 0x38], 0
mov dword [edi + 0x40], eax
mov al, byte [ebp + 0x14]
mov dword [edi + 0x44], 2
mov byte [edi + 0x48], al
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x449f60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4cc6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
lea eax, [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
mov ecx, dword [eax]
or eax, 0xffffffff
sub ecx, 0x10
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x449fc4
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax + 0xc]
test eax, eax
je 0x449fe5
push eax
call fcn.0048a95b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44a3c0
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4d95
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0042b3e0
cmp byte [eax + 0x1c], 0
je 0x44a4f2
call fcn.0042b3e0
test byte [eax + 0x20], 4
je 0x44a4f2
call fcn.0042b3e0
mov dword [ebp - 0x18], eax
call fcn.004046f0
mov edi, eax
test edi, edi
je 0x44a5e3
mov ecx, dword [edi]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
inc ecx
inc ebp
add dword [eax], eax
Function at 0x44e271
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edi, 0x179cf
sub edi, 0x14a8b
pop edi
push ecx
and ecx, 0xc52f
or ecx, 0xea15
pop ecx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x44e2b1
mov dword [ebp - 0x14cc], 1
jmp 0x44e2bb
invalid
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x44e32d
Function at 0x44e600
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
jo 0x44e603
add byte [ecx + 0xd8a3f7], al
add byte [edi + 0x56], bl
Function at 0x46aed0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2dbd
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ecx + 0x160]
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.00402750
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 5
push str..part
call fcn.004025b0
lea ecx, [ebp - 0x10]
call fcn.0040f270
test al, al
je 0x46af39
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.0040f270
test al, al
je 0x46af4c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
push dword [esi]
call fcn.004a32eb
add esp, 8
or ebx, 0xffffffff
test eax, eax
je 0x46afaa
sub eax, dword [esi]
sar eax, 1
cmp eax, ebx
je 0x46afaa
push eax
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0040b1b0
mov byte [ebp - 4], 2
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x46afaa
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x46afd5
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4715e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db935
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00471810
mov ecx, dword [edi + 0x10]
mov ebx, eax
cmp dword [ecx - 0xc], 0
je 0x471684
mov eax, dword [edi + 4]
cmp eax, 6
je 0x471636
cmp eax, 7
je 0x471636
cmp eax, 8
je 0x471636
cmp eax, 9
je 0x471636
cmp eax, 0x12
jne 0x471684
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x58]
movlpd qword [ebp - 0x44], xmm0
push eax
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x8400
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x4c], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call fcn.0042b3e0
cmp byte [eax + 0x1c], 0
je 0x4717b3
call fcn.0042b3e0
test byte [eax + 0x20], 8
je 0x4717b3
call fcn.0042b3e0
mov dword [ebp - 0x1c], eax
call fcn.004046f0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x471801
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x4e2514]
mov ecx, dword [ebp - 0x10]
call esi
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x14]
push 0x18
push 0x4f4ab0
call fcn.004025b0
push dword [edi + 4]
lea ecx, [ebp - 0x14]
call fcn.0042adf0
mov esi, eax
push 0xf
push str.._Return_code:
mov ecx, esi
call fcn.004025b0
push ebx
mov ecx, esi
call fcn.0042adf0
mov dword [ebp - 0x18], eax
call fcn.004046f0
mov edi, eax
test edi, edi
je 0x471801
mov ecx, dword [edi]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
push 0
push 0x4ed694
call fcn.004025b0
push ecx
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.0042b770
mov byte [ebp - 4], 2
or edx, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov eax, edx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x471788
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
or edx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edx
dec edx
test edx, edx
jg 0x4717b3
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
test ebx, ebx
je 0x4717ed
cmp ebx, 0xe0000011
je 0x4717ed
cmp ebx, 0xe0000027
je 0x4717ed
cmp ebx, 0xe0000008
je 0x4717ed
cmp ebx, 0x4c7
je 0x4717ed
cmp ebx, 0x642
je 0x4717ed
cmp ebx, 0xe0000029
je 0x4717ed
push ebx
call fcn.00479520
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402720
int3
Function at 0x4734a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dbe54
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 2
lea eax, [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
add eax, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov ecx, dword [eax]
or eax, 0xffffffff
sub ecx, 0x10
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47350e
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x1c]
call fcn.00479ac0
mov byte [ebp - 4], 0
lea ecx, [ebx + 0x10]
call fcn.004094c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 4]
call fcn.004094c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473ab0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dbf55
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x515080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.purgenotifseen
push dword [edi + 0x184]
call fcn.004ab973
add esp, 8
test eax, eax
jne 0x473c3e
push SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.00441ab0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x4f28f8
mov dword [ebp - 4], 1
lea eax, [edi + 0x188]
push eax
lea ecx, [ebp - 0x18]
call fcn.00409b90
call fcn.004046f0
mov ebx, eax
test ebx, ebx
je 0x473c54
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4e2514]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
push 5
lea ecx, [ebp - 0x20]
call fcn.00443920
test al, al
jne 0x473b6b
mov byte [ebp - 4], 1
or ebx, 0xffffffff
jmp 0x473be0
push ecx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
call fcn.00408da0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x473b93
push dword [edi + 0x18c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x473ba5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x24]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x473bdc
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x473c06
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x473c3e
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4e2514]
mov ecx, edi
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402720
int3