joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471692
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x5e453f
call fcn.0046dc86
xor esi, esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0046432a
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.004643f0
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4716cb
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47173b
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x5e6c34
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x471708
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47173b
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x38]
call fcn.0046433d
call fcn.0046dc4f
ret 8
Function at 0x471c52
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5e4ef4
call fcn.0046dc86
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0046432a
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004643f0
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x471c92
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x471cf4
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x5e6c34
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x471ccf
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x471cf4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0046433d
call fcn.0046dc4f
ret 8

Function at 0x471d1c
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x5ddf2b
call fcn.0046dcba
mov esi, ecx
mov ebx, 0x5e6b60
lea eax, [ebp - 0x230]
push ebx
push str.InstallTime
push str.AppInfo
push eax
call fcn.004721c5
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
push ebx
call fcn.00428710
test eax, eax
jne 0x471dcc
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00480620
lea eax, [esi + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x471d80
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
push str.InstallTime
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x471dac
xor eax, eax
jmp 0x471db9
lea eax, [ebp - 0x218]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402ac0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00483ea9
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.0041ece0
mov eax, esi
call fcn.0046dc64
ret
Function at 0x471e63
Capabilities:
Read .ini file

Disassembly:
push 0x864
mov eax, 0x5e461c
call fcn.0046dcba
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00455267
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x858]
call fcn.00404030
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00480620
lea ecx, [ebx + 0xd4]
add esp, 0xc
cmp dword [ecx + 0x14], 8
jb 0x471ecd
mov ecx, dword [ecx]
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push ecx
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x810]
push 0x400
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x830], 0
xor eax, eax
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
cmp word [ebp - 0x810], ax
je 0x471f27
lea eax, [ebp - 0x810]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00402ac0
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x840]
call fcn.00454c92
test eax, eax
jne 0x471f97
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
mov ecx, ebx
cmovae eax, dword [ebp - 0x828]
push eax
push edi
push esi
lea eax, [ebp - 0x870]
push eax
call fcn.004721c5
push eax
lea ecx, [ebp - 0x858]
call fcn.00404270
xor ebx, ebx
lea ecx, [ebp - 0x870]
push ebx
push 1
call fcn.0041ece0
jmp 0x471fae
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp - 0x840]
push ebx
push eax
lea ecx, [ebp - 0x858]
call fcn.004029a0
cmp dword [ebp - 0x844], 8
lea eax, [ebp - 0x858]
cmovae eax, dword [ebp - 0x858]
push eax
call fcn.00483ea9
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x840]
mov esi, eax
call fcn.0041ece0
push ebx
push 1
lea ecx, [ebp - 0x858]
call fcn.0041ece0
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ece0
mov eax, esi
call fcn.0046dc64
ret 0xc
Function at 0x471fff
Capabilities:
Read .ini file

Disassembly:
push 0x844
mov eax, 0x5e4671
call fcn.0046dcba
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
and dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x844], eax
call fcn.00404060
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00404030
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0x84c], 1
jne 0x4720d8
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00480620
lea eax, [ebx + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x47208e
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x848]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x4720bc
xor eax, eax
jmp 0x4720c9
lea eax, [ebp - 0x810]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00402ac0
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.00454c92
test eax, eax
jne 0x47211c
push edi
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
mov ecx, ebx
push dword [ebp - 0x848]
push eax
call fcn.004721c5
push eax
mov ecx, esi
call fcn.00404270
push 0
push 1
lea ecx, [ebp - 0x840]
call fcn.0041ece0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ece0
mov eax, esi
call fcn.0046dc64
ret 0x14

Function at 0x472219
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x5e46a4
call fcn.0046dcba
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x472244
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x472322
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5e6948
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00402ac0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00480620
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5e6b30
push eax
call fcn.00407df0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x4722d7
call fcn.00472135
jmp 0x4722dc
call fcn.004721ef
push eax
lea ecx, [ebp - 0x828]
call fcn.00404270
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.0041ece0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00483ea9
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.0041ece0
mov eax, esi
call fcn.0046dc64
ret 0xc
Function at 0x47232c
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5e46ee
call fcn.0046dcba
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.00480620
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x472389
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00404060
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x4723cf
mov eax, dword [esi]
jmp 0x4723d1
mov eax, esi
push ebx
push eax
call fcn.0048f3ee
pop ecx
pop ecx
test eax, eax
jne 0x47241d
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x472401
call fcn.00472135
jmp 0x472406
call fcn.004721ef
push eax
mov ecx, esi
call fcn.00404270
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ece0
mov eax, esi
call fcn.0046dc64
ret 0x10
Function at 0x472fcf
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00480620
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x473008
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5eb840
push eax
call fcn.00407df0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x473040
lea eax, [ebp - 0x20c]
push eax
call fcn.00458c36
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00480620
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5e9d58
push eax
call fcn.00407df0
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x47307f
mov eax, esi
jmp 0x47308c
lea eax, [ebp - 0x414]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00402ac0
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00480620
push str.Cache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5e9d58
push eax
call fcn.00407df0
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x4730de
mov eax, esi
jmp 0x4730eb
lea eax, [ebp - 0x61c]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00402ac0
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.00480620
lea eax, [ebp - 0xa44]
push 0x5e6b88
push eax
call fcn.004595ae
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x47312c
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5e89d4
push eax
call fcn.00407df0
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.0041ece0
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47316d
lea eax, [ebp - 0x824]
push eax
call fcn.00458c36
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.00480620
push str.Cache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5e9d58
push eax
call fcn.00407df0
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x4731b7
lea eax, [ebp - 0xa2c]
push eax
call fcn.0048ed77
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00402ac0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046d802
mov esp, ebp
pop ebp
ret
Function at 0x47378a
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x5e47c0
call fcn.0046dcba
mov ebx, ecx
call fcn.00471d04
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.00451f3c
mov esi, str.WanNengWBInfo.ini
push esi
call fcn.0048ed77
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00405c20
push str.guanf
push 0x5e7a74
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004721c5
and dword [ebp - 4], 0
lea esi, [ebx + 0xec]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x473800
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004029a0
push str.guanf
mov ecx, esi
call fcn.00428710
test eax, eax
jne 0x47387c
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00480620
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x47382d
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.guanf
push eax
push edi
push 0x5e7a74
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x47385e
xor eax, eax
jmp 0x47386b
lea eax, [ebp - 0x218]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402ac0
jmp 0x473881
mov edi, str.guanf
push edi
mov ecx, esi
call fcn.00428710
test eax, eax
jne 0x473944
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00404030
push str.WanNengWBInfo.ini
mov byte [ebp - 4], 1
call fcn.0048ed77
pop ecx
push eax
push str.WanNengWBInfo.ini
lea ecx, [ebp - 0x230]
call fcn.00405c20
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5e7a74
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x473915
xor eax, eax
jmp 0x473922
lea eax, [ebp - 0x218]
push eax
call fcn.0048ed77
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402ac0
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.0041ece0
push edi
mov ecx, esi
call fcn.00428710
test eax, eax
jne 0x473980
push edi
push 0x5e7a74
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0047232c
push eax
mov ecx, esi
call fcn.00404270
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0041ece0
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0041ece0
call fcn.0046dc64
ret
Function at 0x474bed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x474c6c
push ebx
push edi
xor edi, edi
push str.c335b80a32136330ebfa2439bf4cbfcb
mov dword [ebp + 8], edi
call fcn.0048edf0
mov ebx, dword [ebp + 0xc]
mov edx, edi
pop ecx
test ebx, ebx
je 0x474c29
mov cl, byte [edi + str.c335b80a32136330ebfa2439bf4cbfcb]
xor byte [edx + esi], cl
inc edi
xor ecx, ecx
cmp edi, eax
cmovge edi, ecx
inc edx
cmp edx, ebx
jb 0x474c13
cmp ebx, 1
jle 0x474c60
cmp byte [esi], 0x37
jne 0x474c60
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x474c3e
cmp al, 0x5a
jne 0x474c60
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.0044bb60
test eax, eax
je 0x474c60
mov edx, dword [ebp + 8]
test edx, edx
je 0x474c60
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x474c6a
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x4756e8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.00452215
test al, al
je 0x475716
stosd dword es:[edi], eax
loop 0x47577b
dec ebp
xchg esi, eax
mov dl, 0xea
sbb esp, dword ss:[eax + 0xbfbd12e]
push es
nop
dec edx
sbb dh, byte [eax + 0x15]
pop ss
call 0x91b6b326
call fcn.004520bc
test al, al
je 0x47573d
add dl, byte [edx]
xor dword [ecx + 0x10b40067], ebp
hlt
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
pop edi
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], ecx
dec ebp
cld
call fcn.0045250c
test al, al
je 0x475798
sbb bl, al
sub esi, dword [eax]
stc
push ebp
inc edx
mov al, byte [0x5968a2db]
jnp 0x47577c
salc
invalid
call fcn.00452215
test al, al
je 0x4757c0
xlatb
in al, dx
mov dh, 0x8f
out dx, eax
sahf
fldcw word [ecx + 0x7c]
pop esi
jb 0x475818
int 0x86
in eax, dx
mov ebx, 0xe4bba865
sbb eax, 0xf6a6f9ed
insd dword es:[edi], dx
add eax, 0x2d9aa635
imul byte [ebp + 5]
xor eax, 0xe82d9aa6
insd dword es:[edi], dx
enter 0xfffffffffffffffd, 0xffffffffffffff84
sal byte [esi + edx + 0x63], 0x98
fld qword [edx + 0x385b5bc]
call fcn.00452032
test al, al
je 0x4757df
arpl word [eax - 0x4a437d23], bx
test dword [ebx], eax
cdq
xchg ebx, eax
or al, 0x3a
xchg edi, eax
mov esp, 0x1c9f0b3d
xchg esi, eax
das
and dword [ebx + ecx*4 + 0x5d], edx
cld
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x4757fa
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sbb esp, dword [ecx]
mov dh, 0xa5
jb 0x4757b9
mov ah, 0xbc
adc dword [edi - 0xeb8a01], ebp
jne 0x475838
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00475888
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x475888
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0045250c
test al, al
je 0x4758a9
add dl, byte [edi + 0xf007dc4]
retf
call fcn.00452215
test al, al
je 0x4758d1
movsd dword es:[edi], dword [esi]
fisttp qword [edx]
and byte [eax], al
or dword [ebx], ebx
rcr dword [ebp + 0x292a496], 0x6b
xor edx, esi
fst qword [esi - 0x783a794f]
outsb dx, byte [esi]
mov al, 0xdf
in al, 0x20
and dword [edi + 0x5ce8165b], 0xffffffc7
std
inc dword [eax + eax*8 + 0x5f1d1674]
fisttp qword [eax - 0x6d54dbb9]
call fcn.00452032
test al, al
je 0x4758f0
sbb eax, 0x4788dd5f
and al, 0xab
xchg edx, eax
sub byte [ebx + 0x7e], cl
das
nop
lodsb al, byte [esi]
loop 0x47593a
in al, dx
adc al, 0x73
sub eax, 0xc933c9f0
xor ecx, ecx
xor edx, edx
xor ebx, ebx
cmp dword [ebp + 0xc], ecx
jle 0x4759f3
mov esi, dword [ebp + 8]
mov al, byte [ebx + esi]
cmp al, 0x3d
jne 0x47590f
inc edx
cmp edx, 2
jg 0x475950
cmp al, 0x7f
ja 0x475950
movzx eax, al
mov al, byte [eax + 0x5ef3a0]
cmp al, 0x7f
je 0x475950
cmp al, 0x40
jae 0x475928
test edx, edx
jne 0x475950
inc ecx
inc ebx
mov dword [ebp - 4], ebx
cmp ebx, dword [ebp + 0xc]
jl 0x475902
test ecx, ecx
je 0x4759f3
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x475958
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x475952
push 0xffffffffffffffee
pop eax
jmp 0x4759f5
add byte [eax], al
add al, ch
push 0xffffffffffffffcb
std
inc dword [eax + eax*8 - 0xd84e78c]
call fcn.004524c7
test al, al
je 0x475979
jnp 0x475955
and byte [ebx], 0x39
retf 0x2de2
and dword [ebp - 4], 0
xor eax, eax
mov edx, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
push 3
pop esi
test ebx, ebx
jle 0x4759ee
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov cl, byte [eax + 0x5ef3a0]
xor eax, eax
cmp cl, 0x40
sete al
sub esi, eax
movzx eax, cl
mov ecx, dword [ebp - 4]
and eax, 0x3f
shl ecx, 6
or ecx, eax
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
cmp eax, 4
jne 0x4759e5
xor eax, eax
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x4759d0
mov eax, ecx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp esi, 1
jle 0x4759dd
mov eax, ecx
shr eax, 8
mov byte [edx], al
inc edx
cmp esi, 2
jle 0x4759e5
mov byte [edx], cl
inc edx
dec ebx
inc edi
test ebx, ebx
jg 0x47598f
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4759fc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x475a10
xor eax, eax
jmp 0x475b4e
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x475a39
dec edx
sub edx, 1
jne 0x475a3b
add eax, 2
jmp 0x475a3b
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x475a4e
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x475b4d
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x475ae4
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x5ef360]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x5ef360]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x5ef360]
mov byte [edi + 2], al
mov al, byte [esi + 0x5ef360]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x475a79
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x475ae7
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x475b40
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x475afc
movzx ecx, byte [eax + 1]
jmp 0x475afe
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x5ef360]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x5ef360]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x475b35
and ecx, 0xf
mov al, byte [ecx*4 + 0x5ef360]
mov byte [edi + 2], al
jmp 0x475b39
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475d16
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5ef17c
call fcn.0048ed77
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0048f635
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.00480620
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.00480620
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.00480620
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x475e14
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.004089f0
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00406390
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4