joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4692c9
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x6c6f93
call fcn.006b9c3c
sub esp, 0xec
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 2
call fcn.0040f6f5
push eax
lea ecx, [ebp - 0x14]
call fcn.004ab6cf
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
movzx ebx, bx
push 0x64
push esi
lea eax, [ebp - 0xf8]
push eax
call fcn.005077d5
add esp, 0xc
push 0x32
lea eax, [ebp - 0xf8]
push eax
push 0x1001
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jne 0x469376
push esi
mov ecx, edi
call fcn.004a63fc
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 5
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004ab6b4
mov byte [ebp - 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x64
push esi
lea eax, [ebp - 0x90]
push eax
call fcn.005077d5
add esp, 0xc
push 0x32
lea eax, [ebp - 0x90]
push eax
push 0x1002
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jne 0x4693b6
push esi
mov ecx, edi
call fcn.004a63fc
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 6
jmp 0x469353
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xf8]
push eax
push str._s___s
lea eax, [ebp - 0x14]
push eax
call fcn.004b0575
add esp, 0x10
push dword [ebp - 0x14]
mov ecx, edi
call fcn.004a63fc
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 7
jmp 0x469353
Function at 0x471490
Capabilities:
Get session user name

Disassembly:
mov eax, 0x6c8113
call fcn.006b9c3c
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
push 2
pop edx
mov byte [ebp - 4], dl
mov eax, 0x1ff
mov dword [ebp - 0x20], eax
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0068a1e7
pop ecx
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push edi
lea ecx, [ebp - 0x44]
call fcn.004a63fc
mov byte [ebp - 4], 3
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.00461197
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.004ab703
push edi
call fcn.0068a1e2
pop ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
cmp dword [esi + 0x14], 0x10
jb 0x47152f
mov eax, dword [esi]
jmp 0x471531
mov eax, esi
mov byte [eax], bl
lea eax, [ebp - 0x5c]
push eax
mov ecx, esi
call fcn.0041208e
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
push ebx
push eax
lea ecx, [ebp - 0x5c]
call fcn.00411bc8
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4750f4
Capabilities:
Check os version

Disassembly:
mov eax, 0x6c8aa0
call fcn.006b9c3c
sub esp, 0x128
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
mov eax, dword [0x78f5b0]
cmp eax, 0xffffffff
jne 0x47515c
mov dword [ebp - 0x134], 0x114
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x475155
cmp dword [ebp - 0x124], 2
jne 0x475155
cmp dword [ebp - 0x130], 6
jb 0x475155
xor eax, eax
inc eax
jmp 0x475157
mov eax, ebx
mov dword [0x78f5b0], eax
test eax, eax
setne al
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4764fe
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x6c8c6d
call fcn.006b9c3c
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x11], cl
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 3
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae esi, dword [ebp + 8]
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae edx, dword [ebp + 0x20]
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ebp - 0x11], al
setne al
push eax
push esi
push edx
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg byte [ebp - 0x11]
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.004ab703
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0x20]
call fcn.004ab703
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4765db
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x6c8c8f
call fcn.006b9c3c
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0x40
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], str.open
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ebx
xor eax, eax
test cl, cl
setne al
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp byte [ebp - 0x11], bl
je 0x476668
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_GetProcessId]
mov edi, eax
jmp 0x47666b
mov edi, dword [ebp - 0x24]
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.004ab703
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0x20]
call fcn.004ab703
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4766de
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8cba
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476771
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8ce5
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push 0x24
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476804
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov eax, 0x6c8d10
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push 7
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476897
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8d3b
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push 8
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47692a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8d66
call fcn.006b9c3c
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push eax
push 0x6e68f0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4769b8
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8d91
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push 5
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476a4b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8dbc
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push eax
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476add
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8de7
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push 0x1c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x476b70
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8e12
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476c03
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6c8e3d
call fcn.006b9c3c
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
push ecx
push eax
push eax
push 0x25
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, esi
call fcn.004a63fc
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4778de
Capabilities:
Create directory

Disassembly:
mov eax, 0x6c9174
call fcn.006b9c3c
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp + 8]
call fcn.004ab703
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479233
Capabilities:
Get file version info

Disassembly:
mov eax, 0x6c9727
call fcn.006b9c3c
sub esp, 0x238
push ebx
push esi
push edi
mov eax, edx
mov esi, ecx
push 0
mov dword [ebp - 0x24], esi
and dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x479274
push 0x73c9f8
mov ecx, esi
call fcn.004a63fc
jmp 0x47932f
push ebx
call fcn.0068a1e7
pop ecx
mov edi, eax
push edi
push ebx
xor ebx, ebx
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x4792ab
push edi
call fcn.0068a1e2
mov ecx, esi
mov dword [esp], 0x73c9f8
call fcn.004a63fc
mov dword [ebp - 4], ebx
jmp 0x479333
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [ebp - 0x20]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x47928f
test dword [ebp - 0x1c], 0xfffffffc
jbe 0x47931b
mov ecx, dword [ebp - 0x20]
movzx eax, word [ecx + ebx*4 + 2]
push eax
movzx eax, word [ecx + ebx*4]
push eax
lea eax, [ebp - 0x244]
push str.StringFileInfo_04x_04xFileDescription
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x28]
add esp, 0x10
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x47934d
mov eax, dword [ebp - 0x1c]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x4792cf
push edi
call fcn.0068a1e2
mov ecx, esi
mov dword [esp], 0x73c9f8
call fcn.004a63fc
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
call fcn.004a63fc
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push edi
call fcn.0068a1e2
and dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
pop ecx
mov word [esi], ax
mov ecx, esi
lea eax, [ebp - 0x40]
push eax
call fcn.004abf8f
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0
push ebx
call fcn.004ab703
jmp 0x47933a
Function at 0x479394
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x6c9772
call fcn.006b9c3c
sub esp, 0x32c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 2
push ebx
push 0x2a
lea eax, [ebp - 0x338]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x44]
call fcn.004a63fc
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x130]
call fcn.00486703
mov dword [ebp - 0x1c], eax
mov edi, ebx
mov dword [ebp - 0x20], edi
cmp edi, 0x25
jae 0x479421
push 0x6f
pop ecx
sub ecx, dword [eax + edi*4 + 0x28]
imul eax, ecx, 0x17
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x1c]
mov byte [edi + eax], dl
inc edi
jmp 0x4793fa
mov byte [eax + 0x25], bl
push eax
lea ecx, [ebp - 0x5c]
call fcn.00411aae
mov byte [ebp - 4], 4
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.00461060
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x44]
call fcn.004abef0
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.004ab703
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.00411bc8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x44]
push eax
call fcn.004a6481
mov byte [ebp - 4], 6
mov byte [ebp - 4], 3
call fcn.0044e82c
add esp, 0x18
test eax, eax
jne 0x4794cc
mov ecx, esi
call fcn.0042f5cc
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
push ebx
push eax
lea ecx, [ebp - 0x44]
call fcn.004ab703
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4794b9
mov ecx, ebx
call fcn.0040f5b8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
cmp dword [esi + 0x14], 8
jb 0x4794e6
mov eax, dword [esi]
jmp 0x4794e8
mov eax, esi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x44]
push eax
mov ecx, esi
call fcn.004abf8f
jmp 0x479496
Function at 0x47d0ca
Capabilities:
Download url
Receive data

Disassembly:
mov eax, 0x6ca15f
call fcn.006b9c3c
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c]
call fcn.0046073e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7c]
call fcn.00460bd6
mov byte [ebp - 4], 5
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.00461060
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x47d12c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004a6263
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.004ab703
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.00411bc8
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea ecx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
cmovae ecx, dword [ebp - 0x4c]
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push ebx
push ebx
push ecx
push eax
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
je 0x47d1ca
push 0x73a9e8
mov ecx, edi
call fcn.00411aae
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 3
push ebx
push esi
lea ecx, [ebp - 0x4c]
call fcn.004ab703
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.004ab703
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x18]
push eax
push 0x6e68e0
push 1
push ebx
push 0x6e68d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 8
push ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.005077d5
add esp, 0xc
push 8
pop eax
mov dword [ebp - 0x2c], eax
sub esi, ebx
je 0x47d249
sub esi, 1
je 0x47d240
sub esi, 1
je 0x47d237
sub esi, 1
je 0x47d22e
sub esi, 1
je 0x47d225
sub esi, 1
jne 0x47d249
mov dword [ebp - 0x28], 5
jmp 0x47d24c
mov dword [ebp - 0x28], 4
jmp 0x47d24c
mov dword [ebp - 0x28], 3
jmp 0x47d24c
mov dword [ebp - 0x28], 2
jmp 0x47d24c
mov dword [ebp - 0x28], 1
jmp 0x47d24c
mov dword [ebp - 0x28], ebx
lea edx, [ebp - 0x4c]
cmp dword [ebp - 0x38], eax
cmovae edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push ebx
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x2c]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push 7
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x73a9b8
mov ecx, edi
call fcn.00411aae
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
push ebx
push eax
lea ecx, [ebp - 0x4c]
call fcn.004ab703
mov byte [ebp - 4], bl
push ebx
push 1
jmp 0x47d1af
Function at 0x47e75c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push esi
push 0x10
xor esi, esi
push esi
push eax
call fcn.005077d5
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x47e7d8
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x47e7cd
mov eax, dword [ebp - 0xc]
push esi
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47e935
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x6ca4ed
call fcn.006b9c3c
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 2
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47e992
push 0x73a9e8
mov ecx, esi
call fcn.00411aae
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x47e9b7
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x73a9e8
mov ecx, esi
call fcn.00411aae
xor ebx, ebx
inc ebx
jmp 0x47e979
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
jne 0x47e9cb
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
jmp 0x47e9a0
push eax
lea ecx, [ebp - 0x40]
call fcn.004a63fc
mov byte [ebp - 4], 3
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.00461197
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.004ab703
jmp 0x47e97c