joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dbbeb
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push edi
mov eax, dword [0x5176f0]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x94]
lea edi, [esp + 0x64]
mov dword [esp + 0xc], esi
call fcn.004699d0
mov edi, eax
push 0x5027ac
lea eax, [esp + 0x30]
push ebx
push eax
mov dword [esp + 0x98], 0
call fcn.00468320
lea ecx, [esp + 0x1c]
push edi
push ecx
mov ebx, 1
mov ecx, eax
mov byte [esp + 0xa0], bl
call fcn.00469840
push eax
lea edx, [esp + 0x60]
push edx
mov ecx, str._is_not_a_valid_key_length
mov byte [esp + 0xa8], 2
call fcn.0045e270
add esp, 0x1c
mov edi, eax
mov ecx, esi
mov byte [esp + 0x8c], 3
call fcn.004ae132
mov byte [esp + 0x8c], 4
push edi
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], ebx
call fcn.00410a90
lea ecx, [esp + 0x48]
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
call fcn.0040b0a0
lea ecx, [esp + 0x10]
call fcn.0040b0a0
lea ecx, [esp + 0x2c]
call fcn.0040b0a0
lea ecx, [esp + 0x64]
call fcn.0040b0a0
mov dword [esi], vtable.CryptoPP::InvalidKeyLength.0
mov eax, esi
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004ae123
add esp, 0x84
ret 4

Function at 0x469c40
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x469c84
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x469c68
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x469cad
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x469cad
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x469ca0
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x469cc0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
mov eax, ebp
shr eax, 2
xor ecx, ecx
xor edx, edx
test eax, eax
je 0x469cfa
mov edx, edi
sub esi, edi
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esi + edx]
xor ebx, dword [edx]
add edx, 4
or ecx, ebx
dec eax
jne 0x469ce4
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
pop ebx
lea eax, [edx*4]
sub ebp, eax
jne 0x469d11
pop edi
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
pop ecx
ret
add esi, eax
add edi, eax
mov eax, ecx
mov edx, ecx
shr edx, 0x10
shr eax, 0x18
or al, dl
mov edx, ecx
shr edx, 8
or al, dl
or cl, al
test ebp, ebp
je 0x469d3f
mov eax, edi
sub esi, edi
mov edi, ebp
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x469d34
pop edi
xor eax, eax
test cl, cl
pop esi
sete al
pop ebp
pop ecx
ret
Function at 0x46b110
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov ecx, dword [eax + 0x8c]
push edi
add ecx, 8
mov edi, 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx - 8]
add ecx, 0x10
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4f0020]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0220]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0420]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4f0620]
mov eax, dword [ecx - 0x14]
xor edx, ebx
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4f0120]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0320]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0520]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4f0720]
xor edx, ebx
mov eax, edx
ror eax, 4
xor eax, dword [ecx - 0x10]
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4f0020]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0220]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0420]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4f0620]
mov eax, dword [ecx - 0xc]
xor esi, ebx
xor eax, edx
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x4f0120]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0320]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
xor ebx, dword [ebp*4 + 0x4f0520]
and eax, 0x3f
xor ebx, dword [eax*4 + 0x4f0720]
xor esi, ebx
dec edi
jne 0x46b132
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, dword [esp + 0x1c]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x46fa10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4dc530
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5176f0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push 1
push 0x51d9c0
mov dword [esp + 0x28], edx
xor edx, edx
push edx
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esi + 0x80]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004ae123
mov esp, ebp
pop ebp
ret 8

Function at 0x471960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc4e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5176f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x18]
push 0x501b40
push eax
call fcn.00470cb0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x10]
push edx
call fcn.00406d10
add esp, 0x14
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00404140
lea ecx, [ebp - 0x10]
call fcn.00403360
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x471a16
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.00407bf0
mov ecx, dword [esi + 8]
add esi, 4
mov dword [ebp + 8], ecx
push esi
lea ecx, [ebp + 8]
call fcn.0040d8c0
mov edx, dword [esi]
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edx
call fcn.0040d8c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
lea esi, [ebp - 0x1c]
call fcn.004724a0
add esp, 0xc
mov ecx, esi
call fcn.00404140
lea ecx, [ebp - 0x10]
call fcn.00404140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x474670
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d784b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 2
mov edi, ecx
mov dword [ebp - 0x244], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x248], esi
mov dword [ebp - method.CGuardHandle.virtual_0], vtable.CGuardHandle.0
push edi
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], ebx
call fcn.00407bf0
lea eax, [ebp - 0x23c]
push eax
mov ebx, 0x22c
push esi
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x474711
lea ecx, [ebp - 0x240]
call fcn.00404140
test esi, esi
je 0x47470a
cmp esi, 0xffffffff
je 0x47470a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x474792
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea ecx, [ebp - 0x23c]
push ecx
push esi
mov dword [ebp - 0x23c], ebx
call edi
test eax, eax
je 0x474771
jmp 0x474730
lea ecx, [ebp - 0x240]
call fcn.00403360
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.004aea86
add esp, 8
test eax, eax
je 0x474765
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], ebx
call edi
test eax, eax
jne 0x474730
jmp 0x474771
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x244], ecx
lea ecx, [ebp - 0x240]
call fcn.00404140
test esi, esi
je 0x47478c
cmp esi, 0xffffffff
je 0x47478c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
Function at 0x474a60
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dba61
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00403360
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x474c3c
lea eax, [ebp - 0x26c]
push str..
push eax
mov esi, edi
call fcn.00470cb0
add esp, 8
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], 0
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x274], esi
cmp esi, 0xffffffff
je 0x474c31
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x238]
push 0x50420c
push edx
call fcn.004aea86
add esp, 8
test eax, eax
je 0x474bb4
lea eax, [ebp - 0x238]
push 0x504210
push eax
call fcn.004aea86
add esp, 8
test eax, eax
je 0x474bb4
lea ecx, [ebp - 0x270]
push 0x501b40
push ecx
mov esi, edi
call fcn.00470cb0
lea edx, [ebp - 0x238]
push edx
lea ecx, [ebp - 0x268]
push ecx
mov esi, eax
mov byte [ebp - 4], 1
call fcn.00470cb0
add esp, 0x10
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 3
call fcn.00404140
push 0x20
lea ecx, [ebp - 0x268]
call fcn.00403360
push eax
call ebx
test byte [ebp - 0x264], 0x10
je 0x474b94
lea edx, [ebp - 0x268]
push edx
call fcn.00474a60
add esp, 4
jmp 0x474b9f
lea ecx, [ebp - 0x268]
call fcn.00474e80
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0
call fcn.00404140
mov esi, dword [ebp - 0x274]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x474af4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
mov ecx, edi
call fcn.00403360
push eax
call ebx
mov ecx, edi
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x474c1a
mov ecx, dword [edi]
push ecx
push str.REBOOT_DEL_DIR__s
call fcn.00425090
mov esi, eax
call fcn.00476610
add esp, 8
push 4
push 0
mov ecx, edi
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x474c31
mov edx, dword [edi]
push edx
push str.DEL_DIR__s
call fcn.00425090
mov esi, eax
call fcn.00476610
add esp, 8
lea ecx, [ebp - 0x26c]
call fcn.00404140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
Function at 0x474c60
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4dc371
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x5176f0]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push esi
mov eax, dword [0x5176f0]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, edi
mov dword [esp + 0x20], eax
call fcn.00403360
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x474e59
lea ecx, [esp + 0x14]
push str..
push ecx
mov esi, edi
call fcn.00470cb0
add esp, 8
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x28c], 0
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x474e50
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov byte [esp + 0xf], 0
lea ebx, [ebx]
lea eax, [esp + 0x50]
push 0x50420c
push eax
call fcn.004aea86
add esp, 8
test eax, eax
je 0x474dff
lea ecx, [esp + 0x50]
push 0x504210
push ecx
call fcn.004aea86
add esp, 8
test eax, eax
je 0x474dff
lea edx, [esp + 0x18]
push 0x501b40
push edx
mov esi, edi
call fcn.00470cb0
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x1c]
push edx
mov esi, eax
mov byte [esp + 0x298], 1
call fcn.00470cb0
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x288], 3
call fcn.00404140
push 0x20
lea ecx, [esp + 0x14]
call fcn.00403360
push eax
call ebx
test byte [esp + 0x24], 0x10
je 0x474da6
lea eax, [esp + 0x10]
push eax
call fcn.00474a60
add esp, 4
jmp 0x474dea
mov ecx, dword [esp + 0x20]
call fcn.00403360
lea ecx, [esp + 0x50]
push ecx
push eax
call fcn.004aea86
add esp, 8
test eax, eax
jne 0x474dc8
mov byte [esp + 0xf], 1
jmp 0x474dea
mov edx, dword [esp + 0x10]
push edx
push str.DEL__s
call fcn.00425090
mov esi, eax
call fcn.00476610
add esp, 8
lea ecx, [esp + 0x10]
call fcn.00474e80
lea ecx, [esp + 0x10]
mov byte [esp + 0x288], 0
call fcn.00404140
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x474d10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
mov ecx, edi
call fcn.00403360
push eax
call ebx
cmp byte [esp + 0xf], 0
jne 0x474e50
mov ecx, edi
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x474e50
push 4
push eax
mov ecx, edi
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x14]
call fcn.00404140
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
Function at 0x475140
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dac0b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x130], esi
call fcn.00475a80
test al, al
je 0x4751bf
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x154]
cmp ax, 9
je 0x47519d
cmp ax, 6
jne 0x4751ae
push str.win10_64
mov ecx, edi
call fcn.00404040
jmp 0x4752c8
push str.win10_32
mov ecx, edi
call fcn.00404040
jmp 0x4752c8
push 0x11c
lea ecx, [ebp - 0x12c]
push esi
push ecx
call fcn.004b28e0
add esp, 0xc
push str.error
lea ecx, [ebp - 0x130]
call fcn.00404040
lea edx, [ebp - 0x12c]
mov dword [ebp - 4], esi
push edx
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4752af
mov eax, dword [ebp - 0x128]
sub eax, 5
je 0x47528f
dec eax
jne case.default.0x475223
mov eax, dword [ebp - 0x124]
cmp eax, 3
ja case.default.0x475223
jmp dword [eax*4 + 0x4752f4]
cmp byte [ebp - 0x12], 1
lea ecx, [ebp - 0x130]
jne 0x4752a5
push str.Vista
jmp 0x4752aa
cmp byte [ebp - 0x12], 1
jne case.default.0x475223
call fcn.004755e0
lea ecx, [ebp - 0x130]
test eax, eax
je 0x47526a
push str.win7_64
call fcn.00404020
push eax
lea esi, [ebp - 0x130]
call fcn.00470e00
jmp 0x4752af
push str.win7_32
call fcn.00404020
push eax
lea esi, [ebp - 0x130]
call fcn.00470e00
jmp 0x4752af
push str.Win8
lea ecx, [ebp - 0x130]
jmp 0x4752aa
mov eax, dword [ebp - 0x124]
sub eax, esi
je case.default.0x475223
dec eax
je 0x4752e4
dec eax
jne 0x4752af
lea ecx, [ebp - 0x130]
push str.other
call fcn.00404020
lea eax, [ebp - 0x130]
push eax
mov ecx, edi
call fcn.00407bf0
lea ecx, [ebp - 0x130]
call fcn.00404140
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
push 0x504348
lea ecx, [ebp - 0x130]
jmp 0x4752aa

Function at 0x475480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], 0
mov word [ebp - 0x20c], ax
call fcn.004b28e0
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00404aa0
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.004ae123
mov esp, ebp
pop ebp
ret

Function at 0x4755e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x24]
cmp ax, 9
je 0x475606
cmp ax, 6
je 0x475606
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x475610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004b28e0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x475679
cmp dword [ebp - 0x11c], 6
jb 0x475679
cmp dword [ebp - 0x118], 2
jb 0x475679
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004ae123
mov esp, ebp
pop ebp
ret

Function at 0x4758b0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
mov esi, 0x100
push ecx
mov dword [ebp - 0x60c], esi
mov word [ebp - 0x204], ax
call fcn.004b28e0
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0x402]
push eax
mov word [ebp - 0x404], dx
call fcn.004b28e0
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x602]
push edx
mov word [ebp - 0x604], cx
call fcn.004b28e0
add esp, 0x24
lea eax, [ebp - 0x608]
push eax
lea ecx, [ebp - 0x204]
push ecx
mov dword [ebp - 0x608], esi
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x610], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
pop esi
test eax, eax
jne 0x47596b
push str.Fail_To_Get_UserName_n
call fcn.004b0f4b
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x475974
sub eax, edx
sar eax, 1
inc eax
mov dword [ebp - 0x608], eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x604]
push ecx
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x47595b
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x47595b
lea eax, [ebp - 0x60c]
push eax
lea ecx, [ebp - 0x404]
push edi
push ecx
call fcn.00475780
add esp, 0xc
test eax, eax
je 0x47595b
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.004ae123
mov esp, ebp
pop ebp
ret

Function at 0x475b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], 0
mov word [ebp - 0x20c], ax
call fcn.004b28e0
add esp, 0xc
push 0
push 0x25
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, esi
test eax, eax
je 0x475b7d
lea eax, [ebp - 0x20c]
push eax
jmp 0x475b82
push 0x4fdaac
call fcn.00404040
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.004ae123
mov esp, ebp
pop ebp
ret
Function at 0x4763c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dab32
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
push 0x258
mov dword [ebp - 0x270], eax
push eax
mov edi, edx
lea eax, [ebp - 0x26a]
xor edx, edx
push eax
mov dword [ebp - 0x278], esi
mov dword [ebp - 0x274], ecx
mov word [ebp - 0x26c], dx
call fcn.004b28e0
add esp, 0xc
mov ecx, edi
call fcn.00403360
push eax
push 0x12c
lea ecx, [ebp - 0x26c]
push ecx
mov ecx, dword [ebp - 0x274]
push 0x4fdaac
call fcn.00403360
push eax
mov ecx, ebx
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x26c]
push edx
mov ecx, esi
call fcn.00404040
push 0x504410
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x270], 1
call fcn.00475cf0
mov edi, eax
call fcn.00475c40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret 4
Function at 0x476c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4daa6b
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.004b7b90
mov eax, dword [0x5176f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x2020]
push eax
push 0x20019
mov dword [ebp - 0x201c], 0
push 0
mov dword [ebp - 0x2024], 0x20019
call fcn.00403360
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x476da6
xor ecx, ecx
push 0x2000
push ecx
lea edx, [ebp - 0x2012]
push edx
mov word [ebp - 0x2014], cx
call fcn.004b28e0
add esp, 0xc
lea eax, [ebp - 0x201c]
push eax
lea ecx, [ebp - 0x2014]
push ecx
lea edx, [ebp - 0x2024]
push edx
push 0
mov ecx, edi
mov dword [ebp - 0x201c], 0x1000
call fcn.00403360
push eax
mov eax, dword [ebp - 0x2020]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x476da6
mov ecx, dword [ebp - 0x2020]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2018]
call fcn.00403540
lea edx, [ebp - 0x2014]
push edx
push 0x5046bc
lea edx, [ebp - 0x2018]
mov dword [ebp - 4], 0
call fcn.00475ed0
add esp, 8
lea eax, [ebp - 0x2018]
push eax
mov ecx, esi
call fcn.00407bf0
lea ecx, [ebp - 0x2018]
call fcn.00404140
jmp 0x476db2
push 0x4fdaac
mov ecx, esi
call fcn.00404040
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae123
mov esp, ebp
pop ebp
ret