joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4708b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x14
mov eax, 0x76306b
call fcn.0048d234
mov esi, ecx
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ebx, [edi + 8]
movzx eax, word [ebx]
sub eax, 0
je 0x470a3d
dec eax
je 0x470995
dec eax
je 0x47096c
dec eax
je 0x47093e
dec eax
je 0x470910
dec eax
je 0x470995
call fcn.004618b4
movzx ecx, word [ebx]
push ecx
push str._server_agent_Read_data_warning:___d_
push 5
push eax
call fcn.004621aa
add esp, 0x10
call fcn.0048d2d9
ret 4
call fcn.004618b4
push str._server_agent_Read_data_:yjs_connect_def_node_success.
push 5
push eax
call fcn.004621aa
add esp, 0xc
push 2
mov ecx, esi
call fcn.0046d17a
push ebx
mov ecx, esi
mov dword [esi + 0x57e4], eax
call fcn.004704e6
jmp 0x470908
call fcn.004618b4
push str._server_agent_Read_data_:sdk_connect_def_node
push 5
push eax
call fcn.004621aa
add esp, 0xc
push 2
mov ecx, esi
call fcn.0046d17a
push ebx
mov ecx, esi
mov dword [esi + 0x57e4], eax
call fcn.004706c8
jmp 0x470908
call fcn.004618b4
push str._server_agent_Read_data_:_write_to_client.
push 5
push eax
call fcn.004621aa
add esp, 0xc
push dword [edi + 4]
lea ecx, [esi + 0x56d0]
push ebx
call fcn.00477470
jmp 0x470908
call fcn.004618b4
push str._agent_server_Server_connect_and_register_success.
push 5
push eax
call fcn.004621aa
add esp, 0xc
lea ecx, [esi + 0x168]
mov dword [esi + 0x57e4], 7
call fcn.004527d0
lea ebx, [esi + 0x51a0]
mov byte [esi + 9], 0
mov byte [ebx], 1
lea edi, [esi + 0x56a8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x5780]
mov ecx, dword [edi]
mov dword [esi + ecx*4 + 0x51a4], eax
inc dword [edi]
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.0046e482
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0046da2c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x470a14
call fcn.0044832a
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x56b0]
call fcn.00477470
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x470908
call fcn.0044832a
jmp 0x470908
call fcn.004618b4
push str._server_agent_Read_data_:_Heartbeat_package.
push 6
push eax
call fcn.004621aa
add esp, 0xc
mov byte [esi + 9], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x10]
mov ecx, eax
mov eax, dword [esi + 0x56a8]
cmp eax, 0x12c
jl 0x470a97
lea eax, [esi + 0x56a4]
mov edx, dword [eax]
mov dword [esi + edx*4 + 0x51a4], ecx
mov ecx, dword [eax]
cmp ecx, 0x12b
jl 0x470a8f
and dword [eax], 0
jmp 0x470908
inc ecx
mov dword [eax], ecx
jmp 0x470908
mov dword [esi + eax*4 + 0x51a4], ecx
inc dword [esi + 0x56a8]
jmp 0x470908
Function at 0x471a37
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0048d310
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
leave
ret

Function at 0x471a75
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push 0x40
xor esi, esi
lea eax, [ebp - 0x40]
push esi
push eax
mov dword [ebp - 0x44], 0x44
call fcn.0048d310
add esp, 0xc
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
leave
ret

Function at 0x471d49
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 4
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x471d68
or eax, 0xffffffff
jmp 0x471de3
push ebx
push esi
mov esi, 0x10000
push esi
push 0x40
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 3
push 0x30
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x471db2
push str.EnumServicesStatus_Eorror_n
call fcn.004910b0
pop ecx
or eax, 0xffffffff
jmp 0x471de1
cmp dword [ebp - 4], edi
jbe 0x471dd6
lea esi, [ebx + 4]
mov eax, dword [esi]
push str.Virtual_Machine
push eax
call fcn.00490e60
pop ecx
pop ecx
test eax, eax
jne 0x471de6
inc edi
add esi, 0x24
cmp edi, dword [ebp - 4]
jb 0x471dba
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret
xor eax, eax
inc eax
jmp 0x471de1

Function at 0x471e07
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
je 0x471e29
cmp word [ebp - 0x24], 6
je 0x471e29
xor eax, eax
leave
ret
xor eax, eax
inc eax
leave
ret
Function at 0x471e2e
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x471ebd
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x471eb2
mov ecx, str.VBoxService.exe
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x471e9c
test dx, dx
je 0x471e98
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x471e9c
add eax, 4
add ecx, 4
test dx, dx
jne 0x471e76
xor eax, eax
jmp 0x471ea1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x471ecc
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x471e6b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048d1f2
leave
ret
xor eax, eax
inc eax
jmp 0x471ebf

Function at 0x471f26
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.CheckHypeVRegistry2222
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.00471e07
test eax, eax
lea eax, [ebp - 4]
push eax
je 0x471f49
push 0x20119
jmp 0x471f4e
push 0x20019
push 0
push str.SoftwareMicrosoftVirtual_MachineGuestParameters
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x471f72
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4723dc
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x472caf
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x388]
sub esp, 0x408
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x384], eax
mov eax, dword [ebp + 0x390]
and dword [ebp - 0x80], 0
push edi
mov edi, dword [ebp + 0x394]
push 0x789bb4
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0048f5eb
add esp, 0xc
cmp dword [ebp - 0x80], 0
je 0x472d45
push esi
push edi
call fcn.004723dc
push dword [ebp - 0x80]
mov esi, 0x400
push esi
lea eax, [ebp - 0x7c]
push 1
push eax
call fcn.0048f1d7
add esp, 0x14
jmp 0x472d30
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.00472b7f
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push esi
push 1
push eax
call fcn.0048f1d7
add esp, 0x1c
test eax, eax
jne 0x472d13
push edi
call fcn.00472c0d
push dword [ebp - 0x80]
call fcn.0048eebb
pop ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x384]
xor ecx, ebp
pop edi
call fcn.0048d1f2
add ebp, 0x388
leave
ret
Function at 0x4757c5
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x118
cmp eax, 0xffffffff
jne 0x4757e8
mov ecx, dword [ebp + 0x14]
push 0x2719
call fcn.00447afc
or eax, 0xffffffff
leave
ret
xor ecx, ecx
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 0xc]
push ebx
inc ecx
push esi
and al, cl
push edi
mov dword [ebp - 0x118], ecx
mov byte [ebp - 1], al
je 0x47580e
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jmp 0x47582b
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, ebx
jl 0x475830
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
lea edi, [ebp - 0xc]
jmp 0x475832
xor edi, edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, dword [ebp + 0x14]
push esi
push edi
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp + 8]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.00447b15
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
jne 0x475891
cmp byte [ebp - 1], bl
je 0x47587a
mov ebx, 0x2733
call fcn.005be2b0
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0xc]
jmp 0x475888
mov dword [ebp - 0x14], ebx
call fcn.005be2b0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi], ecx
jmp 0x47589a
jle 0x47589d
call fcn.005be2b0
mov dword [esi], ebx
mov dword [esi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4758a4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x4758ca
mov ecx, dword [ebp + 0x10]
push 0x2719
call fcn.00447afc
or eax, esi
jmp 0x47594c
xor eax, eax
inc eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x108], esi
test eax, eax
jl 0x475907
cdq
mov ecx, 0x3e8
idiv ecx
lea ebx, [ebp - 8]
imul edx, edx, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp 0x475909
xor ebx, ebx
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [ebp + 0x10]
push edi
push ebx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
inc esi
push esi
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.00447b15
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jl 0x475948
xor esi, esi
call fcn.005be2b0
mov dword [edi], esi
mov dword [edi + 4], eax
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret
Function at 0x475be8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ebx, ebx
cmp byte [ebp + 0x18], bl
je 0x475c07
push ebx
push ebx
jmp 0x475c59
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x475c19
push ebx
push 0x2719
jmp 0x475c59
push edi
push ebx
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x18]
push dword [ebp + 0x14]
mov dword [ebp + 0x18], ebx
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
jne 0x475c49
mov eax, 0x274d
cmp edi, ebx
pop edi
je 0x475c66
cmp eax, 0x3e5
je 0x475c66
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.00462c67
jmp 0x475c71
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.00462c00
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x478c72
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x14], 0
mov eax, dword [ebp + 8]
mov dl, byte [eax]
mov cl, byte [eax + 1]
jbe 0x478d0f
push ebx
push esi
push edi
movzx esi, dl
movzx edi, cl
lea edx, [esi + 1]
and edx, 0x800000ff
jns 0x478ca4
dec edx
or edx, 0xffffff00
inc edx
movzx esi, dl
lea ecx, [esi + eax + 2]
mov bl, byte [ecx]
mov byte [ebp + 0xb], bl
movzx ebx, bl
add ebx, edi
and ebx, 0x800000ff
jns 0x478cc5
dec ebx
or ebx, 0xffffff00
inc ebx
movzx edi, bl
mov byte [ebp - 1], bl
mov bl, byte [edi + eax + 2]
mov byte [ecx], bl
mov bl, byte [ebp + 0xb]
mov byte [edi + eax + 2], bl
movzx ecx, byte [ecx]
movzx ebx, bl
add ecx, ebx
and ecx, 0x800000ff
jns 0x478cf0
dec ecx
or ecx, 0xffffff00
inc ecx
mov ebx, dword [ebp + 0xc]
mov cl, byte [ecx + eax + 2]
xor cl, byte [ebx]
mov ebx, dword [ebp + 0x10]
inc dword [ebp + 0xc]
inc dword [ebp + 0x10]
dec dword [ebp + 0x14]
mov byte [ebx], cl
jne 0x478c91
mov cl, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov byte [eax], dl
mov byte [eax + 1], cl
leave
ret

Function at 0x478f32
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x478f49
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 0x24], 0
pop esi
ret
Function at 0x478f4b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
lea eax, [ebp - 0x70]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE103180000
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x479006
push esi
push edi
push 0xfe
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push ebx
push eax
call fcn.0048d310
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push ebx
mov esi, str.ProviderName
push esi
push dword [ebp - 0x70]
mov edi, 0x80
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x478ffb
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x78]
lea edi, [ebp - 0x6c]
mov esi, 0x78b75c
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x478ffb
mov dword [ebp - 0x74], ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp + 0x94]
mov eax, dword [ebp - 0x74]
xor ecx, ebp
pop ebx
call fcn.0048d1f2
add ebp, 0x98
leave
ret
Function at 0x479bf5
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
je 0x479c37
cmp dword [ebp + 0xc], eax
je 0x479c37
push 2
push ecx
push str.1.0.0
push dword [ebp + 0xc]
call fcn.00479466
test eax, eax
je 0x479c37
push 1
call fcn.004793b2
pop ecx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
call fcn.004793b2
xor eax, eax
pop ecx
inc eax
pop ebp
ret 8

Function at 0x479c3b
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x424
lea ebp, [esp - 4]
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x424], eax
push 0x14
mov eax, 0x763fd8
call fcn.0048d234
and dword [ebp - 4], 0
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x20]
call fcn.00478d16
mov ebx, str..protectdrv
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00478ef5
test eax, eax
jne 0x479d87
mov word [ebp + 0x410], ax
lea edi, [ebp + 0x412]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp], ax
xor edi, edi
lea eax, [ebp + 2]
push edi
push eax
call fcn.0048d310
xor eax, eax
push esi
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push edi
push eax
call fcn.0048d310
mov ecx, dword [ebp - 0x14]
add esp, 0x18
push 9
lea eax, [ebp + 0x410]
push eax
call fcn.0047936e
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x410]
push eax
lea eax, [ebp]
push eax
push str._sdrivers_s.dat
lea eax, [ebp + 0x208]
push esi
push eax
call fcn.004922e1
mov ecx, dword [ebp - 0x14]
add esp, 0x14
call fcn.00479440
mov ecx, dword [ebp - 0x14]
mov esi, eax
push str.antihijacking_pc.dat
lea eax, [ebp + 0x208]
push eax
call fcn.00479bf5
cmp eax, edi
je 0x479d87
push ebx
lea ecx, [ebp - 0x20]
call fcn.00478ef5
cmp eax, edi
jne 0x479d57
push edi
lea eax, [ebp + 0x410]
push eax
push eax
lea eax, [ebp + 0x208]
push eax
lea ecx, [ebp - 0x20]
call fcn.00478ebb
cmp eax, edi
je 0x479d87
cmp esi, 0x20
jne 0x479d6b
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x479d87
push 1
call fcn.004793b2
pop ecx
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call fcn.004793b2
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.00478d24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x424]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0x428
leave
ret

Function at 0x479ec6
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push dword [esp + 0x14]
mov esi, ecx
call fcn.00479e26
push 8
pop ecx
push dword [esp + 0x10]
xor ebx, ebx
mov dword [esi + 0x24], ebx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push 0x7898b8
push 0x21
push esi
stosb byte es:[edi], al
call fcn.0048dede
push ebx
push ebx
push esi
push 0x479e18
push ebx
push ebx
call fcn.0048e0cb
add esp, 0x28
pop edi
mov dword [esi + 0x24], eax
pop esi
pop ebx
ret 8
Function at 0x479f8a
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x2a0
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
mov esi, dword [ebp + 0x7c]
push edi
push 0x78bad0
xor ebx, ebx
push 0x76
push ebx
mov dword [ebp - 0x228], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x47a026
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x22c], eax
cmp eax, ebx
je 0x47a026
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
je 0x47a01a
push edi
push dword [ebp - 0x22c]
push esi
call fcn.004909c0
add esp, 0xc
xor eax, eax
cmp edi, ebx
jbe 0x47a000
xor byte [esi + eax], 0x2b
inc eax
cmp eax, edi
jb 0x479ff7
lea eax, [esi + 0x1b0]
push 0x21
push eax
call fcn.00491099
pop ecx
pop ecx
mov dword [ebp - 0x228], 1
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
push 0x8a
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1a]
push ebx
push eax
call fcn.0048d310
xor eax, eax
push 0x206
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push ebx
push eax
call fcn.0048d310
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ebx, [esi + 0x124]
push ebx
lea eax, [ebp - 0x1c]
push 0x80b2a8
push eax
call edi
add esp, 0x24
mov esi, 0x208
push esi
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x224]
push esi
push eax
call fcn.00471aea
lea eax, [ebp - 0x224]
push eax
push ebx
call fcn.00492410
add esp, 0x10
test eax, eax
jne 0x47a0c2
push 0x80
push eax
push ebx
call fcn.0048d310
lea eax, [ebp - 0x1c]
push eax
push 0x78bac8
push ebx
call edi
add esp, 0x18
mov ecx, dword [ebp + 0x70]
mov eax, dword [ebp - 0x228]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048d1f2
add ebp, 0x74
leave
ret 4

Function at 0x47a1ba
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push ecx
push 0x47a1ac
push eax
push eax
call fcn.0048e0cb
add esp, 0x18
push 0x3a98
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x47a1db
Capabilities:
Read .ini file

Disassembly:
push 0x74
mov eax, 0x764074
call fcn.0048d26a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x80], eax
call fcn.004618b4
mov ecx, eax
call fcn.0046147d
push 8
pop ecx
push str.cloudeconfig.ini
xor eax, eax
push 0x21
mov byte [ebp - 0x34], 0
lea edi, [ebp - 0x33]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
push 0x80bb84
push str.Addr
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0041c2b0
xor edi, edi
push 0x78bae0
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], edi
mov byte [ebp - 0x70], 1
call fcn.0045a602
test eax, eax
jne 0x47a258
mov byte [ebp - 0x70], al
push dword [ebp - 0x70]
call fcn.0045d125
pop ecx
lea eax, [esi + 0x470]
push eax
mov ecx, esi
mov dword [ebp - 0x7c], eax
call fcn.00479f8a
mov dword [ebp - 0x74], eax
lea eax, [esi + 0x64c]
push eax
lea ecx, [ebp - 0x50]
call fcn.0044d9a5
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 1
jae 0x47a294
lea eax, [ebp - 0x4c]
mov ecx, 0x78bad8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47a2bf
cmp dx, di
je 0x47a2bb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47a2bf
add eax, 4
add ecx, 4
cmp dx, di
jne 0x47a299
xor eax, eax
jmp 0x47a2c4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x47a2d5
push edi
call fcn.004618b4
mov ecx, eax
call fcn.004603ad
cmp dword [ebp - 0x74], edi
je 0x47a316
lea edi, [esi + 4]
push edi
mov ecx, esi
call fcn.0047a120
push dword [ebp - 0x70]
add esi, 0xc0
push dword [ebp - 0x80]
mov ebx, eax
push esi
push dword [ebp - 0x78]
mov ecx, edi
push ebx
push dword [ebp - 0x7c]
call fcn.00481311
test ebx, ebx
jne 0x47a316
push dword [ebp - 0x78]
mov ecx, esi
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call fcn.00459272
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.00449c25
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.0041c8f0
mov eax, dword [ebp - 0x74]
call fcn.0048d2ed
ret 8
Function at 0x47b043
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x1e4], eax
mov eax, dword [ebp + 0x1f4]
and dword [ebp - 0x78], 0
and dword [ebp - 0x70], 0
and dword [ebp - 0x74], 0
push esi
push edi
mov edi, dword [ebp + 0x1f0]
push edi
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x47b109
and eax, 0xfffffffe
push eax
push edi
call esi
lea eax, [ebp - 0x70]
push eax
push 0x79aa04
push 1
push 0
push 0x79aa34
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x47b109
mov ecx, dword [ebp - 0x70]
test ecx, ecx
je 0x47b0cf
mov eax, dword [ecx]
lea edx, [ebp - 0x74]
push edx
push 0x79aa24
push ecx
call dword [eax]
test eax, eax
jl 0x47b109
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x74]
test edx, edx
je 0x47b0e6
mov eax, dword [edx]
push 2
push edi
push edx
call dword [eax + 0x14]
test eax, eax
jl 0x47b109
mov ecx, dword [ebp - 0x70]
test ecx, ecx
je 0x47b0fe
mov eax, dword [ecx]
push 4
lea edx, [ebp - 0x6c]
push edx
push 0x104
push dword [ebp - 0x80]
push ecx
call dword [eax + 0xc]
test eax, eax
jl 0x47b109
mov dword [ebp - 0x78], 1
push dword [ebp - 0x7c]
push edi
call esi
mov eax, dword [ebp - 0x74]
pop edi
pop esi
test eax, eax
je 0x47b11e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x47b12b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x1e4]
mov eax, dword [ebp - 0x78]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0x1e8
leave
ret 8