joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460c10
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4fe0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x4d9eb4
push 1
push 0
push 0x4d9f04
mov dword [ebp - 8], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x460d0e
cmp dword [edi + 0x60], 7
lea edx, [edi + 0x4c]
mov dword [ebp - 0xc], 0
jbe 0x460c5d
mov edx, dword [edx]
mov eax, dword [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [edi + 0x48], 7
lea edx, [edi + 0x34]
jbe 0x460c72
mov edx, dword [edx]
mov eax, dword [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
cmp dword [edi + 0x74], 0
je 0x460c97
cmp dword [edi + 0x78], 7
lea edx, [edi + 0x64]
jbe 0x460c8d
mov edx, dword [edx]
mov eax, dword [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push esi
push edx
push 0x4d9ee4
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
js 0x460d02
cmp dword [edi + 0x90], 7
lea esi, [edi + 0x7c]
mov eax, esi
jbe 0x460cbf
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x460cd9
cmp dword [esi + 0x14], 7
jbe 0x460cd2
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, 0x7c
cmp dword [edi + 0x14], 7
jbe 0x460ce4
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
push 0
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret 4
Function at 0x460d20
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d313b
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x4fe0c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x4c4]
push edi
call fcn.004581a0
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0049e870
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x490]
add esp, 0xc
cmp dword [ebp - 0x47c], 7
cmova eax, dword [ebp - 0x490]
push eax
lea eax, [ebp - 0x21c]
push 0x4e7030
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x424]
push 0x208
push 0
push eax
call fcn.0049e870
add esp, 0xc
lea eax, [ebp - 0x4c0]
cmp dword [ebp - 0x4ac], 7
cmova eax, dword [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x424]
push str._s.lnk
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x460e00
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x448]
call fcn.004520b0
lea eax, [ebp - 0x4c4]
push eax
call fcn.00460c10
test eax, eax
js 0x460ee8
cmp dword [edi + 0x90], 7
lea eax, [edi + 0x7c]
jbe 0x460e44
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
call fcn.00404dd0
mov ecx, eax
test ecx, ecx
je 0x460f49
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x428], eax
push str.barP
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 1
push str.Task_sin
push eax
call fcn.0041f160
add esp, 0xc
lea eax, [ebp - 0x448]
cmp dword [ebp - 0x434], 7
cmova eax, dword [ebp - 0x448]
push 0
push 0
push 0
push eax
push 0x4e3458
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x434], 7
lea eax, [ebp - 0x448]
cmova eax, dword [ebp - 0x448]
push eax
call esi
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x428]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x460ee8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x448]
call fcn.004257c0
lea ecx, [ebp - 0x460]
call fcn.004257c0
lea ecx, [ebp - 0x478]
call fcn.004257c0
lea ecx, [ebp - 0x490]
call fcn.004257c0
lea ecx, [ebp - 0x4a8]
call fcn.004257c0
lea ecx, [ebp - 0x4c0]
call fcn.004257c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00404bb0
int3
Function at 0x461980
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4fe0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
mov dword [ebp - 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x461a44
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x461a2e
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0049e870
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x461a12
lea eax, [ebp - 0x210]
push eax
jmp 0x461a49
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x218]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x214], 0
push 0x4e3458
mov ecx, esi
call fcn.00425670
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret 8

Function at 0x461a70
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4fe0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x20a
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0049e870
add esp, 0xc
cmp dword [ebx + 0x10], 0
je 0x461b08
cmp dword [ebx + 0x14], 7
jbe 0x461ac2
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 7
jbe 0x461aca
mov edi, dword [edi]
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [ebp + 0x18], 0
je 0x461b00
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x461b00
push eax
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esi + 0x10], 0
je 0x461b4e
jmp 0x461b2b
cmp dword [esi + 0x10], 0
je 0x461b4e
cmp dword [edi + 0x14], 7
jbe 0x461b16
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004b4e7b
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
cmp dword [esi + 0x14], 7
jbe 0x461b40
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..lnk
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004b695f
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
call fcn.00425670
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret 0x14
Function at 0x464ed0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x4fe0c0]
xor eax, esp
mov dword [esp + 0x70], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0x10], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.00465f40
add esp, 4
lea ecx, [esp + 8]
call fcn.00466000
movups xmm0, xmmword [esp + 0x60]
mov ecx, dword [esp + 0x74]
mov eax, 1
movups xmmword [esi], xmm0
pop esi
xor ecx, esp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret
Function at 0x464f50
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4f7090
push 0x49ee40
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4fe0c0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x34], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
test eax, eax
je 0x4650dd
test edx, edx
je 0x4650dd
test edi, edi
je 0x4650dd
xor esi, esi
xorps xmm0, xmm0
movups xmmword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 4], esi
push ecx
lea ecx, [ebp - 0x4c]
push ecx
mov edx, edi
mov ecx, eax
call fcn.00464ed0
add esp, 8
test eax, eax
je 0x4650d2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x4c]
push eax
mov edx, edi
mov ecx, dword [ebp - 0x34]
call fcn.00464e40
add esp, 8
test eax, eax
je 0x4650d2
xor eax, eax
mov dword [ebp - 0x2c], eax
xor edi, edi
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x30]
nop
mov dl, byte [ebp + eax - 0x24]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 8
jb 0x465013
mov byte [ebp - 0x25], 0
jmp 0x46501e
mov cl, byte [ebp + eax - 0x24]
mov byte [ebp - 0x25], cl
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 8
jb 0x465029
mov byte [ebp - 0x26], 0
jmp 0x465034
mov cl, byte [ebp + eax - 0x24]
mov byte [ebp - 0x26], cl
inc eax
mov dword [ebp - 0x2c], eax
movzx edx, dl
mov ecx, edx
shr ecx, 2
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + edi*2], cx
movzx esi, byte [ebp - 0x25]
mov ecx, esi
shr ecx, 4
and edx, 3
shl edx, 4
or ecx, edx
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp - 0x30]
mov word [edx + edi*2 + 2], cx
movzx edx, byte [ebp - 0x26]
mov ecx, edx
shr ecx, 6
and esi, 0xf
shl esi, 2
or ecx, esi
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, dword [ebp - 0x30]
mov word [esi + edi*2 + 4], cx
and edx, 0x3f
movzx ecx, word [edx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + edi*2 + 6], cx
add edi, 4
mov dword [ebp - 0x38], edi
cmp eax, 8
jb 0x465000
mov dword [esi + edi*2 - 2], 0x3d
mov esi, 1
mov dword [ebp - 0x3c], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4650df
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4650df
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret
Function at 0x467140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3830
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4fe0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x512f80
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esi + 0x34], 0x512f80
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x34]
cmp dword [eax + 4], 0x18
ja 0x4671fa
mov dword [eax], 0
mov eax, dword [esi + 0x34]
mov byte [eax + 8], 0
jmp 0x467211
mov dword [esi + 0x34], 0x512f80
cmp eax, 0x512f80
je 0x467211
push eax
call fcn.0049cf03
add esp, 4
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x467240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x46727c
cmp byte [esi + 0x2c], bl
jne 0x467366
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x467270
jmp 0x46734c
mov edi, dword [esi + 0x18]
test edi, edi
je 0x467292
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x467283
push 2
push 0
push ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.004b40ac
push ebx
call fcn.004b470b
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.004b40ac
add esp, 0x1c
test edi, edi
jg 0x4672fd
cmp byte [esi + 0x2c], 0
jne 0x467366
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4672f4
jmp 0x46734c
lea eax, [edi + 1]
push eax
call fcn.0049d386
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.004b4914
add esp, 0x14
cmp eax, 1
je 0x46736f
push edi
call fcn.0049cf03
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x467366
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x467345
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.00466230
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [edi + ebx], 0
mov eax, edi
mov dl, byte [edi]
mov ecx, edi
test dl, dl
je 0x46739e
nop dword [eax]
inc eax
lea ebx, [ecx + 1]
cmp dl, 0xd
jne 0x467394
mov byte [ecx], 0xa
cmp byte [eax], 0xa
jne 0x467396
inc eax
jmp 0x467396
mov byte [ecx], dl
mov dl, byte [eax]
mov ecx, ebx
test dl, dl
jne 0x467380
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push 0
push edi
call dword [eax + 8]
push edi
call fcn.0049cf03
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46db20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x46db85
mov dword [edi], 0
push 0
mov edx, 0x400000
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
cmp esi, edx
push eax
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x46db78
test ecx, ecx
je 0x46db85
test esi, esi
je 0x46db85
mov ecx, dword [ebp - 4]
jmp 0x46db3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x470a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x470aa0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 4], edx
nop dword [eax]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x470ac9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x470ac6
inc esi
cmp esi, edx
jb 0x470ab7
mov ecx, dword [ebp - 8]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x470bdf
cmp ecx, 3
jbe 0x470b08
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x470b46
cmp cl, 0xff
je 0x470b46
mov edx, dword [ebp - 4]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x470ab0
dec ecx
shl eax, cl
and eax, 7
je 0x470ae0
cmp byte [eax + 0x4e3278], 0
je 0x470b33
movzx ecx, byte [eax + 0x4e3280]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x470b30
cmp cl, 0xff
jne 0x470ae0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x470ab0
movzx ebx, cl
movzx ecx, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
sub ebx, edi
sub ebx, 5
test eax, eax
je 0x470baa
nop dword [eax]
movzx edx, byte [eax + 0x4e3280]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x470b91
cmp dl, 0xff
jne 0x470baa
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor ebx, edx
sub ebx, edi
sub ebx, 5
jmp 0x470b70
mov edx, dword [ebp - 4]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
neg cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x470ab0
pop esi
pop ebx
cmp ecx, 3
jbe 0x470bf4
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x471030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4fe0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x228], ebx
mov eax, dword [0x513970]
test al, 1
jne 0x4710a6
or eax, 1
mov dword [0x513970], eax
call fcn.00404dd0
mov ecx, eax
test ecx, ecx
je 0x47123b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x4d7d40
mov dword [0x513974], eax
call fcn.0049cd06
add esp, 4
mov eax, dword [0x513974]
cmp dword [eax - 0xc], 0
jne 0x471206
mov esi, dword [0x51345c]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
test esi, esi
je 0x4710dd
lock inc dword [esi + 4]
mov esi, dword [0x51345c]
mov ecx, dword [0x513458]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], esi
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
mov eax, dword [ecx]
push edx
call dword [eax + 0x30]
or edi, 0xffffffff
mov byte [ebp - 4], 2
test esi, esi
je 0x47112c
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x47112c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x47112c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
push 0x201
push 0
push dword [ebp - 0x224]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4711e4
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0049e870
add esp, 0xc
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4711c3
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, 0x513974
call fcn.004049e0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x471206
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x513974]
add ecx, 0xfffffff0
push ecx
call fcn.004044e0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404bb0
int3
Function at 0x472aa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3f0b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4fe0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, dword [0x51345c]
test esi, esi
je 0x472aeb
lock inc dword [esi + 4]
mov esi, dword [0x51345c]
mov ecx, dword [0x513458]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x21c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xec]
or edi, 0xffffffff
mov byte [ebp - 4], 4
test esi, esi
je 0x472b3a
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x472b3a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x472b3a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0049e870
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push 0x104
push eax
push 0x4e812c
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x472bb5
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x472b90
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.004049e0
mov esi, 1
jmp 0x472bb7
xor esi, esi
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x472bd8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x472bf6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x472c15
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret
Function at 0x474350
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
cmp dword [eax - 0xc], 0
jne 0x474361
xor ebx, ebx
jmp 0x47437d
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
mov eax, dword [ebp + 8]
setg bl
add eax, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x474395
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x474640
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4fe0c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4746b0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4746a4
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret