joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x40c099
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x40c08e
nop
movzx esi, byte [ecx]
movzx esi, byte [esi + 0x4b1fe0]
lea ebx, [eax*8]
xor esi, ebx
dec edx
xor eax, esi
inc ecx
test edx, edx
jg 0x40c070
mov ebx, dword [ebp + 0xc]
xor edx, edx
div dword [edi]
mov esi, edx
mov dword [ebp - 4], esi
jmp 0x40c0a3
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push eax
mov edx, esi
mov eax, edi
call fcn.0040bef0
add esp, 8
test eax, eax
je 0x40c0e6
mov ecx, dword [ebp + 0x10]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x40c0d4
mov edx, esi
mov ecx, edi
call fcn.0040bf90
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
je 0x40c17a
push 0x14
call fcn.00408240
mov esi, eax
mov eax, dword [ebp + 0x10]
add esp, 4
test esi, esi
je 0x40c17c
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], eax
inc dword [edi + 4]
mov eax, dword [edi + 4]
cmp eax, 0xa
jb 0x40c144
mov ecx, dword [edi]
add ecx, ecx
cmp eax, ecx
jbe 0x40c144
lea edx, [eax + eax]
push edx
push edi
call fcn.0040bda0
add esp, 8
test eax, eax
je 0x40c144
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.0040bd10
xor edx, edx
div dword [edi]
mov dword [ebp - 4], edx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40c161
mov ecx, dword [ebp - 4]
lea edx, [eax + ecx*8]
mov eax, esi
call fcn.0040bd40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 8]
mov dword [esi], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x40c170
mov dword [eax + 4], esi
mov dword [esi + 4], 0
mov dword [edi + 8], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418040
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ecx
xor ebp, ebx
add edi, dword [ebx]
inc edi
inc esp
pop edx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4cc], ecx
jmp 0x418037
push esi
and esi, 0xc7aa
xor esi, 0xd07a
jp 0x418012
add byte [eax], al
jp 0x418012
add byte [eax], al
add esi, 0x2f02
sub esi, 0x9993
pop esi
push eax
push eax
add esp, 4
call 0x418065
add byte [0x33413534], dh
cmp edi, dword [ebx]
inc edx
cmp eax, dword [ebx - 0x74a7fb3c]
test dword [ebx + edi*8], esi
invalid

Function at 0x418065
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ecx
xor ebp, ebx
add edi, dword [ebx]
inc edi
inc esp
pop edx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4cc], ecx
jmp 0x418037
push esi
and esi, 0xc7aa
xor esi, 0xd07a
jp 0x418012
add byte [eax], al
jp 0x418012
add byte [eax], al
add esi, 0x2f02
sub esi, 0x9993
pop esi
push eax
push eax
add esp, 4
call 0x418065
add byte [0x33413534], dh
cmp edi, dword [ebx]
inc edx
cmp eax, dword [ebx - 0x74a7fb3c]
test dword [ebx + edi*8], esi
invalid

Function at 0x4182f6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x418307
add byte [edx], dh
cmp eax, 0x48383437
aaa
cmp dword [ebx - 0x377efb3c], eax
mov cl, 0xe3
add byte [eax], al
pop eax
mov dword [ebp - 0x3cc], 0
push esi
push esi
add esp, 4
and esi, 0x109d2
pop esi
push eax
push ebx
add esp, 4
xor eax, 0xf283
add byte [eax], al

Function at 0x418307
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x418307
add byte [edx], dh
cmp eax, 0x48383437
aaa
cmp dword [ebx - 0x377efb3c], eax
mov cl, 0xe3
add byte [eax], al
pop eax
mov dword [ebp - 0x3cc], 0
push esi
push esi
add esp, 4
and esi, 0x109d2
pop esi
push eax
push ebx
add esp, 4
xor eax, 0xf283
add byte [eax], al

Function at 0x418330
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
pop eax
push ebx
add ebx, 0x7484
xor ebx, 0x16d2f
add ebx, 0xcd36
xor ebx, 0x12240
pop ebx
push ecx
and ecx, 0x121af
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x125bf
jmp 0x418365
sub ebx, 0x4093
pop ebx
push eax
call 0x41837b
add byte [ecx + 0x4e], al
cmp eax, dword [ecx + 0x39]
dec ebp
dec esi
inc edi
add esp, 4
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
invalid
invalid

Function at 0x41837b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
pop eax
push ebx
add ebx, 0x7484
xor ebx, 0x16d2f
add ebx, 0xcd36
xor ebx, 0x12240
pop ebx
push ecx
and ecx, 0x121af
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x125bf
jmp 0x418365
sub ebx, 0x4093
pop ebx
push eax
call 0x41837b
add byte [ecx + 0x4e], al
cmp eax, dword [ecx + 0x39]
dec ebp
dec esi
inc edi
add esp, 4
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
invalid
invalid
Function at 0x4183b6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x16c89
or ebx, 0x90da
pop ebx
mov dword [ebp - 0x1fac], 0xffffffff
push ebx
add ebx, 0x104aa
or ebx, 0xa5a
pop ebx
push edx
jmp 0x4183e8
pop edx
push edi
and edi, 0xf710
pop edi
push ecx
and ecx, 0x14883
jmp 0x418401
pop ecx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x41841f
Function at 0x41973d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push edi
push eax
add esp, 4
add edi, 0x137e5
add edi, 0x7d93
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x419770
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x4197ca
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x419698
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x419698
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4197b4
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x4197be
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x419813
push edi
push ecx
add esp, 4
add edi, 0x11c2e
add edi, 0x198
xor edi, 0x11040
xor edi, 0x12695
pop edi
push edi
and edi, 0x930f
jmp 0x4197fe
add edi, 0xe1a4
pop edi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x41987b
push edx
xor edx, 0x3dd4
and edx, 0x147e
jmp 0x419829
pop edx
push esi
push esi
add esp, 4
or esi, 0x872b
add esi, 0x7040
jmp 0x419844
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x419871
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x41963c
mov dword [ebp - 0x2e0], 0
Function at 0x43f3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edi
test edi, edi
jne 0x43f3de
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x43f3f4
cmp byte [edi], al
je 0x43f3e7
inc ecx
cmp byte [ecx], al
jne 0x43f3e2
sub ecx, edi
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x14]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x43f4f5
jmp 0x43f413
mov edi, dword [ebp + 0xc]
cmp esi, 2
jge 0x43f41b
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43f47b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, esi
shl edx, 4
mov edi, dword [edx + eax]
mov dl, byte [ecx]
test dl, dl
je 0x43f45d
jmp 0x43f440
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x4b1fe0]
cmp dl, byte [eax + 0x4b1fe0]
jne 0x43f45d
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x43f440
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x4b1fe0]
movzx ecx, byte [ecx + 0x4b1fe0]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x43f4e5
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add esi, esi
mov esi, dword [eax + esi*8 + 0xc]
cmp dword [esi + 0x14], 0
je 0x43f4c8
xor eax, eax
mov edx, ebx
mov ecx, edi
test ebx, ebx
jle 0x43f4be
jmp 0x43f4a0
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4b1fe0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x43f4a0
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
xor edx, edx
div dword [esi + 8]
jmp 0x43f4ca
xor edx, edx
push ebx
push edi
lea eax, [esi + 8]
call fcn.0040bef0
add esp, 8
test eax, eax
je 0x43f4fc
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x43f4f5
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 0x10]
jl 0x43f410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x43f4e5
Function at 0x43f600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov ecx, eax
test eax, eax
jne 0x43f61d
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x43f635
cmp byte [eax], 0
je 0x43f628
inc ecx
cmp byte [ecx], 0
jne 0x43f622
sub ecx, eax
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 0x14]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x43f717
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x10], ecx
push edi
nop
mov ecx, eax
cmp eax, 2
jge 0x43f65a
xor ecx, 1
mov edx, dword [ebp + 0xc]
shl ecx, 4
add ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 0xc]
test edx, edx
je 0x43f6aa
mov esi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x43f692
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4b1fe0]
cmp cl, byte [eax + 0x4b1fe0]
jne 0x43f68f
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x43f672
mov eax, dword [ebp - 4]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x4b1fe0]
movzx edx, byte [edx + 0x4b1fe0]
sub edx, ecx
jne 0x43f706
cmp dword [edi + 0x24], 0
lea esi, [edi + 0x18]
je 0x43f6e4
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x43f6de
mov edi, edi
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4b1fe0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x43f6c0
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi]
jmp 0x43f6e6
xor edx, edx
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, esi
call fcn.0040bef0
add esp, 8
test eax, eax
je 0x43f71d
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
test eax, eax
jne 0x43f716
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x14]
jl 0x43f650
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
jmp 0x43f703
Function at 0x442150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x40], edx
mov edx, dword [ecx + 0x10]
add eax, eax
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x28], eax
mov eax, 1
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
jmp 0x442193
mov esi, dword [ebp - 0x30]
push eax
push str.sqlite_stat_d
lea ecx, [ebp - 0x1c]
push ecx
push 0x18
call fcn.00409ed0
mov ecx, dword [esi]
xor ebx, ebx
add esp, 0x10
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x1c]
cmp byte [ebp - 0x1c], bl
je 0x4421c5
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0x4421c0
lea edx, [ebp - 0x1c]
sub eax, edx
and eax, 0x3fffffff
mov edi, eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x38], eax
cmp eax, ebx
jle 0x4422e1
jmp 0x4421ea
mov ecx, dword [ebp - 0x34]
mov edx, ebx
cmp ebx, 2
jge 0x4421f4
xor edx, 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x44224b
mov ecx, dword [ecx + 0x10]
mov esi, edx
add esi, esi
mov esi, dword [ecx + esi*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x442230
lea ecx, [ecx]
movzx ebx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4b1fe0]
cmp cl, byte [ebx + 0x4b1fe0]
jne 0x44222d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x442210
mov ebx, dword [ebp - 0x20]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x4b1fe0]
movzx eax, byte [eax + 0x4b1fe0]
sub eax, ecx
jne 0x4422ad
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8 + 0xc]
cmp dword [esi + 0x14], 0
je 0x44228d
xor eax, eax
mov edx, edi
lea ecx, [ebp - 0x1c]
test edi, edi
jle 0x442286
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4b1fe0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x442265
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x44]
xor edx, edx
div dword [esi + 8]
jmp 0x44228f
xor edx, edx
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [esi + 8]
call fcn.0040bef0
add esp, 8
test eax, eax
je 0x442302
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4422c0
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, dword [ebp - 0x38]
jl 0x4421e7
cmp dword [ebp - 0x24], 0
je 0x4422e1
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
push eax
push ecx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edx
call fcn.0043f2c0
add esp, 0x18
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 4
jle 0x442190
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0
jmp 0x4422ad
Function at 0x47ce90
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4224
call fcn.004a9b70
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x4000
lea ecx, [ebp - 0x420c]
push 0
push ecx
mov dword [ebp - 0x4218], eax
call fcn.004a3190
add esp, 0xc
lea edx, [ebp - 0x4220]
push edx
push 0x4000
lea eax, [ebp - 0x420c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x47cef8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x4220]
shr eax, 2
xor ecx, ecx
mov dword [ebp - 0x4214], eax
mov dword [ebp - 0x4210], ecx
test eax, eax
je 0x47d05e
push ebx
push esi
push edi
lea ebx, [ebx]
mov edi, dword [ebp + ecx*4 - 0x420c]
test edi, edi
je 0x47d046
mov cx, word [0x4bb0b4]
mov esi, dword [str._unknown_]
mov ebx, dword [0x4bb0b0]
push 0xfa
lea edx, [ebp - 0xfe]
push 0
push edx
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], ebx
mov word [ebp - 0x100], cx
call fcn.004a3190
mov ax, word [0x4bb0b4]
push 0xfa
lea ecx, [ebp - 0x202]
push 0
push ecx
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], ebx
mov word [ebp - 0x204], ax
call fcn.004a3190
add esp, 0x18
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x47cfb1
push eax
jmp 0x47d03a
call fcn.00499b00
test eax, eax
je 0x47cff0
call fcn.0049dbd0
cmp eax, 0x13ec
jle 0x47cff0
push 0x104
lea edx, [ebp - 0x20c]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
call fcn.004844d0
add esp, 4
jmp 0x47d025
lea eax, [ebp - 0x4224]
push eax
push 4
lea ecx, [ebp - 0x421c]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x47d039
mov eax, dword [ebp - 0x421c]
push 0x104
lea edx, [ebp - 0x108]
push edx
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0
push edi
call dword [ebp - 0x4218]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4214]
mov ecx, dword [ebp - 0x4210]
inc ecx
mov dword [ebp - 0x4210], ecx
cmp ecx, eax
jb 0x47cf20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004a01d6
mov esp, ebp
pop ebp
ret 8
Function at 0x47d070
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x418]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x418]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x110]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x110]
xor ebx, ebx
cmp byte [eax], bl
je 0x47d0cd
inc eax
dec edx
jne 0x47d0c3
jmp 0x47d0f5
cmp edx, ebx
je 0x47d0f5
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str._regedit.exe
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
push 0x4bb0d4
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x310]
call fcn.00401000
mov eax, 0x104
lea ecx, [ebp - 0x310]
lea ebx, [ebx]
cmp byte [ecx], bl
je 0x47d12a
inc ecx
dec eax
jne 0x47d120
jmp 0x47d14e
cmp eax, ebx
je 0x47d14e
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push esi
lea ecx, [ebp + ecx - 0x310]
mov edx, 0x7fffffff
call fcn.00401000
lea edx, [ebp - 0x110]
mov dword [ebp - 0x448], edx
lea edx, [ebp - 0x458]
lea eax, [ebp - 0x310]
lea ecx, [ebp - 0x418]
push edx
mov dword [ebp - 0x458], 0x3c
mov dword [ebp - 0x454], 0x400
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], str.runas
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x440], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp eax, ebx
jne 0x47d258
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp - 0x438]
push eax
push str.hInstApp_Error_code:__d
lea ecx, [ebp - 0x310]
push 0x200
push ecx
call fcn.00402830
push str.regExecuteScript
lea esi, [ebp - 0x310]
call fcn.0047fb10
add esp, 0x14
push ebx
push ebx
lea edx, [ebp - 0x41c]
push edx
push 0x400
push edi
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [ebp - 0x41c]
push eax
push edi
push str.Last_Error:__d___s
mov ecx, esi
push 0x200
push ecx
call fcn.00402830
add esp, 0x14
push str.regExecuteScript
call fcn.0047fb10
mov edx, dword [ebp - 0x41c]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ebx, esi
call fcn.0047dbc0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x47dbc0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d2afc], 0
push esi
push edi
mov dword [ebp - 0x210], 0
je 0x47dc25
lea eax, [ebp - 0x210]
push str.KERNEL32.DLL
mov dword [ebp - 0x20c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47dc25
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47dc1e
lea ecx, [ebp - 0x20c]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x4c643c], 0x270f
mov edi, eax
mov dword [ebp - 0x20c], edi
jge 0x47dc91
test edi, edi
jne 0x47dc91
lea edi, [ebp - 0x208]
call fcn.00483860
push str.GetLastError:
mov esi, edi
call fcn.0047fb10
add esp, 4
push str.fileRemoveFile____
mov esi, ebx
call fcn.0047fb10
add esp, 4
push 0x4b7c68
mov esi, 0x4b7c68
call fcn.0047fb10
mov edi, dword [ebp - 0x20c]
add esp, 4
cmp dword [0x4d2afc], 0
je 0x47dcd7
lea edx, [ebp - 0x210]
push str.KERNEL32.DLL
mov dword [ebp - 0x20c], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47dcd7
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47dcd0
lea ecx, [ebp - 0x20c]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x47dcf0
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d2afc], 0
push esi
push edi
mov dword [ebp - 0x210], 0
je 0x47dd55
lea eax, [ebp - 0x210]
push str.KERNEL32.DLL
mov dword [ebp - 0x20c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47dd55
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47dd4e
lea ecx, [ebp - 0x20c]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, eax
mov dword [ebp - 0x20c], edi
test edi, edi
je 0x47dd83
push str.fileRemoveFolder_____SUCCESS
mov esi, ebx
call fcn.0047fb10
add esp, 4
cmp dword [0x4c643c], 0x270f
jge 0x47ddd4
test edi, edi
jne 0x47ddd4
lea edi, [ebp - 0x208]
call fcn.00483860
push str.GetLastError:
mov esi, edi
call fcn.0047fb10
add esp, 4
push str.fileRemoveFolder____
mov esi, ebx
call fcn.0047fb10
add esp, 4
push 0x4b7c68
mov esi, 0x4b7c68
call fcn.0047fb10
mov edi, dword [ebp - 0x20c]
add esp, 4
cmp dword [0x4d2afc], 0
je 0x47de1a
lea edx, [ebp - 0x210]
push str.KERNEL32.DLL
mov dword [ebp - 0x20c], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47de1a
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47de13
lea ecx, [ebp - 0x20c]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret