joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec708
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], 0x2e100469
mov dword [ebp - 0x28], 0x1a0c0408
mov dword [ebp - 0x24], 0x1d080d47
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.00478270
mov byte [ebp - 4], 1
xor edx, edx
nop word [eax + eax]
mov cl, byte [ebp + edx - 0x2b]
xor cl, byte [ebp - 0x2c]
mov byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0xb
jb 0x465ee0
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x14], 0
push ecx
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00407900
add esp, 0xc
mov edx, esi
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00420880
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x465f28
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.004099a0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
cmp eax, 0x10
jb 0x465f4f
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.004099a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 4

Function at 0x465f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec748
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x2c], 0x46786c01
mov dword [ebp - 0x28], 0x72646c60
mov dword [ebp - 0x24], 0x7560652f
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.00478270
mov edx, eax
mov byte [ebp - 4], 1
xor ecx, ecx
mov al, byte [ebp + ecx - 0x2b]
xor al, byte [ebp - 0x2c]
mov byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xb
jb 0x465fd3
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x14], 0
push eax
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.00407900
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00420580
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x46601b
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.004099a0
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
cmp ecx, 0x10
jb 0x466042
inc ecx
push ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x5c]
call fcn.004099a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 4
Function at 0x46c470
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed338
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [str.v_90__7_3]
mov edx, dword [ebp + 8]
movups xmmword [ebp - 0x7c], xmm0
mov dword [ebp - 0x98], 0
movaps xmm0, xmmword [0x50c890]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 4
mov dword [ebp - 0xa4], 4
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], 0x2a051a1a
mov byte [ebp - 0x58], 0
mov dword [ebp - 4], 0
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x7b]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x57], al
movzx eax, byte [ebp + ecx - 0x7a]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x56], al
movzx eax, byte [ebp + ecx - 0x79]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x55], al
movzx eax, byte [ebp + ecx - 0x78]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x54], al
movzx eax, byte [ebp + ecx - 0x77]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x53], al
add ecx, 5
cmp ecx, 0x23
jb 0x46c4f0
push edx
lea eax, [ebp - 0x57]
mov byte [ebp - 0x34], 0
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0040e8a0
add esp, 0xc
lea ecx, [ebp - 0x98]
cmp dword [ebp - 0x80], 0x10
lea eax, [ebp - 0x94]
cmovae eax, dword [ebp - 0x94]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46c61f
mov cl, 0x16
mov dword [ebp - 0x30], 0x65785f16
mov dword [ebp - 0x2c], 0x7a7a7762
xor edx, edx
mov dword [ebp - 0x28], 0x62776245
mov word [ebp - 0x24], 0x73
nop
movzx eax, byte [ebp + edx - 0x2f]
xor al, cl
mov byte [ebp + edx - 0x22], al
movzx eax, byte [ebp + edx - 0x2e]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x21], al
movzx eax, byte [ebp + edx - 0x2d]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x20], al
movzx eax, byte [ebp + edx - 0x2c]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x1f], al
movzx eax, byte [ebp + edx - 0x2b]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x1e], al
movzx eax, byte [ebp + edx - 0x2a]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x1d], al
add edx, 6
cmp edx, 0xc
jae 0x46c5f4
mov cl, byte [ebp - 0x30]
jmp 0x46c5a0
lea eax, [ebp - 0xa0]
mov byte [ebp - 0x16], 0
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
lea eax, [ebp - 0x22]
push eax
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x80]
cmp eax, 0x10
jb 0x46c63a
inc eax
lea ecx, [ebp - 0x94]
push eax
push dword [ebp - 0x94]
call fcn.004099a0
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x46c64b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 4
Function at 0x46ca30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed428
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x50], 0
mov edx, 0x17
mov dword [ebp - 0x4c], 0x4f0017
mov dword [ebp - 0x48], 0x780075
mov dword [ebp - 0x44], 0x47006f
mov dword [ebp - 0x40], 0x560074
mov dword [ebp - 0x3c], 0x670067
mov dword [ebp - 0x38], 0x720039
mov dword [ebp - 0x34], 0x72006f
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov ax, word [ebp + ecx*2 - 0x4a]
xor ax, dx
mov word [ebp + ecx*2 - 0x2e], ax
inc ecx
cmp ecx, 0xd
jae 0x46cac9
mov dx, word [ebp - 0x4c]
jmp 0x46cab0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [ebp - 0x14], ax
mov dword [esi + 0x10], eax
mov word [esi], ax
cmp word [ebp - 0x2e], ax
je 0x46caff
lea eax, [ebp - 0x2e]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46caf0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x2e]
mov ecx, esi
push eax
call fcn.00403e20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 4
Function at 0x4774c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee290
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0x6113133d
mov dword [ebp - 0x2c], 0x5b53525e
mov dword [ebp - 0x28], 0x54135a54
mov word [ebp - 0x24], 0x5453
mov byte [ebp - 0x22], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.00478460
mov byte [ebp - 4], 1
xor ecx, ecx
nop
mov dl, byte [ebp + ecx - 0x2f]
xor dl, byte [ebp - 0x30]
mov byte [ebp + ecx - 0x21], dl
inc ecx
cmp ecx, 0xd
jb 0x477520
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x14], 0
push ecx
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00407900
mov eax, dword [ebp - 0x34]
add esp, 0xc
cmp eax, 0x10
jb 0x47755b
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.004099a0
cmp dword [ebp - 0x4c], 0x10
lea esi, [ebp - 0x60]
mov bl, 0x52
mov dword [ebp - 0x20], 0x595b593a
cmovae esi, dword [ebp - 0x60]
mov bh, bl
mov byte [ebp - 0x61], bh
mov cl, 0x5b
mov bh, 0x5a
mov dword [ebp - 0x44], 0x52535f3c
mov byte [ebp - 0x62], bh
mov al, 0x59
mov dl, al
mov word [ebp - 0x1c], 0x5f52
mov bh, 0x55
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x63], bh
mov ch, 0x5f
mov bh, cl
mov dword [ebp - 0x40], 0x5b555a
mov byte [ebp - 0x64], bh
mov ah, ch
mov bh, byte [ebp - 0x20]
mov dh, 0x53
xor al, bh
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x19], al
xor cl, bh
mov al, byte [ebp - 0x62]
xor dl, bh
mov byte [ebp - 0x18], cl
xor ch, bh
mov cl, byte [ebp - 0x44]
xor bl, bh
mov bh, byte [ebp - 0x61]
xor al, cl
mov byte [ebp - 0x39], al
xor ah, cl
mov al, byte [ebp - 0x63]
xor dh, cl
xor al, cl
mov byte [ebp - 0x3c], ah
mov byte [ebp - 0x38], al
xor bh, cl
mov al, byte [ebp - 0x64]
xor al, cl
mov byte [ebp - 0x17], dl
push esi
mov byte [ebp - 0x37], al
lea eax, [ebp - 0x19]
push 1
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x16], bl
push eax
mov byte [ebp - 0x15], ch
mov byte [ebp - 0x3b], dh
mov byte [ebp - 0x3a], bh
mov byte [ebp - 0x36], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x4c]
test eax, eax
setne bl
xor eax, eax
mov dword [ebp - 0x43], eax
mov word [ebp - 0x3f], ax
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x1f], eax
mov word [ebp - 0x1b], ax
cmp ecx, 0x10
jb 0x477636
inc ecx
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
call fcn.004099a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret
Function at 0x4779b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee33b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00477ac0
lea ecx, [ebp - 0x74]
call fcn.00478460
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.00477ec0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.004780a0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00478270
mov dword [ebp - 4], 3
lea esi, [ebp - 0x74]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0xf
mov dword [ebp - 0x7c], 0
mov byte [ebp - 0x8c], 0
call fcn.00409690
cmp dword [ebp - 0x78], 0x10
lea eax, [ebp - 0x8c]
push 0
cmovae eax, dword [ebp - 0x8c]
push eax
call edi
mov eax, dword [ebp - 0x78]
cmp eax, 0x10
jb 0x477a77
inc eax
lea ecx, [ebp - 0x8c]
push eax
push dword [ebp - 0x8c]
call fcn.004099a0
add esi, 0x18
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x477a21
push fcn.004095a0
push 4
push 0x18
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.004a0a32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret
Function at 0x477d50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee400
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], 0x493b3b15
mov dword [ebp - 0x50], 0x737b7a76
mov dword [ebp - 0x4c], 0x7c3b727c
mov word [ebp - 0x48], 0x7c7b
mov byte [ebp - 0x46], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.00478460
mov byte [ebp - 4], 1
xor ecx, ecx
nop
mov dl, byte [ebp + ecx - 0x53]
xor dl, byte [ebp - 0x54]
mov byte [ebp + ecx - 0x45], dl
inc ecx
cmp ecx, 0xd
jb 0x477db0
lea ecx, [ebp - 0x45]
mov byte [ebp - 0x38], 0
push ecx
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00407900
mov eax, dword [ebp - 0x20]
add esp, 0xc
cmp eax, 0x10
jb 0x477deb
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.004099a0
cmp dword [ebp - 0x58], 0x10
lea esi, [ebp - 0x6c]
mov bh, 0x1c
mov dword [ebp - 0x1c], 0xe060569
cmovae esi, dword [ebp - 0x6c]
mov al, 5
mov byte [ebp - 0x6d], bh
mov cl, 6
mov bh, 0x12
mov dword [ebp - 0x30], 0x1b1a1675
mov byte [ebp - 0x6e], bh
mov ah, 0x1a
mov bh, byte [ebp - 0x1c]
mov bl, 0xe
xor al, bh
mov byte [ebp - 0x18], 0
xor cl, bh
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x6e]
xor bl, bh
mov bh, byte [ebp - 0x6d]
mov dl, 0x16
mov byte [ebp - 0x16], cl
mov ch, 0x1b
mov cl, byte [ebp - 0x30]
mov dh, 0x13
xor ah, cl
mov dword [ebp - 0x2c], 0x121c13
xor al, cl
mov byte [ebp - 0x27], ah
push esi
mov byte [ebp - 0x23], al
xor dl, cl
push 4
lea eax, [ebp - 0x17]
mov byte [ebp - 0x15], bl
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x14], 0
xor ch, cl
mov byte [ebp - 0x28], dl
xor dh, cl
mov byte [ebp - 0x26], ch
xor bh, cl
mov byte [ebp - 0x25], dh
push eax
mov byte [ebp - 0x24], bh
mov byte [ebp - 0x22], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x58]
cmp eax, 0x10
jb 0x477e9f
inc eax
lea ecx, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
call fcn.004099a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret
Function at 0x478ee0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3778
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x48]
push eax
call fcn.004c1ebc
xor eax, eax
mov dword [ebp - 0x2c], 7
lea edx, [esi + 0x20c]
mov dword [ebp - 0x30], 0
add esp, 4
mov word [ebp - 0x40], ax
cmp word [edx], ax
jne 0x478f3b
xor ecx, ecx
jmp 0x478f4f
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x478f40
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00403e20
push 0x50add8
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00414c90
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x478f88
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403f90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004c74a3
add esp, 8
cmp eax, 0xffffffff
jne 0x478fb7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x44]
cmp dword [ebp - 0x14], 8
lea eax, [esi + 0x414]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
push str._s_s.__I64d.dmp
lea eax, [esi + 4]
push 0x104
push eax
call fcn.004793e0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
cmp eax, 8
jb 0x478ffb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403f90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret

Function at 0x479020
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0x10]
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x47909e
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
push edi
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x47909e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x47909e
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47a760
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eea45
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x52610c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
mov dword [ebp - 0x10], 0x52e280
mov dword [0x52e280], 0x50b1f8
mov dword [0x52e294], 0
mov dword [0x52e298], 0
mov dword [0x52e29c], 0
mov dword [0x52e2a0], 0
mov dword [0x52e2a4], 0
call fcn.004a0505
add esp, 4
mov dword [0x52e294], eax
test eax, eax
je 0x47a7f0
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [0x52e294]
mov dword [eax], 0x52e294
push 0x52e2a8
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push 8
mov dword [0x52e290], eax
call fcn.004a0505
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
push 0
mov byte [ebp - 4], 2
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0047aca0
push 0
push 0
push 1
mov dword [esi], eax
mov byte [ebp - 4], 1
push 0
mov dword [0x52e28c], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [0x52e288], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor esi, esi
mov dword [0x52e284], eax
cmp dword [0x52e290], esi
jbe 0x47a8da
nop dword [eax]
push 0
push 0
push 0x52e280
push 0x47acd0
push 0
push 0
call fcn.004cb6b1
mov edi, dword [0x52e28c]
add esp, 0x18
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
mov ebx, dword [edi]
push eax
push dword [ebx + 4]
push ebx
call fcn.0047af60
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [edi + 4]
sub ecx, eax
cmp ecx, 1
jb 0x47a8f3
lea ecx, [eax + 1]
inc esi
mov dword [edi + 4], ecx
mov dword [ebx + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
cmp esi, dword [0x52e290]
jb 0x47a880
mov eax, 0x52e280
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.0049cede
int3

Function at 0x47ba00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x47ba19
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x47ba56
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x47ba52
nop word [eax + eax]
cmp esi, edx
jae 0x47ba56
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x47ba40
cmp esi, edx
jb 0x47ba5d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47c210
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eec00
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x52610c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x14]
call fcn.0047c530
push ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0047d190
add esp, 4
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c27a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.0047dc60
mov edi, eax
add esp, 4
test edi, edi
jne 0x47c293
xor esi, esi
jmp 0x47c387
push edi
mov edx, 0x47e0a0
lea ecx, [ebp - 0x24]
call fcn.0047cef0
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
movups xmm0, xmmword [edi + 0x38]
push esi
movups xmmword [ebp - 0x34], xmm0
call fcn.0047c530
push 0
push esi
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 0xc]
test edx, edx
je 0x47c2f7
lea ecx, [edx - 1]
test ecx, ecx
js 0x47c3ba
cmp ecx, edx
jg 0x47c3ba
cmp word [eax + ecx*2], 0x5c
je 0x47c2f7
push 0x507d60
lea ecx, [ebp - 0x10]
call fcn.0047c4e0
xor esi, esi
cmp dword [ebp - 0x30], esi
jb 0x47c35c
mov ebx, dword [ebp - 0x34]
ja 0x47c310
test ebx, ebx
je 0x47c359
nop word [eax + eax]
mov edx, dword [ebp - 0x10]
mov ecx, edi
call fcn.0047be10
test eax, eax
je 0x47c3cc
mov ecx, dword [ebp - 0x30]
add ebx, 0xffffffff
mov eax, esi
adc ecx, 0xffffffff
cdq
cmp edx, ecx
ja 0x47c347
jb 0x47c338
cmp eax, ebx
jae 0x47c347
mov ecx, edi
call fcn.0047e680
test eax, eax
jne 0x47c3cc
inc esi
mov eax, esi
cdq
cmp edx, dword [ebp - 0x30]
jb 0x47c3c4
ja 0x47c359
mov ebx, dword [ebp - 0x34]
cmp eax, ebx
jb 0x47c310
or ebx, 0xffffffff
mov esi, 1
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c37f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x24]
call fcn.0047cf80
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x47c3a6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0047b910
mov ebx, dword [ebp - 0x34]
jmp 0x47c310
xor esi, esi
or ebx, 0xffffffff
jmp 0x47c361