joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d680
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f6d29
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov eax, dword [0x7e7970]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0x1d8]
mov dword [ebp - 0x10], 1
test eax, eax
je 0x46d737
push 0
push 0
push 0xe
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x46d737
lea esi, [eax + 1]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.006b1920
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x14]
push esi
push ebx
push dword [eax + 0x1d8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test ebx, ebx
jne 0x46d71e
xor eax, eax
jmp 0x46d725
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push eax
mov ecx, edi
call fcn.00428920
push ebx
call fcn.006b31f8
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46e260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fa32b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 0
mov dword [edi], vtable.GXSubTooltipWindow.0
mov eax, dword [0x7e7970]
mov dword [edi + 0x2c], eax
mov eax, dword [0x7e7970]
lea esi, [edi + 0x30]
mov dword [ebp - 0x14], esi
mov dword [esi], eax
push 0x790eb0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x790eb0
push eax
mov ecx, esi
call fcn.00428920
inc dword [0x8050e0]
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0xbb8
mov dword [esi + 0x10], 0
mov eax, dword [0x7e7970]
mov dword [edi + 0x6c], eax
mov dword [edi + 0x68], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x4c], eax
mov eax, edi
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0xc8ffff
mov dword [edi + 0x58], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 3
mov dword [edi + 0x78], 0x2ee
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x472550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fa5e0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esi + 0x1c0]
mov dword [ebp - 4], 0
push ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x78], vtable.CAutoLock.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x74], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x4726d4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4726d4
test al, 0x10
jne 0x4726d4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x84]
mov eax, dword [esi + 0x21c]
test eax, eax
je 0x4725e7
push eax
lea ecx, [esi + 0x274]
call fcn.0042d9b0
cmp byte [esi + 0x40c], 1
jne 0x472642
push dword [ebp + 8]
lea ecx, [esi + 0x31c]
call fcn.0042d5f0
test eax, eax
je 0x4726d4
lea edi, [esi + 0x274]
mov dword [esi + 0x1fc], 0
lea ebx, [esi + 0x2c8]
mov dword [esi + 0x200], 9
push edi
mov ecx, ebx
call fcn.0042d9b0
lea ecx, [esi + 0x370]
call fcn.0045efd0
mov ecx, esi
call fcn.00473a00
jmp 0x47269e
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00428690
mov ecx, esi
call fcn.004443e0
test eax, eax
je 0x4726d4
push eax
lea ecx, [ebp - 0x68]
call fcn.0042cde0
lea eax, [ebp - 0x68]
lea edi, [esi + 0x31c]
push eax
mov ecx, edi
call fcn.0042d9b0
lea ecx, [ebp - 0x68]
call fcn.0042ce60
cmp dword [esi + 0x33c], 0
je 0x4726d4
mov dword [esi + 0x21c], edi
lea ebx, [esi + 0x2c8]
lea edi, [esi + 0x274]
mov ecx, ebx
push edi
call fcn.0042d9b0
push dword [esi + 0x21c]
mov ecx, edi
call fcn.0042d9b0
lea eax, [ebp + 8]
mov dword [esi + 0x21c], ebx
push eax
lea ecx, [esi + 0x410]
call fcn.004289a0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
mov ebx, dword [ebp - 0x6c]
mov esi, 1
jmp 0x4726d6
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
lea ecx, [eax - 0xc]
cmp ecx, 0x7e8698
je 0x472708
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x472708
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
push ecx
call fcn.006b31f8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 4
Function at 0x472a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x3f0], 2
jne 0x472aeb
mov eax, dword [esi + 0x3fc]
sub eax, dword [esi + 0x3f8]
sar eax, 2
cmp eax, 1
jbe 0x472aeb
mov edx, dword [esi + 0x408]
cmp dword [ebp + 8], 0xffffffff
mov eax, dword [esi + 0x3fc]
lea ecx, [edx + 1]
cmovne ecx, dword [ebp + 8]
sub eax, dword [esi + 0x3f8]
sar eax, 2
cmp ecx, eax
sbb edi, edi
and edi, ecx
cmp edi, edx
je 0x472af5
mov eax, dword [esi + 0x3f8]
mov dword [esi + 0x408], edi
lea edi, [eax + edi*4]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x472af5
test al, 0x10
jne 0x472af5
push ecx
mov ecx, esp
push edi
call fcn.00428690
mov ecx, esi
call fcn.00472550
test eax, eax
jne 0x472af5
mov ecx, esi
call fcn.00472870
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 0x408], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4744f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi], eax
je 0x474593
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.006b47d0
push edi
push ebx
lea eax, [ebp - 0x214]
push 0x788ab4
push eax
call fcn.004746b0
push 0x100
lea eax, [ebp - 0x614]
push eax
push 0x100
lea eax, [ebp - 0x814]
push eax
push 0x100
lea eax, [ebp - 0x414]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.006bf8b1
add esp, 0x40
lea eax, [ebp - 0x414]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov ecx, dword [esi]
push ebx
push edi
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 8

Function at 0x474680
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
pop ebp
jmp fcn.004744f0
Function at 0x477a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fa8c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x1c0]
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x14], vtable.CAutoLock.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x477bb3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x477bb3
test al, 0x10
jne 0x477bb3
push dword [ebp + 8]
lea ebx, [esi + 0x290]
mov ecx, ebx
call fcn.0042d5f0
test eax, eax
je 0x477bb3
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x344], 0
mov dword [esi + 0x348], eax
cmp eax, 7
je 0x477b2c
cmp eax, 9
je 0x477b2c
mov ecx, dword [esi + 0x8c]
push 0
push esi
mov ecx, dword [ecx + 0x474]
call fcn.00482b10
jmp 0x477b56
push dword [ebp + 0x14]
mov ecx, dword [esi + 0x8c]
mov eax, dword [ebp + 0x10]
push 0
mov dword [esi + 0x358], 0
mov dword [esi + 0x354], eax
mov ecx, dword [ecx + 0x474]
push esi
call fcn.00482a40
lea ecx, [esi + 0x2e4]
mov dword [esi + 0x218], ebx
call fcn.0042ec70
mov eax, dword [esi + 0x304]
test eax, eax
je 0x477b82
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x304], 0
lea ecx, [esi + 0x2e4]
call fcn.0042d580
mov ecx, esi
call fcn.00477ef0
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x477bb3
push 0
push esi
push dword [0x805898]
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
lea ecx, [eax - 0xc]
cmp ecx, 0x7e8698
je 0x477be5
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x477be5
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
push eax
call fcn.006b31f8
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x477c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6fa8c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x1c0]
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x14], vtable.CAutoLock.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x477d0b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x477d0b
test al, 0x10
jne 0x477d0b
push dword [ebp + 8]
lea ebx, [esi + 0x290]
mov ecx, ebx
call fcn.0042d5f0
test eax, eax
je 0x477d0b
lea ecx, [esi + 0x2e4]
mov dword [esi + 0x344], 0
mov dword [esi + 0x348], 0xa
mov dword [esi + 0x360], 1
mov dword [esi + 0x218], ebx
call fcn.0042ec70
mov eax, dword [esi + 0x304]
test eax, eax
je 0x477cd3
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x304], 0
lea ecx, [esi + 0x2e4]
call fcn.0042d580
mov ecx, esi
call fcn.00477ef0
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x477d04
push 0
push esi
push dword [0x805898]
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, 1
jmp 0x477d0d
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
lea ecx, [eax - 0xc]
cmp ecx, 0x7e8698
je 0x477d3f
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x477d3f
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
push ecx
call fcn.006b31f8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x479740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x6faab8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x7e6410]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
lea ebx, [edi + 0x1c0]
mov dword [esp + 0x28], vtable.CAutoLock.0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x80], 0
movsd xmm1, qword [edi + 0x388]
ucomisd xmm1, qword [0x792018]
movsd xmm0, qword [0x7920b8]
lahf
test ah, 0x44
jnp 0x4797df
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jnp 0x4797df
mov eax, dword [edi]
sub esp, 8
mov ecx, edi
movsd qword [esp], xmm0
call dword [eax + 0x8c]
movsd xmm0, qword [0x7920b8]
mov eax, dword [edi]
lea ecx, [esp + 0x30]
movsd qword [edi + 0x388], xmm0
xorps xmm0, xmm0
push ecx
mov ecx, edi
movdqu xmmword [esp + 0x34], xmm0
call dword [eax + 0x18]
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x30]
push dword [edi + 0x368]
mov dword [esp + 0x18], eax
add eax, eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x8c]
mov esi, dword [eax + 0x290]
mov ecx, esi
call fcn.0047b0b0
push dword [edi + 0x36c]
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.0047b0b0
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x368]
test eax, eax
je 0x47985f
mov edx, dword [eax]
mov ecx, eax
push 1
push 0
call dword [edx + 0x50]
jmp 0x47988a
push str.__m_pCurrent__NULL__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47988a
push 0
push 0
push dword [0x805898]
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4798ae
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
push 0
push dword [esp + 0x20]
call fcn.0047af30
mov dword [esi + 0x60], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4798bd
mov dword [eax + 0x60], 0
mov ecx, dword [edi + 0x368]
test ecx, ecx
je 0x4798d0
mov eax, dword [ecx]
push 1
push 0
call dword [eax + 0x50]
mov ecx, dword [edi + 0x36c]
test ecx, ecx
je 0x4798f9
mov eax, dword [ecx]
push 1
push 1
call dword [eax + 0x50]
mov eax, dword [edi + 0x36c]
mov dword [edi + 0x368], eax
mov dword [edi + 0x36c], 0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x479918
push 0
push edi
push dword [0x805890]
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x479ff0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x7ef57c
mov edi, ecx
movapd xmm0, xmm1
push 0x7ef020
push 0
movsd qword [ebp - 0x30], xmm0
push dword [edi + 0x374]
mov ecx, dword [edi + 0x8c]
movsd qword [edi + 0x378], xmm0
call fcn.0044a910
push eax
call fcn.006b7069
mov esi, eax
add esp, 0x14
test esi, esi
je 0x47a126
movsd xmm0, qword [ebp - 0x30]
lea ecx, [esi + 0x28]
ucomisd xmm0, qword [0x792018]
lahf
test ah, 0x44
mov eax, dword [ecx]
jp 0x47a089
push 0
mov dword [esi + 0x134], 0
call dword [eax + 0x2c]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
push 1
mov dword [esi + 0x134], 1
call dword [eax + 0x2c]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, edi
call dword [eax + 0x1c]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
add ecx, eax
push 1
push 0
push 0
push ecx
push edx
push 0
push dword [esi + 4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
movsd xmm0, qword [ebp - 0x30]
mov ecx, edi
mulsd xmm0, qword [0x792128]
cvttsd2si eax, xmm0
push eax
push dword [esi + 4]
push dword [0x8058b0]
call fcn.00444110
mov ecx, dword [edi + 0x8c]
push 0xc8
push 0x64
push edi
mov ecx, dword [ecx + 0x474]
call fcn.00482a40
mov eax, dword [edi]
mov ecx, edi
push 0x64
call dword [eax + 0x74]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret

Function at 0x47a400
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0x64
je 0x47a41f
push eax
call fcn.00477880
pop esi
mov esp, ebp
pop ebp
ret 4
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x47a4d1
push ecx
mov ecx, esi
call fcn.0047a4e0
cmp eax, 1
je 0x47a49e
push ecx
mov ecx, esi
call fcn.0047a590
cmp eax, 1
je 0x47a49e
mov eax, dword [esi + 0x368]
sub eax, 0
je 0x47a46d
dec eax
je 0x47a45c
sub eax, 2
jne 0x47a4d1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x84]
pop esi
mov esp, ebp
pop ebp
ret 4
movsd xmm0, qword [esi + 0x378]
ucomisd xmm0, qword [0x792018]
lahf
test ah, 0x44
jp 0x47a45c
mov ecx, dword [esi + 0x8c]
push 0x64
push esi
mov ecx, dword [ecx + 0x474]
call fcn.00482b10
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x368]
sub eax, 0
je 0x47a4c7
sub eax, 2
je 0x47a4c7
dec eax
jne 0x47a4d1
movsd xmm0, qword [esi + 0x378]
ucomisd xmm0, qword [0x7920b8]
lahf
test ah, 0x44
jnp 0x47a4d1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47cfe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47d18b
mov eax, dword [ebp - 0x108]
sub eax, 0
je 0x47d178
dec eax
je 0x47d104
dec eax
jne 0x47d165
mov eax, dword [ebp - 0x114]
cmp eax, 3
jne 0x47d04d
mov eax, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x47d065
mov eax, 9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x47d0b7
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x47d087
mov eax, 0xa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x47d09f
mov eax, 0xb
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x47d0f1
mov eax, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x47d0f1
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x47d0d9
mov eax, 0xd
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x47d0f1
mov eax, 0xe
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov eax, 0xf
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x47d12a
cmp word [ebp - 0x102], 0x43
sete al
add eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x47d14d
xor eax, eax
cmp word [ebp - 0x102], 0x41
sete al
add eax, 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
cmp eax, 0x5a
jne 0x47d165
mov eax, 7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret

Function at 0x47d1a0
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
push 0x788ef0
push 0x788f04
movdqa xmmword [ebp - 0x30], xmm0
movdqa xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47d1f0
lea ecx, [ebp - 0x30]
push ecx
call eax
jmp 0x47d1fa
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x30], 9
mov eax, 0x20
mov ecx, 0x40
cmove eax, ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x47d520
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.006b47d0
xor eax, eax
push 0x81e
push eax
mov word [ebp - 0xa30], ax
lea eax, [ebp - 0xa2e]
push eax
call fcn.006b47d0
push 0x40
lea eax, [ebp - 0xa7c]
mov dword [ebp - 0xa80], 0
push 0
push eax
call fcn.006b47d0
add esp, 0x24
lea eax, [ebp - 0xa34]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47d653
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa38], 0x104
push eax
lea eax, [ebp - 0x210]
push eax
push 0x790eb0
push dword [ebp - 0xa34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 0xa34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov eax, 5
mov dword [ebp - 0xa54], 1
push 0x789094
mov word [ebp - 0xa50], ax
lea eax, [ebp - 0xa30]
push 0x410
push eax
call fcn.006b6718
add esp, 0x10
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0xa80]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x47d653
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
push esi
push 0x7890a0
lea eax, [ebp - 0xa30]
push 0x410
push eax
call fcn.006b6718
add esp, 0x10
lea eax, [ebp - 0xa30]
push 1
push 0
push eax
push str.explorer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop esi
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.006b3266
mov esp, ebp
pop ebp
ret