joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4703bc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x300
mov eax, 0x44d0a0
call fcn.0043bccd
mov dword [ebp - 0x304], edx
mov edi, ecx
mov dword [ebp - 0x2fc], edi
xor ebx, ebx
inc ebx
test edi, edi
je 0x4703f0
push 0x407044
push edi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
jne 0x4703f2
xor ebx, ebx
and dword [ebp - 4], 0
test ebx, ebx
je 0x4705c8
push edi
lea ecx, [ebp - 0xa8]
call fcn.004319bd
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
call fcn.0046f1b7
mov eax, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0x9c]
mov esi, dword [eax + 0x10]
mov ecx, esi
push 0x40fd54
call dword [0x4a3670]
lea ecx, [ebp - 0xa8]
call esi
and dword [ebp - 0x30c], 0
lea eax, [ebp - 0x2f8]
and dword [ebp - 0x308], 0
push eax
push dword [ebp - 0xa4]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x300], esi
mov byte [ebp - 4], 2
cmp esi, 0xffffffff
je 0x470548
test esi, esi
je 0x470548
push 0x407048
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x470532
push 0x40fd98
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x470532
mov eax, dword [ebp - 0xa8]
push 0xffffffffffffffff
push 0
push edi
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [0x4a3670]
lea ecx, [ebp - 0xa8]
call edi
lea ecx, [ebp - 0xa8]
call fcn.0046f1b7
push 0xffffffffffffffff
push dword [ebp - 0x9c]
lea eax, [ebp - 0x2cc]
push eax
mov eax, dword [ebp - 0xa8]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [0x4a3670]
lea ecx, [ebp - 0xa8]
call edi
test byte [ebp - 0x2f8], 0x10
je 0x470520
mov edx, dword [ebp - 0x304]
mov ecx, dword [ebp - 0xa4]
push 0
call fcn.004703bc
jmp 0x47052c
push dword [ebp - 0xa4]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov edi, dword [ebp - 0x2fc]
lea eax, [ebp - 0x2f8]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x47046c
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x470577
test esi, esi
je 0x470577
mov eax, dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
lea edx, [ebp - 0x2fc]
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x2fc], esi
mov dword [ebp - 0x300], eax
call fcn.0043d568
cmp dword [ebp - 0x304], 0
je 0x47058d
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
and ebx, eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0x401028
test eax, eax
je 0x4705c8
lea ecx, [ebp - 0x98]
cmp eax, ecx
je 0x4705c8
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x4705c8
mov eax, ebx
call fcn.0043bc1f
ret 4
Function at 0x470666
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
push esi
mov ebx, edx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x4706b7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebx], eax
cmp eax, 0x50
je 0x470699
cmp eax, 0xb7
je 0x470699
xor eax, eax
jmp 0x4706d1
test edi, edi
je 0x4706b7
push dword [edi + 4]
push 4
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetFileSecurityW]
test eax, eax
jne 0x4706b7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebx], eax
jmp 0x470695
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
or eax, 0x2000
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
and dword [ebx], 0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x470dcc
Capabilities:
Enumerate services
Query service status
Stop service

Disassembly:
push 0x58
mov eax, 0x44d1db
call fcn.0043bc61
mov edi, ecx
mov dword [ebp - 0x64], edi
lea eax, [ebp - 0x58]
xor ebx, ebx
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push 1
push dword [edi]
call dword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
test eax, eax
jne 0x470f11
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xea
jne 0x470f11
push 0x4084c8
push dword [ebp - 0x54]
call fcn.0043b996
mov esi, eax
mov dword [ebp - 0x60], esi
pop ecx
pop ecx
test esi, esi
je 0x470efd
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 1
push dword [edi]
call dword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
test eax, eax
je 0x470efd
mov edi, ebx
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x58], ebx
jbe 0x470efd
push ecx
push 0x24
push dword [esi]
lea ecx, [ebp - 0x4c]
call fcn.0043420c
xor eax, eax
cmp dword [ebp - 0x4c], eax
setne al
test eax, eax
je 0x470ed9
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push dword [ebp - 0x4c]
call dword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x470ed6
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov edi, eax
mov eax, edx
add edi, 0x7530
adc eax, ebx
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x28], 1
je 0x470ed6
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
cmp edx, dword [ebp - 0x5c]
ja 0x470ed6
jb 0x470eb6
cmp eax, edi
jae 0x470ed6
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x470e9f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0x50]
cmp dword [ebp - 0x4c], ebx
je 0x470ee7
push dword [ebp - 0x4c]
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
inc edi
mov dword [ebp - 0x4c], ebx
add esi, 0x24
mov dword [ebp - 0x50], edi
cmp edi, dword [ebp - 0x58]
jb 0x470e54
mov esi, dword [ebp - 0x60]
mov dword [ebp - 4], ebx
push esi
mov esi, dword [0x402f60]
mov ecx, esi
call dword [0x4a3670]
call esi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x64]
push 1
push dword [eax]
call dword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
jne 0x470f4e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x470f47
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x470f4e
mov ebx, 0x80004005
mov eax, ebx
call fcn.0043bc10
ret
Function at 0x470fcb
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi], 2
jne 0x471175
xor edi, edi
cmp dword [esi + 0x10], edi
jle 0x471175
mov eax, dword [esi + 0x14]
lea ecx, [ebp - 0x170]
push 0x40a8c0
mov dword [ebp - 0x170], edi
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x15c], eax
call fcn.0041d246
test al, al
je 0x471062
mov eax, dword [ebp - 0x170]
cmp eax, dword [esi]
jne 0x471062
mov eax, dword [ebp - 0x16c]
cmp eax, dword [esi + 4]
jne 0x471062
mov eax, dword [ebp - 0x168]
cmp eax, dword [esi + 8]
jne 0x471062
mov eax, dword [ebp - 0x160]
cmp eax, dword [esi + 0x10]
je 0x471175
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x40fda4
push 0x10
push eax
call fcn.0041d6f4
add esp, 0x10
test eax, eax
js 0x471175
push dword [esi + 0x10]
lea eax, [ebp - 0x44]
push 0x4077e4
push 0x10
push eax
call fcn.0041d6f4
add esp, 0x10
test eax, eax
js 0x471175
push edi
push 0x2710
push dword [esi + 8]
push dword [esi + 4]
call fcn.0043d000
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x14c], edx
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_FileTimeToSystemTime]
test eax, eax
je 0x471175
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x180]
push eax
push edi
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x471175
push 0x80
lea eax, [ebp - 0x148]
push eax
push edi
lea eax, [ebp - 0x168]
push eax
push edi
push 0x800
call dword [sym.imp.api_ms_win_core_datetime_l1_1_0.dll_GetTimeFormatW]
test eax, eax
jle 0x471175
lea eax, [ebp - 0x24]
mov dword [ebp - 0x158], 0x407044
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x148]
push 0x406bfc
push edi
mov dword [ebp - 0x14c], eax
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x471175
push edi
lea eax, [ebp - 0x158]
push eax
push edi
push 4
push edi
push 0x800003f7
push 1
push 2
push esi
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
push esi
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043b590
leave
ret
Function at 0x471af1
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x68
push 0
push ebx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], edi
call sub.msvcrt.dll_memset
add esp, 0xc
test edi, edi
je 0x471b3d
xor eax, eax
mov word [edi], ax
lea ecx, [ebp - 0x218]
call fcn.00471db4
mov esi, eax
test esi, esi
js 0x471c59
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetLogicalDrives]
mov di, word [ebp - 0x218]
mov edx, eax
xor eax, eax
mov dword [ebp - 0x224], ebx
mov ebx, dword [ebp - 0x228]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x220], eax
cmp eax, 0x1a
jae 0x471c39
mov ecx, dword [ebp - 0x220]
xor eax, eax
inc eax
shl eax, cl
test edx, eax
je 0x471c1d
lea eax, [ecx + 0x41]
mov dword [ebp - 0xc], 0x3a0020
movzx eax, ax
mov dword [ebp - 0x228], eax
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x5c
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 3
jne 0x471c17
push ecx
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x22c]
mov dx, di
call fcn.00471e1d
mov esi, eax
test esi, esi
js 0x471c17
mov edx, ebx
lea ecx, [ebp - 0x214]
call fcn.00471a00
mov esi, eax
cmp esi, 1
jne 0x471bfe
xor esi, esi
jmp 0x471c17
test esi, esi
js 0x471c17
push dword [ebp - 0x224]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHCORE.dll_SHStrDupW]
mov esi, eax
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
add dword [ebp - 0x224], 4
inc eax
mov dword [ebp - 0x220], eax
test esi, esi
jns 0x471b7b
mov edi, dword [ebp - 0x230]
mov ebx, dword [ebp - 0x234]
test esi, esi
js 0x471c59
test edi, edi
je 0x471c6e
mov ax, word [ebp - 0x218]
mov word [edi], ax
jmp 0x471c6e
xor edi, edi
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
and dword [ebx + edi*4], 0
inc edi
cmp edi, 0x1a
jb 0x471c5b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b590
leave
ret 8
Function at 0x471c81
Capabilities:
Get disk information

Disassembly:
push 0x10
mov eax, 0x449ae0
call fcn.0043bc2e
mov ebx, edx
mov dword [ebp - 0x14], ebx
mov eax, ecx
mov dword [ebp - 0x18], eax
xor ecx, ecx
xor esi, esi
mov word [ebx], cx
mov edi, esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], esi
push ecx
push esi
push esi
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x471d89
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xea
jne 0x471d89
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov esi, dword [0x402f5c]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov ecx, esi
call dword [0x4a3670]
call esi
mov ebx, eax
test ebx, ebx
je 0x471d7d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x471d50
xor eax, eax
mov esi, ebx
cmp word [ebx], ax
je 0x471d65
push esi
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsRootW]
test eax, eax
jne 0x471d45
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1c]
jne 0x471d26
sub ecx, edx
xor eax, eax
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], ax
jne 0x471d16
jmp 0x471d65
mov ecx, dword [ebp - 0x14]
mov ax, word [esi]
mov word [ecx], ax
jmp 0x471d65
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x471d65
movzx edi, di
or edi, 0x80070000
xor esi, esi
mov dword [ebp - 4], esi
mov esi, dword [0x402f60]
mov ecx, esi
push ebx
call dword [0x4a3670]
call esi
jmp 0x471d82
mov edi, 0x8007000e
mov ebx, dword [ebp - 0x14]
xor esi, esi
jmp 0x471d9e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x471da0
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x471dac
cmp word [ebx], si
jne 0x471dac
mov edi, 0x80070057
mov eax, edi
call fcn.0043bbfc
ret

Function at 0x471db4
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x24
push esi
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x471e0d
push dword [ebp - 0x20c]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [edi], ax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0043b590
leave
ret
Function at 0x471e1d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ecx
mov esi, edx
xor edi, edi
call dword [sym.imp.msvcrt.dll_towupper]
movzx eax, ax
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
cmp cx, ax
jne 0x471e6e
push dword [ebp + 8]
mov edx, 0x104
mov ecx, ebx
call fcn.00422867
jmp 0x471ef1
push 0x104
lea eax, [ebp - 0x214]
mov dword [ebp - 0xc], 0x3a0020
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x5c
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x471eb3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x471eb1
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x471ef3
lea eax, [ebp - 0x214]
push 0x7b
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x471ecf
mov edi, 0x8000ffff
test edi, edi
js 0x471ef3
push dword [ebp + 8]
mov edx, 0x104
mov ecx, ebx
call fcn.00422867
mov edi, eax
test edi, edi
js 0x471ef3
push ecx
push esi
mov ecx, ebx
call fcn.00471f06
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b590
leave
ret 0xc
Function at 0x474927
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d440
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x36b4
call fcn.00447ce0
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0x10]
mov esi, 0xdac
and dword [ebp - 4], 0
mov edx, esi
mov eax, dword [ebp + 0xc]
push dword [ecx]
lea ecx, [ebp - 0x36c4]
push eax
call fcn.0045dd9f
test eax, eax
js 0x474a20
lea eax, [ebp - 0x36c4]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
push 0x411b50
lea eax, [ebp - 0x1b6c]
push esi
push eax
call fcn.0041d6f4
add esp, 0x14
test eax, eax
js 0x4749c3
cmp byte [0x4a1379], 0
je 0x4749c3
lea eax, [ebp - 0x1b6c]
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
lea eax, [ebp - 0x1b6c]
push eax
call fcn.00474ebe
cmp byte [0x4a1378], 0
jne 0x4749dd
call fcn.0043a79a
cmp byte [0x4a1379], 0
jne 0x474a01
push 0x407f50
push dword [0x4a05c4]
push dword [0x4a05c0]
call dword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventEnabled]
test al, al
je 0x474a20
test byte [0x4a2942], 0x20
je 0x474a20
lea eax, [ebp - 0x36c4]
mov edx, 0x407f50
push eax
mov ecx, 0x4a05c0
call fcn.004665e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043b590
leave
ret 0xc

Function at 0x47d476
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], 0x44
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x47d4c7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x47d4be
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x47d4eb
mov eax, 0x80004005
jmp 0x47d4eb
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x47d4aa
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
and eax, 0x7ff8fffb
add eax, 0x80070005
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043b590
leave
ret 8
Function at 0x47eef4
Capabilities:
Reference sql statements

Disassembly:
push 0x200
mov eax, 0x44e302
call fcn.0043bccd
mov ebx, edx
mov edx, ecx
push 0x65
pop ecx
mov esi, 0x4124d8
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1d8]
mov dword [ebp - 0x1e0], eax
rep movsd dword es:[edi], dword [esi]
push 0xb
pop ecx
mov esi, 0x4124a4
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 0x204], edi
mov dword [ebp - 0x200], edi
mov dword [ebp - 0x1fc], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x44]
cmp edx, 1
je 0x47ef53
mov eax, 0x407044
push edx
push eax
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0047e757
mov esi, eax
add esp, 0x10
test esi, esi
js 0x47f06a
mov dword [ebp - 0x1dc], edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1dc]
push dword [ebp - 0x204]
call fcn.0047e864
sub esp, 0x18
mov dword [ebp - 0x1f8], edi
mov eax, esp
mov dword [ebp - 0x1f4], edi
mov dword [ebp - 0x1e8], edi
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], edi
lea edx, [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
mov dword [eax], 0x402b3c
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1dc]
mov dword [eax + 8], edx
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 4], 3
call fcn.0047e3b5
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1f0]
push dword [ebp - 0x1e8]
push dword [ebp - 0x1f4]
push dword [ebp - 0x1f8]
call fcn.0047ea49
mov ecx, dword [ebp + 4]
test eax, eax
jns 0x47f01e
push eax
push 0x412290
mov edx, pe_nt_image_headers32
call fcn.0043f81b
mov ecx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x1f0]
mov dword [ebx], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x1dc]
call fcn.0041e3c6
jmp 0x47f06a
lea ecx, [ebp - 0x204]
call fcn.0045e3cb
mov eax, esi
call fcn.0043bc1f
ret 4

Function at 0x47f07f
Capabilities:
Reference sql statements

Disassembly:
push 0x1c8
mov eax, 0x44e356
call fcn.0043bccd
mov ebx, edx
mov edx, ecx
push 0x5d
pop ecx
mov esi, 0x4122e8
lea edi, [ebp - 0x1b8]
rep movsd dword es:[edi], dword [esi]
push 0xb
pop ecx
mov esi, 0x4124a4
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1c4], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x44]
cmp edx, 1
je 0x47f0d5
mov eax, 0x407044
push edx
push eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.0047e757
add esp, 0x10
test eax, eax
js 0x47f16a
mov dword [ebp - 0x1bc], esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1bc]
push dword [ebp - 0x1cc]
call fcn.0047e864
sub esp, 0x18
mov dword [ebp - 0x1d4], esi
mov eax, esp
mov dword [ebp - 0x1d0], esi
mov dword [ebp - 0x1c0], eax
mov dword [eax], 0x402b58
lea ecx, [ebp - 0x1bc]
mov dword [eax + 4], ebx
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x1d4]
push eax
mov byte [ebp - 4], 3
call fcn.0047e3b5
lea ecx, [ebp - 0x1bc]
call fcn.0041e3c6
jmp 0x47f16a
lea ecx, [ebp - 0x1cc]
call fcn.0045e3cb
call fcn.0043bc1f
ret
Function at 0x48949b
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4895f1
mov edi, 0x10000000
cmp eax, 0x7c
je 0x4895f1
cmp eax, 0x29
jne 0x4894d6
cmp dword [esi + 0x10], 0
jne 0x4895f1
test dword [esi + 0x50], edi
je 0x48957e
cmp eax, 0x2e
jne 0x4894f1
push 5
lea ecx, [esi + 0x24]
call fcn.0048b60c
mov ecx, esi
call fcn.0048b658
jmp 0x4895dc
cmp eax, 0x5c
jne 0x489546
mov ecx, esi
call fcn.0048b658
test byte [esi + 0x50], 0x80
je 0x48953a
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x489522
push 4
lea ecx, [esi + 0x24]
call fcn.0048b60c
mov ecx, esi
call fcn.0048b658
jmp 0x4895e3
cmp eax, 0x42
jne 0x48953a
push 4
lea ecx, [esi + 0x24]
call fcn.0048b60c
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x489516
mov ecx, esi
call fcn.00489656
jmp 0x4895dc
cmp eax, 0x5b
jne 0x489563
mov ecx, esi
call fcn.0048b658
mov ecx, esi
call fcn.00489aa1
cmp dword [esi + 0x4c], 0x5d
je 0x4894e5
push 4
jmp 0x489580
cmp eax, 0x28
jne 0x489585
mov ecx, esi
call fcn.0048b658
mov ecx, esi
call fcn.0048ba4f
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x4895d1
push 5
call fcn.0043b1c5
cmp eax, 0x5e
jne 0x48958e
push 2
jmp 0x48950e
cmp eax, 0x24
jne 0x48959a
push 3
jmp 0x48950e
cmp eax, 0x2a
je 0x4895fb
cmp eax, 0x2b
je 0x4895fb
cmp eax, 0x3f
je 0x4895fb
cmp eax, 0x7b
je 0x4895fb
cmp eax, 0x7d
jne 0x4895b8
test dword [esi + 0x50], edi
je 0x4895f7
cmp eax, 0x5d
jne 0x4895c2
test dword [esi + 0x50], edi
je 0x48955f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00488e99
mov bl, 1
mov ecx, esi
call fcn.0048b658
test bl, bl
je 0x4895e3
mov ecx, esi
call fcn.0048b683
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4894b5
pop edi
pop esi
mov al, cl
pop ebx
ret
push 6
jmp 0x489580
push 0xa
jmp 0x489580

Function at 0x4920cd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
mov edi, ecx
cmp dword [ebp + 8], esi
jbe 0x4920f8
movzx eax, byte [esi + edx]
add eax, dword [edi]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
inc esi
mov dword [edi], eax
cmp esi, dword [ebp + 8]
jb 0x4920dd
pop edi
pop esi
pop ebp
ret 4