joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c440
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed328
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x50ca30]
mov edx, dword [ebp + 8]
movups xmmword [ebp - 0x7c], xmm0
mov dword [ebp - 0x98], 0
movaps xmm0, xmmword [0x50ca00]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 4
mov dword [ebp - 0xa4], 4
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], 0x7283737
mov byte [ebp - 0x58], 0
mov dword [ebp - 4], 0
xor ecx, ecx
movzx eax, byte [ebp + ecx - 0x7b]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x57], al
movzx eax, byte [ebp + ecx - 0x7a]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x56], al
movzx eax, byte [ebp + ecx - 0x79]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x55], al
movzx eax, byte [ebp + ecx - 0x78]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x54], al
movzx eax, byte [ebp + ecx - 0x77]
xor al, byte [ebp - 0x7c]
mov byte [ebp + ecx - 0x53], al
add ecx, 5
cmp ecx, 0x23
jb 0x46c4c0
push edx
lea eax, [ebp - 0x57]
mov byte [ebp - 0x34], 0
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0040e8a0
add esp, 0xc
lea ecx, [ebp - 0x98]
cmp dword [ebp - 0x80], 0x10
lea eax, [ebp - 0x94]
cmovae eax, dword [ebp - 0x94]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46c5ef
mov cl, 0x57
mov dword [ebp - 0x30], 0x24391e57
mov dword [ebp - 0x2c], 0x3b3b3623
xor edx, edx
mov dword [ebp - 0x28], 0x23362304
mov word [ebp - 0x24], 0x32
nop
movzx eax, byte [ebp + edx - 0x2f]
xor al, cl
mov byte [ebp + edx - 0x22], al
movzx eax, byte [ebp + edx - 0x2e]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x21], al
movzx eax, byte [ebp + edx - 0x2d]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x20], al
movzx eax, byte [ebp + edx - 0x2c]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x1f], al
movzx eax, byte [ebp + edx - 0x2b]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x1e], al
movzx eax, byte [ebp + edx - 0x2a]
xor al, byte [ebp - 0x30]
mov byte [ebp + edx - 0x1d], al
add edx, 6
cmp edx, 0xc
jae 0x46c5c4
mov cl, byte [ebp - 0x30]
jmp 0x46c570
lea eax, [ebp - 0xa0]
mov byte [ebp - 0x16], 0
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
lea eax, [ebp - 0x22]
push eax
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x80]
cmp eax, 0x10
jb 0x46c60a
inc eax
lea ecx, [ebp - 0x94]
push eax
push dword [ebp - 0x94]
call fcn.004099a0
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x46c61b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 4
Function at 0x46ca00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed418
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x50], 0
mov edx, 0x5b
mov dword [ebp - 0x4c], 0x3005b
mov dword [ebp - 0x48], 0x340039
mov dword [ebp - 0x44], 0xb0023
mov dword [ebp - 0x40], 0x1a0038
mov dword [ebp - 0x3c], 0x2b002b
mov dword [ebp - 0x38], 0x3e0075
mov dword [ebp - 0x34], 0x3e0023
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov ax, word [ebp + ecx*2 - 0x4a]
xor ax, dx
mov word [ebp + ecx*2 - 0x2e], ax
inc ecx
cmp ecx, 0xd
jae 0x46ca99
mov dx, word [ebp - 0x4c]
jmp 0x46ca80
xor eax, eax
mov dword [esi + 0x14], 7
mov word [ebp - 0x14], ax
mov dword [esi + 0x10], eax
mov word [esi], ax
cmp word [ebp - 0x2e], ax
je 0x46cacf
lea eax, [ebp - 0x2e]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46cac0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x2e]
mov ecx, esi
push eax
call fcn.00403e20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 4
Function at 0x4774a0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee270
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0x3240406e
mov dword [ebp - 0x2c], 0x800010d
mov dword [ebp - 0x28], 0x7400907
mov word [ebp - 0x24], 0x700
mov byte [ebp - 0x22], 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.00478440
mov byte [ebp - 4], 1
xor ecx, ecx
nop
mov dl, byte [ebp + ecx - 0x2f]
xor dl, byte [ebp - 0x30]
mov byte [ebp + ecx - 0x21], dl
inc ecx
cmp ecx, 0xd
jb 0x477500
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x14], 0
push ecx
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00407900
mov eax, dword [ebp - 0x34]
add esp, 0xc
cmp eax, 0x10
jb 0x47753b
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.004099a0
cmp dword [ebp - 0x4c], 0x10
lea esi, [ebp - 0x60]
mov bh, 0x7b
mov dword [ebp - 0x20], 0x51535132
cmovae esi, dword [ebp - 0x60]
mov al, 0x51
mov byte [ebp - 0x61], bh
mov dl, al
mov bh, 0x73
mov dword [ebp - 0x44], 0x7b7a7615
mov byte [ebp - 0x62], bh
mov cl, 0x53
mov bh, 0x7c
mov word [ebp - 0x1c], 0x575a
mov byte [ebp - 0x63], bh
mov ah, 0x76
mov bh, 0x72
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x64], bh
mov ch, 0x57
mov bh, byte [ebp - 0x20]
mov bl, 0x5a
xor al, bh
mov dword [ebp - 0x40], 0x727c73
mov byte [ebp - 0x19], al
xor cl, bh
mov al, byte [ebp - 0x62]
xor dl, bh
mov byte [ebp - 0x18], cl
xor ch, bh
mov cl, byte [ebp - 0x44]
xor bl, bh
mov bh, byte [ebp - 0x61]
xor al, cl
mov byte [ebp - 0x39], al
xor ah, cl
mov al, byte [ebp - 0x63]
mov dh, 0x7a
xor al, cl
mov byte [ebp - 0x3c], ah
mov byte [ebp - 0x38], al
xor dh, cl
mov al, byte [ebp - 0x64]
xor bh, cl
xor al, cl
mov byte [ebp - 0x17], dl
push esi
mov byte [ebp - 0x37], al
lea eax, [ebp - 0x19]
push 1
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x16], bl
push eax
mov byte [ebp - 0x15], ch
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x3b], dh
mov byte [ebp - 0x3a], bh
mov byte [ebp - 0x36], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x4c]
test eax, eax
setne bl
xor eax, eax
mov dword [ebp - 0x43], eax
mov word [ebp - 0x3f], ax
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x1f], eax
mov word [ebp - 0x1b], ax
cmp ecx, 0x10
jb 0x477616
inc ecx
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
call fcn.004099a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret
Function at 0x477990
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee31b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00477aa0
lea ecx, [ebp - 0x74]
call fcn.00478440
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.00477ea0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00478080
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00478250
mov dword [ebp - 4], 3
lea esi, [ebp - 0x74]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x78], 0xf
mov dword [ebp - 0x7c], 0
mov byte [ebp - 0x8c], 0
call fcn.00409690
cmp dword [ebp - 0x78], 0x10
lea eax, [ebp - 0x8c]
push 0
cmovae eax, dword [ebp - 0x8c]
push eax
call edi
mov eax, dword [ebp - 0x78]
cmp eax, 0x10
jb 0x477a57
inc eax
lea ecx, [ebp - 0x8c]
push eax
push dword [ebp - 0x8c]
call fcn.004099a0
add esi, 0x18
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x477a01
push fcn.004095a0
push 4
push 0x18
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.004a0a32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret
Function at 0x477d30
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee3e0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], 0x2e5c5c72
mov dword [ebp - 0x50], 0x141c1d11
mov dword [ebp - 0x4c], 0x1b5c151b
mov word [ebp - 0x48], 0x1b1c
mov byte [ebp - 0x46], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.00478440
mov byte [ebp - 4], 1
xor ecx, ecx
nop
mov dl, byte [ebp + ecx - 0x53]
xor dl, byte [ebp - 0x54]
mov byte [ebp + ecx - 0x45], dl
inc ecx
cmp ecx, 0xd
jb 0x477d90
lea ecx, [ebp - 0x45]
mov byte [ebp - 0x38], 0
push ecx
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00407900
mov eax, dword [ebp - 0x20]
add esp, 0xc
cmp eax, 0x10
jb 0x477dcb
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.004099a0
cmp dword [ebp - 0x58], 0x10
lea esi, [ebp - 0x6c]
mov bh, 0x37
mov dword [ebp - 0x1c], 0x545c5f33
cmovae esi, dword [ebp - 0x6c]
mov al, 0x5f
mov byte [ebp - 0x6d], bh
mov cl, 0x5c
mov bh, 0x39
mov dword [ebp - 0x30], 0x30313d5e
mov byte [ebp - 0x6e], bh
mov ah, 0x31
mov bh, byte [ebp - 0x1c]
mov bl, 0x54
xor al, bh
mov byte [ebp - 0x18], 0
xor cl, bh
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x6e]
xor bl, bh
mov bh, byte [ebp - 0x6d]
mov dl, 0x3d
mov byte [ebp - 0x16], cl
mov ch, 0x30
mov cl, byte [ebp - 0x30]
mov dh, 0x38
xor ah, cl
mov dword [ebp - 0x2c], 0x393738
xor al, cl
mov byte [ebp - 0x27], ah
push esi
mov byte [ebp - 0x23], al
xor dl, cl
push 4
lea eax, [ebp - 0x17]
mov byte [ebp - 0x15], bl
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x14], 0
xor ch, cl
mov byte [ebp - 0x28], dl
xor dh, cl
mov byte [ebp - 0x26], ch
xor bh, cl
mov byte [ebp - 0x25], dh
push eax
mov byte [ebp - 0x24], bh
mov byte [ebp - 0x22], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x58]
cmp eax, 0x10
jb 0x477e7f
inc eax
lea ecx, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
call fcn.004099a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret
Function at 0x478ec0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3768
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x48]
push eax
call fcn.004c1ebc
xor eax, eax
mov dword [ebp - 0x2c], 7
lea edx, [esi + 0x20c]
mov dword [ebp - 0x30], 0
add esp, 4
mov word [ebp - 0x40], ax
cmp word [edx], ax
jne 0x478f1b
xor ecx, ecx
jmp 0x478f2f
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x478f20
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00403e20
push 0x50add8
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00414c90
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x478f68
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403f90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004c74a3
add esp, 8
cmp eax, 0xffffffff
jne 0x478f97
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x44]
cmp dword [ebp - 0x14], 8
lea eax, [esi + 0x414]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
push str._s_s.__I64d.dmp
lea eax, [esi + 4]
push 0x104
push eax
call fcn.004793c0
mov eax, dword [ebp - 0x14]
add esp, 0x1c
cmp eax, 8
jb 0x478fdb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403f90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret

Function at 0x479000
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52610c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0x10]
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x47907e
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
push edi
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x47907e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x47907e
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004a04d5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47a740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eea25
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x52610c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
mov dword [ebp - 0x10], 0x52e280
mov dword [0x52e280], 0x50b1f8
mov dword [0x52e294], 0
mov dword [0x52e298], 0
mov dword [0x52e29c], 0
mov dword [0x52e2a0], 0
mov dword [0x52e2a4], 0
call fcn.004a0505
add esp, 4
mov dword [0x52e294], eax
test eax, eax
je 0x47a7d0
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [0x52e294]
mov dword [eax], 0x52e294
push 0x52e2a8
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push 8
mov dword [0x52e290], eax
call fcn.004a0505
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
push 0
mov byte [ebp - 4], 2
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0047ac80
push 0
push 0
push 1
mov dword [esi], eax
mov byte [ebp - 4], 1
push 0
mov dword [0x52e28c], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [0x52e288], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
xor esi, esi
mov dword [0x52e284], eax
cmp dword [0x52e290], esi
jbe 0x47a8ba
nop dword [eax]
push 0
push 0
push 0x52e280
push 0x47acb0
push 0
push 0
call fcn.004cb630
mov edi, dword [0x52e28c]
add esp, 0x18
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
mov ebx, dword [edi]
push eax
push dword [ebx + 4]
push ebx
call fcn.0047af40
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [edi + 4]
sub ecx, eax
cmp ecx, 1
jb 0x47a8d3
lea ecx, [eax + 1]
inc esi
mov dword [edi + 4], ecx
mov dword [ebx + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
cmp esi, dword [0x52e290]
jb 0x47a860
mov eax, 0x52e280
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.0049cede
int3

Function at 0x47b9e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x47b9f9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x47ba36
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x47ba32
nop word [eax + eax]
cmp esi, edx
jae 0x47ba36
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x47ba20
cmp esi, edx
jb 0x47ba3d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47c1f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eebe0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x52610c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x14]
call fcn.0047c510
push ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0047d170
add esp, 4
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c25a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.0047dc40
mov edi, eax
add esp, 4
test edi, edi
jne 0x47c273
xor esi, esi
jmp 0x47c367
push edi
mov edx, 0x47e080
lea ecx, [ebp - 0x24]
call fcn.0047ced0
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
movups xmm0, xmmword [edi + 0x38]
push esi
movups xmmword [ebp - 0x34], xmm0
call fcn.0047c510
push 0
push esi
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 0xc]
test edx, edx
je 0x47c2d7
lea ecx, [edx - 1]
test ecx, ecx
js 0x47c39a
cmp ecx, edx
jg 0x47c39a
cmp word [eax + ecx*2], 0x5c
je 0x47c2d7
push 0x507d60
lea ecx, [ebp - 0x10]
call fcn.0047c4c0
xor esi, esi
cmp dword [ebp - 0x30], esi
jb 0x47c33c
mov ebx, dword [ebp - 0x34]
ja 0x47c2f0
test ebx, ebx
je 0x47c339
nop word [eax + eax]
mov edx, dword [ebp - 0x10]
mov ecx, edi
call fcn.0047bdf0
test eax, eax
je 0x47c3ac
mov ecx, dword [ebp - 0x30]
add ebx, 0xffffffff
mov eax, esi
adc ecx, 0xffffffff
cdq
cmp edx, ecx
ja 0x47c327
jb 0x47c318
cmp eax, ebx
jae 0x47c327
mov ecx, edi
call fcn.0047e660
test eax, eax
jne 0x47c3ac
inc esi
mov eax, esi
cdq
cmp edx, dword [ebp - 0x30]
jb 0x47c3a4
ja 0x47c339
mov ebx, dword [ebp - 0x34]
cmp eax, ebx
jb 0x47c2f0
or ebx, 0xffffffff
mov esi, 1
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c35f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x24]
call fcn.0047cf60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x47c386
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0047b8f0
mov ebx, dword [ebp - 0x34]
jmp 0x47c2f0
xor esi, esi
or ebx, 0xffffffff
jmp 0x47c341
Function at 0x47f1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x47f24f
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004b9360
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x47f21f
sub eax, esi
jmp 0x47f221
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x47f210
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x47f240
sub eax, esi
jmp 0x47f242
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x47f231
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x47f383
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x47f27c
xor eax, eax
jmp 0x47f2cf
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x47f299
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.004831e0
jmp 0x47f2b1
cmp eax, 2
jne 0x47f2b7
mov edx, dword [ebx]
test edx, edx
jne 0x47f2a8
xor eax, eax
jmp 0x47f2b4
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.0047fdc0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.004b9360
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x47f2f7
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x47f30b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x47f1d0
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x47f383
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x47f353
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.004b98e0
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x47f383
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.004b98e0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fd90
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x47fd9b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0047fdc0
Function at 0x4a3710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4d5b6d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d59ec

Function at 0x4dae84
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dab44