joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c599
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x541280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004643c4
mov dword [ebp - 0x14], eax
cmp dword [0x553ed4], esi
jne 0x46c68c
push 0x800
push esi
push 0x4fb71c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46c619
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46c76c
push esi
push esi
push 0x4fb71c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46c76c
push 0x4fb734
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46c76c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x553ed4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x553ed8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4fb764
push edi
mov dword [0x553edc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x553ee4], eax
test eax, eax
je 0x46c689
push 0x4fb780
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x553ee0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46c6b1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46c6a4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46c6c6
push 4
pop eax
jmp 0x46c76e
cmp dword [ebp - 0x14], esi
je 0x46c6c6
push dword [0x553ed4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46c6ab
mov eax, dword [0x553ee0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46c724
cmp dword [0x553ee4], edi
je 0x46c724
push eax
call ebx
push dword [0x553ee4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46c724
test eax, eax
je 0x46c724
call ecx
test eax, eax
je 0x46c719
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46c719
test byte [ebp - 8], 1
jne 0x46c724
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46c754
mov eax, dword [0x553ed8]
cmp eax, edi
je 0x46c751
push eax
call ebx
test eax, eax
je 0x46c751
call eax
mov esi, eax
test esi, esi
je 0x46c751
mov eax, dword [0x553edc]
cmp eax, edi
je 0x46c751
push eax
call ebx
test eax, eax
je 0x46c751
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x553ed4]
call ebx
test eax, eax
je 0x46c76c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46c76e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e339
mov esp, ebp
pop ebp
ret
Function at 0x478310
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x478495
cmp dword [ebp + 0xc], 0
je 0x478495
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x478495
mov eax, dword [ebp + 0x14]
test al, 3
jne 0x478495
push edi
xor edi, edi
test eax, eax
jle 0x47848f
add esi, 2
push ebx
lea ecx, [ecx]
mov cl, byte [esi - 2]
lea ebx, [ecx - 0x41]
cmp bl, 0x19
jbe 0x478389
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x478368
lea ebx, [ecx - 0x47]
jmp 0x478389
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x478375
lea ebx, [ecx + 4]
jmp 0x478389
cmp cl, 0x2b
je 0x478387
cmp cl, 0x2f
je 0x478383
xor bl, bl
jmp 0x478389
mov bl, 0x3f
jmp 0x478389
mov bl, 0x3e
mov cl, byte [esi - 1]
lea edx, [ecx - 0x41]
cmp dl, 0x19
jbe 0x4783c2
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x4783a1
lea edx, [ecx - 0x47]
jmp 0x4783c2
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x4783ae
lea edx, [ecx + 4]
jmp 0x4783c2
cmp cl, 0x2b
je 0x4783c0
cmp cl, 0x2f
je 0x4783bc
xor dl, dl
jmp 0x4783c2
mov dl, 0x3f
jmp 0x4783c2
mov dl, 0x3e
mov cl, byte [esi]
mov al, cl
sub al, 0x41
cmp al, 0x19
jbe 0x4783fa
mov al, cl
sub al, 0x61
cmp al, 0x19
mov al, cl
ja 0x4783da
sub al, 0x47
jmp 0x4783fa
sub al, 0x30
cmp al, 9
ja 0x4783e6
mov al, cl
add al, 4
jmp 0x4783fa
cmp cl, 0x2b
je 0x4783f8
cmp cl, 0x2f
je 0x4783f4
xor al, al
jmp 0x4783fa
mov al, 0x3f
jmp 0x4783fa
mov al, 0x3e
mov ch, byte [esi + 1]
mov ah, ch
sub ah, 0x41
cmp ah, 0x19
jbe 0x47843d
mov cl, ch
sub cl, 0x61
cmp cl, 0x19
ja 0x478418
mov ah, ch
sub ah, 0x47
jmp 0x47843d
mov cl, ch
sub cl, 0x30
cmp cl, 9
ja 0x478429
mov ah, ch
add ah, 4
jmp 0x47843d
cmp ch, 0x2b
je 0x47843b
cmp ch, 0x2f
je 0x478437
xor ah, ah
jmp 0x47843d
mov ah, 0x3f
jmp 0x47843d
mov ah, 0x3e
mov cl, dl
shl bl, 2
shr cl, 4
inc edi
or cl, bl
shl dl, 4
mov ebx, dword [ebp + 8]
mov byte [ebx], cl
mov cl, al
shr cl, 2
or cl, dl
mov byte [ebx + 1], cl
cmp byte [esi], 0x3d
je 0x47848e
shl al, 6
inc edi
or al, ah
mov byte [ebx + 2], al
add ebx, 3
cmp byte [esi + 1], 0x3d
mov dword [ebp + 8], ebx
je 0x47848e
mov eax, dword [ebp + 0x14]
inc edi
sub eax, 4
add esi, 4
mov dword [ebp + 0x14], eax
cmp edi, dword [ebp + 0xc]
jae 0x47848e
test eax, eax
jg 0x478350
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4786c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
jne 0x4786d6
pop edi
xor al, al
pop ebx
pop ebp
ret 8
push esi
push edi
call fcn.004a15fd
push 2
push 0
push edi
mov esi, eax
call fcn.004a11ea
push edi
call fcn.004a15fd
push 0
push esi
push edi
mov dword [ebp + 8], eax
call fcn.004a11ea
mov esi, dword [ebp + 0xc]
add esp, 0x20
test esi, esi
je 0x478710
mov eax, dword [ebp + 8]
cmp eax, esi
jge 0x478713
mov esi, eax
jmp 0x478713
mov esi, dword [ebp + 8]
lea eax, [esi + 2]
push eax
call fcn.0045e5ee
add esp, 4
test eax, eax
je 0x478729
mov word [eax + esi], 0
push edi
push esi
push 1
push eax
mov dword [ebx + 0xc], eax
call fcn.004a10af
add esp, 0x10
cmp esi, eax
je 0x478756
mov ecx, ebx
call fcn.00478610
push edi
call fcn.00461603
add esp, 4
xor al, al
pop esi
pop edi
pop ebx
pop ebp
ret 8
push edi
mov dword [ebx + 8], esi
mov dword [ebx + 4], esi
call fcn.00461603
add esp, 4
mov al, 1
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4787b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4787ec
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4787c8
mov esi, dword [ecx + 8]
jmp 0x4787cf
cmp dword [ecx + 8], esi
cmovb esi, dword [ecx + 8]
push edi
push esi
push 1
push dword [ecx + 0xc]
call fcn.00461515
add esp, 0x10
cmp esi, eax
pop esi
push edi
je 0x4787f3
call fcn.00461603
add esp, 4
xor al, al
pop edi
pop ebp
ret 8
call fcn.00461603
add esp, 4
mov al, 1
pop edi
pop ebp
ret 8

Function at 0x479360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x4793d8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4793d8
push edi
push 0x4fef54
push eax
call fcn.0046167a
mov edi, eax
add esp, 8
test edi, edi
je 0x4793d2
push edi
push 2
lea eax, [ebp + 8]
push 1
push eax
call fcn.004a10af
add esp, 0x10
cmp eax, 2
jne 0x4793c9
cmp byte [ebp + 8], 0xff
jne 0x4793c9
cmp byte [ebp + 9], 0xfe
jne 0x4793c9
mov eax, dword [ebp + 0x10]
push edi
add eax, eax
push eax
push 1
push esi
call fcn.004a10af
push edi
mov esi, eax
call fcn.00461603
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
ret
push edi
call fcn.00461603
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x479440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4794bf
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4794bf
push ebx
push eax
mov eax, dword [ebp + 0x18]
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x47946c
pop ebx
pop edi
pop ebp
ret
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 8], 0
mov esi, eax
je 0x47949f
cmp esi, dword [ebp + 0xc]
push ebx
cmova esi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47949d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x4794a4
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
push esi
push edi
push dword [ebp + 8]
call fcn.00469db0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret

Function at 0x479780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00479650

Function at 0x479830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004796e0

Function at 0x479840
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x553fc0]
test eax, eax
jne 0x479937
push ebx
push esi
push edi
push 0x200
call fcn.0045e5ee
mov esi, eax
add esp, 4
mov dword [0x553fc0], esi
xor edi, edi
movzx ecx, di
mov al, cl
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr cx, 1
and edx, 0x8005
xor dx, cx
mov al, dl
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr dx, 1
and ecx, 0x8005
xor cx, dx
mov al, cl
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr cx, 1
and edx, 0x8005
xor dx, cx
mov al, dl
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr dx, 1
and ecx, 0x8005
xor cx, dx
mov al, cl
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr cx, 1
and edx, 0x8005
xor dx, cx
mov al, dl
and al, 1
movzx ebx, al
neg ebx
sbb ebx, ebx
shr dx, 1
and ebx, 0x8005
xor bx, dx
mov al, bl
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr bx, 1
and ecx, 0x8005
xor cx, bx
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0x8005
xor ax, cx
mov word [esi + edi*2], ax
inc edi
cmp edi, 0x100
jb 0x479867
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x479940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
jne 0x479954
call fcn.00479840
mov esi, eax
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x479993
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x479993
mov eax, dword [ebp + 8]
xor edx, edx
not eax
movzx eax, ax
test edi, edi
je 0x47998c
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
shr ax, 8
and ecx, 0xff
xor ax, word [esi + ecx*2]
movzx eax, ax
cmp edx, edi
jb 0x479970
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov ax, word [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x479ab0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x18]
push eax
call fcn.0046a400
add esp, 0xc
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0x67452301
mov dword [esi + 0x64], 0xefcdab89
mov dword [esi + 0x68], 0x98badcfe
mov dword [esi + 0x6c], 0x10325476
pop esi
ret

Function at 0x47a400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x541280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x7c], ecx
test eax, eax
je 0x47a527
test ecx, ecx
je 0x47a527
push esi
push 0x4fef54
push eax
call fcn.0046167a
mov esi, eax
add esp, 8
mov dword [ebp - 0x78], esi
test esi, esi
jne 0x47a452
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0x10000
call fcn.0045e5ee
add esp, 4
lea ecx, [ebp - 0x74]
mov ebx, eax
call fcn.004799a0
lea ecx, [ebp - 0x74]
call fcn.00479ab0
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47a4c0
lea ebx, [ebx]
push esi
push 0x10000
push 1
push ebx
call fcn.004a10af
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47a4e8
cmp edi, esi
lea ecx, [ebp - 0x74]
cmovb esi, edi
push esi
push ebx
call fcn.004799f0
cmp edi, esi
jb 0x47a4ae
sub edi, esi
jmp 0x47a4b0
xor edi, edi
test esi, esi
je 0x47a4e8
test edi, edi
je 0x47a4e8
mov esi, dword [ebp - 0x78]
jmp 0x47a480
push esi
push 0x10000
push 1
push ebx
call fcn.004a10af
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47a4e8
push esi
push ebx
lea ecx, [ebp - 0x74]
call fcn.004799f0
test esi, esi
mov esi, dword [ebp - 0x78]
jne 0x47a4c0
lea ecx, [ebp - 0x74]
call fcn.00479af0
push ebx
call fcn.0045e578
push dword [ebp - 0x78]
call fcn.00461603
add esp, 8
lea ecx, [ebp - 0x74]
call fcn.00479b80
pop edi
pop ebx
pop esi
movdqu xmm0, xmmword [eax]
mov eax, dword [ebp - 0x7c]
movdqu xmmword [eax], xmm0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
Function at 0x47a8f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x541280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x47a91c
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
push esi
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47a922
sub esi, ecx
sar esi, 1
cmp esi, 3
jae 0x47a948
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
push 0
push ebx
call fcn.0045f045
add esp, 8
cmp eax, 0xffffffff
je 0x47a96a
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
push edi
xor eax, eax
xor ecx, ecx
push 0x800
push eax
mov word [ebp - 0x808], ax
mov edi, ebx
lea eax, [ebp - 0x806]
mov dword [ebp - 0x80c], ecx
push eax
call fcn.0046a400
add esp, 0xc
cmp word [ebx], 0
je 0x47aa05
mov cx, word [ebp + 0xc]
xor eax, eax
nop
lea edi, [edi + 2]
add eax, 2
mov dword [ebp - 0x810], eax
cmp word [edi], cx
jne 0x47a9ff
lea ecx, [ebx + 2]
add ecx, eax
sar eax, 1
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x80c], ecx
push ebx
push eax
call fcn.0045fa8c
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.0045f045
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47a9f5
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x47aa20
mov cx, word [ebp + 0xc]
mov eax, dword [ebp - 0x810]
cmp word [edi], 0
jne 0x47a9a0
mov eax, dword [ebp - 0x80c]
sub eax, ebx
sar eax, 1
cmp eax, esi
je 0x47aa33
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47aa33
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e339
mov esp, ebp
pop ebp
ret
Function at 0x47aa50
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x126c
call fcn.00471f10
mov eax, dword [0x541280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x47aa80
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47aa85
sub ecx, edx
sar ecx, 1
je 0x47aa6f
lea eax, [ebp - 0x1268]
mov dword [ebp - 0xa64], 0
mov dword [ebp - 0x126c], eax
xor eax, eax
cmp word [esi + ecx*2 - 2], 0x5c
mov word [ebp - 0x1268], ax
lea eax, [ebp - 0x126c]
push esi
jne 0x47aacb
push 0x4ff0ac
jmp 0x47aad0
push str._s.
push eax
call fcn.00443de0
add esp, 0xc
mov dword [ebp - 0x258], 0
lea eax, [ebp - 0xa5c]
mov dword [ebp - 0xa60], eax
xor eax, eax
mov word [ebp - 0xa5c], ax
lea eax, [ebp - 0x254]
push ebx
push edi
push eax
lea eax, [ebp - 0x1268]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47ac15
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov ecx, 0x534b18
lea eax, [ebp - 0x228]
jmp 0x47ab30
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47ab56
test dx, dx
je 0x47ab52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47ab56
add eax, 4
add ecx, 4
test dx, dx
jne 0x47ab30
xor eax, eax
jmp 0x47ab5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x47ac03
mov ecx, 0x53ab18
lea eax, [ebp - 0x228]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47ab96
test dx, dx
je 0x47ab92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47ab96
add eax, 4
add ecx, 4
test dx, dx
jne 0x47ab70
xor eax, eax
jmp 0x47ab9b
sbb eax, eax
or eax, 1
test eax, eax
je 0x47ac03
lea eax, [ebp - 0x228]
push eax
push esi
lea eax, [ebp - 0xa60]
push 0x4ff0a0
push eax
call fcn.00443de0
add esp, 0x10
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x47abdd
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0xa5c]
push eax
je 0x47abf9
call fcn.0047aa50
add esp, 4
test al, al
jmp 0x47ac01
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x47ac39
lea eax, [ebp - 0x254]
push eax
push edi
call ebx
test eax, eax
jne 0x47ab20
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
test eax, eax
pop ebx
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0045e339
mov esp, ebp
pop ebp
ret
Function at 0x47af40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1664
call fcn.00471f10
mov eax, dword [0x541280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x47af70
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x47b19c
push 0x800
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.0046a400
lea ecx, [ebp - 0x808]
add esp, 0xc
sub ecx, esi
jmp 0x47afb0
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x47afb0
lea eax, [ebp - 0x808]
push 0xffffffffffffffff
push eax
call fcn.00478a00
lea esi, [ebp - 0x808]
add esp, 8
lea ecx, [esi + 2]
lea ebx, [ebx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47afe0
push edi
xor eax, eax
mov dword [ebp - 0x1664], 0
push 0x800
push eax
mov word [ebp - 0x100c], ax
sub esi, ecx
lea eax, [ebp - 0x100a]
sar esi, 1
push eax
call fcn.0046a400
push 0x22c
lea eax, [ebp - 0x1660]
push 0
push eax
call fcn.0046a400
add esp, 0x18
mov dword [ebp - 0x1660], 0x22c
lea eax, [ebp - 0x1660]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x47b192
xor eax, eax
movzx ecx, word [ebp + eax - 0x163c]
lea eax, [eax + 2]
mov word [ebp + eax - 0x100e], cx
test cx, cx
jne 0x47b052
lea eax, [ebp - 0x100c]
push 0xffffffffffffffff
push eax
call fcn.00478a00
lea ecx, [ebp - 0x100c]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b084
sub ecx, edx
sar ecx, 1
cmp esi, ecx
jb 0x47b166
push ecx
lea eax, [ebp - 0x100c]
push eax
mov eax, esi
sub eax, ecx
lea eax, [ebp + eax*2 - 0x808]
push eax
call fcn.00470f15
add esp, 0xc
test eax, eax
jne 0x47b166
push dword [ebp - 0x1658]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x47b160
push 0x428
lea eax, [ebp - 0x1434]
push 0
push eax
call fcn.0046a400
add esp, 0xc
mov dword [ebp - 0x1434], 0x428
lea eax, [ebp - 0x1434]
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x47b155
lea eax, [ebp - 0x1214]
push 0xffffffffffffffff
push eax
call fcn.00478a00
lea ecx, [ebp - 0x1214]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b122
sub ecx, edx
sar ecx, 1
cmp ecx, esi
jb 0x47b155
push esi
lea eax, [ebp - 0x808]
sub ecx, esi
push eax
lea eax, [ebp - 0x1214]
lea eax, [eax + ecx*2]
push eax
call fcn.00470f15
add esp, 0xc
test eax, eax
je 0x47b17d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x47b166
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1660]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47b050
jmp 0x47b192
mov eax, dword [ebp - 0x1658]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1664], eax
call edi
push ebx
call edi
mov eax, dword [ebp - 0x1664]
pop edi
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
pop esi
call fcn.0045e339
mov esp, ebp
pop ebp
ret
Function at 0x47b1b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x47b1c0
xor al, al
pop esi
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x47b202
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x47b202
push esi
call fcn.0047af40
push eax
call fcn.0047a870
add esp, 8
test al, al
je 0x47b202
cmp byte [ebp + 0xc], 0
je 0x47b202
push edi
push edi
push 0x4ff0cc
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
cmp edi, 1
pop edi
sete al
pop esi
pop ebp
ret

Function at 0x47b210
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x541280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 8
push 0
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47b24c
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e339
mov esp, ebp
pop ebp
ret
push esi
mov ecx, 0x553fd4
mov byte [ebp - 0x15], 0
call fcn.004780d0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
call esi
mov ecx, 0x553fc4
mov dword [ebp - 0x20], eax
call fcn.004780d0
push eax
push edi
call esi
mov ecx, 0x553fcc
mov dword [ebp - 0x1c], eax
call fcn.004780d0
push eax
push edi
call esi
cmp dword [ebp - 0x20], 0
mov dword [ebp - 0x24], eax
je 0x47b322
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x47b322
test eax, eax
je 0x47b322
test ebx, ebx
jne 0x47b2af
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push 0x28
push ebx
call dword [ebp - 0x20]
test eax, eax
je 0x47b322
cmp dword [ebp - 0x1c], 0
je 0x47b322
lea eax, [ebp - 0x2c]
push eax
push str.SeDebugPrivilege
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x47b318
mov eax, dword [ebp - 0x2c]
xorps xmm0, xmm0
push 0
movdqu xmmword [ebp - 0x14], xmm0
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [ebp - 0x24]
test eax, eax
je 0x47b318
mov byte [ebp - 0x15], 1
jmp 0x47b31d
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x1c]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x15]
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.0045e339
mov esp, ebp
pop ebp
ret