joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d6b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.004ea000
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46d71f
lea eax, [ebp - 0x20c]
push 0x794470
push eax
call fcn.004ff8f7
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0046cbf9
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004584a2
mov esp, ebp
pop ebp
ret 4

Function at 0x46e8ec
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.0045feee
test al, al
je 0x46e912
add ah, byte [ebx - 0x247860a0]
and dl, byte [esi - 0x65]
pop ebx
salc
out 0x24, al
clc
mov ebp, 0xb16611a7
jnp 0x46e8b3
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
pop edi
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x46ec5a
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x46f458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x46f4d7
push ebx
push edi
xor edi, edi
push str.a8dab1393108f00fa49185e182052e07
mov dword [ebp + 8], edi
call fcn.004f2bd0
mov ebx, dword [ebp + 0xc]
mov edx, edi
pop ecx
test ebx, ebx
je 0x46f494
mov cl, byte [edi + str.a8dab1393108f00fa49185e182052e07]
xor byte [edx + esi], cl
inc edi
xor ecx, ecx
cmp edi, eax
cmovge edi, ecx
inc edx
cmp edx, ebx
jb 0x46f47e
cmp ebx, 1
jle 0x46f4cb
cmp byte [esi], 0x37
jne 0x46f4cb
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x46f4a9
cmp al, 0x5a
jne 0x46f4cb
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.004526e0
test eax, eax
je 0x46f4cb
mov edx, dword [ebp + 8]
test edx, edx
je 0x46f4cb
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x46f4d5
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x46f809
Capabilities:
Create directory

Disassembly:
push 0x4a8
mov eax, 0x6fc4de
call fcn.00458b7c
mov dword [ebp - 0x4b4], ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x46f82c
xor eax, eax
jmp 0x46fa32
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004ea000
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.004ff950
and dword [ebp - 0x4b0], 0
push esi
call fcn.004f2bd0
add esp, 0x18
mov dword [ebp - 0x4ac], eax
call fcn.004602b4
test al, al
je 0x46f87c
push ebx
mov byte [0x4ba3805], al
fiadd dword [ecx + 0x1c]
and edx, dword [0xd8475fa4]
mov ebx, es
call fcn.0046015b
test al, al
je 0x46f8a2
and eax, 0x198879fc
popal
jbe 0x46f902
sbb eax, 0x278b9b69
invalid
call fcn.0045ffbd
test al, al
je 0x46f8c5
outsb dx, byte [esi]
retf 0xd519
xor ecx, ecx
mov dword [ebp - 0x214], 7
xor eax, eax
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x228], ax
mov edi, 0x100
mov dword [ebp - 4], ecx
push edi
push ecx
lea eax, [ebp - 0x210]
push eax
call fcn.004ea000
mov eax, dword [ebp - 0x4ac]
add esp, 0xc
cmp byte [ebp + eax - 0x111], 0x5c
je 0x46f911
out dx, eax
invalid
mov byte [ebp + eax - 0x110], 0x5c
cmp byte [ebp - 0x110], 0
je 0x46fa20
mov ebx, dword [ebp - 0x4b0]
mov esi, dword [ebp - 0x4b4]
mov al, byte [ebp + ebx - 0x110]
cmp al, 0x3a
jne 0x46f93d
push 2
pop eax
jmp 0x46fa10
cmp al, 0x5c
jne 0x46fa0d
push ebx
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004e9970
add esp, 0xc
cmp ebx, edi
jae 0x46fa4e
lea eax, [ebp - 0x210]
mov byte [ebp + ebx - 0x210], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.0042d3c0
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x258]
mov ecx, esi
push eax
call fcn.0046ffec
push eax
lea ecx, [ebp - 0x228]
call fcn.004224b0
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.004209e0
push 0
push 1
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.00440130
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x46fa0d
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
push 0
cmovae eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46fa3a
xor eax, eax
inc eax
add ebx, eax
cmp byte [ebp + ebx - 0x110], 0
jne 0x46f92a
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.004209e0
xor eax, eax
inc eax
call fcn.00458b37
ret 4
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.004209e0
jmp 0x46f825
call fcn.00458a40
int3

Function at 0x46ffbe
Capabilities:
Create thread

Disassembly:
mov edx, dword [ecx + 0x300]
or eax, 0xffffffff
cmp edx, eax
je 0x46ffd0
cmp edx, 1
jne 0x46ffeb
xor eax, eax
push eax
push eax
push ecx
push 0x46fd5c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret
Function at 0x4700a8
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
call fcn.0046033e
test al, al
je 0x4700d3
ror dword [edx + ecx*4], cl
fsubr qword [ebp + 0x465926c5]
imul ecx, dword [ebp - 0x72], 0x747f7e6e
das
pop esi
lodsd eax, dword [esi]
pop esi
sbb al, 0x9c
invalid
call fcn.004603c8
test al, al
je 0x4700ef
adc edx, edx
jo 0x470133
sal byte [eax + 0x54], cl
dec edi
sub al, 0x44
mov dx, 0x5cca
nop
jae 0x470102
xlatb
mov byte [eax], dh
scasb al, byte es:[edi]
cmp al, 0xc1
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x470105
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sal dword [eax], 0xe8
out dx, eax
add edi, edi
inc dword [eax + eax*8 - 0x1258e18c]
call fcn.004602f9
test al, al
je 0x47012c
cmpsd dword [esi], dword es:[edi]
in eax, dx
cmc
or ah, ah
mov ecx, dword [ecx]
push ecx
or dword [eax - 0x1788d661], esp
adc al, byte [eax]
mul al
pushal
aaa
jmp 0x6643a56d
call fcn.00460047
test al, al
je 0x470153
xor dword [esi + edx], edx
wait
push edx
pushfd
insd dword es:[edi], dx
jl 0x4700db
cmp byte [ebx], cl
pushal
jnp 0x470179
hlt
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x47019b
call fcn.00460002
test al, al
je 0x470186
or dword [edx + edi*8], edx
mov esi, edi
xchg ebx, eax
mov ss, word [edi - 0x2ee24b35]
mov byte [0xc1484ca5], al
shl dword [edx - 0x3eb7b35b], 1
xlatb
test eax, 0x7916d571
fisttp qword [ebx - 0x47c03a3]
or bh, byte [ebp + 9]
mov ebx, dword [ebp - 4]
cmp ebx, 0xa
jge 0x470197
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4700ef
xor eax, eax
jmp 0x47019e
Function at 0x470904
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x94
mov eax, 0x6fc5b4
call fcn.00458b7c
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x9c], eax
xor ebx, ebx
mov dword [ebp - 0x14], 7
push ebx
xor eax, eax
mov dword [ebp - 4], ebx
push 0x7943cc
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00420aa0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0046e9e6
mov esi, ebx
call fcn.0045feee
test al, al
je 0x470970
jne 0x470961
imul edi, dword [eax + 0x71d6bd08], 0xffffffb9
sub dword [eax + 0x6a75383b], 0xd06a469f
mov ecx, 0x383ba881
jne 0x4709d2
lahf
inc esi
push 0xffffffffffffffd0
adc al, 0x2c
xor ebx, ebx
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x470b2b
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push 0x80
push 4
push ebx
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x98], eax
cmp eax, 0xffffffff
jne 0x470a11
call fcn.0046040d
test al, al
je 0x4709df
invalid
in eax, dx
fld xword [ecx]
mov esp, 0x633ef75
in eax, dx
or eax, 0xe820d7bb
mov edi, eax
invalid
call fcn.0046026f
test al, al
je 0x470a97
invalid
call fcn.0046033e
test al, al
je 0x470a34
mov esp, 0x1aa0f3d5
xor dword [ebp + esi*8 - 0xf], edx
dec esi
mov ds, word [edi]
aaa
movsd dword es:[edi], dword [esi]
das
pop ss
invalid
call fcn.0045ff33
test al, al
je 0x470a55
int 0x70
pop edx
add byte [eax - 0x20], dl
xchg byte [edx + esi*2 - 0x13], dl
and edx, dword [eax + 0x65]
dec esp
cmp al, 0x4b
sub al, 0xb7
sub al, 0xbb
in al, dx
sub al, 0xc5
mov esi, dword [ebp - 0x98]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.00458626
mov ebx, eax
mov dword [ebp - 0xa0], ebx
pop ecx
test ebx, ebx
jne 0x470a9e
call fcn.0045feee
test al, al
je 0x470a97
xlatb
fmul dword [eax]
aas
sbb byte [eax], ch
sbb ebp, dword [edi - 0x1d025d90]
or ecx, dword [edx - 0x19]
daa
outsb dx, byte [esi]
lds eax, [eax]
dec edx
xlatb
xor esi, esi
jmp 0x470b2b
push edi
push 0
push ebx
call fcn.004ea000
add esp, 0xc
push 0
push dword [ebp - 0x9c]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call fcn.00460002
test al, al
je 0x470ad8
bound ecx, qword [esi - 0xa61305a]
xor byte [0xc090283e], bl
xor dword [edx + 0x5d], 0xe0c35c07
xchg esi, eax
call fcn.004603c8
test al, al
je 0x470af9
wait
xchg byte [ebx + 0x20d3222b], dl
cmp esi, edx
inc edx
fistp dword [edi]
cld
add eax, dword [ebx - 0x25]
add dword [esi - 0x75], 0xaa45035d
xor al, 0xe8
psubw mm7, mm6
inc dword [eax + eax*8 + 0x213f1774]
push edx
cli
call fcn.0046040d
test al, al
je 0x470b19
aas
and dword [edx - 6], edx
xchg ebp, eax
retf
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xa0]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004209e0
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004209e0
mov eax, esi
call fcn.00458b37
ret
Function at 0x470ea5
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x470eb7
pop ebp
ret
push esi
push edi
xor esi, esi
push esi
push 0x80
push 4
push esi
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x470eec
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x47127f
Capabilities:
Delete file

Disassembly:
adc eax, sym.imp.KERNEL32.dll_MoveFileExW
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004600d1
test al, al
je 0x4712ad
cdq
in eax, 0x96
jnp 0x471269
stc
xor dh, cl
sub eax, 0x950488a1
pop edi
fadd st(0), st(0)
cmp al, 0x64
cmp byte [eax + ebp*8 + 0x5b], dl
int1
invalid
call fcn.0046040d
test al, al
je 0x4712d2
bound edi, qword [edx + esi + 0x31]
inc edx
loopne 0x4712d8
call 0xc6269cb5
rcr byte [ebp + 0x1ea7449f], cl
clc
inc ecx
mov byte ds:[0xca87f4b4], al
cli
and ch, al
test dh, ch
invalid
call fcn.0046015b
test al, al
je 0x4712f8
sal byte [ebp + ebx - 0x5d], 0x7b
fisub dword [esi]
mov dword [0x2624da7b], eax
mov esp, 0x7a7a6c1
test eax, 0xc871816b
mov al, dl
out 0x4c, al
imul ebx, esi, 5
mov bh, 0x3c
push 0xfffffffffffffff2
pop esp
lahf
push 0x714d20
push dword [ebp + 8]
call fcn.004fa468
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x4713a0
call fcn.0046040d
test al, al
je 0x47133a
xor dword [esi + 0x6a], esi
faddp st(7)
mov dword [edi - 0xf], ecx
dec ecx
pushal
pop ecx
in al, dx
push ss
cdq
and al, byte [eax]
push ebx
cmp al, 0xa3
test eax, 0x8392e5f
xchg esp, eax
imul esi, dword [ebx + ebx*8 - 0x10cf17c6], 0xfffffffe
inc dword [eax + eax*8 - 0x3fd6df8c]
call fcn.0046026f
test al, al
je 0x471363
sub eax, eax
sub bh, 0x8b
retf
mov esi, dword [ebp - 4]
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004ffdb2
push esi
call fcn.004fa50c
add esp, 0x14
call fcn.004603c8
test al, al
je 0x471397
invalid
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472b4a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00472622
xor edi, edi
inc edi
test al, al
je 0x472be8
call fcn.0046033e
test al, al
je 0x472b8c
add al, 0xf3
cmp byte [edx + 0x43e3ad41], dl
sub eax, 0xa752e14b
xchg byte [esi], ch
sti
cli
push edi
adc al, 0x13
movsb byte es:[edi], byte [esi]
lcall 0xe847, 0xdb33ff33
aaa
fdivr st(6)
inc dword [eax + eax*8 - 0x256cec8c]
pop esp
sub cl, 0xd1
inc edx
dec edx
call fcn.004603c8
test al, al
je 0x472ba8
xchg ebx, eax
ficomp dword [edx + eax*4 - 0x17]
rol dword [edx + 0x4a], 1
dec esp
into
pop ss
or dword [esi - 0x73], eax
cmpsd dword [esi], dword es:[edi]
or dword [ebp - 0x3c], 0x44
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call fcn.004724aa
pop ecx
test al, al
je 0x472be8
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x472c53
call fcn.00460383
test al, al
je 0x472c0c
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
adc eax, 0x670a773c
cmp byte [ecx - 0x6e], al
mov esp, 0x2177f93a
sal byte [eax], 1
cmc
clc
hlt
call fcn.00460047
test al, al
je 0x472c30
int 0xe0
salc
push edx
fdivr dword [ebp - 0x4652f121]
sub ebx, ecx
movsd dword es:[edi], dword [esi]
dec eax
rep stosd dword es:[edi], eax
mov byte [0xf5ce11cb], al
mov eax, dword [0xbf37]
popfd
loopne 0x472c30
push dword [ebp + 0x14]
jne 0x472c47
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 4]
test eax, eax
push 1
movzx ecx, dl
pop eax
cmovne ecx, eax
mov byte [ebp - 4], cl
call fcn.0045ffbd
test al, al
je 0x472c76
les edx, [edi + 0x547e074a]
cmp dh, byte [edi - 0x1547aacb]
adc dword [eax + 0xf], ebp
xor bl, byte [0x26aeb121]
push es
stosb byte es:[edi], al
and al, 0xee
inc esp
call fcn.00460116
test al, al
je 0x472c9d
xor esp, edx
adc al, 0xbe
dec ecx
and esp, 0x2426557f
and eax, 0x53e1eeb7
push esp
sub dword [ecx + 0x7b4e9258], ebp
add dword [ecx - 8], ebx
xchg esi, eax
push esp
cwde
inc edi
mov edx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472ca9
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a0
mov eax, 0x6fc6ac
call fcn.00458b7c
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.00422530
mov esi, 0x714abc
mov byte [ebp - 4], 1
push esi
call fcn.004f2ba9
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
cli
invalid
call fcn.00422710
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2ac], eax
call fcn.004602b4
test al, al
je 0x472d1b
sub ecx, edi
test eax, 0xf0a38765
test byte [ebx], bl
bound esi, qword [ecx]
pop es
mov cl, al
ret
call fcn.0046015b
test al, al
je 0x472d41
or al, 0x24
jmp 0x472cc6
call fcn.0045ffbd
test al, al
je 0x472d64
jno 0x472cdd
inc ecx
pop ebx
aaa
outsb dx, byte [esi]
xor al, ch
jmp 0x81789cf5
mov esi, dword [ebp - 0x2ac]
cmp esi, 0xffffffff
je 0x472e91
push 0x2e
pop edi
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x472e91
cmp word [ebp - 0x27c], di
je 0x472d76
cmp word [ebp - 0x27a], 0
je 0x472d76
cmp word [ebp - 0x27a], di
jne 0x472db2
cmp word [ebp - 0x278], 0
je 0x472d76
xor eax, eax
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], ebx
cmp word [ebp - 0x27c], ax
je 0x472dda
lea eax, [ebp - 0x27c]
push eax
call fcn.004f2ba9
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00420aa0
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x472e44
call fcn.00422530
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00422840
push 0x794470
call fcn.004f2ba9
pop ecx
push eax
push 0x794470
lea ecx, [ebp - 0x28]
call fcn.00422710
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00422530
call fcn.00472ca9
jmp 0x472e6f
call fcn.00422530
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00422840
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00422530
call fcn.00473180
add esp, 0x18
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.004209e0
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004209e0
jmp 0x472d76
call fcn.0045feee
test al, al
je 0x472eaf
mov dword [0xcd612adf], eax
add eax, 0xf19e2c74
int1
adc eax, 0xfc6e9056
pop ebx
jl 0x472f17
mov dword [0x15ff566f], eax
xor al, 0xc2
jo 0x472eb6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x472ee2
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004209e0
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004209e0
call fcn.00458b37
ret
Function at 0x4744ad
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
push esi
push edi
lea ecx, [eax + 0x210]
mov dword [ebp - 0x14], eax
mov esi, dword [ecx]
mov dword [ebp - 0x18], ecx
cmp esi, dword [eax + 0x214]
je 0x474564
mov eax, dword [ebp + 8]
lea edi, [esi + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 8], edi
lea ecx, [eax + 0xa8]
add eax, 0x28
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
push ecx
call ebx
push 0x70e44c
call ebx
sub edi, 0xffffff80
push edi
call ebx
push 0x70e44c
call ebx
push dword [ebp - 0xc]
call ebx
push 0x70e44c
call ebx
push dword [ebp - 8]
call ebx
push 0x70e44c
call ebx
push edi
push dword [ebp - 0x10]
call fcn.004fa890
mov edi, dword [ebp - 8]
pop ecx
pop ecx
test eax, eax
jne 0x474544
push edi
push dword [ebp - 0xc]
call fcn.004fa890
pop ecx
pop ecx
test eax, eax
je 0x474560
mov eax, 0x1b0
add edi, eax
add esi, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x474564
mov ecx, dword [ebp - 0x10]
jmp 0x4744f4
mov byte [ebp - 1], 1
call fcn.0046040d
test al, al
je 0x47458c
pop eax
salc
dec esp
lodsb al, byte [esi]
aas
into
rol esi, cl
cmp dword [ebx], 0xbd7e07b3
rol byte [ebx + 0x14], 1
dec esp
sub eax, 0xa42a607
test byte [ecx + 0x5e], bl
pop es
dec eax
mov dword [edx], edi
scasb al, byte es:[edi]
call fcn.0046026f
test al, al
je 0x4745b5
das
mov dword [ebp + 0x3a], ecx
dec edi
fadd dword [edi + 0x63]
push eax
push edx
mov dword [0x53d961d8], eax
and eax, 0xa54a61a7
xor eax, 0x6f8472d9
jbe 0x4745fa
adc ah, byte [edi]
imul edx, dword [edx - 0x827fa5], 0
cmp byte [ebp - 1], 0
jne 0x4745dc
mov esi, dword [ebp + 8]
lea edx, [esi + 0xa8]
push edx
call fcn.004f2bd0
pop ecx
test eax, eax
je 0x4745dc
mov ecx, dword [ebp - 0x18]
push esi
call fcn.00475294
mov al, 1
jmp 0x4745de
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
shr eax, 8
mov byte [esi + ebx], al
mov al, byte [edx + ecx*4]
mov byte [esi + ebx + 1], al
add esi, 2
inc ecx
cmp ecx, dword [ebp + 0x10]
jle 0x4745fd
jmp 0x474634
mov al, byte [esi + ebx]
cmp al, 0xff
jle 0x47463d
movsx eax, al
cmp eax, 0xff
jge 0x47463d
push eax
call fcn.004ff468
pop ecx
test eax, eax
je 0x47463d
mov byte [esi + ebx], 0
dec esi
test esi, esi
jg 0x474618
call fcn.004602b4
test al, al
je 0x474657
adc ch, dh
adc eax, 0x7afdabd1
mov ch, byte [ebx + 0x44]
cmp esp, dword [ebx + 0x178a2548]
pushfd
call fcn.0046015b
test al, al
je 0x47467d
xchg esi, eax
inc eax
mov ch, 0xe
inc ebp
sub dword [edx - 0x1e], edi
or eax, 0xed80f2af
aaa
retf
call fcn.0045ffbd
test al, al
je 0x4746a0
sub dword [edx - 0x1b], edx
and al, 0x13
ret 0x278d
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4751bb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
in al, dx
sbb byte [ecx], al
add byte [eax], al
mov eax, dword [0x7ca418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
call fcn.004603c8
test al, al
je 0x4751fd
xchg esi, eax
push esp
jl 0x4751bf
add al, 0xdc
inc ebp
mov ebp, dword [edx - 0x2d]
retf 0xfa15
mov edi, 0x114
lea eax, [ebp - 0x118]
push edi
push ebx
push eax
call fcn.004ea000
add esp, 0xc
mov dword [ebp - 0x118], edi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x475238
mov ecx, esi
call fcn.004749f8
jmp 0x47524d
mov edi, ebx
test ebx, ebx
jne 0x47524d
mov ecx, esi
call fcn.004748ab
inc edi
mov ebx, eax
cmp edi, 0xa
jl 0x47523a
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004584a2
mov esp, ebp
pop ebp
ret

Function at 0x475624
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x248
mov eax, 0x6fc8ae
add al, byte [eax]
add byte [eax + 0x6fc8ae], bh
call fcn.00458b7c
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x250], 0
push 0x208
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x24c], ebx
call fcn.004ea000
add esp, 0xc
call fcn.0045ff78
test al, al
je 0x475689
jb 0x475626
mov cl, cl
cmp dl, byte [edx + 0x13]
invalid
call fcn.0046022a
test al, al
je 0x4756a4
invalid
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x4757d9
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4757cb
call fcn.0045ff78
test al, al
je 0x4756f8
test dword [ebx + 0x2717ce36], edx
push esp
out dx, eax
push ss
xor byte [edi + 0x367cf0d9], dh
cdq
dec edx
dec esi
push esi
scasd eax, dword es:[edi]
mov gs, eax
push edx
invalid
call fcn.0045ffbd
test al, al
je 0x47571b
iretd
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x47574b
lea eax, [ebp - 0x218]
push eax
call fcn.004f2ba9
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00420aa0
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0045f706
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.004209e0
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x254]
call fcn.00473f5d
pop ecx
pop ecx
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.00440130
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
mov dword [ebp - 0x24c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4756b8
call fcn.00458b37
ret