joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484eb8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 8], 0
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x10c]
mov dword [ebp - 4], ecx
push str._system.exe
push 0x104
mov edx, dword [ebp - 4]
push edx
call fcn.00415330
lea eax, [ebp - 0x10c]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x484f4d
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00453370
mov ecx, eax
call fcn.00453794
test eax, eax
jne 0x484f4d
mov dword [ebp - 0x11c], 1
jmp 0x484f57
mov dword [ebp - 0x11c], 0
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x114], edx
call fcn.00484c5e
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x114], 0
je 0x484fa0
mov eax, dword [ebp + 0xc]
push eax
push 0x6b
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [ebp + 8]
cmp dword [ebp - 0x110], 0
je 0x484fa0
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x48518d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00471ba0
mov eax, dword [ebp - 4]
mov dword [eax], 0x4b5298
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x114], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x110], 0
push 0x104
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x48521b
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax + 0xb]
cmp edx, 0x5c
je 0x48521b
push 0x537464
push 0x104
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call fcn.00407f00
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x487c5c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac031
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
mov dword [ebp - 0x164], ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x30]
call fcn.00489280
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x150], ecx
lea edx, [ebp - 0x30]
mov dword [ebp - 0x14c], edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push SysStringLen
call fcn.00445886
mov ecx, eax
call fcn.00448392
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push SysStringLen
call fcn.00445886
mov ecx, eax
call fcn.00448392
push 0x539898
push SysStringLen
call fcn.00445886
mov ecx, eax
call fcn.00448392
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call fcn.00445886
mov ecx, eax
call fcn.00448392
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push SysStringLen
call fcn.00445886
mov ecx, eax
call fcn.00448392
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00445886
mov ecx, eax
call fcn.00445ff5
lea eax, [ebp - 0x150]
push eax
push 0x4874c0
lea ecx, [ebp - 0x30]
push ecx
call fcn.00431386
mov ecx, eax
call fcn.00430512
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x30]
call fcn.0047afe0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x34], 0
jmp 0x487d90
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0x30]
call fcn.0047afe0
cmp dword [ebp - 0x34], eax
jae 0x487e41
mov eax, dword [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
call fcn.0047b020
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x487e3c
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0xc], 1
jne 0x487e04
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x158], 0
je 0x487df8
push 1
mov ecx, dword [ebp - 0x158]
call fcn.00489150
mov dword [ebp - 0x168], eax
jmp 0x487e02
mov dword [ebp - 0x168], 0
jmp 0x487d87
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0041f4d0
push eax
push 0x104
lea edx, [ebp - 0x144]
push edx
call fcn.00415330
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp + 8]
call fcn.00489360
jmp 0x487d87
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x160], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004892c0
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48826d
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac051
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe20
mov dword [ebp - 0xe2c], ecx
push 1
lea ecx, [ebp - 0xdf4]
call fcn.00416cc0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1a0]
call fcn.0042fcf0
mov ecx, dword [ebp + 8]
call fcn.004318f0
test eax, eax
jne 0x4882e3
mov dword [ebp - 0xe00], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.00416d50
mov eax, dword [ebp - 0xe00]
jmp 0x4884f7
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0xe04]
push eax
mov ecx, dword [ebp + 8]
call fcn.004172b0
mov ecx, dword [eax]
mov dword [ebp - 0x1a0], ecx
jmp 0x48832c
push 0
lea edx, [ebp - 0xe08]
push edx
lea ecx, [ebp - 0x1a0]
call fcn.00417310
lea eax, [ebp - 0xe0c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00436710
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00448ed0
and eax, 0xff
test eax, eax
je 0x488392
lea ecx, [ebp - 0x1a0]
call fcn.00416c20
push eax
push 0x104
lea ecx, [ebp - 0x19c]
push ecx
call fcn.00415330
mov dword [ebp - 0xe10], 0
lea edx, [ebp - 0xe10]
push edx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0xdf4]
call fcn.00416dd0
jmp 0x488318
mov dword [ebp - 0xdf8], 0
push 0
lea ecx, [ebp - 0xdf8]
push ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4883bd
call fcn.0048fdb2
test eax, eax
je 0x4883e4
mov dword [ebp - 0xe14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.00416d50
mov eax, dword [ebp - 0xe14]
jmp 0x4884f7
lea edx, [ebp - 0xdf4]
push edx
call fcn.0048bbad
add esp, 4
test eax, eax
je 0x48841e
mov dword [ebp - 0xe18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.00416d50
mov eax, dword [ebp - 0xe18]
jmp 0x4884f7
lea eax, [ebp - 0xe1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004172b0
mov ecx, dword [eax]
mov dword [ebp - 0x1a0], ecx
jmp 0x48844b
push 0
lea edx, [ebp - 0xe20]
push edx
lea ecx, [ebp - 0x1a0]
call fcn.00417310
lea eax, [ebp - 0xe24]
push eax
mov ecx, dword [ebp + 8]
call fcn.00436710
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00448ed0
and eax, 0xff
test eax, eax
je 0x4884c6
lea ecx, [ebp - 0x1a0]
call fcn.00416c20
push eax
push 0x104
lea ecx, [ebp - 0x19c]
push ecx
call fcn.00415330
lea edx, [ebp - 0x19c]
push edx
lea ecx, [ebp - 0xdf4]
call fcn.00416ec0
mov dword [ebp - 0xdfc], eax
lea ecx, [ebp - 0x1a0]
call fcn.00416c20
mov ecx, dword [ebp - 0xdfc]
mov edx, dword [ecx + 0x168]
mov dword [eax + 0x10c], edx
jmp 0x488437
lea eax, [ebp - 0xdf4]
push eax
call fcn.0048dc2b
add esp, 4
mov dword [ebp - 0xe28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf4]
call fcn.00416d50
mov eax, dword [ebp - 0xe28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x488c03
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push edi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], 1
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp + eax - 0x108]
mov dword [ebp - 0x110], ecx
push 0x104
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp + eax - 0x214]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x218], 0x5377e8
jmp 0x488ca8
mov ecx, dword [ebp - 0x218]
add ecx, 0x105
mov dword [ebp - 0x218], ecx
cmp dword [ebp - 0x218], 0x53831f
jae 0x488d4f
mov edx, dword [ebp - 0x218]
mov al, byte [edx]
mov byte [ebp - 0x220], al
cmp byte [ebp - 0x220], 0
je 0x488cda
cmp byte [ebp - 0x220], 1
je 0x488d13
jmp 0x488d4a
mov ecx, dword [ebp - 0x218]
add ecx, 1
push ecx
push 0x104
mov edx, dword [ebp - 0x110]
push edx
call fcn.00415330
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x488d11
mov eax, 1
jmp 0x488d51
jmp 0x488d4a
mov edx, dword [ebp - 0x218]
add edx, 1
push edx
push 0x104
mov eax, dword [ebp - 0x10c]
push eax
call fcn.00415330
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x488d4a
mov eax, 1
jmp 0x488d51
jmp 0x488c96
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x489e86
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac106
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x489ebb
xor eax, eax
jmp 0x489fad
lea ecx, [ebp - 0x10]
call fcn.00409340
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffff
jne 0x489f10
mov dword [ebp - 0x144], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409510
mov eax, dword [ebp - 0x144]
jmp 0x489fad
mov dword [ebp - 0x138], 0x128
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x489f81
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x489f6a
mov dword [ebp - 0x148], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409510
mov eax, dword [ebp - 0x148]
jmp 0x489fad
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x489f31
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409510
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48a142
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
mov dword [ebp - 0x140], 0
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x48a181
xor eax, eax
jmp 0x48a2c8
lea ecx, [ebp - 0x10]
call fcn.00409340
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jne 0x48a1d6
mov dword [ebp - 0x150], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409510
mov eax, dword [ebp - 0x150]
jmp 0x48a2c8
mov dword [ebp - 0x138], 0x128
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x48a29a
mov dword [ebp - 0x148], 0
jmp 0x48a216
mov eax, dword [ebp - 0x148]
add eax, 1
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xa
jge 0x48a27f
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x48a27d
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
je 0x48a270
mov dword [ebp - 0x140], 1
push 0
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48a207
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x48a1fb
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x154], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409510
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48baf3
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48bb1e
call fcn.0048fdb2
test eax, eax
je 0x48bb3b
push 0x40
push 0x53af24
push 0x53af2c
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x48bba9
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x804
je 0x48bb79
cmp dword [ebp - 8], 4
je 0x48bb79
cmp dword [ebp - 8], 0x1004
je 0x48bb79
push 0x40
push 0x53af58
push 0x53af60
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x48bba9
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048bbad
add esp, 4
test eax, eax
je 0x48bb90
mov eax, 6
jmp 0x48bba9
mov edx, dword [ebp + 8]
push edx
call fcn.0048ce24
add esp, 4
test eax, eax
je 0x48bba7
mov eax, 6
jmp 0x48bba9
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48ccf3
Capabilities:
Copy file
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48cd3d
mov eax, 1
jmp 0x48ce20
mov ecx, 1
test ecx, ecx
je 0x48cd85
call dword [sym.imp.MSVCRT.dll_rand]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x53b220
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call fcn.0040a150
add esp, 0x14
lea edx, [ebp - 0x118]
push edx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x48cd85
jmp 0x48cd3d
push 0x80
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48cdd4
push 0
push 3
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424610
mov ecx, eax
call fcn.004248c8
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48ce08
push 4
push 0
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10], eax
mov eax, 1
jmp 0x48ce20
push 1
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48dcc5
Capabilities:
Copy file
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x53b548
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x48dd1c
push 0x53b554
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x48dd1c
mov eax, 1
jmp 0x48de22
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48dd3f
mov eax, 1
jmp 0x48de22
mov eax, 1
test eax, eax
je 0x48dd87
call dword [sym.imp.MSVCRT.dll_rand]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s.tmp_d
push 0x104
lea eax, [ebp - 0x118]
push eax
call fcn.0040a150
add esp, 0x14
lea ecx, [ebp - 0x118]
push ecx
call fcn.0042b4af
add esp, 4
test eax, eax
je 0x48dd87
jmp 0x48dd3f
push 0x80
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48ddd6
push 0
push 3
mov eax, dword [ebp + 8]
push eax
call fcn.00424610
mov ecx, eax
call fcn.004248c8
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48de0a
push 4
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10], eax
mov eax, 1
jmp 0x48de22
push 1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10], eax
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x48de26
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov dword [ebp - 0x19c], 1
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x198], 0x94
lea ecx, [ebp - 0x198]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x48decb
cmp dword [ebp - 0x194], 5
jne 0x48de96
cmp dword [ebp - 0x190], 0
jne 0x48de96
lea edx, [ebp - 0x104]
push edx
push str._sSFC.dll
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a150
add esp, 0x10
jmp 0x48dec9
cmp dword [ebp - 0x194], 5
jne 0x48debd
lea edx, [ebp - 0x104]
push edx
push str._sSFC_OS.dll
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a150
add esp, 0x10
jmp 0x48dec9
mov dword [ebp - 0x19c], 0
jmp 0x48dee1
jmp 0x48ded7
mov dword [ebp - 0x19c], 0
jmp 0x48dedf
mov eax, dword [ebp - 0x19c]
jmp 0x48dee3
jmp 0x48ded7
jmp 0x48ded7
mov esp, ebp
pop ebp
ret
Function at 0x48f27d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac27c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1940
call sub.ntdll.dll__chkstk
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.__xml_version_1.0__encoding_GB2312____info__input__item__majver__s__majver__subver__s__subver__file__s__file__path__s__path___item___input___info_
push 0x800
lea ecx, [ebp - 0x1834]
push ecx
call fcn.0040a150
add esp, 0x1c
push 0x1000
lea edx, [ebp - 0x1010]
push edx
lea eax, [ebp - 0x1834]
push eax
call fcn.0048ff09
add esp, 0xc
mov dword [ebp - 0x193c], eax
cmp dword [ebp - 0x193c], 0
je 0x48f2fd
mov eax, dword [ebp - 0x193c]
jmp 0x48f42e
lea ecx, [ebp - 0x1010]
push ecx
call fcn.0048f727
add esp, 4
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x1034]
push edx
lea eax, [ebp - 0x1010]
push eax
call fcn.0048f43c
add esp, 8
test eax, eax
jne 0x48f333
mov eax, 0x14
jmp 0x48f42e
mov ecx, dword [ebp + 0x18]
push ecx
push 0x104
lea edx, [ebp - 0x1938]
push edx
call fcn.00409000
mov eax, dword [ebp + 0x10]
push eax
push 0x104
lea ecx, [ebp - 0x1938]
push ecx
call fcn.00407f00
push str..cab
push 0x104
lea edx, [ebp - 0x1938]
push edx
call fcn.00407f00
lea eax, [ebp - 0x1938]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xea60
lea ecx, [ebp - 0x1938]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0048f6cc
add esp, 0xc
mov dword [ebp - 0x193c], eax
cmp dword [ebp - 0x193c], 0
je 0x48f3af
mov eax, dword [ebp - 0x193c]
jmp 0x48f42e
lea ecx, [ebp - 0x1944]
call fcn.0048ebdd
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x1938]
push ecx
lea ecx, [ebp - 0x1944]
call fcn.0048ef3a
test eax, eax
je 0x48f40c
lea edx, [ebp - 0x1938]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1948], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1944]
call fcn.0048ebf4
mov eax, dword [ebp - 0x1948]
jmp 0x48f42e
mov dword [ebp - 0x194c], 0x12
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1944]
call fcn.0048ebf4
mov eax, dword [ebp - 0x194c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret