joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e20b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x18
mov esi, ecx
call fcn.00431d79
mov edx, eax
pop ecx
test edx, edx
je 0x48e244
xor ecx, ecx
mov dword [edx], esi
push ecx
push ecx
push edx
mov dword [edx + 0x10], ecx
mov eax, dword [ebp + 8]
push 0x48e247
push ecx
mov dword [edx + 8], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [edx + 0xc], eax
call fcn.005f3fd0
add esp, 0x18
pop esi
pop ebp
ret

Function at 0x48e37f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0xe8
cmp dword [0x6c8918], eax
je 0x48e398
inc eax
jmp 0x48e48f
push ebx
push edi
xor ebx, ebx
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
stosd dword es:[edi], eax
push 0xc8
push ebx
mov dword [ebp - 0xc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xe8]
push eax
call fcn.005e1e60
add esp, 0xc
call fcn.0048e8d2
push dword [ebp + 8]
mov ecx, 0x6c88f4
mov dword [0x6c891c], eax
call fcn.004060f8
call fcn.0048e81b
xor edi, edi
lea eax, [ebp - 0x20]
inc edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push 0x6c88f8
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0xe8]
push 0x69f6b8
push eax
call fcn.0048ea81
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
push edi
push edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push edi
push ebx
mov dword [0x6c88e8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6c88ec], eax
cmp dword [0x6c88e8], ebx
je 0x48e48b
test eax, eax
je 0x48e48b
push ebx
push ebx
push 0x6c88e0
push 0x48e678
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6c88f0], eax
test eax, eax
je 0x48e48b
mov dword [0x6c8918], edi
mov eax, edi
jmp 0x48e48d
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48e495
Capabilities:
Terminate thread

Disassembly:
push edi
xor edi, edi
mov dword [0x6c88e0], 1
cmp dword [0x6c88f0], edi
je 0x48e4df
mov eax, dword [0x6c88ec]
test eax, eax
je 0x48e4ba
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [0x6c88f0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x48e4df
push edi
push dword [0x6c88f0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x6c88ec]
test eax, eax
je 0x48e4f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6c88ec], edi
mov eax, dword [0x6c88f0]
test eax, eax
je 0x48e50b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6c88f0], edi
mov dword [0x6c8918], edi
pop edi
ret
Function at 0x48e687
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x612ee5
call fcn.0060c3a8
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0048e9e0
mov esi, eax
mov dword [ebp - 0x14], esi
push 0xffffffffffffffff
mov dword [ebp - 4], ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48e800
mov ebx, dword [ebp - 0x10]
lea ecx, [edi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x14]
lea ecx, [edi + 0x30]
cmp eax, ecx
je 0x48e6ee
mov eax, esi
mov esi, dword [ecx]
mov dword [ecx], eax
mov eax, ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov dword [ecx + 4], eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x48e7e5
cmp dword [edi + 4], 0
jne 0x48e729
push 0x69f73c
push dword [edi + 0x14]
call fcn.005e8eae
mov dword [edi + 4], eax
pop ecx
pop ecx
test eax, eax
je 0x48e7e5
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
add eax, 8
cmp ecx, eax
je 0x48e752
push 0xffffffffffffffff
push 0
push eax
call fcn.00409916
mov esi, dword [esi]
dec ebx
push 0
push 1
mov dword [ebp - 0x10], ebx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.004097fa
push 0x20
push 1
push esi
call fcn.00403f7c
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
cmp dword [edi + 4], 0
je 0x48e7b3
push dword [edi + 4]
push dword [ebp - 0x1c]
push 1
push eax
call fcn.005f2ab9
push dword [edi + 4]
push 2
push 1
push 0x695ec8
call fcn.005f2ab9
add esp, 0x20
mov esi, dword [ebp - 0x14]
test ebx, ebx
jne 0x48e73c
cmp dword [edi + 4], 0
je 0x48e7cd
push dword [edi + 4]
call fcn.005e558d
and dword [edi + 4], 0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004097fa
mov esi, dword [ebp - 0x14]
jmp 0x48e6c6
cmp dword [edi], 0
jne 0x48e800
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [edi + 0x18]
test eax, eax
je 0x48e6c9
lea ecx, [ebp - 0x14]
call fcn.0048e928
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48e81b
Capabilities:
Delete file
Get file size
Move file
Set file attributes

Disassembly:
mov eax, 0x60d0c5
call fcn.0060c3a8
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push dword [0x6c88f4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x48e8bf
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
push edi
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x80000
jb 0x48e8be
mov eax, dword [0x6c88f4]
add eax, 0xfffffff0
push eax
call fcn.004067cf
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0048e973
mov esi, dword [ebp - 0x10]
mov ebx, dword [0x6c88f4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esi - 0x10]
call fcn.00404ea9
pop esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
inc eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48eb0e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x612f44
call fcn.0060c3a8
sub esp, 0x90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x9c], vtable.KMD5.0
push edi
mov esi, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [ebp - 0x18], ebx
lea eax, [esi + 4]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
lea ebx, [esi + 0x14]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push edi
call fcn.0048ecb9
test eax, eax
je 0x48ec8f
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x48ec8a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48ec8a
push 0x5c
push esi
call fcn.005e3a70
pop ecx
pop ecx
test eax, eax
je 0x48ec8a
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x48ec8a
inc eax
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040a965
push eax
lea ecx, [ebx - 0xc]
mov byte [ebp - 4], 2
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404ea9
mov byte [ebp - 0x3c], 0
lea edi, [ebp - 0x3b]
xor eax, eax
stosd dword es:[edi], eax
push ecx
push ecx
push esi
stosd dword es:[edi], eax
lea ecx, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00413262
test eax, eax
je 0x48ec8a
push 0x10
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.005e0960
add esp, 0xc
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 3
xor edi, edi
movzx eax, byte [ebp + edi - 0x3c]
push eax
lea eax, [ebp - 0x14]
push 0x69c688
push eax
call fcn.004090e5
add esp, 0xc
inc edi
cmp edi, 0x10
jl 0x48ec28
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 0
je 0x48ec59
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00406123
mov eax, dword [ebp - 0x18]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x28], eax
call fcn.00404ea9
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.00404ea9
mov edi, dword [ebp - 0x1c]
add ebx, 4
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 3
jge 0x48ec9a
mov edi, dword [ebp - 0x28]
jmp 0x48eb4f
lea ecx, [esi - 0x10]
jmp 0x48ec95
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
lea ecx, [ebp - 0x9c]
call fcn.00413231
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
inc eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ecb9
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 8], eax
cmp dword [eax], esi
jne 0x48ecd5
xor eax, eax
jmp 0x48ee05
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
push ebx
mov ebx, esi
test eax, eax
je 0x48ee02
cmp eax, 4
je 0x48ee02
cmp eax, 8
je 0x48ee02
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x48ee02
push edi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push esi
push ecx
call dword [eax]
test eax, eax
jne 0x48edef
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x48edef
cmp edi, 8
je 0x48edef
push edi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x48edef
push 0x208
lea eax, [ebp - 0x228]
push esi
push eax
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x103
push eax
push esi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x48edd4
push 0x208
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x430]
push 0x104
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x48edef
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.0048ee0c
test eax, eax
je 0x48edef
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48eddd
mov dword [eax], edi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x228]
push eax
call fcn.004060f8
xor esi, esi
inc esi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
test ebx, ebx
je 0x48ee01
push ebx
call edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48ee0c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x48ef03
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x48ef03
lea eax, [ebp - 0x4b8]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x48eefb
xor eax, eax
mov dword [ebp + 8], eax
cmp word [ebp - 0x4b8], ax
je 0x48eefb
lea ebx, [ebp - 0x4b8]
mov dword [ebp + 0xc], eax
push 0x69f77c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48eeda
push 0x69f784
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48eeda
mov ax, word [ebx]
mov word [ebp - 8], ax
mov eax, dword [ebp + 0xc]
push 0x64
mov ax, word [ebp + eax - 0x4b6]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x48ef03
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd0]
push ebx
push eax
push edi
call fcn.005f21ad
add esp, 0xc
test eax, eax
je 0x48ef0e
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x4b8]
add eax, 4
mov dword [ebp + 8], eax
add eax, eax
add ebx, eax
mov dword [ebp + 0xc], eax
xor eax, eax
cmp word [ebx], ax
jne 0x48ee63
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + ebx*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
inc eax
jmp 0x48ef05

Function at 0x48ef29
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, edx
call fcn.0048eff5
test al, al
jne 0x48ef49
or eax, 0xffffffff
jmp 0x48efee
mov ecx, dword [esi + 4]
lea edx, [ebp - 4]
call fcn.0048f0c2
test al, al
je 0x48ef41
mov esi, str.Data_Buffer
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
jne 0x48ef78
xor eax, eax
jmp 0x48efee
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x48ef91
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
jmp 0x48ef74
push 0x28
call fcn.005f1042
mov ebx, eax
pop ecx
test ebx, ebx
je 0x48ef88
mov dword [ebp - 4], 2
push 0x3e8
push 0x28
push ebx
push 0
push 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x48efcb
cmp dword [ebx + 4], 0
jne 0x48efcb
inc edi
sub dword [ebp - 4], 1
jne 0x48efa6
push ebx
call fcn.005f06f3
pop ecx
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
call fcn.0048f074
test al, al
push 0xffffffffffffffff
pop eax
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48eff5
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x48f056
push 0x6c4390
call fcn.0048f12f
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_WSAStartup_operation:
mov ecx, esi
call fcn.00412451
mov edx, str.WSAGetLastError____
mov ecx, eax
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048f12f
xor al, al
jmp 0x48f06e
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x16]
push eax
call fcn.005f2387
mov al, 1
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48f0c2
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push ecx
mov esi, edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x48f10b
push 0x6c4390
call fcn.0048f12f
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_gethostbyname_operation:_WSAGetLastError____
mov ecx, esi
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048f12f
pop ecx
xor al, al
jmp 0x48f12a
mov eax, dword [eax + 0xc]
push ecx
lea ecx, [esp + 8]
push dword [eax]
call fcn.0048f219
pop ecx
pop ecx
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [esi], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48f2f1
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x612f97
call fcn.0060c3a8
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], edi
mov ebx, 0x693da4
push ebx
lea ecx, [edi + 0xc]
mov dword [edi], vtable.KInstallTool::KUIInfoReport.0
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00406173
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], esi
call fcn.00406173
mov byte [ebp - 4], 1
call fcn.00404f47
push eax
lea ecx, [edi + 0x14]
call fcn.004065d8
push ebx
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00406173
push ebx
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
call fcn.00406173
push ebx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 4
call fcn.00406173
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov eax, edi
mov byte [edi + 0x28], 7
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48f6df
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
push edi
mov edi, ecx
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 8], eax
call esi
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 4], eax
call esi
cmp byte [edi + 4], bl
jne 0x48f70d
push 0xfffffffffffffffd
pop ebx
jmp 0x48f723
push ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [edi + 4], bl
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48fbe1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
call fcn.0048fbc2
test al, al
je 0x48fc08
or esi, 0xffffffff
jmp 0x48fc73
push ebx
push 8
call fcn.00431d79
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x48fc1b
push 0xfffffffffffffffa
jmp 0x48fc71
lea eax, [edi + 0xc]
mov dword [ebx], edi
push eax
push esi
push ebx
push 0x48feef
push esi
push esi
mov dword [ebx + 4], esi
call fcn.005f3fd0
add esp, 0x18
mov dword [edi + 8], eax
test eax, eax
je 0x48fc65
lea ebx, [edi + 0x14]
jmp 0x48fc4f
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 4], 0
push ebx
je 0x48fc41
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x48fc72
push 8
push ebx
call fcn.00499fdc
pop ecx
pop ecx
push 0xfffffffffffffffe
pop esi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48fc86
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x612f97
call fcn.0060c3a8
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
push edi
mov edi, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.KInstallTool::KUIInfoReport.0
mov dword [ebp + 8], esi
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov eax, dword [edi + 0x10]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x14]
mov eax, dword [edi + 0x14]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0x18]
mov eax, dword [edi + 0x18]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x1c]
mov eax, dword [edi + 0x1c]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x20]
mov eax, dword [edi + 0x20]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add esp, 0x18
add eax, 0x10
mov dword [esi], eax
mov al, byte [edi + 0x24]
mov byte [ebx + 0x24], al
mov al, byte [edi + 0x25]
mov byte [ebx + 0x25], al
mov al, byte [edi + 0x26]
mov byte [ebx + 0x26], al
mov al, byte [edi + 0x27]
mov byte [ebx + 0x27], al
mov al, byte [edi + 0x28]
mov byte [ebx + 0x28], al
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
pop edi
mov dword [ebx + 0x30], eax
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x490def
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x60d26f
call fcn.0060c3a8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x490f02
mov ecx, dword [ecx + 0xc]
cmp ecx, ebx
jne 0x490e16
mov ecx, esi
call fcn.00492322
mov eax, ebx
jmp 0x490f0b
cmp ecx, 2
jne 0x490e37
cmp byte [esi + 0x5f2], 0
jne 0x490e2a
mov byte [esi + 0x5f2], bl
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x490e0f
cmp ecx, 0x65
jne 0x490e45
mov ecx, esi
call fcn.00492440
jmp 0x490e0f
cmp ecx, 0x66
jne 0x490e5f
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x584], eax
sete al
push eax
call fcn.00493388
jmp 0x490e0f
cmp ecx, 0x191
jne 0x490e70
mov ecx, esi
call fcn.00492534
jmp 0x490e0f
cmp ecx, 0x96
jne 0x490e9a
push dword [esi + 0x5b0]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
mov ecx, esi
call fcn.00491e8c
jmp 0x490e0f
cmp ecx, 0x1f5
jne 0x490eae
mov ecx, esi
call fcn.004925a0
jmp 0x490e0f
cmp ecx, 0xa0
jne 0x490ec0
call fcn.0049268e
jmp 0x490e0f
cmp ecx, 0x68
jne 0x490ed1
mov ecx, esi
call fcn.004930fb
jmp 0x490e0f
cmp ecx, 0x2bf
jne 0x490f02
push str.https:__www.ijinshan.com_privacy_dubaPrivacy.html
lea ecx, [ebp + 8]
call fcn.00406173
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00471db7
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x490e0f
and dword [esi + 0x5b4], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4