joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d60
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov dword [esp + 0x28], 1
call sub.cygwin1.dll_socket
test eax, eax
mov ebx, eax
js 0x408ee1
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_setsockopt
test eax, eax
js 0x408f05
lea eax, [esp + 0x30]
mov edx, 2
mov dword [esp + 8], 0x10
mov dword [esp], ebx
mov dword [esp + 0x30], 0
mov dword [esp + 4], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov word [esp + 0x30], dx
call sub.cygwin1.dll_bind
test eax, eax
js 0x408f30
lea ebp, [esp + 0x2c]
lea edi, [esp + 0x40]
mov dword [esp], ebx
mov dword [esp + 0x2c], 0x10
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
call sub.cygwin1.dll_getsockname
test eax, eax
movzx esi, word [esp + 0x42]
jne 0x408e95
mov eax, esi
xchg ah, al
movzx esi, ax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.cygwin1.dll_inet_ntoa
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], esi
mov dword [esp + 4], str.__s____d__n
mov dword [esp], eax
call sub.cygwin1.dll_sprintf
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.cygwin1.dll_listen
test eax, eax
js 0x408ec0
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.cygwin1.dll_getsockname
add esp, 0x5c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.cygwin1.dll___errno
mov dword [esp + 8], str.getsockname
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00409570
movzx esi, word [esp + 0x42]
jmp 0x408e38
call sub.cygwin1.dll___errno
mov dword [esp + 8], str.listen
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00409570
jmp 0x408e7b
call sub.cygwin1.dll___errno
mov dword [esp + 8], str.socket
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00409570
jmp 0x408d95
call sub.cygwin1.dll___errno
mov dword [esp + 8], str.setsockopt__reuse_address_
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00409570
jmp 0x408dc5
call sub.cygwin1.dll___errno
mov dword [esp + 8], str.bind
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00409570
jmp 0x408e0f
Function at 0x409020
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push edi
push esi
mov eax, 2
push ebx
sub esp, 0x30
mov esi, dword [esp + 0x40]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov word [esp + 0x20], ax
cmp byte [esi], 0x5b
je 0x409075
mov dword [esp + 8], str.tcp_connect:_illegal_format1_n
mov dword [esp + 4], 0
mov dword [esp], 1
call fcn.00409570
add esi, 1
mov dword [esp + 4], 0x5d
mov dword [esp], esi
call sub.cygwin1.dll_strchr
test eax, eax
mov edi, eax
je 0x409239
mov byte [edi], 0
mov dword [esp], esi
lea ebx, [edi + 1]
call sub.cygwin1.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x24], eax
je 0x4091c2
mov eax, dword [sym.imp.cygwin1.dll___ctype_ptr__]
movzx edx, byte [edi + 1]
mov ecx, dword [eax]
mov eax, edx
test byte [ecx + edx + 1], 8
je 0x4090d0
add ebx, 1
movzx edx, byte [ebx]
test byte [ecx + edx + 1], 8
mov eax, edx
jne 0x4090c1
cmp al, 0x3c
je 0x4090f0
mov dword [esp + 8], str.tcp_connect:_illegal_format4_n
mov dword [esp + 4], 0
mov dword [esp], 1
call fcn.00409570
add ebx, 1
mov dword [esp + 4], 0x3e
mov dword [esp], ebx
call sub.cygwin1.dll_strchr
test eax, eax
je 0x409218
mov dword [esp], ebx
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
call sub.cygwin1.dll_strtol
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
xchg ah, al
mov word [esp + 0x22], ax
call sub.cygwin1.dll_socket
test eax, eax
mov ebx, eax
js 0x4091f4
mov dword [esp + 4], 0x408d50
mov dword [esp], 0xe
call sub.cygwin1.dll_signal
mov dword [esp], 0x1e
call sub.cygwin1.dll_alarm
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x10
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.cygwin1.dll_connect
test eax, eax
js 0x4091a1
mov dword [esp], 0
call sub.cygwin1.dll_alarm
add esp, 0x30
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call sub.cygwin1.dll___errno
mov dword [esp + 8], str.connect
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00409570
jmp 0x40918c
mov dword [esp], esi
call sub.cygwin1.dll_gethostbyname
test eax, eax
je 0x40925a
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x24]
mov eax, dword [eax]
mov dword [esp], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sub.cygwin1.dll_memcpy
jmp 0x4090ad
call sub.cygwin1.dll___errno
mov dword [esp + 8], str.socket
mov eax, dword [eax]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00409570
jmp 0x409150
mov dword [esp + 8], str.tcp_connect:_illegal_format5_n
mov dword [esp + 4], 0
mov dword [esp], 1
call fcn.00409570
jmp 0x40910b
mov dword [esp + 8], str.tcp_connect:_illegal_format2_n
mov dword [esp + 4], 0
mov dword [esp], 1
call fcn.00409570
jmp 0x409092
mov dword [esp + 8], str.tcp_connect:_illegal_format3_n
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 0x1c], eax
call fcn.00409570
mov eax, dword [esp + 0x1c]
jmp 0x4091d2
Function at 0x409300
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [sym.imp.cygwin1.dll_opterr]
mov ebx, dword [sym.imp.cygwin1.dll_optind]
cmp dword [esp + 0x30], 2
mov dword [sym.imp.cygwin1.dll_opterr], 0
je 0x409334
mov dword [sym.imp.cygwin1.dll_opterr], esi
mov dword [sym.imp.cygwin1.dll_optind], ebx
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x40f580
mov dword [esp + 8], 0x40f560
mov dword [esp], 2
mov dword [esp + 4], eax
call sub.cygwin1.dll_getopt_long
cmp eax, 0xffffffff
je 0x409322
cmp eax, 0x68
je 0x409390
cmp eax, 0x76
jne 0x409322
mov dword [esp], 0
call dword [esp + 0x38]
mov dword [esp], 0
call sub.cygwin1.dll_exit
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 0
call dword [esp + 0x3c]
jmp 0x40936f
Function at 0x4044c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48ed10
push 0x480e70
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5a7f20]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
xor edi, edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, esi
je 0x40457c
cmp eax, 0xffffffff
je 0x40457c
lea ecx, [ebp - 0x30]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40457c
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
push edx
push 0x404044
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40457c
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 2
push esi
push esi
push 0x10
lea eax, [ebp - 0x2c]
push eax
push esi
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40457c
lea edi, [esi + 1]
jmp 0x404579
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x404596
cmp eax, 0xffffffff
je 0x404596
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00480aee
mov esp, ebp
pop ebp
ret
Function at 0x404940
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48ecf0
push 0x480e70
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5a7f20]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 4], ebx
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x44c], edi
cmp edi, ebx
je 0x404a31
cmp edi, 0xffffffff
je 0x404a31
mov dword [ebp - 0x444], ebx
push 0x424
push ebx
lea eax, [ebp - 0x440]
push eax
call fcn.00481000
add esp, 0xc
mov dword [ebp - 0x444], 0x428
lea ecx, [ebp - 0x444]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
cmp eax, ebx
je 0x404a31
lea edx, [ebp - 0x424]
push edx
call fcn.004826ad
add esp, 4
cmp eax, ebx
je 0x404a3a
mov ecx, eax
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x404a00
sub ecx, esi
sar ecx, 1
add ecx, ecx
push ecx
push eax
push ebx
call fcn.00438580
add esp, 0xc
mov ecx, 0x6fcb9ae
cmp eax, ecx
jne 0x404a3a
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x448], edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x404a72
mov dword [ebp - 0x444], 0x428
lea eax, [ebp - 0x444]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x4049e1
cmp edi, ebx
je 0x404a82
cmp edi, 0xffffffff
je 0x404a82
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00480aee
mov esp, ebp
pop ebp
ret 4
Function at 0x480aee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a7f20]
jne 0x480af8
repz ret
jmp fcn.00484544

Function at 0x48a01f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a7f20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00483f04
and dword [ebp - 0x14], 0
cmp dword [0x5a9ca4], 0
mov dword [ebp - 0x18], eax
jne 0x48a0d2
push 0x402ef8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48a17a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402eec
push ebx
call edi
test eax, eax
je 0x48a17a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402edc
push ebx
mov dword [0x5a9ca4], eax
call edi
push eax
call esi
push 0x402ec8
push ebx
mov dword [0x5a9ca8], eax
call edi
push eax
call esi
push 0x402eac
push ebx
mov dword [0x5a9cac], eax
call edi
push eax
call esi
mov dword [0x5a9cb4], eax
test eax, eax
je 0x48a0d2
push 0x402e94
push ebx
call edi
push eax
call esi
mov dword [0x5a9cb0], eax
mov eax, dword [0x5a9cb0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x48a12b
cmp dword [0x5a9cb4], ecx
je 0x48a12b
push eax
call esi
push dword [0x5a9cb4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48a12b
test ebx, ebx
je 0x48a12b
call edi
test eax, eax
je 0x48a122
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48a122
test byte [ebp - 8], 1
jne 0x48a12b
or dword [ebp + 0x10], 0x200000
jmp 0x48a15e
mov eax, dword [0x5a9ca8]
cmp eax, dword [ebp - 0x18]
je 0x48a15e
push eax
call esi
test eax, eax
je 0x48a15e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48a15e
mov eax, dword [0x5a9cac]
cmp eax, dword [ebp - 0x18]
je 0x48a15e
push eax
call esi
test eax, eax
je 0x48a15e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5a9ca4]
call esi
test eax, eax
je 0x48a17a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48a17c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00480aee
leave
ret
Function at 0x4904a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4925b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5a7f20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x8f
lea eax, [ebp - 0x18]
push 0x5a7690
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.0046e370
mov ecx, dword [ebp - 0x18]
add esp, 0xc
cmp dword [ecx - 0xc], ebx
je 0x49057b
mov edi, dword [ebp + 8]
cmp ebx, 2
jge 0x49057b
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test ebx, ebx
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x490572
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test edi, edi
jne 0x49053e
lea eax, [edi + 0xd]
jmp 0x49055e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x404118
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x490572
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
inc ebx
jmp 0x4904f7
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4905bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4905d0
Capabilities:
Delete file
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4925db
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5a7f20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x230]
push ecx
push edx
push eax
mov byte [ebp - 4], 1
call fcn.00449010
add esp, 0xc
cmp eax, edi
je 0x490778
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x22c]
je 0x490778
lea ecx, [ebp - 0x230]
push 0x401df8
push ecx
call fcn.0044a390
add esp, 8
push 0x401de8
push 0x401dd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x490778
push esi
call eax
cmp eax, edi
je 0x4906fd
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4906fd
push 0x206
lea eax, [ebp - 0x21a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x21c], dx
call fcn.00481000
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x490778
lea edx, [ebp - 0x21c]
push edx
push edi
push edi
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x490778
push 1
lea ecx, [ebp - 0x21c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x490778
push 0x401dc8
lea edx, [ebp - 0x220]
push esi
push edx
mov dword [ebp - 0x220], edi
call fcn.00482f12
add esp, 0xc
test eax, eax
jne 0x490778
mov eax, dword [ebp - 0x220]
cmp eax, edi
je 0x490778
mov ecx, dword [ebp - 0x22c]
push eax
mov eax, dword [ebp - 0x230]
sub ecx, eax
push ecx
push 1
push eax
call fcn.00482dda
mov edx, dword [ebp - 0x220]
push edx
call fcn.00482c27
mov eax, dword [ebp - 0x220]
mov esi, dword [ebp - 0x22c]
sub esi, dword [ebp - 0x230]
push eax
call fcn.00482a38
mov ecx, dword [ebp - 0x220]
xor ebx, ebx
cmp esi, eax
push ecx
sete bl
call fcn.00482830
add esp, 0x1c
mov eax, dword [ebp - 0x230]
cmp eax, edi
je 0x4907a3
push eax
call fcn.00480e61
add esp, 4
jmp 0x4907a3
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00480aee
mov esp, ebp
pop ebp
ret
Function at 0x490930
Capabilities:
Check if file exists
Create process on windows
Delete file
Extract resource via kernel32 functions
Move file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492658
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5a7f20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x490b17
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x490973
sub eax, edx
sar eax, 1
je 0x490b17
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x490b17
push 0x409
push 0x65
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x490b09
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
je 0x490b17
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x490b17
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x490b17
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
mov byte [ebp - 4], 1
call fcn.00449010
add esp, 0xc
cmp eax, ebx
je 0x490af0
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x28]
je 0x490af0
mov edi, dword [ebp + 8]
push 0x401dc8
lea eax, [ebp - 0x18]
push edi
push eax
mov dword [ebp - 0x18], ebx
call fcn.00482f12
add esp, 0xc
test eax, eax
jne 0x490af0
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x490af0
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
push ecx
sub esi, eax
push esi
push 1
push eax
call fcn.00482dda
mov edx, dword [ebp - 0x18]
xor ecx, ecx
cmp esi, eax
sete cl
push edx
mov esi, ecx
call fcn.00482830
add esp, 0x14
cmp esi, ebx
je 0x490af0
mov eax, dword [0x5a8e20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5a8e20
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x6b
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0043da80
cmp eax, ebx
je 0x490ae8
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 0xc], ebx
je 0x490ae8
push edi
lea ecx, [ebp + 8]
call fcn.0043eb30
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00479e30
push esi
lea ecx, [ebp + 8]
call fcn.00478a70
cmp eax, ebx
je 0x490ae0
mov eax, dword [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x490ae0
mov ecx, dword [ebp + 8]
push 1
push ebx
push ebx
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], 1
lea ecx, [ebp + 8]
call fcn.00475ce0
lea ecx, [ebp - 0x1c]
call fcn.00405fd0
lea ecx, [ebp - 0x2c]
call fcn.00445530
jmp 0x490b17
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491020
Capabilities:
Enumerate processes
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4926c6
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x5a7f20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x2d0], edi
cmp edi, ebx
je 0x49118b
cmp edi, 0xffffffff
je 0x49118b
push 0x228
lea eax, [ebp - 0x2c0]
push ebx
push eax
call fcn.00481000
add esp, 0xc
lea ecx, [ebp - 0x2c4]
push ecx
push edi
mov dword [ebp - 0x2c4], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x491179
push 0xfde9
lea eax, [ebp - 0x2a0]
lea edx, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edx
call fcn.00473380
mov ecx, dword [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 4], 1
call fcn.0047b400
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
mov byte [ebp - 4], 3
cmp eax, edx
je 0x491107
push eax
call fcn.004819cf
add esp, 4
lea ecx, [ebp - 0x2cc]
call fcn.00477f10
mov esi, dword [ebp - 0x2cc]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x491120
sub eax, edx
mov edx, esi
or ecx, 0xffffffff
mov edi, edi
mov ebx, eax
dec eax
test ebx, ebx
je 0x49114f
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4019b8]
inc edx
jmp 0x491130
not ecx
lea eax, [esi - 0x10]
or edx, 0xffffffff
cmp dword [ebp + 8], ecx
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
jne 0x4911b9
lea ebx, [edx + 2]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x491179
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x49119b
cmp edi, 0xffffffff
je 0x49118b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
test edi, edi
je 0x49119b
cmp edi, 0xffffffff
je 0x49119b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00480aee
mov esp, ebp
pop ebp
ret
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4911cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x2c4]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4910b1
mov ebx, dword [ebp - 0x2c8]
jmp 0x491179
Function at 0x491210
Capabilities:
Enumerate processes
Hash data with crc32
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492711
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x5a7f20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
push edi
push 2
mov dword [ebp - 0x2c8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x2d4], 0x5e853e99
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x2d0], esi
cmp esi, edi
je 0x4914d3
cmp esi, 0xffffffff
je 0x4914d3
push 0x228
lea eax, [ebp - 0x2c0]
push edi
push eax
call fcn.00481000
add esp, 0xc
lea ecx, [ebp - 0x2c4]
call dword [ecx + 0x56]