joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef34f
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x67c
mov eax, dword [0x61dc40]
xor eax, esp
mov dword [esp + 0x678], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x10]
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
test eax, eax
je 0x4ef4e9
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x4ef4e9
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ef4e9
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4ef4e9
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [esp + 0x480], ax
lea eax, [esp + 0x482]
push eax
call fcn.00596530
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x5ee4c8
push ebx
lea eax, [esp + 0x480]
push eax
call esi
and dword [esp + 0x20], 0
push 0x24c
lea eax, [esp + 0x28]
push 0
push eax
call fcn.00596530
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x4ef4e9
lea eax, [esp + 0x4c]
push 0x5e23ec
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4ef4c3
lea eax, [esp + 0x4c]
push 0x5ed394
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4ef4c3
xor eax, eax
push edi
push eax
mov word [esp + 0x278], ax
lea eax, [esp + 0x27a]
push eax
call fcn.00596530
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
push ebx
lea eax, [esp + 0x278]
push eax
call esi
test byte [esp + 0x20], 0x10
lea eax, [esp + 0x270]
je 0x4ef4a2
push dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
push dword [esp + 0x18]
push eax
call fcn.004ef34f
jmp 0x4ef4c3
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x4ef4c3
push dword [esp + 0x14]
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4ef4c3
mov eax, dword [esp + 0x10]
inc dword [eax]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4ef426
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x4ef4eb
xor eax, eax
mov ecx, dword [esp + 0x684]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0058f3cf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f045f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x434], eax
mov edi, edx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x428], esi
cmp dword [eax + 0x28], esi
jne 0x4f049a
xor eax, eax
jmp 0x4f05c9
xor eax, eax
push 0x40e
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push esi
push eax
call fcn.00596530
add esp, 0xc
cmp edi, esi
je 0x4f04e2
cmp word [edi], si
je 0x4f04e2
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderFavorites
push 0x5dfc14
lea eax, [ebp - 0x41c]
push 0x207
push eax
call fcn.0058f42f
add esp, 0x14
jmp 0x4f0500
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMenuOrderFavorites
push 0x5db9e0
lea eax, [ebp - 0x41c]
push 0x208
push eax
call fcn.0058f42f
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
push esi
push esi
mov ebx, str.Order
push ebx
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 0x420], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edi, 0x80000001
push edi
call esi
test eax, eax
jne 0x4f05c3
mov eax, dword [ebp - 0x420]
test eax, eax
je 0x4f05c3
add eax, 4
push eax
call fcn.0058e040
pop ecx
mov dword [ebp - 0x424], eax
test eax, eax
je 0x4f05c3
mov ecx, dword [ebp - 0x420]
add ecx, 4
push ecx
push 0
push eax
call fcn.00596530
add dword [ebp - 0x420], 2
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
lea eax, [ebp - 0x42c]
push eax
push ebx
lea eax, [ebp - 0x41c]
push eax
push edi
mov dword [ebp - 0x42c], 3
call esi
test eax, eax
jne 0x4f05c3
mov eax, dword [ebp - 0x434]
push dword [eax + 0x28]
mov ecx, dword [ebp - 0x430]
push dword [ebp - 0x420]
push dword [ebp - 0x424]
call fcn.004f05da
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret 4

Function at 0x4f0805
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0xa4]
push esi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4f08ab
cmp dword [ebp - 0x98], 2
jne 0x4f08ab
cmp dword [ebp - 0xa4], 4
jbe 0x4f08ab
cmp dword [ebp - 0xa4], 5
jne 0x4f087e
cmp dword [ebp - 0xa0], 1
je 0x4f087a
cmp dword [ebp - 0xa0], 2
jne 0x4f08a7
push 0x12
jmp 0x4f08a6
cmp dword [ebp - 0xa4], 6
jne 0x4f08a7
mov eax, dword [ebp - 0xa0]
cmp eax, esi
jne 0x4f0895
push 0x24
jmp 0x4f08a6
cmp eax, 1
je 0x4f08a4
cmp eax, 2
je 0x4f08a4
cmp eax, 3
jne 0x4f08a7
push 0x28
pop esi
mov eax, esi
jmp 0x4f08ad
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.0058f3cf
add ebp, 0x78
leave
ret
Function at 0x4f2b23
Capabilities:
Check if file exists

Disassembly:
push 0xec
mov eax, 0x5be1f1
call fcn.00598fca
mov eax, dword [ebp + 8]
and dword [ebp - 0xd8], 0
mov esi, edx
push esi
mov edi, ecx
mov dword [ebp - 0xdc], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f2c32
and dword [ebp - 4], 0
lea eax, [ebp - 0xd4]
push eax
call fcn.00548b11
lea eax, [ebp - 0x44]
push eax
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.0054af1d
mov edx, esi
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 2
call fcn.00426b05
lea ecx, [ebp - 0x44]
push ecx
push eax
lea ebx, [ebp - 0xd4]
mov byte [ebp - 4], 3
call fcn.00548b5a
push 0
push 1
lea ecx, [ebp - 0xf8]
mov bl, al
mov byte [ebp - 4], 2
call fcn.00407567
test bl, bl
je 0x4f2c15
lea eax, [ebp - 0x44]
call fcn.0054bd37
test al, al
je 0x4f2c15
mov esi, str.roots
mov edx, esi
lea ecx, [ebp - 0x44]
call fcn.0054b949
call fcn.0054bd37
test al, al
je 0x4f2c15
mov edx, esi
lea ecx, [ebp - 0x44]
call fcn.0054b949
mov edx, str.bookmark_bar
mov ecx, eax
call fcn.0054b949
mov ecx, eax
call fcn.0054bd37
test al, al
je 0x4f2c15
mov edx, str.children
call fcn.0054b949
push dword [ebp - 0xdc]
mov ecx, edi
push eax
call fcn.004f2c40
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0054b1a0
lea eax, [ebp - 0xd4]
call fcn.0040b0d5
mov eax, dword [ebp - 0xd8]
call fcn.00599026
ret 4
Function at 0x4f2e3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5bd194
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x61dc40]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 8]
call fcn.0054bd25
test al, al
jne 0x4f2e83
xor eax, eax
jmp 0x4f3084
mov eax, dword [ebp + 8]
call fcn.0054b6cc
and dword [esp + 0x10], 0
mov dword [esp + 0x24], eax
test eax, eax
jbe 0x4f3081
push dword [esp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.0054b71c
mov ebx, eax
call fcn.0054bd37
test al, al
je 0x4f3064
mov edx, 0x5e86ec
mov ecx, ebx
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x4f3064
mov eax, dword [eax]
push str.folder
push eax
call fcn.00593a9c
neg eax
pop ecx
sbb eax, eax
inc eax
pop ecx
mov ecx, ebx
je 0x4f2f8b
mov edx, str.name
call fcn.0054b949
mov esi, eax
cmp byte [esi + 8], 4
jne 0x4f3064
lea edi, [esp + 0x2c]
call fcn.004eba8b
and dword [esp + 0x90], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 1
push dword [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.0047f54f
pop ecx
pop ecx
lea edi, [esp + 0x48]
mov byte [esp + 0x90], 1
call fcn.0040a3cc
mov byte [esp + 0x90], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00407b6b
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
lea edx, [esp + 0x2c]
push edx
call dword [eax]
test eax, eax
je 0x4f3078
mov edx, str.children
mov ecx, ebx
call fcn.0054b949
push dword [esp + 0x44]
mov ecx, esi
push eax
call fcn.004f2e3d
lea esi, [esp + 0x3c]
jmp 0x4f3057
mov edx, 0x5defbc
call fcn.0054b949
mov edx, str.name
mov ecx, ebx
mov esi, eax
call fcn.0054b949
cmp byte [esi + 8], 4
mov ebx, eax
jne 0x4f3064
cmp byte [ebx + 8], 4
jne 0x4f3064
lea edi, [esp + 0x58]
call fcn.004eba8b
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x90], 2
and dword [esp + 0x6c], 0
mov dword [esp + 0x68], eax
push dword [esi]
lea eax, [esp + 0x20]
push eax
call fcn.0047f54f
pop ecx
pop ecx
lea edi, [esp + 0x78]
mov byte [esp + 0x90], 3
call fcn.0040a3cc
mov byte [esp + 0x90], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.00407b6b
push dword [ebx]
lea eax, [esp + 0x24]
push eax
call fcn.0047f54f
pop ecx
pop ecx
lea edi, [esp + 0x74]
mov byte [esp + 0x90], 4
call fcn.0040a3cc
mov byte [esp + 0x90], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
lea edx, [esp + 0x58]
push edx
call dword [eax]
lea esi, [esp + 0x68]
test eax, eax
je 0x4f307c
or dword [esp + 0x90], 0xffffffff
call fcn.004ebad1
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x24]
jb 0x4f2e9c
jmp 0x4f3081
lea esi, [esp + 0x3c]
call fcn.004ebad1
xor eax, eax
inc eax
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f3fae
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x5b2cea
call fcn.00598f2b
xor esi, esi
mov dword [ebp - 0x18], esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f40c4
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x10]
push eax
push 0x5cd820
xor ebx, ebx
inc ebx
push ebx
push esi
push 0x5cd830
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4f40b3
cmp dword [ebp - 0x10], esi
je 0x4f40b3
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
xor eax, eax
lea esi, [ebp - 0x30]
mov word [ebp - 0x30], ax
call fcn.00441039
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0xe8]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or eax, 0xffffffff
cmp ax, word [ebp - 0x14]
jne 0x4f40b3
and dword [ebp + 8], 0
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x10]
push str.bookmark
lea esi, [ebp - 0x1c]
call fcn.00440fbd
mov byte [ebp - 4], 3
mov eax, dword [eax]
mov ecx, dword [edi]
lea edx, [ebp + 8]
push edx
push eax
push edi
mov dword [ebp - 0x18], ebx
call dword [ecx + 0xdc]
test eax, eax
jne 0x4f407b
cmp dword [ebp + 8], eax
jne 0x4f407d
xor bl, bl
mov dword [ebp - 4], 2
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test bl, bl
je 0x4f40a2
cmp dword [ebp + 8], 0
je 0x4f40a2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f40ce
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4f40b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4f40c4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
call fcn.00599003
ret 8
Function at 0x4f4932
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc98
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0xc98], esi
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x18], ebx
call fcn.004f4ce4
cmp esi, ebx
je 0x4f4bb0
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push 0x250
lea eax, [ebp - 0x460]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push esi
push str._s.
mov esi, 0x103
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0058f42f
add esp, 0x10
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc94], eax
cmp eax, 0xffffffff
je 0x4f4b98
mov ecx, 0x5e23ec
lea eax, [ebp - 0x434]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4f4a08
test dx, dx
je 0x4f4a04
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4f4a08
add eax, 4
add ecx, 4
test dx, dx
jne 0x4f49e2
xor eax, eax
jmp 0x4f4a0d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4f4b71
mov ecx, 0x5ed394
lea eax, [ebp - 0x434]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4f4a46
test dx, dx
je 0x4f4a42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4f4a46
add eax, 4
add ecx, 4
test dx, dx
jne 0x4f4a20
xor eax, eax
jmp 0x4f4a4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4f4b71
mov ebx, dword [ebp - 0x460]
test bl, 2
je 0x4f4a67
test bl, 0x10
je 0x4f4b71
test bl, 0x10
je 0x4f4ad8
push 0x418
lea eax, [ebp - 0xc90]
push 0
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push 0x5db9e0
lea eax, [ebp - 0xa84]
push esi
push eax
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0x87c], ebx
call fcn.0058f42f
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0xc98]
lea eax, [ebp - 0xc8c]
push 0x5eb400
push esi
push eax
call fcn.0058f42f
add esp, 0x24
lea eax, [ebp - 0xc90]
jmp 0x4f4b69
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x4f4b71
push str..url
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4f4b71
push 0x418
push eax
lea eax, [ebp - 0x878]
push eax
call fcn.00596530
mov eax, dword [ebp - 0x460]
and dword [ebp - 0x878], 0
add esp, 0xc
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0xc98]
lea eax, [ebp - 0x874]
push 0x5def50
push esi
push eax
call fcn.0058f42f
add esp, 0x14
lea eax, [ebp - 0x434]
push eax
push 0x5db9e0
lea eax, [ebp - 0x66c]
push esi
push eax
call fcn.0058f42f
add esp, 0x10
lea eax, [ebp - 0x878]
push eax
mov eax, edi
call fcn.004f4c79
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0xc94]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4f49d7
push dword [ebp - 0xc94]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
call fcn.004f4bbe
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x418
cdq
idiv ecx
mov dword [edi + 0x1c], eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret
Function at 0x4f649f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
xor edx, edx
sub ebx, dword [ebp + 0xc]
push esi
je 0x4f64c4
mov ecx, dword [ebp + 8]
mov esi, edi
sub ecx, edi
mov dword [ebp + 0xc], ebx
mov edx, ebx
mov bl, byte [ecx + esi]
xor byte [esi], bl
inc esi
dec dword [ebp + 0xc]
jne 0x4f64b9
cmp edx, eax
jae 0x4f64db
mov esi, dword [ebp + 8]
sub esi, edi
lea ecx, [edx + edi]
sub eax, edx
mov dl, byte [ecx + esi]
mov byte [ecx], dl
inc ecx
dec eax
jne 0x4f64d2
pop esi
pop ebx
pop ebp
ret
Function at 0x4f7617
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
xor esi, esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00596530
add esp, 0xc
push dword [esi + 0x61ef34]
call fcn.004040a8
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f7679
inc edi
add esi, 8
cmp esi, 0x18
jb 0x4f7630
xor eax, eax
cmp dword [ebp + 8], eax
je 0x4f7690
cmp edi, 3
sete al
jmp 0x4f7695
test edi, edi
setne al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0058f3cf
leave
ret 4

Function at 0x4f76a5
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 8]
push 0x4f76f3
push 0
push 0
call fcn.005905f0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4f76ee
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret 4
Function at 0x4f771a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5bc91b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x61dc40]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x61dc40]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], esi
xor edi, edi
xor eax, eax
push 0x206
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
call fcn.00596530
add esp, 0xc
push dword [edi + 0x61ef34]
call fcn.004040a8
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f785d
and dword [esp + 0x14], 0
lea eax, [esp + 0x34]
push eax
call fcn.00440517
and dword [esp + 0x268], 0
lea eax, [esp + 0x1c]
push eax
call fcn.00440517
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x278], 1
call fcn.004f9218
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x40]
test eax, 0xfffffffc
je 0x4f780c
push dword [edi + 0x61ef38]
lea ebx, [esp + 0x38]
push esi
call fcn.004fa0cd
xor ebx, ebx
inc ebx
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
test eax, 0xfffffffc
je 0x4f782f
push dword [edi + 0x61ef38]
lea eax, [esp + 0x20]
mov ecx, esi
call fcn.004f99f5
xor ebx, ebx
inc ebx
cmp dword [esp + 0x14], 0
jne 0x4f783f
lea ecx, [esp + 0x4c]
call fcn.0047611f
lea esi, [esp + 0x1c]
call fcn.0047509e
or dword [esp + 0x268], 0xffffffff
lea esi, [esp + 0x34]
call fcn.0047509e
mov esi, dword [esp + 0x18]
add edi, 8
cmp edi, 0x18
jb 0x4f7764
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0058f3cf
mov esp, ebp
pop ebp
ret
Function at 0x4faa26
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push edi
push 0x4faa71
push 0
push 0
call fcn.005905f0
add esp, 0x18
test eax, eax
je 0x4faa54
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 5
jbe 0x4faa2d
mov eax, dword [ebp + 8]
call fcn.004fb7e0
mov dword [0x6cab38], 1
pop edi
leave
ret 4

Function at 0x4fb806
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x1c4]
sub esp, 0x244
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x1c0], eax
mov eax, dword [ebp + 0x1cc]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x44], ebx
cmp edi, ebx
je 0x4fb8f8
cmp word [edi], bx
je 0x4fb8f8
lea esi, [eax + 0xac]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x4fb8f8
xor eax, eax
push 0x1fe
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push ebx
push eax
call fcn.00596530
push 0x38
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00596530
add esp, 0x18
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push edi
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x6c], 0xff
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4fb8f8
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
xor edi, edi
test eax, eax
jbe 0x4fb8f3
push edi
call fcn.00404e8b
cmp dword [eax + 0x18], 8
jb 0x4fb8c8
mov eax, dword [eax + 4]
jmp 0x4fb8cb
add eax, 4
push eax
lea eax, [ebp - 0x40]
call fcn.004268ca
pop ecx
test eax, eax
jne 0x4fb8ec
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
inc edi
cmp edi, eax
jb 0x4fb8b7
jmp 0x4fb8f3
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x44]
jmp 0x4fb8fa
xor eax, eax
mov ecx, dword [ebp + 0x1c0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
add ebp, 0x1c4
leave
ret 4
Function at 0x501246
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x501261
xor eax, eax
jmp 0x5012f1
mov dword [ebx + 0x10], esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0xc]
push eax
push esi
push ebx
push 0x50133b
push 0x200000
push esi
call fcn.005905f0
add esp, 0x18
cmp eax, esi
je 0x50125a
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x5012c1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
call edi
test eax, eax
jne 0x5012ad
push 0xff
push 0xffffffffffffffff
push esi
lea eax, [ebx + 0x14]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
je 0x5012ed
cmp eax, 0xffffffff
jne 0x5012c1
mov eax, dword [ebx + 4]
pop edi
pop esi
leave
ret

Function at 0x505dbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
inc ebx
push esi
mov esi, 0x6ae028
test byte [0x6ae020], bl
jne 0x505df7
or dword [0x6ae020], ebx
call fcn.0046ff87
push 0x5c317b
call fcn.0058fc1b
pop ecx
cmp dword [0x64592c], 0
jne 0x505e6f
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [0x64592c], ebx
call fcn.00596530
add esp, 0xc
call fcn.004040a8
push eax
push str._sACMannager.db
mov ecx, 0x104
lea edi, [ebp - 0x20c]
call fcn.00405374
pop ecx
pop ecx
mov eax, edi
push eax
call fcn.0046ffa6
push ebx
push esi
call fcn.00470070
pop edi
test eax, eax
je 0x505e6f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0046ffa6
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret

Function at 0x50c678
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
mov edi, eax
lea esi, [edi + 0x134]
mov eax, dword [esi]
test eax, eax
je 0x50c695
push 0
xor ecx, ecx
call fcn.0051b72c
and dword [esi], 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50c6ad
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0050ca94
mov edi, eax
call fcn.0050d71c
pop edi
pop esi
pop ecx
ret