joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f0e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f4435
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x5550ec]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
lea eax, [edi + 0x3c]
mov dword [esp + 0x78], esi
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add edi, 0x58
mov eax, edi
mov byte [esp + 0x78], 1
call fcn.0047fa84
push 2
pop ecx
cmp eax, ecx
jae 0x47f176
xor edi, edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esi, [esp + 0x5c]
call fcn.004c17de
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x18], ecx
mov eax, edi
call fcn.0047fa84
mov ebx, dword [esp + 0x14]
mov esi, eax
mov eax, edi
add esi, ebx
call fcn.0047fa84
cmp esi, eax
jb 0x47f1a2
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [edi + 4]
lea eax, [eax + esi*8]
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00401311
add eax, 0x10
mov dword [esi], eax
add ebx, 4
push ebx
lea esi, [esp + 0x3c]
call fcn.0047ff45
pop ecx
pop ecx
lea ecx, [esp + 0x24]
push ecx
mov esi, eax
mov byte [esp + 0x7c], 2
call fcn.0047ff80
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
lea ebx, [esp + 0x4c]
mov byte [esp + 0x80], 3
call fcn.0047f896
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.004012f9
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, edi
call fcn.0047fa84
mov esi, eax
add esi, dword [esp + 0x14]
mov eax, edi
call fcn.0047fa84
cmp esi, eax
jb 0x47f23e
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [edi + 4]
lea esi, [eax + esi*8]
mov eax, dword [esi + 4]
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov ebx, esp
call fcn.00401311
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
add eax, 0x186a3
push eax
lea esi, [esp + 0x44]
call fcn.0047ff45
pop ecx
pop ecx
lea ecx, [esp + 0x2c]
push ecx
mov esi, eax
mov byte [esp + 0x7c], 4
call fcn.0047ff80
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 8]
lea ebx, [esp + 0x58]
mov byte [esp + 0x80], 5
call fcn.0047f896
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
call fcn.004012f9
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
call fcn.004012f9
inc dword [esp + 0x14]
dec dword [esp + 0x18]
jne 0x47f182
xor edi, edi
inc edi
jmp 0x47f14c
Function at 0x4801cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
test edi, edi
je 0x4801e1
cmp dword [esi], 2
jae 0x4801e1
push 0x7a
pop eax
jmp 0x480242
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x480242
cmp dword [ebp + 0xc], 7
je 0x480212
push 0xd
jmp 0x4801de
test edi, edi
mov ecx, dword [ebp - 4]
je 0x48023c
test cl, 1
jne 0x48020e
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x48020e
cmp word [edi + eax*2 - 2], 0
jne 0x48020e
cmp eax, 1
jbe 0x48023c
cmp word [edi + eax*2 - 4], 0
jne 0x48020e
shr ecx, 1
mov dword [esi], ecx
xor eax, eax
leave
ret 8

Function at 0x488747
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x488765
xor eax, eax
jmp 0x488812
push 0x28
push 0
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
cmp dword [ebp - 8], 0x10
mov ecx, dword [ebp - 0x1c]
jae 0x488788
lea ecx, [ebp - 0x1c]
test ecx, ecx
je 0x4887a2
jmp 0x48879d
mov al, byte [ecx]
cmp al, 0x41
jl 0x48879c
cmp al, 0x5a
jg 0x48879c
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x48878e
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x4887ae
lea eax, [ebp - 0x1c]
push ebx
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0042ab59
cmp ebx, 0x25
movzx eax, ax
pop ecx
mov dword [ebp - 0x24], eax
jbe 0x4887c7
push 0x25
pop ebx
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x4887d3
lea eax, [ebp - 0x1c]
push ebx
push eax
lea esi, [edi + 3]
push esi
call sub.MSVCR80.dll_memcpy
lea eax, [ebx + 2]
mov byte [edi], al
mov ax, word [ebp - 0x24]
add esp, 0xc
test esi, esi
mov word [edi + 1], ax
je 0x488805
test ebx, ebx
je 0x488805
xor eax, eax
test ebx, ebx
jbe 0x488805
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ebx
jb 0x4887fc
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d6e66
leave
ret
Function at 0x48895d
Capabilities:
Read file via mapping

Disassembly:
push 0x20
mov eax, 0x4eea33
call fcn.004d76d5
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor edi, edi
push str.Global_
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call dword [0x506424]
cmp dword [0x55b15c], 8
mov eax, dword [0x55b148]
jae 0x488998
mov eax, 0x55b148
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4889ae
lea eax, [ebp - 0x28]
cmp dword [esi + 4], edi
jne 0x4889e6
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, edi
mov dword [esi], eax
je 0x4889e9
push 0x3fe0
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
jne 0x4889e3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
jmp 0x4889e9
mov dword [esi + 4], eax
xor edi, edi
inc edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, edi
call fcn.004d7758
ret

Function at 0x4889fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [ecx + 4]
test ecx, ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], edx
jne 0x488a22
xor eax, eax
jmp 0x488a7d
and dword [ebp - 0x34], 0
and dword [ebp - 0x38], 0
test eax, eax
lea esi, [ecx + 0x20]
je 0x488a7a
test esi, esi
je 0x488a7a
lea ecx, [ebp - 0x30]
push ecx
call fcn.0048881f
pop ecx
lea edi, [ebp - 0x38]
lea ebx, [ebp - 0x34]
mov ecx, esi
lea edx, [ebp - 0x30]
call fcn.00488869
cmp dword [ebp - 0x34], 0
je 0x488a7a
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
push 0x10
add eax, 0x2c
push eax
push esi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
test esi, esi
je 0x488a7a
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x488a70
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d6e66
leave
ret 4
Function at 0x488af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x318
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x294], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x72]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x74], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x488b32
mov esi, dword [esi + 4]
jmp 0x488b35
add esi, 4
cmp dword [0x55b194], 8
mov eax, dword [0x55b180]
jae 0x488b48
mov eax, 0x55b180
push esi
push eax
push 0x50b078
lea eax, [ebp - 0x74]
push 0x104
push eax
call fcn.0048e7b6
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push 0x20219
push edi
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x488b87
mov eax, 0xe00c0012
jmp 0x488c02
mov esi, 0xfe
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov dword [ebp - 0x7c], edi
mov word [ebp + 0x194], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
push str.Name
push dword [ebp - 0x78]
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x488bf2
cmp dword [ebp - 0x7c], 1
jne 0x488bf2
push str..Pipe_
mov ecx, ebx
call dword [0x506424]
lea eax, [ebp + 0x194]
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
jmp 0x488bf7
mov esi, 0xe00c001f
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp + 0x294]
pop edi
xor ecx, ebp
pop esi
call fcn.004d6e66
add ebp, 0x298
leave
ret

Function at 0x488fb3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
jmp 0x488fe5
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x488ff1
add esi, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
jne 0x488fbc
xor eax, eax
pop esi
leave
ret 0xc
mov eax, 0xe00c0009
jmp 0x488fec

Function at 0x488ff8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
jmp 0x48902a
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x489036
add esi, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
jne 0x489001
xor eax, eax
pop esi
leave
ret 0xc
mov eax, 0xe00c000b
jmp 0x489031
Function at 0x48a837
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f3c1a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5550ec]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x18]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x48a99f
xor ebx, ebx
lea ecx, [esp + 0x1c]
call fcn.00490637
mov dword [esp + 0x38], ebx
mov eax, dword [0x55a320]
mov ecx, 0x55a320
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x38], 1
push dword [esi + 0x18]
lea eax, [esp + 0x1c]
push str._url:__s_
call fcn.00401a17
mov edx, dword [esp + 0x20]
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049336c
test eax, eax
je 0x48a97e
mov eax, dword [esi + 0x18]
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x55ac14], ebx
cdq
mov dword [esp + 0x24], eax
mov edi, edx
je 0x48a971
cmp edi, ebx
jl 0x48a8fc
jg 0x48a8f5
cmp eax, 0x20
jbe 0x48a8fc
mov byte [esp + 0x17], 1
jmp 0x48a900
mov byte [esp + 0x17], bl
mov esi, dword [esi + 0x18]
lea eax, [esp + 0x17]
push eax
push str.___result:
push esi
push str.ShellExecute_
push 0x511610
push str.OpenUrl2Task::Run
push 0x5115dc
lea eax, [esp + 0x3c]
push eax
push 0x5115d8
push ecx
mov dword [esp + 0x48], 0x152
call fcn.004022da
add esp, 4
call fcn.00402322
call fcn.00423ea4
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.00402322
call fcn.004333be
mov esi, eax
call fcn.0040234b
cmp edi, ebx
jl 0x48a983
jg 0x48a97e
cmp dword [esp + 0x24], 0x20
jbe 0x48a983
xor esi, esi
inc esi
jmp 0x48a985
xor esi, esi
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48aead
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x4f3bab
call fcn.004d766c
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x1c]
or ecx, 0x20006
push ecx
push eax
push dword [edi + 0x18]
lea eax, [ebp - 0x10]
call fcn.00407234
test eax, eax
je 0x48aef5
cmp dword [ebp - 0x10], ebx
je 0x48aeee
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x48b025
mov eax, dword [edi + 0x2c]
dec eax
je 0x48aff7
dec eax
je 0x48aff3
dec eax
je 0x48afb4
dec eax
je 0x48af99
dec eax
je 0x48af7f
dec eax
dec eax
je 0x48af4c
sub eax, 4
jne 0x48af77
mov eax, dword [edi + 0x24]
mov edi, dword [edi + 0x20]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi64]
pop ecx
mov dword [ebp - 0x18], eax
push 8
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], edx
push 0xb
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x48b00a
lea esi, [edi + 0x38]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x48af77
mov ecx, dword [esi + 8]
sub ecx, eax
sar ecx, 1
je 0x48af77
mov edi, dword [edi + 0x20]
call fcn.00469c5e
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00435a67
jmp 0x48b00a
push 0xd
pop esi
jmp 0x48b00c
push dword [edi + 0x24]
call dword [sym.imp.MSVCR80.dll__wtoi]
mov edi, dword [edi + 0x20]
pop ecx
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x14]
push eax
push 5
jmp 0x48af3c
mov eax, dword [edi + 0x24]
mov edi, dword [edi + 0x20]
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
pop ecx
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00436237
jmp 0x48b00a
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0x24]
push eax
mov dword [ebp - 0x14], ebx
call fcn.00425042
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x48afec
push dword [ebp - 0x14]
mov edi, dword [edi + 0x20]
push ebx
push 3
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x48afef
push 0xd
pop esi
xor ebx, ebx
jmp 0x48b00c
push 2
jmp 0x48aff9
push 1
mov eax, dword [edi + 0x24]
mov edi, dword [edi + 0x20]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.004361fc
mov esi, eax
xor eax, eax
cmp esi, ebx
sete al
cmp dword [ebp - 0x10], ebx
mov esi, eax
je 0x48b023
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.004d7744
ret

Function at 0x48b082
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, eax
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x1c]
or ecx, 0x20006
push ecx
push eax
push dword [esi + 0x18]
lea eax, [ebp - 4]
call fcn.00409d6a
test eax, eax
jne 0x48b0ba
push dword [esi + 0x20]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x48b0c3
cmp eax, 2
je 0x48b0c3
xor esi, esi
jmp 0x48b0c6
xor esi, esi
inc esi
cmp dword [ebp - 4], 0
je 0x48b0d5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x48c43a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x501230
mov eax, dword fs:[0]
push eax
sub esp, 0x3e0
push ebx
push esi
push edi
mov eax, dword [0x5550ec]
xor eax, esp
push eax
lea eax, [esp + 0x3f0]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x44]
push eax
call fcn.0044dcce
xor ebx, ebx
lea eax, [esi + 0x18]
lea edi, [esp + 0x48]
mov dword [esp + 0x3f8], ebx
call fcn.00402a4c
lea eax, [esi + 0x20]
lea edi, [esp + 0x4c]
call fcn.00402a4c
lea eax, [esi + 0x24]
lea edi, [esp + 0x50]
call fcn.00402a4c
lea eax, [esi + 0x28]
lea edi, [esp + 0x54]
call fcn.00402a4c
lea eax, [esi + 0x2c]
lea edi, [esp + 0x58]
call fcn.00402a4c
lea eax, [esi + 0x30]
lea edi, [esp + 0x5c]
call fcn.00402a4c
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.MSVCR80.dll__wcsicmp]
push 0x51ae78
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x48c4ea
mov dword [esp + 0x44], 1
jmp 0x48c503
mov esi, dword [esi + 0x1c]
push str.user
push esi
call edi
neg eax
sbb eax, eax
neg eax
inc eax
pop ecx
inc eax
pop ecx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
call fcn.0044dd7d
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea edi, [esp + 0x20]
mov byte [esp + 0x3f8], 1
call fcn.0044cc1e
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x400], 2
call fcn.0044d4cc
xor esi, esi
cmp eax, ebx
jne 0x48c582
lea eax, [esp + 0x20]
call fcn.00478e31
lea edi, [esp + 0x10]
call fcn.0044ddd4
or dword [esp + 0x3f8], 0xffffffff
lea eax, [esp + 0x44]
push eax
call fcn.00478da1
mov eax, esi
mov ecx, dword [esp + 0x3f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
inc ebx
xor edi, edi
cmp dword [esp + 0x14], 0
je 0x48c5c0
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x14]
sar eax, 5
cmp esi, eax
jae 0x48c5c0
mov eax, dword [esp + 0x14]
push dword [edi + eax + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x48c5b8
test ebx, ebx
je 0x48c5b8
xor ebx, ebx
inc ebx
jmp 0x48c5ba
xor ebx, ebx
inc esi
add edi, 0x20
jmp 0x48c587
mov esi, ebx
jmp 0x48c546
Function at 0x48db3b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fe963
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x5550ec]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x2c]
push eax
call fcn.0049c1bb
and dword [esp + 0x68], 0
lea esi, [esp + 0x20]
call fcn.0047a72e
xor ebx, ebx
inc ebx
mov byte [esp + 0x68], bl
push dword [edi + 0x18]
mov ecx, esi
call fcn.0049c5ee
cmp dword [esp + 0x2c], 0
pop ecx
jne 0x48dbc8
mov esi, ebx
lea eax, [esp + 0x20]
mov byte [esp + 0x68], 0
call fcn.0047a751
lea edi, [esp + 0x2c]
call fcn.0049c20b
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x20]
cmp eax, dword [esp + 0x18]
je 0x48dbf2
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, dword [esp + 0x1c]
je 0x48dc45
lea esi, [esp + 0x18]
call fcn.004c6268
push dword [eax]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x48dc28
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x48dc36
cmp dword [esp + 0x14], 0
jne 0x48dc36
and dword [esp + 0x14], 0
jmp 0x48dc3a
mov dword [esp + 0x14], ebx
lea esi, [esp + 0x18]
call fcn.00468cbd
jmp 0x48dbde
mov esi, dword [esp + 0x14]
jmp 0x48db9c
Function at 0x48fdcf
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1d0]
sub esp, 0x250
mov eax, dword [0x5550ec]
xor eax, ebp
mov dword [ebp + 0x1cc], eax
mov eax, dword [ebp + 0x1d8]
push edi
xor edi, edi
push 0x228
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x5c]
push edi
push eax
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x60], edi
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 2
mov dword [ebp - 0x78], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x6c], eax
jne 0x48fe2e
xor eax, eax
jmp 0x48ff42
push esi
lea ecx, [ebp - 0x60]
push ecx
push eax
mov dword [ebp - 0x60], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x48ff2c
push ebx
cmp dword [ebp - 0x68], edi
je 0x48fe5c
push dword [ebp - 0x68]
call esi
mov dword [ebp - 0x68], edi
cmp dword [ebp - 0x64], edi
je 0x48fe69
push dword [ebp - 0x64]
call esi
mov dword [ebp - 0x64], edi
lea eax, [ebp - 0x3c]
push str.explorer.exe
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x48fef5
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x48fef5
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x1dc]
jne 0x48fef5
push dword [ebp - 0x58]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
mov dword [ebp - 0x68], eax
je 0x48fef5
lea eax, [ebp - 0x64]
push eax
push 0xf01ff
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48fef5
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x64]
lea ebx, [ebp - 0x74]
mov dword [ebp - 0x74], edi
call fcn.0048fcad
test eax, eax
pop ecx
pop ecx
je 0x48fef5
mov ebx, dword [ebp - 0x74]
push dword [ebx]
call fcn.0048fc1c
test eax, eax
pop ecx
push ebx
je 0x48ff0b
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48fe4f
jmp 0x48ff21
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
mov dword [ebp - 0x70], 1
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
cmp dword [ebp - 0x68], edi
pop ebx
je 0x48ff2c
push dword [ebp - 0x68]
call esi
cmp dword [ebp - 0x64], edi
je 0x48ff39
push dword [ebp - 0x64]
call esi
mov dword [ebp - 0x64], edi
push dword [ebp - 0x6c]
call esi
mov eax, dword [ebp - 0x70]
pop esi
mov ecx, dword [ebp + 0x1cc]
xor ecx, ebp
pop edi
call fcn.004d6e66
add ebp, 0x1d0
leave
ret
Function at 0x48ff58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ecx, ecx
cmp dword [ebp + 8], ecx
push esi
push edi
je 0x48ffad
cmp dword [ebp + 0xc], ecx
je 0x48ffad
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], ecx
jbe 0x48ffad
push 0x5851f42d
push 0x4c957f2d
push ecx
push eax
call fcn.004ea3a0
add eax, 1
adc edx, 0
mov ecx, edx
mov ebx, eax
mov edi, ecx
shrd ebx, edi, 0x13
mov edx, esi
and edx, 3
xor bl, byte [ebp + edx + 0x10]
shr edi, 0x13
mov edi, dword [ebp + 8]
xor byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x48ff74
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4909a6
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 4
mov eax, 0x4f368c
call fcn.004d766c
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402cc5
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4909e6
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, esi
call fcn.004d7744
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4909d0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x4909d0
lea ecx, [ebp - 0x10]
call fcn.0049095d
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x490a1d
xor esi, esi
jmp 0x4909d3
push eax
call fcn.004909a6
test eax, eax
pop ecx
je 0x490a19
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4909d0
call edi
cmp eax, ebx
jne 0x490a19
jmp 0x4909d0