joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a37b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6133f3
call fcn.0060cc48
sub esp, 0x218
push ebx
push esi
push edi
mov edi, ecx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x224]
push esi
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.005e26d0
add esp, 0xc
push esi
call fcn.005f230f
pop ecx
push edx
push eax
lea eax, [ebp - 0x18]
push str.http:__2398.35go.net_defend_o1_jcqgx.ini
push eax
call fcn.00413d50
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
add esp, 0xc
mov ecx, esi
push eax
call fcn.0046edeb
pop ecx
pop ecx
test eax, eax
jne 0x48a449
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x48a449
lea eax, [ebp - 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x48a449
push str.jcqgx.ini
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [edi + 0x24]
call fcn.004060f8
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x14]
call fcn.0046f0d8
test eax, eax
jne 0x48a44b
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a471
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x613425
call fcn.0060cc48
sub esp, 0xc18
push ebx
push esi
push edi
push 0x800
xor esi, esi
lea eax, [ebp - 0xc24]
push esi
push eax
mov edi, ecx
call fcn.005e26d0
mov ebx, 0x208
lea eax, [ebp - 0x21c]
push ebx
push esi
push eax
call fcn.005e26d0
push ebx
lea eax, [ebp - 0x424]
push esi
push eax
call fcn.005e26d0
mov ebx, dword [ebp + 8]
add esp, 0x24
mov dword [ebx], esi
call fcn.00404f47
push eax
lea ecx, [ebp + 8]
call fcn.004065d8
mov dword [ebp - 4], esi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc24]
push dword [edi + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x400
push eax
push 0x694da4
push 0x6a0910
push dword [edi + 0x18]
call esi
push dword [edi + 0x24]
lea eax, [ebp - 0x21c]
push 0x104
push eax
push 0x694da4
push 0x6a0918
push dword [edi + 0x18]
call esi
push dword [edi + 0x24]
lea eax, [ebp - 0x424]
push 0x104
push eax
push 0x694da4
push 0x6a0920
push dword [edi + 0x18]
call esi
lea eax, [ebp - 0xc24]
push eax
call fcn.005f0fb8
pop ecx
test eax, eax
jne 0x48a564
mov dword [ebx], 0x162
xor esi, esi
jmp 0x48a65e
lea eax, [ebp - 0x21c]
push eax
call fcn.005f0fb8
pop ecx
test eax, eax
jne 0x48a57d
mov dword [ebx], 0x164
jmp 0x48a55d
lea eax, [ebp - 0x424]
push eax
call fcn.005f0fb8
xor esi, esi
pop ecx
test eax, eax
jne 0x48a59b
mov dword [ebx], 0x163
jmp 0x48a65e
push dword [edi + 0x24]
push esi
push str.probability
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x34], eax
lea ecx, [edi + 0x28]
lea eax, [ebp - 0xc24]
push eax
call fcn.004060f8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [edi + 0x2c]
call fcn.004060f8
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp + 8]
call fcn.004060f8
lea eax, [ebp + 8]
push eax
call fcn.004706c9
mov edx, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00470634
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x10]
push eax
call fcn.0048a692
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040b545
pop ecx
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 4
call fcn.00406123
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
xor esi, esi
inc esi
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48e6b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x18
mov esi, ecx
call fcn.00431ddf
mov edx, eax
pop ecx
test edx, edx
je 0x48e6f1
xor ecx, ecx
mov dword [edx], esi
push ecx
push ecx
push edx
mov dword [edx + 0x10], ecx
mov eax, dword [ebp + 8]
push 0x48e6f4
push ecx
mov dword [edx + 8], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [edx + 0xc], eax
call fcn.005f4880
add esp, 0x18
pop esi
pop ebp
ret

Function at 0x48e82c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0xe8
cmp dword [0x6ca940], eax
je 0x48e845
inc eax
jmp 0x48e93c
push ebx
push edi
xor ebx, ebx
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
stosd dword es:[edi], eax
push 0xc8
push ebx
mov dword [ebp - 0xc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xe8]
push eax
call fcn.005e26d0
add esp, 0xc
call fcn.0048ed7f
push dword [ebp + 8]
mov ecx, 0x6ca91c
mov dword [0x6ca944], eax
call fcn.004060f8
call fcn.0048ecc8
xor edi, edi
lea eax, [ebp - 0x20]
inc edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push 0x6ca920
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0xe8]
push 0x6a0c00
push eax
call fcn.0048ef2e
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
push edi
push edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push edi
push ebx
mov dword [0x6ca910], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6ca914], eax
cmp dword [0x6ca910], ebx
je 0x48e938
test eax, eax
je 0x48e938
push ebx
push ebx
push 0x6ca908
push 0x48eb25
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6ca918], eax
test eax, eax
je 0x48e938
mov dword [0x6ca940], edi
mov eax, edi
jmp 0x48e93a
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48e942
Capabilities:
Terminate thread

Disassembly:
push edi
xor edi, edi
mov dword [0x6ca908], 1
cmp dword [0x6ca918], edi
je 0x48e98c
mov eax, dword [0x6ca914]
test eax, eax
je 0x48e967
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [0x6ca918]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x48e98c
push edi
push dword [0x6ca918]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x6ca914]
test eax, eax
je 0x48e9a2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6ca914], edi
mov eax, dword [0x6ca918]
test eax, eax
je 0x48e9b8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6ca918], edi
mov dword [0x6ca940], edi
pop edi
ret
Function at 0x48eb34
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x613811
call fcn.0060cc48
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0048ee8d
mov esi, eax
mov dword [ebp - 0x14], esi
push 0xffffffffffffffff
mov dword [ebp - 4], ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48ecad
mov ebx, dword [ebp - 0x10]
lea ecx, [edi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x14]
lea ecx, [edi + 0x30]
cmp eax, ecx
je 0x48eb9b
mov eax, esi
mov esi, dword [ecx]
mov dword [ecx], eax
mov eax, ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
mov dword [ecx + 4], eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x48ec92
cmp dword [edi + 4], 0
jne 0x48ebd6
push 0x6a0c84
push dword [edi + 0x14]
call fcn.005e972e
mov dword [edi + 4], eax
pop ecx
pop ecx
test eax, eax
je 0x48ec92
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
add eax, 8
cmp ecx, eax
je 0x48ebff
push 0xffffffffffffffff
push 0
push eax
call fcn.00409916
mov esi, dword [esi]
dec ebx
push 0
push 1
mov dword [ebp - 0x10], ebx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.004097fa
push 0x20
push 1
push esi
call fcn.00403f7c
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
cmp dword [edi + 4], 0
je 0x48ec60
push dword [edi + 4]
push dword [ebp - 0x1c]
push 1
push eax
call fcn.005f3369
push dword [edi + 4]
push 2
push 1
push 0x696ef0
call fcn.005f3369
add esp, 0x20
mov esi, dword [ebp - 0x14]
test ebx, ebx
jne 0x48ebe9
cmp dword [edi + 4], 0
je 0x48ec7a
push dword [edi + 4]
call fcn.005e5e1d
and dword [edi + 4], 0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004097fa
mov esi, dword [ebp - 0x14]
jmp 0x48eb73
cmp dword [edi], 0
jne 0x48ecad
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [edi + 0x18]
test eax, eax
je 0x48eb76
lea ecx, [ebp - 0x14]
call fcn.0048edd5
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48ecc8
Capabilities:
Delete file
Get file size
Move file
Set file attributes

Disassembly:
mov eax, 0x60d965
call fcn.0060cc48
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push dword [0x6ca91c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x48ed6c
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
push edi
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x80000
jb 0x48ed6b
mov eax, dword [0x6ca91c]
add eax, 0xfffffff0
push eax
call fcn.004067cf
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0048ee20
mov esi, dword [ebp - 0x10]
mov ebx, dword [0x6ca91c]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esi - 0x10]
call fcn.00404ea9
pop esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
inc eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48efbb
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x613870
call fcn.0060cc48
sub esp, 0x90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x9c], vtable.KMD5.0
push edi
mov esi, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [ebp - 0x18], ebx
lea eax, [esi + 4]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], eax
lea ebx, [esi + 0x14]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push edi
call fcn.0048f166
test eax, eax
je 0x48f13c
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x48f137
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48f137
push 0x5c
push esi
call fcn.005e42e0
pop ecx
pop ecx
test eax, eax
je 0x48f137
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x48f137
inc eax
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040a965
push eax
lea ecx, [ebx - 0xc]
mov byte [ebp - 4], 2
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00404ea9
mov byte [ebp - 0x3c], 0
lea edi, [ebp - 0x3b]
xor eax, eax
stosd dword es:[edi], eax
push ecx
push ecx
push esi
stosd dword es:[edi], eax
lea ecx, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00413262
test eax, eax
je 0x48f137
push 0x10
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.005e11d0
add esp, 0xc
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 3
xor edi, edi
movzx eax, byte [ebp + edi - 0x3c]
push eax
lea eax, [ebp - 0x14]
push 0x69d6b0
push eax
call fcn.004090e5
add esp, 0xc
inc edi
cmp edi, 0x10
jl 0x48f0d5
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 0
je 0x48f106
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00406123
mov eax, dword [ebp - 0x18]
lea ecx, [edi - 0x10]
mov dword [ebp - 0x28], eax
call fcn.00404ea9
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.00404ea9
mov edi, dword [ebp - 0x1c]
add ebx, 4
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 3
jge 0x48f147
mov edi, dword [ebp - 0x28]
jmp 0x48effc
lea ecx, [esi - 0x10]
jmp 0x48f142
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
lea ecx, [ebp - 0x9c]
call fcn.00413231
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
inc eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f166
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 8], eax
cmp dword [eax], esi
jne 0x48f182
xor eax, eax
jmp 0x48f2b2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
push ebx
mov ebx, esi
test eax, eax
je 0x48f2af
cmp eax, 4
je 0x48f2af
cmp eax, 8
je 0x48f2af
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x48f2af
push edi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push esi
push ecx
call dword [eax]
test eax, eax
jne 0x48f29c
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x48f29c
cmp edi, 8
je 0x48f29c
push edi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x48f29c
push 0x208
lea eax, [ebp - 0x228]
push esi
push eax
call fcn.005e26d0
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x103
push eax
push esi
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x48f281
push 0x208
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.005e26d0
add esp, 0xc
lea eax, [ebp - 0x430]
push 0x104
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x48f29c
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.0048f2b9
test eax, eax
je 0x48f29c
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48f28a
mov dword [eax], edi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x228]
push eax
call fcn.004060f8
xor esi, esi
inc esi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
test ebx, ebx
je 0x48f2ae
push ebx
call edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48f2b9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x48f3b0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x48f3b0
lea eax, [ebp - 0x4b8]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x48f3a8
xor eax, eax
mov dword [ebp + 8], eax
cmp word [ebp - 0x4b8], ax
je 0x48f3a8
lea ebx, [ebp - 0x4b8]
mov dword [ebp + 0xc], eax
push 0x6a0cc4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48f387
push 0x6a0ccc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48f387
mov ax, word [ebx]
mov word [ebp - 8], ax
mov eax, dword [ebp + 0xc]
push 0x64
mov ax, word [ebp + eax - 0x4b6]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x48f3b0
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd0]
push ebx
push eax
push edi
call fcn.005f2a5d
add esp, 0xc
test eax, eax
je 0x48f3bb
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x4b8]
add eax, 4
mov dword [ebp + 8], eax
add eax, eax
add ebx, eax
mov dword [ebp + 0xc], eax
xor eax, eax
cmp word [ebx], ax
jne 0x48f310
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + ebx*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
inc eax
jmp 0x48f3b2

Function at 0x48f3d6
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, edx
call fcn.0048f4a2
test al, al
jne 0x48f3f6
or eax, 0xffffffff
jmp 0x48f49b
mov ecx, dword [esi + 4]
lea edx, [ebp - 4]
call fcn.0048f56f
test al, al
je 0x48f3ee
mov esi, str.Data_Buffer
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
jne 0x48f425
xor eax, eax
jmp 0x48f49b
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x48f43e
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
jmp 0x48f421
push 0x28
call fcn.005f1902
mov ebx, eax
pop ecx
test ebx, ebx
je 0x48f435
mov dword [ebp - 4], 2
push 0x3e8
push 0x28
push ebx
push 0
push 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x48f478
cmp dword [ebx + 4], 0
jne 0x48f478
inc edi
sub dword [ebp - 4], 1
jne 0x48f453
push ebx
call fcn.005f0fb3
pop ecx
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
call fcn.0048f521
test al, al
push 0xffffffffffffffff
pop eax
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f4a2
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x48f503
push 0x6c63b0
call fcn.0048f5dc
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_WSAStartup_operation:
mov ecx, esi
call fcn.00412451
mov edx, str.WSAGetLastError____
mov ecx, eax
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048f5dc
xor al, al
jmp 0x48f51b
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x16]
push eax
call fcn.005f2c37
mov al, 1
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48f56f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push ecx
mov esi, edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x48f5b8
push 0x6c63b0
call fcn.0048f5dc
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_gethostbyname_operation:_WSAGetLastError____
mov ecx, esi
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048f5dc
pop ecx
xor al, al
jmp 0x48f5d7
mov eax, dword [eax + 0xc]
push ecx
lea ecx, [esp + 8]
push dword [eax]
call fcn.0048f6c6
pop ecx
pop ecx
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [esi], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48f79e
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6138c3
call fcn.0060cc48
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], edi
mov ebx, 0x694da4
push ebx
lea ecx, [edi + 0xc]
mov dword [edi], vtable.KInstallTool::KUIInfoReport.0
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00406173
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], esi
call fcn.00406173
mov byte [ebp - 4], 1
call fcn.00404f47
push eax
lea ecx, [edi + 0x14]
call fcn.004065d8
push ebx
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00406173
push ebx
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
call fcn.00406173
push ebx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 4
call fcn.00406173
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov eax, edi
mov byte [edi + 0x28], 7
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48fb8c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
push edi
mov edi, ecx
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 8], eax
call esi
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 4], eax
call esi
cmp byte [edi + 4], bl
jne 0x48fbba
push 0xfffffffffffffffd
pop ebx
jmp 0x48fbd0
push ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [edi + 4], bl
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49008e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
call fcn.0049006f
test al, al
je 0x4900b5
or esi, 0xffffffff
jmp 0x490120
push ebx
push 8
call fcn.00431ddf
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4900c8
push 0xfffffffffffffffa
jmp 0x49011e
lea eax, [edi + 0xc]
mov dword [ebx], edi
push eax
push esi
push ebx
push 0x49039c
push esi
push esi
mov dword [ebx + 4], esi
call fcn.005f4880
add esp, 0x18
mov dword [edi + 8], eax
test eax, eax
je 0x490112
lea ebx, [edi + 0x14]
jmp 0x4900fc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 4], 0
push ebx
je 0x4900ee
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x49011f
push 8
push ebx
call fcn.0049a82c
pop ecx
pop ecx
push 0xfffffffffffffffe
pop esi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4