joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b849
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x47b88c
xor eax, eax
jmp 0x47b8cc
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a2a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47b8a7
xor eax, eax
jmp 0x47b8cc
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x47b8ca
mov eax, 1
jmp 0x47b8cc
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x47bc65
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1168
push 0x4a2bd4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x2c]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov dx, word [ecx + 6]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], 0
jmp 0x47bce5
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x28]
jge 0x47bd29
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 0x24]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 0xc], ecx
jae 0x47bd27
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x14]
jbe 0x47bd27
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x47bd4f
jmp 0x47bcd3
xor edx, edx
test edx, edx
jne 0x47bc99
mov dword [ebp - 4], 0xffffffff
jmp 0x47bd4c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c29b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push edi
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x110], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp + eax - 0x104]
mov dword [ebp - 0x108], ecx
push str._temp_
push 0x104
mov edx, dword [ebp - 0x108]
push edx
call fcn.004154e0
mov eax, dword [ebp - 0x108]
add eax, 6
mov dword [ebp - 0x114], eax
push 0x536b90
push 0x104
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.004154e0
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [0x5429a8]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x47c366
xor eax, eax
jmp 0x47c42c
mov ecx, dword [ebp - 0x254]
and ecx, 0x10
test ecx, ecx
je 0x47c378
jmp 0x47c3fd
lea edx, [ebp - 0x228]
push edx
push 0x104
mov eax, dword [ebp - 0x114]
push eax
call fcn.004154e0
lea ecx, [ebp - 0x104]
push ecx
call fcn.0044b990
mov ecx, eax
call fcn.0044bdb4
test eax, eax
je 0x47c3a9
jmp 0x47c3fd
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x104]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x47c3c2
jmp 0x47c3fd
lea ecx, [ebp - 0x104]
push ecx
call fcn.0042ab23
add esp, 4
test eax, eax
jne 0x47c3d7
jmp 0x47c3fd
mov edx, dword [ebp + 0xc]
push edx
push 0x6b
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [ebp + 8]
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [0x542974]
test eax, eax
jne 0x47c366
mov edx, dword [ebp - 0x10c]
push edx
call dword [0x542988]
mov eax, dword [ebp - 0x110]
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x47c433
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x47c44b
mov eax, dword [ebp - 8]
jmp 0x47c4a2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x47c45e
mov eax, dword [ebp - 8]
jmp 0x47c4a2
push 0
push 0x80
push 3
push 0
push 7
push closesocket
mov ecx, dword [ebp + 8]
push ecx
call dword [0x54299c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x47c495
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x47c495
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x47c94d
Capabilities:
Get common file path
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x536c98
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b4e0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47cb93
mov dword [ebp - 0x224], 0x208
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x21c], 0
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 0x536cd0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043ae50
mov ecx, eax
call fcn.0043b507
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x47ca3c
mov edx, dword [ebp - 0x224]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x32c], eax
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x32c]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 0x536ce0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043ae50
mov ecx, eax
call fcn.0043b507
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.0043ae50
mov ecx, eax
call fcn.0043b5f9
cmp dword [ebp - 0xc], 0
jne 0x47cb6f
push 0x104
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x328]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov byte [edx], 0x5c
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
cmp dword [ebp - 0x32c], 0
jne 0x47ca9e
lea edx, [ebp - 0x21c]
mov dword [ebp - 0x340], edx
jmp 0x47caaa
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0x340]
mov dword [ebp - 0x330], ecx
cmp dword [ebp - 0x330], 0
je 0x47cb6f
mov edx, dword [ebp - 0x330]
movsx eax, byte [edx]
test eax, eax
je 0x47cb6f
push 0x2c
mov ecx, dword [ebp - 0x330]
push ecx
call fcn.0041e600
add esp, 8
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
je 0x47cb0c
mov edx, dword [ebp - 0x334]
mov byte [edx], 0
mov eax, dword [ebp - 0x334]
add eax, 1
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x330]
push ecx
push 0x104
mov edx, dword [ebp - 0x14]
push edx
call fcn.004154e0
lea eax, [ebp - 0x328]
push eax
call fcn.0042ae0a
add esp, 4
test eax, eax
je 0x47cb55
push 2
push 0x536cf0
mov ecx, dword [ebp - 0x330]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x47cb55
mov dword [ebp - 4], 1
jmp 0x47cb6f
mov edx, dword [ebp - 0x334]
mov dword [ebp - 0x330], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x47cab6
cmp dword [ebp - 0x32c], 0
je 0x47cb93
mov ecx, dword [ebp - 0x32c]
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x33c]
push edx
call fcn.004a4518
add esp, 4
cmp dword [ebp - 8], 2
jle 0x47cba0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x47cba7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 8], 0
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x10c]
mov dword [ebp - 4], ecx
push str._system.exe
push 0x104
mov edx, dword [ebp - 4]
push edx
call fcn.004154e0
lea eax, [ebp - 0x10c]
push eax
call fcn.0042ae0a
add esp, 4
test eax, eax
je 0x47cc3c
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0044b990
mov ecx, eax
call fcn.0044bdb4
test eax, eax
jne 0x47cc3c
mov dword [ebp - 0x11c], 1
jmp 0x47cc46
mov dword [ebp - 0x11c], 0
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x114], edx
call fcn.0047c94d
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x114], 0
je 0x47cc8f
mov eax, dword [ebp + 0xc]
push eax
push 0x6b
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
call dword [ebp + 8]
cmp dword [ebp - 0x110], 0
je 0x47cc8f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x47ce7d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0046a530
mov eax, dword [ebp - 4]
mov dword [eax], 0x4b13d0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x114], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x110], 0
push 0x104
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x47cf0b
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax + 0xb]
cmp edx, 0x5c
je 0x47cf0b
push 0x5376b4
push 0x104
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call fcn.00408090
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4801e7
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a74e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf3c
mov dword [ebp - 0xf48], ecx
push 1
lea ecx, [ebp - 0xf10]
call fcn.00416dd0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2bc]
call fcn.00481a00
mov ecx, dword [ebp + 8]
call fcn.004325a0
test eax, eax
jne 0x48025d
mov dword [ebp - 0xf1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.00416e60
mov eax, dword [ebp - 0xf1c]
jmp 0x48047d
mov dword [ebp - 0x150], 2
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0xf20]
push eax
mov ecx, dword [ebp + 8]
call fcn.00416da0
mov ecx, dword [eax]
mov dword [ebp - 0x2bc], ecx
jmp 0x4802b2
push 0
lea edx, [ebp - 0xf24]
push edx
lea ecx, [ebp - 0x2bc]
call fcn.00416820
lea eax, [ebp - 0xf28]
push eax
mov ecx, dword [ebp + 8]
call fcn.004819b0
push eax
lea ecx, [ebp - 0x2bc]
call fcn.00441530
and eax, 0xff
test eax, eax
je 0x480318
lea ecx, [ebp - 0x2bc]
call fcn.00417430
push eax
push 0x104
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.004154e0
mov dword [ebp - 0xf2c], 0
lea edx, [ebp - 0xf2c]
push edx
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0xf10]
call fcn.00416ee0
jmp 0x48029e
mov dword [ebp - 0xf14], 0
push 0
lea ecx, [ebp - 0xf14]
push ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x480343
call fcn.0048af47
test eax, eax
je 0x48036a
mov dword [ebp - 0xf30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.00416e60
mov eax, dword [ebp - 0xf30]
jmp 0x48047d
lea edx, [ebp - 0xf10]
push edx
call fcn.00484be4
add esp, 4
test eax, eax
je 0x4803a4
mov dword [ebp - 0xf34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.00416e60
mov eax, dword [ebp - 0xf34]
jmp 0x48047d
lea eax, [ebp - 0xf38]
push eax
mov ecx, dword [ebp + 8]
call fcn.00416da0
mov ecx, dword [eax]
mov dword [ebp - 0x2bc], ecx
jmp 0x4803d1
push 0
lea edx, [ebp - 0xf3c]
push edx
lea ecx, [ebp - 0x2bc]
call fcn.00416820
lea eax, [ebp - 0xf40]
push eax
mov ecx, dword [ebp + 8]
call fcn.004819b0
push eax
lea ecx, [ebp - 0x2bc]
call fcn.00441530
and eax, 0xff
test eax, eax
je 0x48044c
lea ecx, [ebp - 0x2bc]
call fcn.00417430
push eax
push 0x104
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.004154e0
lea edx, [ebp - 0x2b8]
push edx
lea ecx, [ebp - 0xf10]
call fcn.00416fb0
mov dword [ebp - 0xf18], eax
lea ecx, [ebp - 0x2bc]
call fcn.00417430
mov ecx, dword [ebp - 0xf18]
mov edx, dword [ecx + 0x168]
mov dword [eax + 0x10c], edx
jmp 0x4803bd
lea eax, [ebp - 0xf10]
push eax
call fcn.0048734b
add esp, 4
mov dword [ebp - 0xf44], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.00416e60
mov eax, dword [ebp - 0xf44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4810af
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push edi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], 1
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp + eax - 0x108]
mov dword [ebp - 0x110], ecx
push 0x104
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp + eax - 0x214]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x218], 0x537a38
jmp 0x481154
mov ecx, dword [ebp - 0x218]
add ecx, 0x105
mov dword [ebp - 0x218], ecx
cmp dword [ebp - 0x218], 0x53856f
jae 0x4811fb
mov edx, dword [ebp - 0x218]
mov al, byte [edx]
mov byte [ebp - 0x220], al
cmp byte [ebp - 0x220], 0
je 0x481186
cmp byte [ebp - 0x220], 1
je 0x4811bf
jmp 0x4811f6
mov ecx, dword [ebp - 0x218]
add ecx, 1
push ecx
push 0x104
mov edx, dword [ebp - 0x110]
push edx
call fcn.004154e0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4811bd
mov eax, 1
jmp 0x4811fd
jmp 0x4811f6
mov edx, dword [ebp - 0x218]
add edx, 1
push edx
push 0x104
mov eax, dword [ebp - 0x10c]
push eax
call fcn.004154e0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4811f6
mov eax, 1
jmp 0x4811fd
jmp 0x481142
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4825f2
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7596
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x482627
xor eax, eax
jmp 0x482719
lea ecx, [ebp - 0x10]
call fcn.004094b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffff
jne 0x48267c
mov dword [ebp - 0x144], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409680
mov eax, dword [ebp - 0x144]
jmp 0x482719
mov dword [ebp - 0x138], 0x128
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4826ed
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4826d6
mov dword [ebp - 0x148], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409680
mov eax, dword [ebp - 0x148]
jmp 0x482719
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x48269d
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409680
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4828ae
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a75e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
mov dword [ebp - 0x140], 0
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x4828ed
xor eax, eax
jmp 0x482a34
lea ecx, [ebp - 0x10]
call fcn.004094b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jne 0x482942
mov dword [ebp - 0x150], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409680
mov eax, dword [ebp - 0x150]
jmp 0x482a34
mov dword [ebp - 0x138], 0x128
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x482a06
mov dword [ebp - 0x148], 0
jmp 0x482982
mov eax, dword [ebp - 0x148]
add eax, 1
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xa
jge 0x4829eb
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4829e9
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
je 0x4829dc
mov dword [ebp - 0x140], 1
push 0
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x482973
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x482967
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x154], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409680
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x483d34
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1800
push 0x4a2bd4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042a230
add esp, 4
test eax, eax
jne 0x483d7d
jmp 0x483df4
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov dx, word [ecx + 0x14]
mov eax, dword [ebp - 0x28]
lea ecx, [eax + edx + 0x18]
mov edx, dword [ebp - 0x28]
xor eax, eax
mov ax, word [edx + 6]
sub eax, 1
imul eax, eax, 0x28
add ecx, eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 0x20]
add edx, dword [eax + 0x10]
mov dword [ebp - 0x2c], edx
push 4
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x483dd7
jmp 0x483df4
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x3383537
je 0x483ded
jmp 0x483df4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x483e0d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x484b2a
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x484b55
call fcn.0048af47
test eax, eax
je 0x484b72
push 0x40
push 0x53b2a4
push 0x53b2ac
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x484be0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x804
je 0x484bb0
cmp dword [ebp - 8], 4
je 0x484bb0
cmp dword [ebp - 8], 0x1004
je 0x484bb0
push 0x40
push 0x53b2d8
push 0x53b2e0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x484be0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00484be4
add esp, 4
test eax, eax
je 0x484bc7
mov eax, 6
jmp 0x484be0
mov edx, dword [ebp + 8]
push edx
call fcn.00486392
add esp, 4
test eax, eax
je 0x484bde
mov eax, 6
jmp 0x484be0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48623a
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [0x5429a0]
push 0x80
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x5429a0]
push 0x407
push str.ReplaceOneSysFile___d_n
call fcn.00401ab0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.OldFile__s_NewFile__s_n
call fcn.00401ab0
add esp, 0xc
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4862ab
mov eax, 1
jmp 0x48638e
mov eax, 1
test eax, eax
je 0x4862f3
call dword [sym.imp.MSVCRT.dll_rand]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x53b654
push 0x104
lea eax, [ebp - 0x118]
push eax
call fcn.0040a2c0
add esp, 0x14
lea ecx, [ebp - 0x118]
push ecx
call fcn.0042ae0a
add esp, 4
test eax, eax
je 0x4862f3
jmp 0x4862ab
push 0x80
lea edx, [ebp - 0x118]
push edx
call dword [0x5429a0]
lea eax, [ebp - 0x118]
push eax
call dword [0x542978]
push 1
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x486342
push 0
push 3
mov eax, dword [ebp + 8]
push eax
call fcn.00423e80
mov ecx, eax
call fcn.00424138
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x486376
push 4
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10], eax
mov eax, 1
jmp 0x48638e
push 1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x10], eax
xor eax, eax
mov esp, ebp
pop ebp
ret