joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472c00
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
mov dword [ebp - 0x420], 0
call fcn.004dead0
add esp, 0xc
xor bl, bl
test edi, edi
je 0x472cb2
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004dead0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x105
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x472cb2
push 0
push 0
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0041b90e
add esp, 0x24
movzx ebx, bl
test eax, eax
mov ecx, 1
cmove ebx, ecx
test bl, bl
mov dword [esi + 0x14], 7
mov eax, 0x511a98
mov dword [esi + 0x10], 0
lea edx, [ebp - 0x41c]
cmove edx, eax
xor eax, eax
mov word [esi], ax
cmp word [edx], ax
jne 0x472cde
xor ecx, ecx
jmp 0x472cf2
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x472ce3
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004073d0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x472d10
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5090db
mov eax, dword fs:[0]
push eax
mov eax, 0x10bc
call fcn.004df410
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x10]
cmp edi, 0x824
jb 0x472d57
xor al, al
jmp 0x472f09
xor eax, eax
mov dword [ebp - 0x105c], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x1070]
mov dword [ebp - 0x1060], 0
mov word [ebp - 0x1070], ax
call fcn.00407980
mov dword [ebp - 4], 0
cmp edi, 2
jb 0x472de1
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x472d9b
mov ecx, dword [esi]
jmp 0x472d9d
mov ecx, esi
cmp word [ecx], 0x22
jne 0x472de1
cmp eax, 8
jb 0x472dac
mov eax, dword [esi]
jmp 0x472dae
mov eax, esi
cmp word [eax + edi*2 - 2], 0x22
jne 0x472de1
lea eax, [edi - 2]
mov ecx, esi
push eax
push 1
lea eax, [ebp - 0x10c8]
push eax
call fcn.00407940
push eax
lea ecx, [ebp - 0x1070]
call fcn.00407aa0
lea ecx, [ebp - 0x10c8]
call fcn.00408450
cmp dword [ebp - 0x1060], 0
mov dword [ebp - 0x1074], 0x824
je 0x472eee
cmp dword [ebp - 0x105c], 8
lea eax, [ebp - 0x1070]
cmovae eax, dword [ebp - 0x1070]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x472eee
push 0x3c
lea eax, [ebp - 0x10b0]
push 0
push eax
call fcn.004dead0
add esp, 0xc
mov dword [ebp - 0x10b0], 0x3c
cmp dword [ebp - 0x105c], 8
lea ecx, [ebp - 0x10b0]
lea eax, [ebp - 0x1070]
mov dword [ebp - 0x10a8], 1
cmovae eax, dword [ebp - 0x1070]
push ecx
push 0
push dword [ebp - 0x1060]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x472eee
mov eax, dword [ebp - 0x10a4]
cmp eax, 3
je 0x472e80
cmp eax, 4
jne 0x472eee
cmp dword [ebp - 0x105c], 8
lea ecx, [ebp - 0x1074]
push 0
push 2
push ecx
lea ecx, [ebp - 0x1058]
lea eax, [ebp - 0x1070]
cmovae eax, dword [ebp - 0x1070]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_UrlGetPartW]
test eax, eax
jne 0x472eee
lea eax, [ebp - 0x1058]
push str.help.adobe.com
push eax
call fcn.004099a7
add esp, 8
test eax, eax
je 0x472eea
lea eax, [ebp - 0x1058]
push str.adobehelp.corp.adobe.com
push eax
call fcn.004099a7
add esp, 8
test eax, eax
jne 0x472eee
call fcn.004a1f20
test al, al
je 0x472eee
mov bl, 1
jmp 0x472ef0
xor bl, bl
cmp dword [ebp - 0x105c], 8
jb 0x472f07
push dword [ebp - 0x1070]
call fcn.0040823e
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x473800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50abc0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor al, al
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov byte [ebp - 0x41], al
cmp dword [esi + 0x10], 0
je 0x473916
mov ecx, esi
call fcn.0041e2d0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x473913
mov ecx, esi
call fcn.0041e2d0
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x473913
push 0
push str.ime_shared
lea eax, [ebp - 0x40]
push 0x25
push eax
call fcn.0042b3f0
push 0
push str.ime_shared
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push 0x24
push eax
call fcn.0042b3f0
push ebx
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push esi
push eax
call fcn.00473700
add esp, 0x30
test al, al
jne 0x4738d7
push ebx
push edi
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00473700
add esp, 0x10
test al, al
jne 0x4738d7
push ebx
push edi
push esi
call fcn.00473940
add esp, 0xc
test al, al
jne 0x4738d7
xor bl, bl
jmp 0x4738d9
mov bl, 1
cmp dword [ebp - 0x14], 8
jb 0x4738ea
push dword [ebp - 0x28]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x47390f
push dword [ebp - 0x40]
call fcn.0040823e
add esp, 4
mov al, bl
jmp 0x473916
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x474050
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509268
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x58]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
xor eax, eax
push 0xb
push str.imjpuex.exe
mov byte [ebp - 0x59], 0
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.004073d0
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00407980
push 1
push 0x514704
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040efb0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f160
lea eax, [ebp - 0x28]
push eax
push eax
call fcn.0041acb0
add esp, 8
test al, al
je 0x4741d8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4741d8
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
push ebx
call fcn.0041acb0
add esp, 8
test al, al
je 0x4741b7
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.00441880
add esp, 8
test al, al
jne 0x474178
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00441880
add esp, 8
test al, al
je 0x4741b7
cmp dword [edi + 0x10], 0
je 0x47419d
push ebx
push edi
call fcn.00441880
add esp, 8
test al, al
jne 0x47419d
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00441880
add esp, 8
test al, al
je 0x4741b7
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x28]
cmp eax, ecx
je 0x4741b3
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00407980
mov byte [ebp - 0x59], 1
cmp dword [ebp - 0x2c], 8
jb 0x4741c8
push dword [ebp - 0x40]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x14], 8
jb 0x4741e9
push dword [ebp - 0x28]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x44], 8
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], eax
jb 0x47420a
push dword [ebp - 0x58]
call fcn.0040823e
add esp, 4
mov al, byte [ebp - 0x59]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x475850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 0x38]
push esi
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
test eax, eax
je 0x47588a
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00475920
add esp, 0x2c
test eax, eax
jne 0x4758a5
pop esi
pop ebp
ret
push 0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4758a5
pop esi
pop ebp
ret
push ebx
push edi
push 0
call fcn.00447970
push 0
mov edi, eax
call fcn.004a11d0
add esp, 8
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x4758c9
mov edi, 0x1fffff
mov ebx, edi
push 1
push 0
push edi
mov edi, dword [ebp + 0xc]
push esi
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x4758f6
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
push 1
push 0
push ebx
lea eax, [esi + 4]
push eax
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
pop edi
sbb eax, eax
pop ebx
neg eax
pop esi
pop ebp
ret
Function at 0x475c10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509538
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x68], eax
call fcn.00408a10
cmp eax, 3
jge 0x475cf8
push 0x40
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.004dead0
mov edi, dword [ebp + 0x24]
add esp, 0xc
mov dword [ebp - 0x54], 0x44
or edi, 0x1080000
mov byte [ebp - 0x58], 0
mov ecx, 0x55bb0c
mov eax, 1
lock xadd dword [ecx], eax
inc eax
cmp eax, 1
sete byte [ebp - 0x57]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], esi
call fcn.00476530
test al, al
je 0x475ce9
push dword [ebp - 0x68]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push edi
push dword [ebp + 0x20]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x6c]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
call fcn.00475720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x475d20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x78], eax
call fcn.00408a10
cmp eax, 3
jl 0x475eac
push esi
push 0x511988
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x475ebc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.InitializeProcThreadAttributeList
push esi
call ebx
mov edi, eax
test edi, edi
je 0x475ecd
push str.UpdateProcThreadAttribute
push esi
call ebx
mov ebx, eax
test ebx, ebx
je 0x475ecd
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 1
push 0
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x475ecd
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x475ecd
lea eax, [ebp - 8]
push eax
push 0
push 1
push esi
call edi
test eax, eax
je 0x475ecd
push 0
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0x20000
push 0
push esi
call ebx
test eax, eax
je 0x475ecd
push 0x44
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.004dead0
mov eax, dword [ebp - 0x64]
add esp, 0xc
mov dword [ebp - 0x10], esi
movdqu xmm0, xmmword [eax]
push dword [ebp - 0x78]
movdqu xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x54], 0x48
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [ebp - 0x44], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [ebp - 0x34], xmm0
movdqu xmm0, xmmword [eax + 0x30]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x6c]
mov eax, dword [ebp + 0x24]
push dword [ebp - 0x58]
or eax, 0x1080000
push eax
push dword [ebp + 0x20]
movdqu xmmword [ebp - 0x24], xmm0
push dword [ebp - 0x74]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x478590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50615b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x556620]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 4
mov dword [edi], 0x51946c
call fcn.00405f0d
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4785eb
push 1
mov dword [esi], 0
call fcn.004dd284
add esp, 4
mov dword [esi], eax
jmp 0x4785ed
xor esi, esi
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478e30
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x214], 0
mov eax, dword [esi]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
je 0x478e71
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push ebx
push edi
push 0xffffffffffffffff
mov eax, dword [eax]
mov dword [ebp - 0x20c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x20c]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
je 0x478efd
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp eax, 0x80
je 0x478efd
cmp eax, 0x81
je 0x478efd
test eax, eax
je 0x478efd
mov eax, dword [esi]
lea ecx, [ebp - 0x210]
push ecx
push 0x200
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x210], 0
push ecx
push dword [esi + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x478ef2
cmp dword [ebp - 0x210], 0x200
je 0x478f10
push dword [esi + 8]
xor bl, bl
call edi
test eax, eax
jne 0x478f21
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov bl, 1
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
jne 0x478efd
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x478efd
test bl, bl
jne 0x478f76
mov eax, dword [esi]
push 0xffffffffffffffff
push 0
mov eax, dword [eax]
mov dword [ebp - 0x20c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x20c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x478ea6
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x479480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0
call fcn.00408a20
cmp dword [eax + 0x28], 1
je 0x4794b6
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x4794df
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0xc], eax
test eax, eax
jne 0x4794f1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esi]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea eax, [ebp - 0x2c]
push 0
push 0
push 0x100002
push eax
push dword [ecx]
push dword [esi + 8]
push edi
call ebx
test eax, eax
je 0x479606
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push 0
push 0
push 0x100002
push ecx
push dword [eax]
push dword [esi + 0xc]
push edi
call ebx
test eax, eax
je 0x479606
mov eax, dword [esi]
mov edi, 0x1000
push 0x40
push 0x3000
push edi
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
jne 0x4795ad
lea esp, [esp]
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push 0x1c
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
push edi
movdqu xmmword [ebp - 0x24], xmm0
movq qword [ebp - 0x14], xmm0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x4795a9
mov eax, dword [esi]
add edi, dword [ebp - 0x18]
push 0x40
push 0x3000
push 0x1000
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x479560
test ebx, ebx
je 0x479606
push 0x2c
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.004dead0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [esi]
push ecx
push 0x10
lea ecx, [ebp - 0x5c]
mov dword [ebp - 8], 0
push ecx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x479606
cmp dword [ebp - 8], 0x10
jne 0x479606
push ebx
mov ecx, esi
call fcn.00479030
test al, al
je 0x479606
mov ecx, esi
call fcn.00478e30
test al, al
jne 0x479619
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push ebx
push dword [eax]
call fcn.00478f90
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.00401580
mov esp, ebp
pop ebp
ret
Function at 0x486a10
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esi + 0x24], 0
test eax, eax
je 0x486a45
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x486a5a
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [esi + 8], 0
cmp dword [esi + 0x1c], 0
je 0x486a8c
cmp dword [esi + 0x20], 8
push edi
lea edi, [esi + 0xc]
jb 0x486a6e
mov eax, dword [edi]
jmp 0x486a70
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x486a86
mov edi, dword [edi]
xor eax, eax
mov word [edi], ax
pop edi
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x486b41
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ae9c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x486b41
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movdqa xmm0, xmmword [0x52af10]
lea eax, [ebp - 0x424]
push 0
push eax
push 0
push 0
movdqu xmmword [ebp - 0x424], xmm0
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
cmp word [ebp - 0x20c], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
jne 0x486b0d
xor ecx, ecx
jmp 0x486b25
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x486b16
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xc]
call fcn.004073d0
push dword [esi + 0x44]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x28], 0
xor ecx, ebp
pop esi
call fcn.00401580
mov esp, ebp
pop ebp
ret

Function at 0x486cf0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x486d0b
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x486d20
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [esi + 8], 0
cmp dword [esi + 0x1c], 0
je 0x486d59
cmp dword [esi + 0x20], 8
push edi
lea edi, [esi + 0xc]
jb 0x486d34
mov eax, dword [edi]
jmp 0x486d36
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x486d4c
mov edi, dword [edi]
xor eax, eax
mov word [edi], ax
pop edi
mov dword [esi + 0x24], eax
mov dword [esi], eax
pop esi
ret
mov dword [esi + 0x24], 0
mov dword [esi], 0
pop esi
ret