joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47daf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
jne 0x47db06
pop edi
xor al, al
pop ebx
pop ebp
ret 8
push esi
push edi
call fcn.004a705d
push 2
push 0
push edi
mov esi, eax
call fcn.004a6c4a
push edi
call fcn.004a705d
push 0
push esi
push edi
mov dword [ebp + 8], eax
call fcn.004a6c4a
mov esi, dword [ebp + 0xc]
add esp, 0x20
test esi, esi
je 0x47db40
mov eax, dword [ebp + 8]
cmp eax, esi
jge 0x47db43
mov esi, eax
jmp 0x47db43
mov esi, dword [ebp + 8]
lea eax, [esi + 2]
push eax
call fcn.00464009
add esp, 4
test eax, eax
je 0x47db59
mov word [eax + esi], 0
push edi
push esi
push 1
push eax
mov dword [ebx + 0xc], eax
call fcn.004a6b0f
add esp, 0x10
cmp esi, eax
je 0x47db86
mov ecx, ebx
call fcn.0047da40
push edi
call fcn.0046656f
add esp, 4
xor al, al
pop esi
pop edi
pop ebx
pop ebp
ret 8
push edi
mov dword [ebx + 8], esi
mov dword [ebx + 4], esi
call fcn.0046656f
add esp, 4
mov al, 1
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x47dbe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x47dc1c
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x47dbf8
mov esi, dword [ecx + 8]
jmp 0x47dbff
cmp dword [ecx + 8], esi
cmovb esi, dword [ecx + 8]
push edi
push esi
push 1
push dword [ecx + 0xc]
call fcn.00466481
add esp, 0x10
cmp esi, eax
pop esi
push edi
je 0x47dc23
call fcn.0046656f
add esp, 4
xor al, al
pop edi
pop ebp
ret 8
call fcn.0046656f
add esp, 4
mov al, 1
pop edi
pop ebp
ret 8

Function at 0x47e5b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x47e628
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x47e628
push edi
push 0x504fcc
push eax
call fcn.004665e6
mov edi, eax
add esp, 8
test edi, edi
je 0x47e622
push edi
push 2
lea eax, [ebp + 8]
push 1
push eax
call fcn.004a6b0f
add esp, 0x10
cmp eax, 2
jne 0x47e619
cmp byte [ebp + 8], 0xff
jne 0x47e619
cmp byte [ebp + 9], 0xfe
jne 0x47e619
mov eax, dword [ebp + 0x10]
push edi
add eax, eax
push eax
push 1
push esi
call fcn.004a6b0f
push edi
mov esi, eax
call fcn.0046656f
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
ret
push edi
call fcn.0046656f
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x47e630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
test eax, eax
je 0x47e67e
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x47e67e
push edi
push 0x5411a0
push eax
call fcn.004665e6
mov edi, eax
add esp, 8
test edi, edi
jne 0x47e65d
pop edi
xor al, al
pop ebx
pop ebp
ret
push edi
push dword [ebp + 0x10]
push 1
push ebx
call fcn.00466481
cmp dword [ebp + 0x10], eax
push edi
sete bl
call fcn.0046656f
add esp, 0x14
mov al, bl
pop edi
pop ebx
pop ebp
ret
xor al, al
pop ebx
pop ebp
ret
Function at 0x47e6f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47e76f
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x47e76f
push ebx
push eax
mov eax, dword [ebp + 0x18]
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x47e71c
pop ebx
pop edi
pop ebp
ret
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 8], 0
mov esi, eax
je 0x47e74f
cmp esi, dword [ebp + 0xc]
push ebx
cmova esi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x47e74d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x47e754
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
push esi
push edi
push dword [ebp + 8]
call fcn.0046ed30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret

Function at 0x47ea30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e900

Function at 0x47eae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e990

Function at 0x47eaf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x55af80]
test eax, eax
jne 0x47ebe7
push ebx
push esi
push edi
push 0x200
call fcn.00464009
mov esi, eax
add esp, 4
mov dword [0x55af80], esi
xor edi, edi
movzx ecx, di
mov al, cl
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr cx, 1
and edx, 0x8005
xor dx, cx
mov al, dl
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr dx, 1
and ecx, 0x8005
xor cx, dx
mov al, cl
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr cx, 1
and edx, 0x8005
xor dx, cx
mov al, dl
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr dx, 1
and ecx, 0x8005
xor cx, dx
mov al, cl
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr cx, 1
and edx, 0x8005
xor dx, cx
mov al, dl
and al, 1
movzx ebx, al
neg ebx
sbb ebx, ebx
shr dx, 1
and ebx, 0x8005
xor bx, dx
mov al, bl
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr bx, 1
and ecx, 0x8005
xor cx, bx
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0x8005
xor ax, cx
mov word [esi + edi*2], ax
inc edi
cmp edi, 0x100
jb 0x47eb17
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x47ebf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
jne 0x47ec04
call fcn.0047eaf0
mov esi, eax
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x47ec43
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47ec43
mov eax, dword [ebp + 8]
xor edx, edx
not eax
movzx eax, ax
test edi, edi
je 0x47ec3c
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
shr ax, 8
and ecx, 0xff
xor ax, word [esi + ecx*2]
movzx eax, ax
cmp edx, edi
jb 0x47ec20
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov ax, word [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x47ed60
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x18]
push eax
call fcn.0046f380
add esp, 0xc
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0x67452301
mov dword [esi + 0x64], 0xefcdab89
mov dword [esi + 0x68], 0x98badcfe
mov dword [esi + 0x6c], 0x10325476
pop esi
ret

Function at 0x47f6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x7c], ecx
test eax, eax
je 0x47f7d7
test ecx, ecx
je 0x47f7d7
push esi
push 0x504fcc
push eax
call fcn.004665e6
mov esi, eax
add esp, 8
mov dword [ebp - 0x78], esi
test esi, esi
jne 0x47f702
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0x10000
call fcn.00464009
add esp, 4
lea ecx, [ebp - 0x74]
mov ebx, eax
call fcn.0047ec50
lea ecx, [ebp - 0x74]
call fcn.0047ed60
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47f770
lea ebx, [ebx]
push esi
push 0x10000
push 1
push ebx
call fcn.004a6b0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47f798
cmp edi, esi
lea ecx, [ebp - 0x74]
cmovb esi, edi
push esi
push ebx
call fcn.0047eca0
cmp edi, esi
jb 0x47f75e
sub edi, esi
jmp 0x47f760
xor edi, edi
test esi, esi
je 0x47f798
test edi, edi
je 0x47f798
mov esi, dword [ebp - 0x78]
jmp 0x47f730
push esi
push 0x10000
push 1
push ebx
call fcn.004a6b0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47f798
push esi
push ebx
lea ecx, [ebp - 0x74]
call fcn.0047eca0
test esi, esi
mov esi, dword [ebp - 0x78]
jne 0x47f770
lea ecx, [ebp - 0x74]
call fcn.0047eda0
push ebx
call fcn.00463d2b
push dword [ebp - 0x78]
call fcn.0046656f
add esp, 8
lea ecx, [ebp - 0x74]
call fcn.0047ee30
pop edi
pop ebx
pop esi
movdqu xmm0, xmmword [eax]
mov eax, dword [ebp - 0x7c]
movdqu xmmword [eax], xmm0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x47fcf0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x47fd1c
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
push esi
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47fd22
sub esi, ecx
sar esi, 1
cmp esi, 3
jae 0x47fd48
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
push 0
push ebx
call fcn.00463c55
add esp, 8
cmp eax, 0xffffffff
je 0x47fd6a
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
push edi
xor eax, eax
xor ecx, ecx
push 0x800
push eax
mov word [ebp - 0x808], ax
mov edi, ebx
lea eax, [ebp - 0x806]
mov dword [ebp - 0x80c], ecx
push eax
call fcn.0046f380
add esp, 0xc
cmp word [ebx], 0
je 0x47fe05
mov cx, word [ebp + 0xc]
xor eax, eax
nop
lea edi, [edi + 2]
add eax, 2
mov dword [ebp - 0x810], eax
cmp word [edi], cx
jne 0x47fdff
lea ecx, [ebx + 2]
add ecx, eax
sar eax, 1
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x80c], ecx
push ebx
push eax
call fcn.00463af4
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.00463c55
add esp, 0x14
cmp eax, 0xffffffff
jne 0x47fdf5
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x47fe20
mov cx, word [ebp + 0xc]
mov eax, dword [ebp - 0x810]
cmp word [edi], 0
jne 0x47fda0
mov eax, dword [ebp - 0x80c]
sub eax, ebx
sar eax, 1
cmp eax, esi
je 0x47fe33
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47fe33
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x47fe50
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x126c
call fcn.00476ea0
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x47fe80
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47fe85
sub ecx, edx
sar ecx, 1
je 0x47fe6f
lea eax, [ebp - 0x1268]
mov dword [ebp - 0xa64], 0
mov dword [ebp - 0x126c], eax
xor eax, eax
cmp word [esi + ecx*2 - 2], 0x5c
mov word [ebp - 0x1268], ax
lea eax, [ebp - 0x126c]
push esi
jne 0x47fecb
push 0x5050e0
jmp 0x47fed0
push str._s.
push eax
call fcn.00445f30
add esp, 0xc
mov dword [ebp - 0x258], 0
lea eax, [ebp - 0xa5c]
mov dword [ebp - 0xa60], eax
xor eax, eax
mov word [ebp - 0xa5c], ax
lea eax, [ebp - 0x254]
push ebx
push edi
push eax
lea eax, [ebp - 0x1268]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x480015
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov ecx, 0x53ac74
lea eax, [ebp - 0x228]
jmp 0x47ff30
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47ff56
test dx, dx
je 0x47ff52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47ff56
add eax, 4
add ecx, 4
test dx, dx
jne 0x47ff30
xor eax, eax
jmp 0x47ff5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x480003
mov ecx, 0x540c48
lea eax, [ebp - 0x228]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47ff96
test dx, dx
je 0x47ff92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47ff96
add eax, 4
add ecx, 4
test dx, dx
jne 0x47ff70
xor eax, eax
jmp 0x47ff9b
sbb eax, eax
or eax, 1
test eax, eax
je 0x480003
lea eax, [ebp - 0x228]
push eax
push esi
lea eax, [ebp - 0xa60]
push str._s_s
push eax
call fcn.00445f30
add esp, 0x10
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x47ffdd
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0xa5c]
push eax
je 0x47fff9
call fcn.0047fe50
add esp, 4
test al, al
jmp 0x480001
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x480039
lea eax, [ebp - 0x254]
push eax
push edi
call ebx
test eax, eax
jne 0x47ff20
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
test eax, eax
pop ebx
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x480050
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1238
call fcn.00476ea0
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x480080
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4801a8
push 0x800
push eax
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x100a]
push eax
call fcn.0046f380
lea ecx, [ebp - 0x100c]
add esp, 0xc
sub ecx, esi
jmp 0x4800c0
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4800c0
lea eax, [ebp - 0x100c]
push 0xffffffffffffffff
push eax
call fcn.0047d830
xor eax, eax
xor esi, esi
push 0x800
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.0046f380
add esp, 0x14
mov dword [ebp - 0x1238], 0x22c
lea eax, [ebp - 0x1238]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48019f
lea ecx, [ecx]
xor eax, eax
movzx ecx, word [ebp + eax - 0x1214]
lea eax, [eax + 2]
mov word [ebp + eax - 0x80a], cx
test cx, cx
jne 0x480122
lea eax, [ebp - 0x808]
push 0xffffffffffffffff
push eax
call fcn.0047d830
add esp, 8
lea ecx, [ebp - 0x808]
lea eax, [ebp - 0x100c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48017d
test dx, dx
je 0x480179
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48017d
add eax, 4
add ecx, 4
test dx, dx
jne 0x480157
xor eax, eax
jmp 0x480182
sbb eax, eax
or eax, 1
test eax, eax
je 0x480199
lea eax, [ebp - 0x1238]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x480120
jmp 0x48019f
mov esi, dword [ebp - 0x1230]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x4801c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1664
call fcn.00476ea0
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4801f0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x48041c
push 0x800
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.0046f380
lea ecx, [ebp - 0x808]
add esp, 0xc
sub ecx, esi
jmp 0x480230
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x480230
lea eax, [ebp - 0x808]
push 0xffffffffffffffff
push eax
call fcn.0047d830
lea esi, [ebp - 0x808]
add esp, 8
lea ecx, [esi + 2]
lea ebx, [ebx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x480260
push edi
xor eax, eax
mov dword [ebp - 0x1664], 0
push 0x800
push eax
mov word [ebp - 0x100c], ax
sub esi, ecx
lea eax, [ebp - 0x100a]
sar esi, 1
push eax
call fcn.0046f380
push 0x22c
lea eax, [ebp - 0x1660]
push 0
push eax
call fcn.0046f380
add esp, 0x18
mov dword [ebp - 0x1660], 0x22c
lea eax, [ebp - 0x1660]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x480412
xor eax, eax
movzx ecx, word [ebp + eax - 0x163c]
lea eax, [eax + 2]
mov word [ebp + eax - 0x100e], cx
test cx, cx
jne 0x4802d2
lea eax, [ebp - 0x100c]
push 0xffffffffffffffff
push eax
call fcn.0047d830
lea ecx, [ebp - 0x100c]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480304
sub ecx, edx
sar ecx, 1
cmp esi, ecx
jb 0x4803e6
push ecx
lea eax, [ebp - 0x100c]
push eax
mov eax, esi
sub eax, ecx
lea eax, [ebp + eax*2 - 0x808]
push eax
call fcn.00475ea5
add esp, 0xc
test eax, eax
jne 0x4803e6
push dword [ebp - 0x1658]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4803e0
push 0x428
lea eax, [ebp - 0x1434]
push 0
push eax
call fcn.0046f380
add esp, 0xc
mov dword [ebp - 0x1434], 0x428
lea eax, [ebp - 0x1434]
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4803d5
lea eax, [ebp - 0x1214]
push 0xffffffffffffffff
push eax
call fcn.0047d830
lea ecx, [ebp - 0x1214]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4803a2
sub ecx, edx
sar ecx, 1
cmp ecx, esi
jb 0x4803d5
push esi
lea eax, [ebp - 0x808]
sub ecx, esi
push eax
lea eax, [ebp - 0x1214]
lea eax, [eax + ecx*2]
push eax
call fcn.00475ea5
add esp, 0xc
test eax, eax
je 0x4803fd
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x4803e6
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1660]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4802d0
jmp 0x480412
mov eax, dword [ebp - 0x1658]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1664], eax
call edi
push ebx
call edi
mov eax, dword [ebp - 0x1664]
pop edi
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
pop esi
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x480430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x480440
xor al, al
pop esi
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x480482
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x480482
push esi
call fcn.004801c0
push eax
call fcn.0047fbf0
add esp, 8
test al, al
je 0x480482
cmp byte [ebp + 0xc], 0
je 0x480482
push edi
push edi
push 0x505100
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
cmp edi, 1
pop edi
sete al
pop esi
pop ebp
ret

Function at 0x480490
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 8
push 0
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4804cc
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004632a9
mov esp, ebp
pop ebp
ret
push esi
mov ecx, 0x55af94
mov byte [ebp - 0x15], 0
call fcn.0047ce60
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
call esi
mov ecx, 0x55af84
mov dword [ebp - 0x20], eax
call fcn.0047ce60
push eax
push edi
call esi
mov ecx, 0x55af8c
mov dword [ebp - 0x1c], eax
call fcn.0047ce60
push eax
push edi
call esi
cmp dword [ebp - 0x20], 0
mov dword [ebp - 0x24], eax
je 0x4805a2
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x4805a2
test eax, eax
je 0x4805a2
test ebx, ebx
jne 0x48052f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push 0x28
push ebx
call dword [ebp - 0x20]
test eax, eax
je 0x4805a2
cmp dword [ebp - 0x1c], 0
je 0x4805a2
lea eax, [ebp - 0x2c]
push eax
push str.SeDebugPrivilege
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x480598
mov eax, dword [ebp - 0x2c]
xorps xmm0, xmm0
push 0
movdqu xmmword [ebp - 0x14], xmm0
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [ebp - 0x24]
test eax, eax
je 0x480598
mov byte [ebp - 0x15], 1
jmp 0x48059d
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x1c]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x15]
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.004632a9
mov esp, ebp
pop ebp
ret
Function at 0x480b70
Capabilities:
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2020
call fcn.00476ea0
mov eax, dword [0x548280]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x400
lea eax, [ebp - 0x1810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.0047fac0
lea eax, [ebp - 0x100c]
push 0
push eax
call fcn.0047fb00
lea eax, [ebp - 0x2018]
mov dword [ebp - 0x1814], 0
mov dword [ebp - 0x201c], eax
xor eax, eax
mov word [ebp - 0x2018], ax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x201c]
push str.__c_del__q__s
push eax
call fcn.00445f30
lea eax, [ebp - 0x2020]
push eax
push 0
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x808]
push str.cmd.exe
push eax
call fcn.004806b0
add esp, 0x30
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x480cb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x480cbd
xor al, al
pop esi
ret
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x480d30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 4], eax
pop esi
setne al
ret

Function at 0x480ce0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x480d1e
mov eax, dword [ebp + 8]
test eax, eax
je 0x480cfc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
pop ebp
ret 4