joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487fe0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c7936
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
push esi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x424]
mov dword fs:[0], eax
mov eax, dword [esp + 0x434]
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], eax
call fcn.00418110
mov dword [esp + 0x42c], 0
mov eax, dword [esi]
test eax, eax
je 0x48805a
cmp eax, 0xffffffff
je 0x48805a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x48813e
mov dword [esi], 0xffffffff
mov eax, dword [edi]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x400
lea edx, [esp + 0x28]
push edx
push eax
call ebp
test eax, eax
je 0x4880ed
lea ebx, [ebx]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4880ed
call fcn.004041e0
push eax
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004659e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x42c], 1
call fcn.004180e0
push eax
lea ecx, [esp + 0x14]
call fcn.0042cd20
push eax
lea ecx, [esp + 0x14]
call fcn.00464b90
lea ecx, [esp + 0x10]
mov byte [esp + 0x42c], 0
call fcn.00418010
mov ecx, dword [edi]
push 0
lea edx, [esp + 0x18]
push edx
push 0x400
lea eax, [esp + 0x28]
push eax
push ecx
call ebp
test eax, eax
jne 0x488080
mov esi, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
push esi
call fcn.00488150
push esi
call fcn.00488880
push esi
call fcn.00488c50
lea ecx, [esp + 0xc]
call fcn.00418010
mov eax, 1
mov ecx, dword [esp + 0x424]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004a1873
add esp, 0x424
ret 4
lea ecx, [esp + 0xc]
call fcn.00418010
xor eax, eax
jmp 0x488116
Function at 0x48a630
Capabilities:
Create thread

Disassembly:
sub esp, 0xf4
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0xec], eax
cmp dword [0x4f8984], 0
push esi
push edi
mov esi, ecx
je 0x48a66d
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.004a1873
add esp, 0xf4
ret
call fcn.0048aec0
push esi
mov ecx, 0x4f8958
call fcn.00432450
xor eax, eax
push 0xc6
push eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
lea eax, [esp + 0x32]
push eax
mov dword [0x4f8984], 1
mov byte [esp + 0x14], 0
call fcn.004a1e50
add esp, 0xc
push 1
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [esp + 8]
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4e2240
lea ecx, [esp + 0x30]
push 0x63
push ecx
call fcn.004a27c8
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0x10
lea edx, [esp + 0x28]
push edx
push 1
push 1
lea eax, [esp + 0x28]
push eax
call esi
mov ecx, 0x4f894c
mov edi, eax
call fcn.0043df90
mov ecx, 0x4f894c
mov dword [0x4f894c], edi
call fcn.0042cd20
push 0
push 0
push 0
push 0
call esi
mov ecx, 0x4f8950
mov esi, eax
call fcn.0043df90
mov ecx, 0x4f8950
mov dword [0x4f8950], esi
call fcn.0042cd20
mov ecx, 0x4f894c
call fcn.0042cd20
test eax, eax
je 0x48a7e5
mov ecx, 0x4f8950
call fcn.0042cd20
test eax, eax
je 0x48a7e5
push 0
push 0
push 0x4f8948
push 0x48abe0
push 0
push 0
call fcn.004a6a81
add esp, 0x18
mov ecx, 0x4f8954
mov esi, eax
call fcn.0043df90
mov ecx, 0x4f8954
mov dword [0x4f8954], esi
call fcn.0042cd20
mov ecx, 0x4f8954
call fcn.0042cd20
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.004a1873
add esp, 0xf4
ret
mov ecx, dword [esp + 0xf4]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004a1873
add esp, 0xf4
ret

Function at 0x48ae30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp dword [eax + 0x2c], 0
push esi
lea esi, [eax + 0x2c]
jne 0x48aeab
push 0x4e22f8
lea ecx, [eax + 0x10]
call fcn.00403570
push eax
push esi
call fcn.004a601d
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x48aeab
push edi
push 2
push 0
push eax
call fcn.004a7af5
mov eax, dword [esi]
push eax
call fcn.004a7d12
mov ecx, dword [esi]
push 0
push 0
push ecx
mov edi, eax
call fcn.004a7af5
add esp, 0x1c
test edi, edi
pop edi
jne 0x48aeab
mov edx, dword [esi]
push edx
push 2
lea eax, [esp + 0xc]
mov word [esp + 0xd], 0
push 1
push eax
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], 0xfe
mov byte [esp + 0x16], 0
call fcn.004a7edf
add esp, 0x10
xor eax, eax
cmp dword [esi], eax
pop esi
setne al
pop ecx
ret
Function at 0x48aec0
Capabilities:
Get file size
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c9738
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ecx, 0x4f8958
call fcn.00403570
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x48afa2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x48af26
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x80000
jb 0x48afa2
mov ecx, 0x4f8958
call fcn.00403570
push eax
lea ecx, [esp + 0x18]
call fcn.00402f90
push 0x4e2308
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.0043af20
mov ecx, 0x4f8958
call fcn.00403570
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.0042cd20
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
push 0
push esi
call ebx
push 1
push esi
call fcn.0048cd60
add esp, 8
push 0
push edi
call ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0x14]
call fcn.00418010
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x48b8c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c843b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x2a]
push 0
push eax
mov dword [esp + 0x10], 0
mov word [esp + 0x30], 0
call fcn.004a1e50
mov eax, 1
add esp, 0xc
test byte [0x4f8c04], al
jne 0x48b944
or dword [0x4f8c04], eax
mov ecx, 0x4f8be8
call fcn.004323f0
push 0x4cc1d0
call fcn.004a2975
add esp, 4
mov ecx, 0x4f8be8
call fcn.00470f10
test al, al
je 0x48b99a
push 0x104
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0xc]
call fcn.004093c0
push eax
mov ecx, 0x4f8be8
mov dword [esp + 0x23c], 0
call fcn.00432420
lea ecx, [esp + 8]
mov dword [esp + 0x238], 0xffffffff
call fcn.00406930
push 0x4f8be8
mov ecx, esi
call fcn.00409680
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004a1873
add esp, 0x238
ret
Function at 0x48b9d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c7752
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004323f0
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004a1e50
add esp, 0xc
push 0
push 0x10
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00432450
call fcn.0048c000
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004a1873
add esp, 0x224
ret

Function at 0x48baa0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c7752
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004323f0
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004a1e50
add esp, 0xc
push 0
push 0x19
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00432450
call fcn.0048c000
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004a1873
add esp, 0x224
ret

Function at 0x48bb70
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c7752
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004323f0
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004a1e50
add esp, 0xc
push 0
push 2
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00432450
call fcn.0048c000
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004a1873
add esp, 0x224
ret
Function at 0x48bc40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c7752
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004323f0
push 0x208
lea eax, [esp + 0x16]
mov dword [esp + 0x22c], 0
push 0
push eax
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], 0
call fcn.004a1e50
add esp, 0xc
push 0
push 0x17
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00432450
call fcn.0048c000
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004a1873
add esp, 0x224
ret

Function at 0x48c400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00403570
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x48c740
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4caff8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
push edi
lea ecx, [esp + 0x18]
call fcn.004093c0
push edi
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48c7f9
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edi
call ebx
test eax, eax
jne 0x48c7f9
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0xb7
je 0x48c7f9
lea esi, [esp + 0x14]
call fcn.0048c670
mov ecx, esi
call fcn.00470f10
test al, al
mov ecx, esi
jne 0x48c7de
call fcn.00403570
push eax
call fcn.0048c740
add esp, 4
test eax, eax
jne 0x48c7e7
lea ecx, [esp + 0x14]
call fcn.00406930
xor eax, eax
jmp 0x48c807
push 0
push edi
call ebx
test eax, eax
jne 0x48c7f9
call ebp
cmp eax, 0xb7
jne 0x48c7da
lea ecx, [esp + 0x14]
call fcn.00406930
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004a1873
add esp, 0x2c
ret
Function at 0x48c8a0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4c61cb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x230], eax
push esi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
xor esi, esi
lea ecx, [esp + 8]
mov dword [esp + 8], esi
call fcn.00418110
push esi
push 2
mov dword [esp + 0x24c], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x48c904
lea eax, [esp + 8]
push eax
jmp 0x48c951
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48c945
jmp 0x48c920
cmp dword [esp + 0x14], ebx
je 0x48c937
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48c920
jmp 0x48c945
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0xc]
call fcn.00403020
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 8]
push edx
mov ecx, edi
call fcn.00418140
lea ecx, [esp + 8]
call fcn.00418010
mov eax, edi
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004a1873
add esp, 0x240
ret
Function at 0x48c990
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c6186
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x2c]
call fcn.004082d0
xor ebx, ebx
mov dword [esp + 0x288], ebx
call fcn.0047dc00
mov dword [esp + 0x1c], eax
mov byte [eax + 0x15], 1
mov eax, dword [esp + 0x1c]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], eax
mov eax, dword [esp + 0x1c]
mov dword [eax + 8], eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x288], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push 2
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x48ca48
lea eax, [esp + 0x44]
push eax
push edi
mov dword [esp + 0x4c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
jne 0x48ca70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
mov byte [esp + 0x288], 0
call fcn.0047d220
lea ecx, [esp + 0x2c]
call fcn.0043c0c0
xor eax, eax
jmp 0x48cb2d
lea ecx, [esp + 0x4c]
push ecx
lea eax, [esp + 0x1c]
call fcn.0047ce50
mov edx, dword [esp + 0x5c]
mov dword [eax], edx
lea eax, [esp + 0x44]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48ca70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0xa
nop
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.0042dcc0
lea edx, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
mov eax, ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ecx
call fcn.0047cf00
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
je 0x48cad8
cmp eax, dword [esp + 0x24]
je 0x48cadd
call fcn.004a1a9d
mov ecx, dword [ebx + 4]
cmp ecx, dword [esp + 0x28]
je 0x48cb0e
mov edx, edi
sub edi, 1
test edx, edx
je 0x48cb0e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
call fcn.0047ce50
mov ecx, dword [eax]
lea ebx, [esp + 0x14]
mov dword [esp + 0x14], ecx
call fcn.0048ef30
jmp 0x48caa0
lea eax, [esp + 0x18]
mov byte [esp + 0x288], 0
call fcn.0047d220
lea ecx, [esp + 0x2c]
call fcn.0043c0c0
mov eax, 1
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.004a1873
mov esp, ebp
pop ebp
ret
Function at 0x48cb60
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push esi
xor ebx, ebx
push 0x228
lea eax, [esp + 0x10]
push ebx
push eax
mov dword [esp + 0x14], ebx
call fcn.004a1e50
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x48cc05
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48cbfe
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov edi, edi
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x48cbe7
cmp eax, ebx
je 0x48cbe7
cmp eax, 4
je 0x48cbe7
lea edx, [esp + 0x30]
push str.360tray.exe
push edx
call fcn.004a3704
add esp, 8
test eax, eax
je 0x48cbf8
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48cbc0
jmp 0x48cbfd
mov ebx, 1
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004a1873
add esp, 0x230
ret

Function at 0x48cc20
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4e9040
push 0x4a85f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4f3280]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, esi
je 0x48ccce
lea ecx, [ebp - 0x28]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, esi
je 0x48ccce
mov edi, 1
mov dword [ebp - 0x38], edi
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 2
push esi
push esi
push esi
lea ecx, [ebp - 0x38]
push ecx
push esi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, esi
je 0x48ccce
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.0048ccf1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d9c0
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ca44b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x228], eax
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
xor edi, edi
push edi
push 0x1a
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00408270
lea ecx, [esp + 0xc]
mov dword [esp + 0x23c], edi
call fcn.00470f10
test al, al
je 0x48da3d
push 0x4dfaac
mov ecx, esi
call fcn.004093c0
jmp 0x48dab9
lea ecx, [esp + 0xc]
call fcn.004035a0
mov edi, eax
sub edi, 1
cmp dword [esp + 0x20], edi
ja 0x48da56
call fcn.004a0776
lea ecx, [esp + 0xc]
call fcn.00404150
movzx eax, word [eax + edi*2]
cmp ax, 0x5c
je 0x48da7d
cmp ax, 0x2f
je 0x48da7d
push 0x4e1cf8
lea ecx, [esp + 0x10]
call fcn.0044bb90
push 0x4e25c8
lea ecx, [esp + 0x10]
call fcn.0044be50
lea ecx, [esp + 0xc]
call fcn.00403570
push eax
call fcn.0048c740
add esp, 4
test eax, eax
mov ecx, esi
jne 0x48daaf
push 0x4dfaac
call fcn.004093c0
jmp 0x48dab9
lea edx, [esp + 0xc]
push edx
call fcn.00403420
lea ecx, [esp + 0xc]
call fcn.00403470
mov eax, esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004a1873
add esp, 0x238
ret

Function at 0x48daf0
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4ca44b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4f3280]
xor eax, esp
mov dword [esp + 0x228], eax
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
xor edi, edi
push edi
push 0x23
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00408270
lea ecx, [esp + 0xc]
mov dword [esp + 0x23c], edi
call fcn.00470f10
test al, al
je 0x48db6d
push 0x4dfaac
mov ecx, esi
call fcn.004093c0
jmp 0x48dbe9
lea ecx, [esp + 0xc]
call fcn.004035a0
mov edi, eax
sub edi, 1
cmp dword [esp + 0x20], edi
ja 0x48db86
call fcn.004a0776
lea ecx, [esp + 0xc]
call fcn.00404150
movzx eax, word [eax + edi*2]
cmp ax, 0x5c
je 0x48dbad
cmp ax, 0x2f
je 0x48dbad
push 0x4e1cf8
lea ecx, [esp + 0x10]
call fcn.0044bb90
push 0x4e25c8
lea ecx, [esp + 0x10]
call fcn.0044be50
lea ecx, [esp + 0xc]
call fcn.00403570
push eax
call fcn.0048c740
add esp, 4
test eax, eax
mov ecx, esi
jne 0x48dbdf
push 0x4dfaac
call fcn.004093c0
jmp 0x48dbe9
lea edx, [esp + 0xc]
push edx
call fcn.00403420
lea ecx, [esp + 0xc]
call fcn.00403470
mov eax, esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.004a1873
add esp, 0x238
ret
Function at 0x48e0a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c4878
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f3280]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
mov dword [esp + 0x20], 0
je 0x48e1bb
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x200000
ja 0x48e1a0
lea edi, [eax + 1]
push edi
mov dword [esp + 0x18], 0
mov esi, eax
call fcn.004a07b5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x48e1a0
push edi
push 0
push ebx
call fcn.004a1e50
add esp, 0xc
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48e197
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48e197
sub esi, eax
add edi, eax
test esi, esi
jne 0x48e136
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x48e179
push eax
lea ecx, [esp + 0x14]
call fcn.0043f130
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004779d0
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push ebx
call fcn.004a186e
add esp, 4
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x48e1bb
push eax
lea ecx, [esp + 0x14]
call fcn.0043f130
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004779d0
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret