joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475410
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4982d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c7650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x14]
push eax
call fcn.00475250
mov ecx, dword [ebp - 0x14]
push 0
push 0x80
push 3
push 0
push 1
push connect
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, esi
mov ebx, eax
call fcn.00405640
cmp ebx, 0xffffffff
je 0x47553a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00477302
mov ecx, dword [ebp - 0x10]
add esp, 4
push 0
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
xor edx, edx
mov word [edi + ebx*2], dx
test edi, edi
jne 0x4754ca
xor eax, eax
jmp 0x4754df
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4754d0
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, esi
call fcn.00405810
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00416f50
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004051c0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47552a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00416e60
push edi
call fcn.00479b81
add esp, 4
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x475560
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4756f0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], 0
mov word [ebp - 0x20c], ax
call fcn.0047d070
add esp, 0xc
push 0
push 0x28
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x475760
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, esi
call fcn.00417c60
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004799e1
mov esp, ebp
pop ebp
ret
Function at 0x475880
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498352
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x11c
lea eax, [ebp - 0x12c]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x130], 0
call fcn.0047d070
add esp, 0xc
push str.error
mov ecx, esi
call fcn.00405910
lea ecx, [ebp - 0x12c]
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47594d
mov eax, dword [ebp - 0x128]
sub eax, 5
je 0x47593f
dec eax
jne 0x47594d
cmp dword [ebp - 0x124], 5
ja 0x47594d
cmp byte [ebp - 0x12], 1
jne 0x47594d
push str.win7s
mov ecx, esi
call fcn.004058c0
jmp 0x47594d
push 3
push 0x4a2bb8
mov ecx, esi
call fcn.00405810
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
Function at 0x475a60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4983f8
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
mov dword [ebp - 0x224], ebx
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x228], esi
mov word [ebp - 0x218], ax
call fcn.0047d070
mov edx, dword [0x4c72d4]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x4c72d4
call eax
add eax, 0x10
mov dword [esi], eax
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x224], 1
call fcn.00475880
add esp, 4
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 4], 1
mov ecx, 0x4a2bb8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x475b28
cmp dx, bx
je 0x475b24
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x475b28
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x475b02
xor eax, eax
jmp 0x475b2d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
je 0x475b73
push ebx
push 0x23
lea edx, [ebp - 0x218]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x475b50
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00405810
jmp 0x475c28
lea ecx, [ebp - 0x21c]
push str.win7s
push ecx
call fcn.00475690
add esp, 8
test al, al
je 0x475c28
push ebx
push 0x2e
lea edx, [ebp - 0x218]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x475bb0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00405810
mov eax, dword [esi]
push 0x5c
push eax
call fcn.00479b8c
add esp, 8
cmp eax, ebx
je 0x475c28
sub eax, dword [esi]
sar eax, 1
cmp eax, ebx
jle 0x475c28
push eax
lea ecx, [ebp - 0x220]
push ecx
mov ecx, esi
call fcn.00416f50
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004051c0
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x475c28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x475c4d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
Function at 0x475c70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4981d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c7650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov dword [ebp - 0x10], esi
call fcn.00475a60
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], esi
cmp dword [ecx - 0xc], esi
je 0x475ce2
push 8
push str.Fundata
lea ecx, [ebp - 0x10]
call fcn.004171c0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00405350
mov esi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [esi], eax
jmp 0x475cf1
mov esi, dword [ebp + 8]
push 0x4aa0c0
mov ecx, esi
call fcn.00405910
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x475d13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x475dd0
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpQueryInfoA]
push esi
push edi
mov esi, ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x58]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
xor edi, edi
push 0x20000013
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
call ebx
test eax, eax
je 0x475e70
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ecx, 0xc8
jne 0x475e26
cmp eax, edi
je 0x475e32
cmp ecx, 0x12e
jne 0x475e70
cmp eax, edi
jne 0x475e70
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x58]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x20000005
push ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
call ebx
test eax, eax
je 0x475e70
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop edi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475e80
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ecx + 0x58]
lea edx, [ebp - 8]
push edx
lea esi, [ecx + 0x64]
push esi
push 0x20000013
push eax
mov dword [ebp - 8], 4
mov dword [ebp - 4], 0
mov dword [esi], 0x194
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov esi, dword [esi]
cmp esi, 0xc8
je 0x475ecf
cmp esi, 0x130
je 0x475ecf
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x475ee0
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push esi
push eax
mov dword [ebp - 4], 0
call fcn.00475790
add esp, 8
test al, al
je 0x475f44
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 4]
push edx
mov dword [esi + 0x5c], ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 4]
and al, 4
sub al, 4
movzx eax, al
push 0
neg eax
push 0
sbb eax, eax
push 0
and eax, 4
push eax
push str.Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.2__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 0x54], eax
test eax, eax
jne 0x475f4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x68], eax
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.00475d30
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x475f70
Capabilities:
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49842b
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.0047dc10
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
mov dword [ebp - 0x2018], ebx
mov dword [ebp - 0x2014], ebx
mov dword [ebp - 0x2028], eax
jb 0x475fc3
mov eax, dword [eax]
push eax
call fcn.00477130
add esp, 4
push eax
lea ecx, [ebp - 0x2024]
call fcn.00476dc0
lea ecx, [ebp - 0x2024]
call fcn.00476db0
cmp eax, 0xffffffff
jne 0x475ff0
mov dword [ebp - 4], eax
jmp 0x4760d9
push 0x1fff
lea eax, [ebp - 0x200f]
push ebx
push eax
mov byte [ebp - 0x2010], bl
call fcn.0047d070
mov eax, dword [esi + 0x58]
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea ecx, [ebp - 0x201c]
push ecx
push 0x2000
lea edx, [ebp - 0x2010]
push edx
push eax
call edi
cmp eax, ebx
je 0x4760aa
mov edi, edi
mov ecx, dword [ebp - 0x201c]
cmp ecx, ebx
je 0x4760a6
add dword [ebp - 0x2018], ecx
push ebx
lea edx, [ebp - 0x201c]
adc dword [ebp - 0x2014], ebx
push edx
push ecx
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2024]
call fcn.00476db0
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4760b3
push 0x1fff
lea ecx, [ebp - 0x200f]
push ebx
push ecx
mov byte [ebp - 0x2010], bl
call fcn.0047d070
mov ecx, dword [esi + 0x58]
add esp, 0xc
lea edx, [ebp - 0x201c]
push edx
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push ecx
call edi
cmp eax, ebx
jne 0x476030
jmp 0x4760aa
cmp eax, ebx
jne 0x476102
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x68], eax
or edi, 0xffffffff
cmp dword [esi + 0x68], edi
jne 0x4760c1
mov eax, dword [esi + 0x64]
mov dword [esi + 0x68], eax
mov eax, dword [ebp - 0x2028]
cmp dword [eax + 0x14], 8
jb 0x4760cf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x2024]
call fcn.00476de0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00475e80
test eax, eax
je 0x4760b3
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
mov edx, eax
or edx, ecx
je 0x476129
cmp dword [ebp - 0x2018], eax
jne 0x4760b3
cmp dword [ebp - 0x2014], ecx
jne 0x4760b3
lea ecx, [ebp - 0x2024]
mov dword [ebp - 4], 0xffffffff
call fcn.00476de0
mov al, 1
jmp 0x4760e6
Function at 0x476280
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4984b1
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4c72d4]
mov edx, dword [eax + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, 0x4c72d4
mov dword [ebp - 0x41c], ebx
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x414], esi
push 0x3ff
lea eax, [ebp - 0x40f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x420], ebx
mov byte [ebp - 0x410], bl
call fcn.0047d070
add esp, 0xc
push ebx
lea ecx, [ebp - 0x420]
push ecx
push 0x3ff
lea edx, [ebp - 0x410]
push edx
push 0x10000001
call sub.urlmon.dll_UrlMkGetSessionOption
cmp eax, 0x8007000e
je 0x476322
cmp eax, ebx
jne 0x476412
mov eax, dword [0x4c72d4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4c72d4
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x418], esi
lea eax, [ebp - 0x410]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x476379
mov ecx, eax
movzx eax, cx
push ebx
push eax
mov dword [ebp - 0x41c], eax
call fcn.004053e0
add esp, 8
cmp eax, ebx
je 0x476391
mov edx, dword [ebp - 0x41c]
push edx
push eax
lea ecx, [ebp - 0x418]
call fcn.004055a0
jmp 0x47638b
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x418]
call fcn.00416dd0
mov esi, dword [ebp - 0x418]
push 0xb
push str.User_Agent:
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 2
call fcn.00405810
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [ebp - 0x414]
call fcn.004171c0
push 0xa
push str._Funshion_
lea ecx, [ebp - 0x414]
call fcn.004171c0
push 7
push str.1.0.0.1
lea ecx, [ebp - 0x414]
call fcn.004171c0
push 2
push 0x4a2c8c
lea ecx, [ebp - 0x414]
call fcn.004171c0
lea eax, [esi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47640c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x414]
xor ecx, ecx
mov eax, esi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x476426
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.00417c60
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x476461
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
Function at 0x476840
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498566
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x240], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00476dc0
mov eax, dword [edi]
sub eax, 0x10
push eax
mov dword [ebp - 4], ebx
call fcn.00405350
add esp, 4
lea edi, [eax + 0x10]
lea eax, [ebp - 0x23c]
push eax
mov ebx, 0x22c
push esi
mov dword [ebp - 0x23c], ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4768f7
mov byte [ebp - 4], al
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4768de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0xffffffff
call fcn.00476de0
xor eax, eax
jmp 0x476981
lea ecx, [ebp - 0x23c]
push ecx
push esi
mov dword [ebp - 0x23c], ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x476949
mov edi, edi
lea edx, [ebp - 0x218]
push edi
push edx
call fcn.0047d266
add esp, 8
test eax, eax
je 0x47693d
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x476910
jmp 0x476949
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x240], ecx
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x476969
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0xffffffff
call fcn.00476de0
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
Function at 0x476d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.004769f0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
sub edx, ecx
sar edx, 2
add esp, 8
xor esi, esi
test edx, edx
je 0x476d8f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ecx + esi*4]
test eax, eax
je 0x476d80
push eax
push 0
push 1
call edi
test eax, eax
je 0x476d7d
push 0
push eax
call ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub eax, ecx
inc esi
sar eax, 2
cmp esi, eax
jb 0x476d66
pop edi
pop ebx
pop esi
test ecx, ecx
je 0x476d9d
push ecx
call fcn.004799d6
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x477130
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498650
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x477180
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00417c60
push 1
push 0xffffffffffffffff
push 0x4b0ca8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00476e50
push 0x4aa0c0
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.00405910
or edi, 0xffffffff
mov byte [ebp - 4], 1
cmp esi, edi
je 0x4772b0
push esi
push 0
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00421a30
mov edi, 8
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], edi
jb 0x4771f0
mov edx, dword [eax]
jmp 0x4771f2
mov edx, eax
test edx, edx
jne 0x4771fa
xor eax, eax
jmp 0x47720f
mov eax, edx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x477200
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x4c]
call fcn.00405810
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], edi
jb 0x47722e
mov edx, dword [ebp - 0x48]
push edx
call fcn.004799d6
add esp, 4
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x477292
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
push eax
call fcn.00405350
lea esi, [eax + 0x10]
mov dword [ebp - 0x54], esi
push esi
lea ecx, [ebp - 0x4c]
push 0x4a2e60
push ecx
mov byte [ebp - 4], 3
call fcn.004052b0
mov edx, dword [ebp - 0x4c]
add esp, 0x10
push 0
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477292
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x50]
push 0
push 0x80
push 2
push 0
push 5
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4772d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0x18], 8
jb 0x4772e5
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004799d6
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret