joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4817a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a952
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4c1600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
je 0x48180b
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4817fa
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x24], eax
jmp 0x481801
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 4], 0
lea edx, [ebp - 0x1c]
push edx
call fcn.004815d0
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x4aeea8
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004022e0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040a1f0
lea ecx, [ebp - 0x10]
call fcn.0041b0d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
call fcn.0040a1f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x483cd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a6b3
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4c1600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.004010a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00483a60
add esp, 4
push 0x4af5d0
lea ecx, [ebp - 0x10]
call fcn.00402130
push 0
lea ecx, [ebp - 0x10]
call fcn.0041b0d0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.version
lea ecx, [ebp - 0x10]
call fcn.00402130
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x4c5924
call fcn.00401140
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.004010a0
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040a1f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x484050
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a9e4
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x4c1600]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x26c], 3
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x4c592c
call fcn.0041da10
lea edx, [ebp - 0x274]
push edx
mov ecx, 0x4c592c
call fcn.0040b950
push eax
lea ecx, [ebp - 0x14]
call fcn.0040b7f0
movzx eax, al
test eax, eax
je 0x4840c2
mov al, 9
jmp 0x48422d
mov word [ebp - 0x22c], 0
push 0x206
push 0
lea ecx, [ebp - 0x22a]
push ecx
call fcn.00452150
add esp, 0xc
push 0
push 0x26
lea edx, [ebp - 0x22c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004010c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00483a60
add esp, 4
push str.Kingsoft
lea ecx, [ebp - 0x1c]
call fcn.00402130
lea ecx, [ebp - 0x18]
call fcn.00401080
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x14]
call fcn.0041fcf0
mov eax, dword [eax + 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.silence1handle_dsupply_dinstallpath__s_
lea edx, [ebp - 0x18]
push edx
call fcn.0041bf80
add esp, 0x14
mov dword [ebp - 0x268], 0
push 0x38
push 0
lea eax, [ebp - 0x264]
push eax
call fcn.00452150
add esp, 0xc
mov dword [ebp - 0x268], 0x3c
lea ecx, [ebp - 0x14]
call fcn.0041fcf0
add eax, 0x10
mov ecx, eax
call fcn.0041b0d0
mov dword [ebp - 0x258], eax
lea ecx, [ebp - 0x18]
call fcn.0041b0d0
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x264], 0x40
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4841e8
mov byte [ebp - 0x275], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040a1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040a1f0
mov al, byte [ebp - 0x275]
jmp 0x48422d
mov byte [ebp - 0x276], 9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0040a1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040a1f0
mov al, byte [ebp - 0x276]
jmp 0x48422d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00451d4e
mov esp, ebp
pop ebp
ret
Function at 0x4846b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49aa8a
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4c1600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00483aa0
add esp, 8
lea edx, [ebp - 0x5c]
push edx
mov ecx, 0x4c592c
call fcn.0040b950
push eax
lea ecx, [ebp - 0x14]
call fcn.0040b7f0
movzx eax, al
test eax, eax
je 0x48470a
xor eax, eax
jmp 0x4847b9
mov dword [0x4c2b9c], 7
lea ecx, [ebp - 0x54]
call fcn.00401080
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0041fcf0
cmp dword [eax + 4], 0
je 0x48474e
lea ecx, [ebp - 0x14]
call fcn.0041fcf0
mov ecx, dword [eax + 4]
push ecx
push str._supplyid_d
lea edx, [ebp - 0x54]
push edx
call fcn.0041bf80
add esp, 0xc
mov dword [ebp - 0x50], 0
push 0x38
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.00452150
add esp, 0xc
mov dword [ebp - 0x50], 0x3c
lea ecx, [ebp - 0x14]
call fcn.0041fcf0
add eax, 0x10
mov ecx, eax
call fcn.0041b0d0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x54]
call fcn.0041b0d0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x34], 5
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0040a1f0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x485300
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b2e3
mov eax, dword fs:[0]
push eax
sub esp, 0x378
mov eax, dword [0x4c1600]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00499400
mov word [ebp - 0x22c], 0
push 0x208
push 0
lea eax, [ebp - 0x22a]
push eax
call fcn.00452150
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x48538f
push 0x4af798
lea edx, [ebp - 0x22c]
push edx
call fcn.00473ef0
add esp, 8
push 0x4af7cc
lea eax, [ebp - 0x22c]
push eax
call fcn.00474130
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [0x4c581c], ecx
push 0x4af800
call fcn.00482ca0
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4853db
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4853db
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4853d4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
jmp 0x485501
call fcn.00484d50
lea ecx, [ebp - 0x374]
call fcn.00487700
mov dword [ebp - 4], 0
push 0
push 0
lea ecx, [ebp - 0x374]
call fcn.00426de0
lea ecx, [ebp - 0x370]
call fcn.00425e60
push str.QQPCDownload_PropData
lea ecx, [ebp - 0x370]
call fcn.0041b0d0
push eax
call fcn.00482c80
add esp, 8
push 0
push 0
push 0
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x48546c
cmp dword [ebp - 0x240], 0x20
je 0x48544e
cmp dword [ebp - 0x240], 0xd
jne 0x485450
jmp 0x485425
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x485425
call fcn.00483240
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x378]
push edx
call fcn.00483f00
add esp, 4
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x384], eax
mov byte [ebp - 4], 1
push 0x4af858
mov ecx, dword [ebp - 0x384]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004022e0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x378]
call fcn.0040a1f0
lea ecx, [ebp - 0x10]
call fcn.0041b0d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x37c], 0
lea ecx, [ebp - 0x10]
call fcn.0040a1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x374]
call fcn.00487b80
mov eax, dword [ebp - 0x37c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00451d4e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x485ef0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b7f5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4c1600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x18]
call fcn.00413890
mov dword [ebp - 4], 0
push 0
push 0
push 0x80
push 3
push 1
push 0xc0000000
mov ecx, 0x4c5924
call fcn.0041b0d0
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a120
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x28], 0
jge 0x485f7e
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040a1d0
mov eax, dword [ebp - 0x3c]
jmp 0x4860e5
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a180
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00450d6b
add esp, 4
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x18]
call fcn.00426130
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.00482d40
add esp, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
push edx
call fcn.00451cd8
add esp, 4
lea ecx, [ebp - 0x18]
call fcn.0040aaf0
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 0
je 0x4860bc
mov eax, dword [ebp - 0x1c]
shl eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00450d6b
add esp, 4
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0
je 0x4860a4
mov eax, dword [ebp - 0x38]
push eax
push 0
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00452150
add esp, 0xc
mov edx, dword [ebp - 0x38]
sub edx, 2
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push str.37k_IF__y_d
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.0048fe80
add esp, 0x14
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.00451cd8
add esp, 4
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x20], 0
je 0x486092
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00485890
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push eax
call fcn.00451cd8
add esp, 4
cmp dword [ebp - 0x24], 0
je 0x4860bc
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
push edx
call fcn.00451cd8
add esp, 4
mov ecx, 0x4c5924
call fcn.0041b0d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040a1d0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x486970
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4c1600]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00452150
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x214], 0
push str.RT_RCDATA
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x486a22
xor eax, eax
jmp 0x486b22
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jne 0x486a49
xor eax, eax
jmp 0x486b22
mov edx, dword [ebp - 0x230]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x486a70
xor eax, eax
jmp 0x486b22
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x486a93
xor eax, eax
jmp 0x486b22
push 0
push 0x80
push 2
push 0
push 1
push 0x10000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x486ac2
xor eax, eax
jmp 0x486b22
push 0
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x486b06
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x486b22
mov dword [ebp - 0x228], 1
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00451d4e
mov esp, ebp
pop ebp
ret
Function at 0x487700
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ac2f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4c1600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
call fcn.0041d6a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x20
call fcn.0048c7c0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
mov dword [eax], vtable.CMainDlg.0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x20], vtable.CMainDlg.1.0
push 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x2c
call fcn.0041dc20
mov byte [ebp - 4], 2
push 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x30
call fcn.0041dc20
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x20]
add ecx, 0x3c
call fcn.0047cf30
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x20]
add ecx, 0x84
call fcn.0047cf30
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x20]
add ecx, 0xd8
call fcn.00401080
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x20]
add ecx, 0xe8
call fcn.00401080
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x20]
add ecx, 0xec
call fcn.00401080
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x20]
add ecx, 0x114
call fcn.0040edd0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x28], 1
push 0
push 0x10
push 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xa0
call fcn.00426110
mov ecx, dword [ebp - 0x20]
add ecx, 0x30
call fcn.0041dca0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0xa0
call fcn.00426110
mov ecx, dword [ebp - 0x20]
add ecx, 0x2c
call fcn.0041dc70
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x34], 0
push 0x68
call fcn.00453bdc
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x487850
mov ecx, dword [ebp - 0x1c]
call fcn.00476460
mov dword [ebp - 0x24], eax
jmp 0x487857
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x24], eax
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x24], 0
je 0x487887
mov edx, dword [0x4af8e8]
push edx
mov eax, dword [0x4af8e4]
push eax
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0x24]
call fcn.004761d0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0xcc], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xd0], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xd4], 0
mov ecx, dword [ebp - 0x20]
add ecx, 0xd8
call fcn.004020c0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0xdc], 1
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xf0], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0xf8], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0xe0], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xe4], 0
mov edx, dword [ebp - 0x20]
add edx, 0xfc
push edx
call fcn.0041c400
add esp, 4
mov eax, dword [ebp - 0x20]
add eax, 0x104
push eax
call fcn.0041c3e0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x487950
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x120c
call fcn.0046f8b0
mov eax, dword [0x4c1600]
xor eax, ebp
mov dword [ebp - 0xfb0], eax
push esi
mov dword [ebp - 0xfa8], 0
push 0xf9c
push 0
lea eax, [ebp - 0xfa4]
push eax
call fcn.00452150
add esp, 0xc
mov dword [ebp - 0x1208], 0
mov dword [ebp - 0xfac], 0
mov word [ebp - 0x11b8], 0
push 0x206
push 0
lea ecx, [ebp - 0x11b6]
push ecx
call fcn.00452150
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x1204], 0
mov word [ebp - 0x1200], 0
push 0x40
push 0
lea edx, [ebp - 0x11fe]
push edx
call fcn.00452150
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x4879fb
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x487a02
xor eax, eax
jmp 0x487b6c
lea edx, [ebp - 0x1208]
push edx
push 0xfa0
lea eax, [ebp - 0xfa8]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x487a27
cmp dword [ebp - 0x1208], 0
jne 0x487a2e
xor eax, eax
jmp 0x487b6c
mov ecx, dword [ebp - 0x1208]
shr ecx, 2
mov dword [ebp - 0xfac], ecx
mov dword [ebp - 0x120c], 0
jmp 0x487a58
mov edx, dword [ebp - 0x120c]
add edx, 1
mov dword [ebp - 0x120c], edx
mov eax, dword [ebp - 0x120c]
cmp eax, dword [ebp - 0xfac]
jae 0x487b6a
mov ecx, dword [ebp - 0x120c]
mov edx, dword [ebp + ecx*4 - 0xfa8]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x487b65
mov dword [ebp - 0x1204], 0
push 0x208
push 0
lea eax, [ebp - 0x11b8]
push eax
call fcn.00452150
add esp, 0xc
lea ecx, [ebp - 0x1208]
push ecx
push 4
lea edx, [ebp - 0x1204]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x487b54
push 0x104
lea ecx, [ebp - 0x11b8]
push ecx
mov edx, dword [ebp - 0x1204]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x487b54
lea ecx, [ebp - 0x11b8]
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
lea edx, [ebp - 0x11b8]
push edx
call fcn.00451d38
add esp, 4
lea esi, [ebp - 0x1200]
lea ecx, [ebp - 0x11b8]
call fcn.0044fe10
movzx eax, al
test eax, eax
je 0x487b54
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1200]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x487b54
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov eax, 1
jmp 0x487b6c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
jmp 0x487a49
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xfb0]
xor ecx, ebp
call fcn.00451d4e
mov esp, ebp
pop ebp
ret
Function at 0x487e10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b865
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x4c1600]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x148], ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
push 0x4afe08
lea ecx, [ebp - 0x98]
call fcn.004028f0
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x14c]
mov dword [ebp - 0x150], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x150]
push eax
push 0x4afe0c
lea ecx, [ebp - 0xb4]
call fcn.004028f0
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x158], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x158]
push edx
push 0x4afe10
lea ecx, [ebp - 0xd0]
call fcn.004028f0
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x160], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x160]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd4], esp
mov edx, dword [ebp - 0x10]
push edx
call fcn.004028f0
mov dword [ebp - 0x164], eax
lea ecx, [ebp - 0x7c]
call fcn.00499a90
mov dword [ebp - 0x168], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd0]
call fcn.00402970
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.00402970
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x98]
call fcn.00402970
push str.supplyid
lea ecx, [ebp - 0xf0]
call fcn.004028f0
mov byte [ebp - 4], 7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x7c]
call fcn.0041f740
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xf0]
call fcn.00402970
push str.target
lea ecx, [ebp - 0x10c]
call fcn.004028f0
mov byte [ebp - 4], 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x7c]
call fcn.0041f740
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x10c]
call fcn.00402970
push 0x4afe3c
lea ecx, [ebp - 0x128]
call fcn.004028f0
mov byte [ebp - 4], 9
push 0x4c5940
push 0x4c5940
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0041fa60
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x128]
call fcn.00402970
push str.productname
lea ecx, [ebp - 0x144]
call fcn.004028f0
mov byte [ebp - 4], 0xa
push 0x4c595c
push 0x4c595c
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.0041fa60
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x144]
call fcn.00402970
mov edx, dword [ebp + 8]
mov dword [edx], 0x2230d
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
push str.http:__c.pc.qq.com_fcgi_bin_downurlquery_id140045guid_sver_s
mov ecx, 0x4c5940
call fcn.00409fa0
push 0x4afe5c
mov ecx, 0x4c595c
call fcn.00409fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00499b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00451d4e
mov esp, ebp
pop ebp
ret 8