joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475e47
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], eax
je 0x475eaa
push ebx
push edi
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00486640
add esp, 0xc
mov ebx, str._ALLUSERSPROFILE_
push ebx
xor ecx, ecx
call fcn.0041531e
or edi, 0xffffffff
cmp eax, edi
je 0x475ead
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.00476377
pop ecx
test eax, eax
pop ecx
jne 0x475fbd
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
mov ebx, str._APPDATA_
push ebx
xor ecx, ecx
call fcn.0041531e
cmp eax, edi
jne 0x475e8f
mov ebx, str._TEMP_
push ebx
xor ecx, ecx
call fcn.0041531e
cmp eax, edi
jne 0x475e8f
mov ebx, str._SYSTEM_
push ebx
xor ecx, ecx
call fcn.0041531e
cmp eax, edi
je 0x475efb
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x475ea6
jmp 0x475fbd
mov ebx, str._WINDOWS_
push ebx
xor ecx, ecx
call fcn.0041531e
cmp eax, edi
je 0x475f20
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x475ef2
mov ebx, str._CUR_MODULE_
push ebx
xor ecx, ecx
call fcn.0041531e
cmp eax, edi
je 0x475f42
lea eax, [ebp - 0x210]
push eax
call fcn.004762d0
jmp 0x475e9d
mov ebx, str._CUR_EXE_MODULE_
push ebx
xor ecx, ecx
call fcn.0041531e
cmp eax, edi
je 0x475f71
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x475ea6
jmp 0x475fb0
mov ebx, str._CUR_DIR_
push ebx
xor ecx, ecx
call fcn.0041531e
cmp eax, edi
je 0x475ea6
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00486640
add esp, 0xc
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call fcn.00471ec0
push 0x3f
xor ecx, ecx
call fcn.004275b5
mov ebx, eax
cmp ebx, edi
je 0x47604f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0048b66a
pop ecx
jmp 0x476040
and word [ebp + 8], 0
xor eax, eax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.0048b677
and eax, 0x8000000f
jns 0x476006
dec eax
or eax, 0xfffffff0
inc eax
push eax
lea eax, [ebp + 8]
push 0x4d0ea4
push eax
call fcn.0047760c
movzx edi, word [ebp + 8]
add esp, 0xc
test ebx, ebx
jl 0x47605e
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp ebx, eax
mov dword [ebp - 4], eax
jge 0x47605e
call fcn.0042faf1
mov word [eax + ebx*2], di
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.00414cbf
inc ebx
mov ecx, ebx
mov eax, esi
call fcn.0047765e
cmp ax, 0x3f
je 0x475fe9
mov eax, esi
call fcn.00474fe9
xor eax, eax
inc eax
jmp 0x475ea8
push 0x80070057
call fcn.00414deb
int3
Function at 0x476069
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
xor esi, esi
test byte [0x4ef658], 1
mov dword [ebp - 4], esi
jne 0x4760a8
mov eax, dword [0x4ed5f0]
or dword [0x4ef658], 1
mov ecx, 0x4ed5f0
call dword [eax + 0xc]
add eax, 0x10
push 0x4beac1
mov dword [0x4ef654], eax
call fcn.00486c5c
pop ecx
mov eax, dword [0x4ef654]
cmp dword [eax - 0xc], esi
jne 0x4760f1
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.00486640
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
push 0x4ef654
call fcn.00427868
mov eax, dword [0x4ef654]
add eax, 0xfffffff0
call fcn.004278fb
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
leave
ret

Function at 0x476108
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
xor esi, esi
test byte [0x4ef650], 1
mov dword [ebp - 4], esi
jne 0x476147
mov eax, dword [0x4ed5f0]
or dword [0x4ef650], 1
mov ecx, 0x4ed5f0
call dword [eax + 0xc]
add eax, 0x10
push 0x4beace
mov dword [0x4ef64c], eax
call fcn.00486c5c
pop ecx
mov eax, dword [0x4ef64c]
cmp dword [eax - 0xc], esi
jne 0x476190
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.00486640
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
push 0x4ef64c
call fcn.00427868
mov eax, dword [0x4ef64c]
add eax, 0xfffffff0
call fcn.004278fb
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
leave
ret

Function at 0x4761a7
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x4bc106
call fcn.004b89d0
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x4ed5f0
mov dword [ebp - 0x10], edi
call fcn.00425728
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.00486640
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x476229
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00427868
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x476377
Capabilities:
Query environment variable

Disassembly:
push 0x14
push 0x4da650
call fcn.004b883c
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], eax
je 0x476425
cmp dword [ebp + 0xc], eax
je 0x476425
push eax
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
mov esi, eax
cmp esi, 1
jb 0x476425
mov ebx, 0x103
cmp esi, ebx
ja 0x476425
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004841da
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x476421
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.00486640
add esp, 0xc
push esi
push dword [ebp - 0x24]
push dword [ebp + 8]
call edi
test eax, eax
je 0x476421
cmp eax, ebx
ja 0x476421
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0xc]
call fcn.0048957c
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x476421
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x476434
push dword [ebp - 0x1c]
call fcn.00486839
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.004b8877
ret

Function at 0x476554
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4bc106
call fcn.004b89d0
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x206
mov dword [ebp - 4], edi
lea eax, [ebp - 0x216]
push edi
mov dword [ebp - 0x10], edi
push eax
mov word [ebp - 0x218], di
call fcn.00486640
add esp, 0xc
mov ecx, 0x4ed5f0
call fcn.00425728
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 4], edi
push 0x104
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
je 0x4765dc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00427868
push str.kinst.log
push esi
call fcn.00427541
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4765ec
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push edi
push str.explorer.exe
lea eax, [ebp - 4]
push eax
xor esi, esi
xor edi, edi
call fcn.004279af
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x230], esi
call fcn.00486640
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x476689
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x47666e
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call fcn.00487d12
test eax, eax
pop ecx
pop ecx
je 0x476674
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47664c
jmp 0x476682
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ecx], eax
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040dae8
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4769a5
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, 0x4bab51
call fcn.004b89d0
push ebx
push esi
push edi
and dword [ebp - 4], 0
push str._access
lea eax, [ebp + 8]
push eax
call fcn.00427541
mov ebx, dword [ebp + 8]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
test edi, edi
je 0x4769e7
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4769ee
call esi
cmp eax, 5
je 0x4769f1
xor edi, edi
inc edi
lea eax, [ebx - 0x10]
call fcn.0040dae8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x476e1e
Capabilities:
Move file

Disassembly:
mov eax, 0x4bbcfc
call fcn.004b89d0
sub esp, 0x38
push esi
push edi
and dword [ebp - 4], 0
lea esi, [ebp + 8]
call fcn.0042faf1
push eax
lea eax, [ebp - 0x44]
call fcn.0044859f
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 1
call fcn.00448762
lea eax, [ebp - 0x28]
call fcn.004488af
movzx edi, al
test edi, edi
jne 0x476e8e
cmp dword [ebp - 0x14], 0x104
jb 0x476e6f
xor al, al
jmp 0x476e8b
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x476e7b
lea eax, [ebp - 0x24]
push 5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
movzx edi, al
push 0
push 1
lea esi, [ebp - 0x28]
call fcn.0042b515
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0042b515
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040dae8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x477a3a
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, 0x4bcfc9
call fcn.004b89d0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
sub esp, 0x9c
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
je 0x477ba9
mov ecx, dword [edi]
cmp dword [ecx - 0xc], ebx
je 0x477ba9
push eax
lea esi, [ebp - 0xa4]
call fcn.00428576
mov dword [ebp - 4], ebx
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.004256e5
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 2
cmp dword [ebp - 0xa4], eax
je 0x477aa1
push dword [ebp - 0xa4]
call fcn.00485be5
pop ecx
mov ecx, 0x4ed5f0
lea esi, [ebp - 0x14]
mov dword [ebp - 0x20], 0x4d1000
call fcn.00425728
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 3
push dword [edi]
mov eax, esi
push eax
call fcn.00427868
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x477ad6
mov dword [ebp - 0x18], eax
push dword [ebp + 8]
lea ebx, [ebp - 0x20]
call fcn.0047796f
push dword [edi]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x477af7
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0x14], 0
lea ebx, [ebp - 0x20]
jne 0x477b07
push 0x12c
jmp 0x477b0a
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00477679
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x477b5d
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x477b2b
mov dword [eax], ebx
cmp dword [ebp - 0x10], 0
je 0x477b3e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
mov esi, 0xfa
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040dae8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040dae8
mov eax, esi
jmp 0x477bac
push dword [edi]
call esi
test eax, eax
jne 0x477b7c
cmp dword [ebp - 0x10], eax
je 0x477b77
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
push 0x35
pop esi
jmp 0x477b43
cmp dword [ebp - 0x10], 0
je 0x477b8f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040dae8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040dae8
xor eax, eax
jmp 0x477bac
push 0x33
pop eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x478807
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esi + 0xc]
cmp dword [eax - 0xc], 0
jne 0x478816
mov eax, 0x13a
ret
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x478827
mov eax, 0x13b
ret
push dword [esi + 0x20]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.004759d2
add esp, 0xc
test eax, eax
je 0x478841
xor eax, eax
ret
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push eax
push ecx
mov ecx, dword [esi + 0x20]
call fcn.00475738
test eax, eax
pop ecx
pop ecx
jne 0x47883e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push 0
push eax
push ecx
mov ecx, dword [esi + 0x20]
call fcn.00474f09
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffec7
add eax, 0x139
ret

Function at 0x478c56
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
push esi
push edi
call fcn.00478d22
test al, al
jne 0x478c73
or eax, 0xffffffff
jmp 0x478d1e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.00478df3
test al, al
pop ecx
pop ecx
je 0x478c6b
and dword [ebp - 4], 0
mov esi, str.Data_Buffer
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.iphlpapi.dll_IcmpCreateFile
mov edi, eax
cmp edi, 0xffffffff
jne 0x478ca8
xor eax, eax
jmp 0x478d1e
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x478cc1
push edi
call sub.iphlpapi.dll_IcmpCloseHandle
jmp 0x478ca4
push 0x28
call fcn.00486776
mov esi, eax
test esi, esi
pop ecx
je 0x478cb9
mov dword [ebp - 8], 2
push 0x3e8
push 0x28
push esi
push 0
push 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push edi
call sub.iphlpapi.dll_IcmpSendEcho
test eax, eax
je 0x478cfc
cmp dword [esi + 4], 0
jne 0x478cfc
inc dword [ebp - 4]
dec dword [ebp - 8]
jne 0x478cd6
push esi
call fcn.00485be5
pop ecx
push edi
call sub.iphlpapi.dll_IcmpCloseHandle
call fcn.00478da5
test al, al
je 0x478c6b
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x478d22
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
push esi
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x478d87
push 0x4ed3f0
call fcn.00478e7b
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
push str.WSAGetLastError____
push ecx
push str.An_error_occured_in_WSAStartup_operation:
push esi
call fcn.0044d2c6
add esp, 0xc
push eax
call fcn.0044d2c6
add esp, 0xc
push eax
call fcn.0043e811
mov esi, eax
call fcn.00478e68
xor al, al
jmp 0x478da0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x16]
push eax
call fcn.0048b66a
pop ecx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478df3
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x478e3c
push 0x4ed3f0
call fcn.00478e7b
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
push str.An_error_occured_in_gethostbyname_operation:_WSAGetLastError____
push esi
call fcn.0044d2c6
add esp, 0xc
push eax
call fcn.0043e811
mov esi, eax
call fcn.00478e68
xor al, al
jmp 0x478e63
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [esp + 0xc]
push 4
push eax
call fcn.00486e7c
add esp, 0x10
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47966e
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4b98f8
call fcn.004b89d0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x4c6d78
push ebx
lea eax, [edi + 0xc]
xor esi, esi
push eax
mov dword [edi], vtable.KInstallTool::KUIInfoReport.0
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.004279af
push ebx
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.004279af
lea esi, [edi + 0x14]
mov ecx, 0x4ed5f0
mov byte [ebp - 4], 1
call fcn.00425728
push ebx
lea eax, [edi + 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.004279af
push ebx
lea eax, [edi + 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.004279af
push ebx
lea eax, [edi + 0x20]
push eax
mov byte [ebp - 4], 4
call fcn.004279af
and dword [edi + 0x2c], 0
and dword [edi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x24], 0
mov byte [edi + 0x25], 0
mov byte [edi + 0x26], 0
mov byte [edi + 0x27], 0
mov byte [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x479c82
Capabilities:
Terminate thread

Disassembly:
push ecx
and dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebp, [esi + 0x2c]
push ebp
call edi
lea ebx, [esi + 0x14]
push ebx
call edi
cmp byte [esi + 4], 0
jne 0x479caf
mov dword [esp + 0x10], 0xfffffffd
jmp 0x479cc7
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call esi
push ebp
call esi
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x479d96
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
and dword [esp], 0
push ebx
push esi
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0x2c]
push eax
mov dword [esp + 0x14], eax
call edi
call fcn.00479e41
test al, al
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
je 0x479dc7
or dword [esp + 0xc], 0xffffffff
jmp 0x479e31
push ebp
push 8
call fcn.00459afb
mov ebp, eax
xor eax, eax
cmp ebp, eax
pop ecx
jne 0x479de2
mov dword [esp + 0x10], 0xfffffffa
jmp 0x479e30
lea ecx, [esi + 0xc]
push ecx
push eax
push ebp
push 0x47a030
push eax
push eax
mov dword [ebp], esi
mov dword [ebp + 4], eax
call fcn.00487b55
add esp, 0x18
test eax, eax
mov dword [esi + 8], eax
je 0x479e21
lea ebp, [esi + 0x14]
jmp 0x479e13
call ebx
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
call edi
cmp byte [esi + 4], 0
push ebp
je 0x479e09
call ebx
jmp 0x479e30
push ebp
call fcn.00485be5
pop ecx
mov dword [esp + 0x10], 0xfffffffe
pop ebp
push dword [esp + 0x10]
call ebx
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret

Function at 0x479f62
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4b98f8
call fcn.004b89d0
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esi], vtable.KInstallTool::KUIInfoReport.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push 0x10
pop ebx
sub eax, ebx
call fcn.004278fb
add eax, ebx
mov dword [esi + 0xc], eax
and dword [ebp - 4], 0
mov eax, dword [edi + 0x10]
sub eax, ebx
call fcn.004278fb
add eax, ebx
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x14]
sub eax, ebx
call fcn.004278fb
add eax, ebx
mov dword [esi + 0x14], eax
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x18]
sub eax, ebx
call fcn.004278fb
add eax, ebx
mov dword [esi + 0x18], eax
mov byte [ebp - 4], 3
mov eax, dword [edi + 0x1c]
sub eax, ebx
call fcn.004278fb
add eax, ebx
mov dword [esi + 0x1c], eax
mov byte [ebp - 4], 4
mov eax, dword [edi + 0x20]
sub eax, ebx
call fcn.004278fb
add eax, ebx
mov dword [esi + 0x20], eax
mov al, byte [edi + 0x24]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], al
mov al, byte [edi + 0x25]
mov byte [esi + 0x25], al
mov al, byte [edi + 0x26]
mov byte [esi + 0x26], al
mov al, byte [edi + 0x27]
mov byte [esi + 0x27], al
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x47a327
Capabilities:
Create thread

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xe8
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [0x4ef3a4], ebx
je 0x47a345
inc eax
jmp 0x47a434
push esi
push edi
mov byte [ebp + 0x54], bl
lea edi, [ebp + 0x55]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp + 0x68], ebx
lea edi, [ebp + 0x6c]
stosd dword es:[edi], eax
push 0xc6
stosd dword es:[edi], eax
lea eax, [ebp - 0x72]
push ebx
push eax
mov word [ebp - 0x74], bx
call fcn.00486640
add esp, 0xc
call fcn.0047a83f
push dword [ebp + 0x7c]
mov dword [0x4ef3a8], eax
push 0x4ef37c
call fcn.00427868
call fcn.0047a78c
xor edi, edi
inc edi
push edi
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push edi
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp + 0x54]
push 0x4ef380
mov dword [ebp + 0x68], 0xc
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x74]
push 0x4d15f0
push eax
call fcn.0047aaca
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push edi
push edi
lea eax, [ebp + 0x68]
push eax
call esi
push ebx
push ebx
push edi
push ebx
mov dword [0x4ef370], eax
call esi
cmp dword [0x4ef370], ebx
mov dword [0x4ef374], eax
je 0x47a430
cmp eax, ebx
je 0x47a430
push ebx
push ebx
push 0x4ef368
push 0x47a5df
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [0x4ef378], eax
je 0x47a430
mov dword [0x4ef3a4], edi
mov eax, edi
jmp 0x47a432
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4

Function at 0x47a43c
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
xor edi, edi
cmp dword [0x4ef378], edi
mov dword [0x4ef368], 1
je 0x47a487
mov eax, dword [0x4ef374]
cmp eax, edi
je 0x47a462
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [0x4ef378]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x47a487
push edi
push dword [0x4ef378]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4ef374]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x47a49f
push eax
call esi
mov dword [0x4ef374], edi
mov eax, dword [0x4ef378]
cmp eax, edi
je 0x47a4b1
push eax
call esi
mov dword [0x4ef378], edi
mov dword [0x4ef3a4], edi
pop edi
pop esi
ret