joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b01f
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695ae0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
xor edi, edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.0040d595
push dword [ebp + 0x10]
lea ecx, [esi + 0x18]
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0040d595
push dword [ebp + 0xc]
lea ecx, [esi + 0x34]
mov byte [esi + 0x30], 1
call fcn.0041cad4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4922a2
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [ebp + 8]
test edi, edi
je 0x4922f1
and dword [ebp + 0xc], 0
lea eax, [edi + esi]
xor edx, edx
cmp edi, eax
cmova esi, edx
test esi, esi
je 0x4922f1
movzx eax, byte [edi]
push 0x100
cdq
push 0x1b3
xor edx, ebx
xor eax, ecx
push edx
push eax
call fcn.0064d190
mov ecx, eax
inc edi
mov eax, dword [ebp + 0xc]
mov ebx, edx
inc eax
mov dword [ebp + 0xc], eax
cmp eax, esi
jb 0x4922c8
pop edi
pop esi
mov edx, ebx
mov eax, ecx
pop ebx
pop ebp
ret 8

Function at 0x49a24f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69edba
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x49a40a
push 7
pop ebx
xor eax, eax
mov dword [ebp - 0x64], edi
push str.Microsoft.Office.Experimentation.Configs.EcsPersistentStore
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], ebx
mov word [ebp - 0x74], ax
call fcn.0040d510
lea edx, [ebp - 0x74]
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xb8]
call fcn.0049b352
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.0040d475
xor eax, eax
mov dword [ebp - 0x1c], edi
push 0x6d92dc
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x2c], ax
call fcn.0040d510
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x34], edi
push str.CountryCode
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x44], ax
call fcn.0040d510
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xb0]
call fcn.0047b01f
lea ecx, [ebp - 0x44]
call fcn.0040d475
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.0040d475
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00480e69
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x49a343
mov edx, dword [esi]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
mov ecx, dword [ebp - 0x4c]
cmovae eax, dword [ebp - 0x5c]
cmp ecx, dword [esi + 0x10]
jne 0x49a365
push ecx
push edx
push eax
call fcn.0040b7a0
add esp, 0xc
test eax, eax
je 0x49a374
push esi
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], bl
call fcn.0047afc9
lea ecx, [ebp - 0x5c]
call fcn.0040d475
lea ecx, [ebp - 0xb0]
call fcn.00479be2
mov dword [ebp - 4], 0xa
jmp 0x49a3fb
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
je 0x49a40a
call fcn.00412707
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret
Function at 0x4b33e9
Capabilities:
Receive http response

Disassembly:
push 0x68
mov eax, 0x6a0d40
call fcn.0064cfe4
mov esi, ecx
cmp byte [esi + 0x4c], 0
je 0x4b341f
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x98]
mov dword [eax], edx
mov ecx, dword [esi + 0xa0]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xa4]
mov dword [eax + 0xc], ecx
jmp 0x4b3592
cmp byte [esi + 0x11], 0
jne 0x4b344b
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 6
push eax
push dword [ebp + 8]
xorps xmm0, xmm0
lea ecx, [esi + 0x84]
movlpd qword [ebp - 0x20], xmm0
call fcn.004ba287
jmp 0x4b358f
mov eax, dword [esi + 0x3c]
xor ebx, ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
cmp dword [esi + 0x34], 0
mov dword [ebp - 0x18], ebx
je 0x4b354f
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x34]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x4b3495
xorps xmm0, xmm0
mov dword [ebp - 0x44], ebx
movlpd qword [ebp - 0x3c], xmm0
lea eax, [ebp - 0x44]
mov edi, ebx
jmp 0x4b34a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.004abc8f
mov edi, dword [eax]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
test edi, edi
jne 0x4b3563
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
test eax, eax
je 0x4b352f
mov ebx, dword [ebp - 0x10]
add eax, ebx
push ecx
push eax
call fcn.00433e9e
and dword [ebp - 0x1c], edi
cmp dword [esi + 0x34], edi
je 0x4b354f
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
add eax, ebx
push eax
push dword [esi + 0x34]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x4b3500
and dword [ebp - 0x54], edi
lea eax, [ebp - 0x54]
xorps xmm0, xmm0
movlpd qword [ebp - 0x4c], xmm0
jmp 0x4b3512
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x74]
call fcn.004abc8f
mov edi, dword [eax]
mov ebx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
test edi, edi
jne 0x4b3563
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 0x10], eax
jmp 0x4b3465
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
call fcn.00433e9e
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 0x3c]
call fcn.004b0632
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x48], eax
jmp 0x4b3563
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
push 6
mov dword [ebp - 0x14], eax
pop edi
mov ecx, dword [ebp - 0x14]
lea eax, [esi + 0x98]
mov byte [esi + 0x4c], 1
push eax
push dword [ebp + 8]
mov dword [eax + 0xc], ecx
lea ecx, [esi + 0x84]
mov dword [eax], edi
mov dword [eax + 8], ebx
call fcn.004ba287
lea ecx, [ebp - 0x34]
call fcn.00419dd5
mov eax, dword [ebp + 8]
call fcn.0064cfad
ret 4
Function at 0x4b5a77
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x696135
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [esi], 0x6fa92c
mov dword [esi + 4], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x4b5ab6
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x30], ebx
push 7
pop ecx
mov dword [esi + 0x34], ecx
mov word [esi + 0x20], ax
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ecx
mov word [esi + 0x38], ax
mov eax, esi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov word [esi + 0x68], bx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4bce27
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695ae0
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x6fdf40
push ebx
push ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0040e1a7
mov dword [esi + 4], eax
lea eax, [esi + 0x2c]
push eax
mov dword [esi + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov byte [esi + 0x30], bl
mov eax, esi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0e81
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x4c0e9b
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x4c0e8e
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x4c2623
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x698e3b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
xor esi, esi
cmp dword [edi + 0x30], ebx
je 0x4c2661
cmp dword [edi + 0x30], esi
jne 0x4c26c1
xorps xmm0, xmm0
lea ecx, [edi + 0x14]
movlpd qword [ebp - 0x18], xmm0
call fcn.00425120
lea edx, [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp dword [ebp - 0x14], esi
ja 0x4c268a
cmp dword [ebp - 0x18], esi
ja 0x4c268a
mov dword [edi + 0x34], esi
jmp 0x4c26c1
push esi
push 0x64
pop esi
push esi
push dword [edi + 0x24]
push dword [edi + 0x20]
call fcn.0064d190
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edx
push eax
call fcn.0064d1d0
test edx, edx
jb 0x4c26b7
ja 0x4c26b1
cmp eax, esi
jbe 0x4c26b7
and dword [ebp - 0x1c], 0
jmp 0x4c26bc
mov esi, eax
mov dword [ebp - 0x1c], edx
mov dword [edi + 0x34], esi
xor esi, esi
cmp dword [edi + 0x2c], ebx
jne 0x4c2717
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount64]
je 0x4c26e7
call ebx
sub eax, dword [edi + 0x38]
sbb edx, dword [edi + 0x3c]
cmp edx, esi
ja 0x4c26e7
jb 0x4c2717
cmp eax, 0xfa
jb 0x4c2717
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
lea edx, [ebp - 0x10]
mov eax, dword fs:[0x2c]
push edx
push ecx
mov esi, dword [eax]
mov eax, dword [ecx]
inc dword [esi + 4]
call dword [eax + 0xc]
dec dword [esi + 4]
test eax, eax
je 0x4c271a
call ebx
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c414f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6990db
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov esi, ecx
mov ebx, dword [ebp + 8]
movzx eax, bx
mov dword [ebp - 0x10], eax
cmp eax, 4
jae 0x4c426b
mov eax, ebx
mov ecx, 0x7f0000
and eax, 0xffff0000
or eax, ecx
cmp eax, ecx
jne 0x4c426b
lea eax, [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4c41cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x4c4270
mov edx, dword [ebp - 0x18]
xor edi, edi
mov ecx, dword [ebp - 0x1c]
cmp edx, edi
jg 0x4c41eb
jl 0x4c41e1
cmp ecx, edi
jae 0x4c41eb
mov edi, 0x8000ffff
jmp 0x4c4270
xor eax, eax
mov dword [esi + 0x40], ecx
cmp dword [ebp - 0x10], eax
mov dword [esi + 0x44], edx
setne al
mov dword [esi + 0x18], eax
mov eax, ebx
and eax, 0x100000
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
je 0x4c4219
or dword [esi + 0x14], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0x14], eax
mov ecx, dword [esi + 0x7c]
cmp ecx, ebx
je 0x4c4250
mov dword [ebp - 4], edi
test ebx, ebx
je 0x4c4239
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
mov ecx, dword [esi + 0x7c]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4c424d
mov dword [esi + 0x7c], edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x7c], ebx
test dword [ebp + 8], 0x20000
jne 0x4c4270
push edi
add esi, 0x24
push edi
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [esi + 0x18], 1
jmp 0x4c4270
mov edi, 0x80070057
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c5358
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
je 0x4c53a6
lea eax, [ebp - 8]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4c5390
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x4c53a6
mov eax, dword [ebp - 4]
test eax, eax
jl 0x4c53a6
mov ecx, dword [ebp - 8]
jg 0x4c53a0
test ecx, ecx
jb 0x4c53a6
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c99d0
Capabilities:
Get common file path

Disassembly:
xor eax, eax
mov word [ecx], ax
cmp dword [0x829518], eax
je 0x4c99ef
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
setne al
ret
jmp fcn.004c9cb6

Function at 0x4c9a09
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x100
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x904]
push eax
call fcn.0064f890
add esp, 0xc
lea edx, [ebp - 0x804]
mov ecx, esi
xor edi, edi
push 0x400
call fcn.00437c04
push 0x5c
pop esi
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0064e75b
pop ecx
pop ecx
test eax, eax
je 0x4c9a75
xor ecx, ecx
mov dword [ebp + edi*4 - 0x904], eax
mov word [eax], cx
inc edi
cmp edi, 0x40
jge 0x4c9ac9
test eax, eax
je 0x4c9aad
lea ecx, [ebp - 0x804]
call fcn.004c9998
test eax, eax
js 0x4c9a55
jmp 0x4c9aad
mov eax, dword [ebp + edi*4 - 0x908]
dec edi
push 0
mov word [eax], si
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4c9ab7
cmp edi, 1
jg 0x4c9a8f
xor eax, eax
inc eax
jmp 0x4c9acb
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
jmp 0x4c9acb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret
Function at 0x4c9adb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edx, [ebp - 0x20c]
push 0x104
mov word [ebp - 0x20c], ax
call fcn.00437c04
mov edi, eax
push 0x5c
pop ebx
cmp bx, word [edi - 2]
jne 0x4c9b1d
add edi, 0xfffffffe
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x20c]
mov esi, edi
cmp edi, eax
jbe 0x4c9b58
cmp bx, word [esi]
jne 0x4c9b42
xor eax, eax
lea ecx, [ebp - 0x20c]
mov word [esi], ax
call fcn.004c99f4
test eax, eax
jne 0x4c9b51
sub esi, 2
lea eax, [ebp - 0x20c]
cmp esi, eax
ja 0x4c9b29
jmp 0x4c9b54
mov word [esi], bx
cmp esi, edi
ja 0x4c9b8c
xor eax, eax
cmp word [esi], ax
jne 0x4c9b85
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4c9b80
lea ecx, [ebp - 0x20c]
call fcn.004c99f4
test eax, eax
je 0x4c9ba0
mov word [esi], bx
xor eax, eax
add esi, 2
cmp esi, edi
jbe 0x4c9b5a
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x4c9b8f

Function at 0x4c9ba4
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
mov ebx, ecx
mov word [ebx], ax
call fcn.004c99d0
test al, al
jne 0x4c9bc2
xor eax, eax
jmp 0x4c9c79
cmp dword [0x829518], 0
je 0x4c9bd3
xor eax, eax
inc eax
jmp 0x4c9c79
push esi
mov ecx, ebx
call fcn.004319dc
mov esi, eax
mov dword [ebp - 4], eax
test esi, esi
jle 0x4c9c7e
push edi
push 0x5c
pop eax
mov edi, 0x104
cmp word [ebx + esi*2 - 2], ax
je 0x4c9c04
cmp esi, edi
je 0x4c9c24
mov word [ebx + esi*2], ax
inc esi
mov dword [ebp - 4], esi
push ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], esi
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.004c9c8b
mov ecx, eax
call fcn.0043cc45
cmp dword [eax], edi
jle 0x4c9c28
xor eax, eax
jmp 0x4c9c77
push 6
lea edi, [ebx + esi*2]
mov esi, str.Content.MSO
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.004c99f4
test eax, eax
jne 0x4c9c62
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, ebx
call fcn.004c9998
or eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [ebx + eax*2 + 0x16], cx
xor ecx, ecx
mov word [ebx + eax*2 + 0x18], cx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x14428f
call fcn.00422704
int3
Function at 0x4c9fd4
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a1e8d
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
test edi, edi
jg 0x4ca015
xor eax, eax
jmp 0x4ca0c7
cmp esi, ebx
je 0x4ca01e
xor eax, eax
mov word [esi], ax
cmp edi, 0x104
jl 0x4ca03a
push esi
push 0
push 0x6fe40c
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x4ca0c7
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.0064f890
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push 0x6fe40c
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
test ebx, ebx
je 0x4ca0c5
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x21c]
jne 0x4ca07c
sub ecx, edx
sar ecx, 1
cmp ecx, edi
jl 0x4ca0b7
mov eax, dword [0x81cf10]
mov ecx, 0x81cf10
push 0x3ca797
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4ca00e
push edi
mov edx, esi
lea ecx, [ebp - 0x218]
call fcn.00437c04
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4ca36d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a1ef3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov word [edi], ax
test esi, esi
js 0x4ca475
cmp esi, 0x1a
je 0x4ca3dd
cmp esi, 0x1c
je 0x4ca3dd
cmp esi, 0x23
je 0x4ca3dd
cmp esi, 5
je 0x4ca3dd
cmp esi, 0x27
je 0x4ca3dd
cmp esi, 6
je 0x4ca3dd
cmp esi, 0x10
je 0x4ca3dd
mov eax, dword [0x81cf10]
mov ecx, 0x81cf10
push 0x3ca4d6
call dword [eax + 4]
push ecx
push edi
xor ebx, ebx
mov ecx, 0x82a2a0
push esi
mov dword [ebp - 4], ebx
call fcn.004ca214
test eax, eax
je 0x4ca463
cmp eax, 2
je 0x4ca45e
or dword [ebp - 4], 0xffffffff
mov eax, esi
push edi
push ebx
push ebx
or eax, 0x8000
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test ebx, ebx
jns 0x4ca418
mov eax, ebx
jmp 0x4ca463
mov ecx, edi
call fcn.004319dc
push 0x5c
pop edx
test eax, eax
je 0x4ca438
cmp word [edi + eax*2 - 2], dx
je 0x4ca443
lea ecx, [eax + 1]
cmp ecx, 0x104
jge 0x4ca443
mov word [edi + eax*2], dx
xor edx, edx
mov word [edi + eax*2 + 2], dx
push edi
push esi
mov ecx, 0x82a2a0
mov dword [ebp - 4], 2
call fcn.004ca17c
jmp 0x4ca414
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x3ca4d4
call fcn.00422704
int3
Function at 0x4da52d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a27a6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
push ecx
xor edi, edi
push ecx
mov dword [ebp - 0x1c], edi
call fcn.00450873
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4da572
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
cmp dword [eax], edi
je 0x4da583
mov ebx, 0x80004005
jmp 0x4da642
cmp byte [esi + 0x30], 0
je 0x4da579
inc dword [esi + 0x2c]
test byte [esi + 0x2c], 0x3f
jne 0x4da59a
push edi
mov ecx, esi
call fcn.004da65f
lea eax, [ebp + 0x10]
mov dword [ebp - 4], edi
push eax
lea ecx, [esi + 0x20]
mov dword [ebp + 0x10], edi
call fcn.004cb874
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
sub eax, ecx
sar eax, 2
dec eax
lea eax, [ecx + eax*4]
jmp 0x4da5dc
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x4da5ea
mov ebx, 0x8007000e
jmp 0x4da642
lea eax, [ebp - 0x1c]
mov ebx, edi
push eax
push edi
push dword [ebp + 0xc]
push 0x4e25cb
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
jne 0x4da625
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x4da637
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4da633
mov dword [eax], ecx
mov eax, edi
jmp 0x4da63a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4da642
add dword [esi + 0x24], 0xfffffffc
mov ecx, esi
call fcn.004508a2
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4dd992
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695730
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x816078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
and dword [ebp - 4], 0
xor eax, eax
mov esi, dword [ebp + 8]
inc eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x6df07c
and dword [ebx + 0x14], 0
mov dword [ebx], 0x703540
mov dword [ebx + 0x10], 0x703568
mov dword [ebx + 0x18], esi
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebx + 0x20], 0x6df07c
mov dword [ebx], 0x703460
mov dword [ebx + 0x10], 0x703488
mov dword [ebx + 0x20], 0x703450
mov eax, dword [esi + 0x20]
mov esi, dword [esi + 0x14]
mov edi, dword [eax + 0x428]
xor eax, eax
push eax
push eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
and dword [ebx + 0x48], 0
lea eax, [esi + 0x10]
mov dword [ebx + 0x4c], eax
lea ecx, [ebx + 0x50]
mov eax, dword [ebp + 0xc]
push eax
push str._BootPulsar
push edi
mov dword [ebx + 0x454], eax
call fcn.004dcefb
mov dword [ebx + 0x450], eax
xor eax, eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x458], eax
mov byte [ebx + 0x45c], al
mov eax, ebx
mov dword [ebx + 0x460], 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8