joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b780
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
mov dword [edi + 0xc], 0
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x45b7a6
mov eax, dword [edi + 0x10]
lea ecx, [edi + 0x10]
push edx
call dword [eax + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x45b80e
cmp dword [ebp - 4], eax
jbe 0x45b803
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x45b803
mov dword [ebx + 0xc], 0xffffffff
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call fcn.0051a0bd
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [ebp + 8], eax
test eax, eax
je 0x45b898
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [edx + 0xc], ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
jne 0x45b854
cmp dword [edi + 0x24], ecx
mov ecx, 0x580994
je 0x45b854
mov ecx, dword [edi + 0x1c]
cmp ebx, ecx
je 0x45b898
mov dword [edi + 0xc], 0
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x45b870
mov eax, dword [edi + 0x10]
push ecx
lea ecx, [edi + 0x10]
call dword [eax + 0xc]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
test ebx, ebx
je 0x45b898
cmp word [ebx], 0
je 0x45b898
push ebx
lea ecx, [edi + 0x10]
call fcn.004993c0
push ebx
call fcn.00513d93
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45b8b0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
or edx, 0x20000000
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
mov eax, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push edx
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x45b8fe
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
jbe 0x45b918
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x45b918
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x465bc0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558b7c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5bf364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
mov dword [ebp - 0x20], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 2
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 4
lea eax, [edi + 0x20]
mov dword [ebp - 0x24], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 5
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 7
lea ebx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0x24], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x465c92
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov byte [ebp - 4], 9
lea ecx, [edi + 0x68]
mov al, byte [ebp + 0x34]
push 9
mov byte [edi + 0x60], al
mov dword [ebp - 0x14], ecx
call fcn.004642d0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xd]
push eax
mov ecx, esi
mov byte [ebp - 0xd], 1
call fcn.00470350
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x465ce2
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov dword [ebp + 0x30], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x47ac00
Capabilities:
Terminate process

Disassembly:
call fcn.0047ac40
test eax, eax
jle 0x47ac34
push esi
push edi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
pop edi
setne al
pop esi
ret
xor eax, eax
ret
Function at 0x486730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov eax, dword [0x5bf364]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
xor eax, eax
push esi
push edi
cmp dword [0x5cef88], eax
jne 0x48691b
xorps xmm0, xmm0
mov dword [esp + 0x40], 1
movups xmmword [esp + 0x4c], xmm0
lea edx, [esp + 0x40]
mov dword [esp + 0x44], eax
movq qword [esp + 0x5c], xmm0
movaps xmm0, xmmword [0x5951b0]
movups xmmword [esp + 0x64], xmm0
mov dword [esp + 0x48], 2
xorps xmm0, xmm0
mov dword [esp + 0x74], 0x14
movups xmmword [esp + 0x78], xmm0
mov dword [esp + 0xa8], 0x1a
movaps xmm0, xmmword [0x5951c0]
movups xmmword [esp + 0x88], xmm0
mov dword [esp + 0x28], 3
movaps xmm0, xmmword [0x595160]
movups xmmword [esp + 0x98], xmm0
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], 9
mov dword [esp + 0x34], 0x5c7ba0
mov dword [esp + 0x38], 0x5cad20
mov dword [esp + 0x3c], 0x5c7d20
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
nop
mov esi, dword [esp + eax + 0x28]
mov ecx, dword [esp + eax + 0x34]
xor eax, eax
mov dword [esp + 0x10], eax
test esi, esi
jle 0x486862
mov eax, dword [edx + eax*4]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
nop
mov edi, dword [edx + ebx*4]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
add ecx, 0xc
sub esi, 1
jne 0x486827
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + eax + 0x28]
cmp ebx, esi
jl 0x486820
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jl 0x486812
mov eax, dword [esp + 0x18]
add edx, 0x24
add eax, 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
cmp eax, 0xc
jl 0x486800
call fcn.004814c0
xor edi, edi
mov dword [esp + 0x10], edi
mov ecx, edi
mov ebx, 0x10
sar ebx, cl
mov eax, 0x40
sar eax, cl
xor esi, esi
mov ecx, dword [edi*4 + 0x583a60]
mov dword [esp + 0x1c], ecx
test ebx, ebx
jle 0x486901
movd xmm1, eax
mov edi, ecx
cvtdq2pd xmm1, xmm1
movsd qword [esp + 0x20], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, esi
addsd xmm0, xmm0
addsd xmm0, qword [0x594e98]
mulsd xmm0, qword [0x594f28]
divsd xmm0, xmm1
call fcn.0053ccf0
movsd xmm1, qword [0x594e98]
addsd xmm0, xmm0
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movsd xmm1, qword [esp + 0x20]
movss dword [edi + esi*4], xmm0
inc esi
cmp esi, ebx
jl 0x4868b5
mov edi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 5
jl 0x486884
mov dword [0x5cef88], 1
xor eax, eax
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0050ec8c
mov esp, ebp
pop ebp
ret
Function at 0x494b40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x5bf364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x400000
mov dword [0x5c6700], 0x5937c4
mov dword [0x5c6708], 0x593c50
push 0
mov dword [ebp - 0x14], 0x5c6700
mov dword [0x5c671c], 1
mov dword [0x5c6718], 0x100
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x494dee
lea eax, [ecx + 0x400000]
mov dword [0x5c6714], ecx
mov dword [0x5c6710], eax
mov edx, 0x1555
mov eax, dword [0x5c6718]
mov dword [0x5c670c], ecx
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x5c6718]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x5c6718]
add ecx, eax
add eax, ecx
mov dword [ecx], eax
mov eax, dword [0x5c6718]
add ecx, eax
sub edx, 1
jne 0x494bd4
mov dword [ecx], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0x5c6720
mov dword [ebp - 0x18], 0x5c6720
mov dword [ebp - 0x1c], 0x5c6720
mov dword [0x5c6720], 0x587da8
mov dword [0x5c6724], edx
mov dword [0x5c6728], edx
mov byte [ebp - 4], 1
mov dword [0x5c6720], 0x587ce8
mov dword [0x5c672c], edx
mov dword [0x5c6734], edx
mov dword [0x5c6730], edx
mov dword [0x5c6738], 0x40
mov byte [ebp - 4], 2
mov dword [0x5c6738], 0x80
mov byte [ebp - 4], 5
mov dword [0x5c673c], edx
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x5c6750
mov dword [ebp - 0x20], 0x5c6750
call esi
mov byte [ebp - 4], 7
mov dword [0x5c6768], 0
mov byte [ebp - 4], 8
push 0x5c6774
mov dword [ebp - 0x24], 0x5c6774
call esi
mov byte [ebp - 4], 9
mov dword [0x5c678c], 0x3e8
mov dword [ebp - 0x28], 0x5c67a0
mov dword [ebp - 0x2c], 0x5c67a0
mov dword [0x5c67a0], 0x587da8
mov dword [0x5c67a4], 0
mov dword [0x5c67a8], 0
mov byte [ebp - 4], 0xa
mov dword [0x5c67a0], 0x587ce8
mov dword [0x5c67ac], 0
mov dword [0x5c67b4], 0
mov dword [0x5c67b0], 0
mov dword [0x5c67b8], 0x40
mov byte [ebp - 4], 0xb
mov dword [0x5c67b8], 0x80
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov dword [0x5c6794], 0x3e80
mov dword [0x5c6798], 1
mov dword [0x5c679c], 0
lea eax, [eax*2 + 2]
mov dword [0x5c6790], eax
mov byte [ebp - 4], 0xe
push 0x5c67bc
call esi
mov byte [ebp - 4], 0xf
push ecx
mov ecx, 0x5c67d4
call fcn.004247f0
mov byte [ebp - 4], 0x10
mov dword [0x5c6740], 0
mov dword [0x5c67fc], 0
movsd xmm0, qword [0x594e98]
movsd qword [0x5c6748], xmm0
xorps xmm0, xmm0
mov dword [0x5c6800], 0
mov dword [0x5c6804], 0
mov dword [0x5c6808], 0
mov dword [0x5c6744], 0
movq qword [0x5c676c], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, 0x5c6700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00519c88
int3
Function at 0x495840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esi + 0x14], 0
test ebx, ebx
jne 0x49585f
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0xc
mov eax, dword [ecx]
push edi
xor edi, edi
call dword [eax]
push dword [ebp + 0x10]
mov ecx, eax
movzx eax, bx
push eax
push ecx
mov dword [ebp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x495935
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x495935
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x49592c
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [esi + 0x14], 0
cmp dword [esi + 0x10], edi
jl 0x495910
cmp edi, 1
jne 0x4958d5
mov eax, dword [esi + 0xc]
mov cl, byte [ebx]
mov byte [eax], cl
inc dword [esi + 0x14]
jmp 0x495927
cmp edi, 2
jne 0x4958e8
mov eax, dword [esi + 0xc]
movzx ecx, word [ebx]
mov word [eax], cx
add dword [esi + 0x14], edi
jmp 0x495927
cmp edi, 4
jne 0x4958f9
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov dword [eax], ecx
add dword [esi + 0x14], edi
jmp 0x495927
cmp edi, 8
jne 0x495910
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
add dword [esi + 0x14], edi
jmp 0x495927
test edi, edi
jle 0x495927
push edi
mov ecx, esi
call fcn.004992e0
push edi
push ebx
push eax
call fcn.00510fc0
add esp, 0xc
mov edi, 1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x497260
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55cd75
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push esi
push edi
mov eax, dword [0x5bf364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x497438
cmp word [esi], 0
je 0x497438
lea ecx, [ebp - 0x38]
call fcn.00405c90
mov dword [ebp - 4], 0
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x497403
cmp word [esi + 2], 0
je 0x497312
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4972c4
sub ecx, edi
mov eax, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x497312
cmp word [esi + ecx*2 - 4], 0x3a
je 0x497312
lea eax, [ecx - 1]
push eax
push esi
lea ecx, [ebp - 0x38]
call fcn.0049c620
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x49730f
cmp dword [ebp - 0x14], esi
jne 0x49730c
movzx eax, word [0x580994]
mov esi, 0x580994
jmp 0x497312
mov esi, dword [ebp - 0x1c]
movzx eax, word [esi]
movzx eax, ax
test ax, ax
je 0x497403
cmp eax, 0x5c
jne 0x49732e
cmp word [esi + 2], 0
je 0x497403
cmp word [esi + 2], 0x3a
jne 0x497352
movzx eax, word [esi + 4]
test ax, ax
je 0x497403
cmp eax, 0x5c
jne 0x497352
cmp word [esi + 6], 0
je 0x497403
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x497403
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x497403
cmp eax, 3
jne 0x4973ff
push 0x5c
push esi
call fcn.0051078b
mov edx, eax
add esp, 8
test edx, edx
je 0x4973ff
cmp word [edx + 2], 0
jne 0x4973b1
sub edx, 2
cmp edx, esi
jb 0x4973ff
nop
cmp word [edx], 0x5c
je 0x4973b1
sub edx, 2
cmp edx, esi
jae 0x4973a0
xor esi, esi
jmp 0x497408
lea ecx, [ebp - 0x64]
call fcn.00405c90
mov byte [ebp - 4], 1
sub edx, esi
sar edx, 1
lea ecx, [ebp - 0x64]
push edx
push esi
call fcn.0049c620
lea ecx, [ebp - 0x64]
call fcn.00412280
mov ecx, eax
call fcn.00497260
test eax, eax
je 0x4973f3
push 0
push esi
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00405240
jmp 0x497408
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00405240
xor esi, esi
jmp 0x497408
mov esi, 1
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541f2d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x5bf364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
test edx, edx
je 0x49790f
cmp word [edx], 0
je 0x49790f
lea ecx, [ebp - 0x38]
call fcn.00405c90
mov dword [ebp - 4], 0
cmp word [edx], 0
je 0x4978d0
cmp word [edx + 2], 0
je 0x4978d0
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497890
sub ecx, esi
sar ecx, 1
cmp word [edx + ecx*2 - 2], 0x5c
jne 0x4978d0
cmp word [edx + ecx*2 - 4], 0x3a
je 0x4978d0
lea eax, [ecx - 1]
push eax
push edx
lea ecx, [ebp - 0x38]
call fcn.0049c620
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x4978d0
cmp dword [ebp - 0x14], 0
mov edx, 0x580994
cmovne edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497930
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55cebd
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push esi
mov eax, dword [0x5bf364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test ecx, ecx
je 0x497ac2
cmp word [ecx], 0
je 0x497ac2
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x78], xmm0
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp - 0x7c], 0x44
test eax, eax
js 0x4979a9
or dword [ebp - 0x50], 1
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x38], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x38], vtable.CVolObject.0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x38]
call fcn.004993c0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0x24], ecx
cmove eax, ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x497a2f
xor esi, esi
jmp 0x497a52
push 0x1f4
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], vtable.CVolMem.0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x497a8d
mov eax, dword [ebp - 0x38]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CMStringArray.virtual_12
jne 0x497a88
mov ecx, 0x5c6708
call fcn.0049a2e0
jmp 0x497a8d
lea ecx, [ebp - 0x38]
call eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov dword [ebp - 0x38], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x497ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 8]
push eax
push 1
push 0
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x497b0c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push esi
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp + 8]
neg eax
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497b40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55cf5e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x5bf364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 9
push str.browse:__
push ebx
call fcn.005221d8
add esp, 0xc
test eax, eax
jne 0x497c7b
lea ecx, [ebp - 0x24c]
call fcn.00405c90
mov dword [ebp - 4], 0
lea eax, [ebx + 0x12]
push eax
lea ecx, [ebp - 0x24c]
mov dword [ebp - method.CMStringArray.virtual_0], vtable.CWString.0
call fcn.0049c380
mov dword [ebp - 4], 1
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.0049da60
mov byte [ebp - 4], 2
mov edx, eax
push 0x593850
lea ecx, [ebp - 0x2a4]
call fcn.0049d910
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x497bfd
cmp dword [eax + 0x24], ecx
mov ecx, 0x580994
je 0x497bfd
mov ecx, dword [eax + 0x1c]
push 1
push 0
push ecx
push str.explorer.exe
push 0x58d0c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x294]
call fcn.00405c00
mov byte [ebp - 4], 2
mov dword [ebp - method.CMStringArray.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c0]
call fcn.00405c00
mov byte [ebp - 4], 1
mov dword [ebp - method.CMStringArray.virtual_0], vtable.CVolObject.0
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x23c]
call fcn.00405c00
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - method.CMStringArray.virtual_0], vtable.CVolObject.0
mov eax, 1
jmp 0x497da6
push 0xa
push 0
push 0
push ebx
push 0x58d0c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x497c71
xor eax, eax
mov edx, str..htm
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21c]
push eax
call fcn.00497ae0
add esp, 4
test eax, eax
je 0x497da4
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x497cc2
lea eax, [ebp - 0x21c]
mov ecx, 0xa
mov esi, str._shellopencommand
mov edx, eax
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00497ae0
add esp, 4
test eax, eax
je 0x497da4
lea eax, [ebp - 0x21c]
push str.__1_
push eax
call fcn.00510851
add esp, 8
test eax, eax
jne 0x497d23
lea eax, [ebp - 0x21c]
push 0x5938f0
push eax
call fcn.00510851
add esp, 8
test eax, eax
je 0x497d2a
xor ecx, ecx
mov word [eax], cx
jmp 0x497d49
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497d33
sub ecx, edx
sar ecx, 1
lea eax, [ebp + ecx*2 - 0x21e]
push eax
lea ecx, [ebp - 0x278]
call fcn.00404cd0
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x278]
push 0x20
call fcn.0049c300
push ebx
lea ecx, [ebp - 0x278]
call fcn.0049c380
push 0xffffffffffffffff
lea ecx, [ebp - 0x278]
call fcn.00412280
mov ecx, eax
call fcn.00497930
add esp, 4
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.00405240
mov eax, esi
jmp 0x497da6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ec8c
mov esp, ebp
pop ebp
ret