joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47a4c0
sub ecx, edx
lea edx, [ebp - 0x20c]
sar ecx, 1
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x47a4e0
sub edx, esi
sar edx, 1
lea ebx, [edx + 0x13]
add ebx, ecx
lea eax, [ebx + ebx]
push eax
call fcn.004c8c9a
mov esi, eax
lea eax, [ebp - 0x206]
push 0x5c
push eax
call fcn.004c55d8
push 0xc
xor ecx, ecx
push 0x50f604
push edi
mov word [eax], cx
call fcn.004c94d0
add esp, 0x18
test eax, eax
jne 0x47a55b
lea eax, [edi + 2]
push 0x5c
push eax
call fcn.004c55d8
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x50f620
push ebx
push esi
call fcn.00415290
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 4
push 0x4fc4f4
push edi
call fcn.004c928a
add esp, 0xc
test eax, eax
jne 0x47a590
lea eax, [edi + 8]
push eax
push ebx
push esi
call fcn.004c905a
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
cmp word [edi], 0x5c
push edi
jne 0x47a5a6
movzx eax, word [ebp - 0x20c]
push eax
push 0x50f62c
jmp 0x47a5b2
lea eax, [ebp - 0x20c]
push eax
push 0x50f638
push ebx
push esi
call fcn.00415290
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret

Function at 0x47a5d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 0x4fbd20
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004c905a
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 4]
mov ebx, dword [ebp + 0x18]
add esp, 0xc
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov dword [ebx], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp + 0x14], eax
test eax, eax
jne 0x47a61a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.004c8c9a
add esp, 4
mov esi, eax
push esi
push dword [ebp + 0x14]
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x47a6a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x30]
push dword [esi + 0x34]
call fcn.004902b0
push 0x4fc65c
push esi
call fcn.00492890
add esp, 0x18
test eax, eax
jne 0x47a66d
push 0x50f368
push esi
call fcn.00492890
add esp, 8
test eax, eax
je 0x47a678
push eax
call fcn.004c8c20
mov dword [edi], eax
add esp, 4
push 0x4fc67c
push esi
call fcn.00492890
add esp, 8
test eax, eax
jne 0x47a69c
push 0x50f390
push esi
call fcn.00492890
add esp, 8
test eax, eax
je 0x47a6a7
push eax
call fcn.004c8c20
mov dword [ebx], eax
add esp, 4
push esi
call fcn.004c8c7f
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47aa90
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
call fcn.004c8c20
mov esi, eax
add esp, 4
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47aab0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
push esi
call fcn.004c9a09
push 0x501dcc
push esi
call fcn.004c5729
add esp, 0x10
test eax, eax
je 0x47aba7
mov esi, dword [ebp + 0xc]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47aae7
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x2e]
mov dword [ebp - 0xc], eax
add eax, eax
push eax
call fcn.004c8c9a
push esi
push 0x50d278
push dword [ebp - 0xc]
mov ebx, eax
push ebx
call fcn.00415290
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47ac26
push 0x501d88
push dword [ebp - 4]
call fcn.00478c70
mov edi, eax
add esp, 8
test edi, edi
jne 0x47ac26
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0x50f308
push dword [ebp - 0xc]
push ebx
call fcn.00415290
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47ac26
push 0x501d88
push dword [ebp - 4]
call fcn.00478c70
add esp, 8
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47ac26
push 5
push dword [ebp + 0xc]
push dword [0x556ab8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x47abc6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push eax
call esi
push dword [ebp - 8]
call fcn.004c8c9a
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x47ac26
lea ecx, [esi + esi]
push ecx
call fcn.004c8c9a
add esp, 4
mov edi, eax
push esi
push edi
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
call fcn.004c8c7f
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47ac83
push 0
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
mov ebx, eax
test ebx, ebx
je 0x47ac83
lea ecx, [ebx + ebx]
push ecx
call fcn.004c8c9a
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push ebx
push esi
call fcn.004c97d5
push edi
call fcn.004c8c7f
add esp, 0xc
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x80c]
xor esi, esi
push eax
push 0x20019
push esi
push 0x50f528
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47ba92
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x810]
push eax
push esi
lea eax, [ebp - 0x814]
mov dword [ebp - 0x808], 0x400
push eax
push esi
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x80c]
call edi
test eax, eax
jne 0x47ba85
nop dword [eax + eax]
lea eax, [esi*8 + 0x10]
push eax
push dword [0x555a20]
call fcn.004c8ca5
mov dword [0x555a20], eax
lea eax, [ebp - 0x804]
push eax
call fcn.004c8c20
mov ecx, dword [0x555a20]
mov dword [ecx + esi*8], eax
push dword [ebp - 0x810]
call fcn.004c8c9a
mov ecx, dword [0x555a20]
add esp, 0x10
mov dword [ecx + esi*8 + 4], eax
lea eax, [ebp - 0x810]
add dword [ebp - 0x808], 2
push eax
mov eax, dword [0x555a20]
push dword [eax + esi*8 + 4]
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x80c]
call edi
mov eax, dword [0x555a20]
mov dword [eax + esi*8 + 8], 0
lea eax, [ebp - 0x810]
push eax
push 0
lea eax, [ebp - 0x814]
mov dword [ebp - 0x808], 0x400
push eax
push 0
lea eax, [ebp - 0x808]
inc esi
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x80c]
call edi
test eax, eax
je 0x47b9c0
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c3287
mov esp, ebp
pop ebp
ret

Function at 0x47bab0
Capabilities:
Persist via image file execution options registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004c52c0
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00478bb0
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
push 0x50f400
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x47bb6f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47bb10
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0x5019a4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x47bb5e
cmp byte [ebp + 0xc], 0
je 0x47bb8f
push esi
jmp 0x47bb76
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x47bb8f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [0x555ec8]
push 0x50f4e8
call fcn.004aad00
add esp, 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.004c3287
mov esp, ebp
pop ebp
ret
Function at 0x47bba0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x418]
push eax
push 0x50f400
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47bd4d
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x5019a4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47bd41
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004c9a09
add esp, 8
lea eax, [ebp - 0x20a]
push 0x102
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x22
push 0x502150
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004d6277
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004c9a09
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.004c5688
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004c5688
add esp, 0x24
test eax, eax
je 0x47bd41
test esi, esi
je 0x47bd41
mov cx, word [esi]
cmp cx, word [eax]
jne 0x47bcba
test cx, cx
je 0x47bcb6
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x47bcba
add esi, 4
add eax, 4
test cx, cx
jne 0x47bc94
xor eax, eax
jmp 0x47bcbf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47bd41
push dword [ebp - 0x418]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x41c]
push eax
push 0x50f400
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47bd16
push 0x5019a4
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x41c]
call esi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [0x555ec8]
push 0x50f4ac
call fcn.004aad00
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004c3287
mov esp, ebp
pop ebp
ret
Function at 0x47c020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00478bb0
mov eax, dword [ebp + 0xc]
add esp, 8
mov dword [ebp - 0x434], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x414]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x450]
push eax
movlpd qword [ebp - 0x430], xmm0
movlpd qword [ebp - 0x428], xmm0
movlpd qword [ebp - 0x420], xmm0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x44c], 0x40
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0x4fc0e8
mov dword [ebp - 0x43c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
test eax, eax
jne 0x47c0e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x47c0f7
push 0xffffffffffffffff
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
Function at 0x47c150
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x24
push ebx
mov ebx, dword [ecx + 0xb4]
push esi
push edi
xor edi, edi
test ebx, ebx
jne 0x47c16e
mov ebx, dword [ecx + 0xe4]
mov esi, dword [0x550f44]
test esi, esi
je 0x47c237
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0xc], eax
nop
cmp dword [ecx + 0xb4], 0
je 0x47c1b1
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x47c1b1
push ebx
push eax
call fcn.004c9380
add esp, 8
test eax, eax
je 0x47c1c9
mov eax, dword [esi + 0xe4]
test eax, eax
je 0x47c224
push ebx
push eax
call fcn.004c9380
add esp, 8
test eax, eax
jne 0x47c224
push dword [esi + 0x338]
call fcn.004c8c7f
add esp, 4
cmp word [edi], 0
je 0x47c1e8
push edi
call fcn.004c8c20
add esp, 4
jmp 0x47c1ea
xor eax, eax
mov dword [esi + 0x338], eax
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push 0x1053
push dword [0x555ecc]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, 0xffffffff
je 0x47c224
push 0xffffffffffffffff
push eax
push 0x7eb
push dword [0x555ec8]
call dword [ebp - 0xc]
mov esi, dword [esi + 0x5c0]
mov ecx, dword [ebp + 8]
test esi, esi
jne 0x47c190
xor edi, edi
mov ecx, dword [0x555a20]
test ecx, ecx
je 0x47c278
cmp dword [ecx], 0
je 0x47c278
xor eax, eax
nop dword [eax + eax]
push ebx
push dword [eax + ecx]
call fcn.004c9380
add esp, 8
test eax, eax
je 0x47c30d
mov ecx, dword [0x555a20]
inc edi
lea eax, [edi*8]
cmp dword [eax + ecx], 0
jne 0x47c250
mov esi, dword [ebp + 0xc]
shl edi, 3
test ecx, ecx
je 0x47c288
cmp dword [edi + ecx], 0
jne 0x47c2c6
lea eax, [edi + 0x10]
push eax
push ecx
call fcn.004c8ca5
push ebx
mov dword [0x555a20], eax
call fcn.004c8c20
mov ecx, dword [0x555a20]
push esi
mov dword [edi + ecx], eax
call fcn.004c8c20
mov ecx, dword [0x555a20]
add esp, 0x10
mov dword [edi + ecx + 4], eax
mov eax, dword [0x555a20]
mov dword [edi + eax + 8], 0
lea eax, [ebp - 4]
push eax
push 0x50f528
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x47c371
mov edx, dword [0x555a20]
add edx, edi
mov esi, dword [edx + 4]
cmp word [esi], ax
jne 0x47c33c
push dword [edx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x555a20]
push dword [eax + edi*8 + 4]
call fcn.004c8c7f
mov esi, dword [ebp + 0xc]
push esi
call fcn.004c8c20
mov ecx, dword [0x555a20]
add esp, 8
mov dword [ecx + edi*8 + 4], eax
mov ecx, dword [0x555a20]
jmp 0x47c27b
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47c341
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push dword [edx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48af20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 4
push 0x5554be
push 0x511910
mov dword [ebp - 4], 0
call fcn.004c94d0
mov edi, dword [sym.imp.USER32.dll_DialogBoxParamW]
add esp, 0xc
test eax, eax
jne 0x48afb0
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x5552b4
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.004c8c9a
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push 0x5552b4
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x48afa5
cmp dword [ebx + 0x30], 0x60000
jae 0x48afa5
cmp dword [ebp + 8], 0
push 0
push 0x453640
push 0
jne 0x48af98
push 0x51191c
jmp 0x48af9d
push 0x511944
push dword [0x5509e8]
call edi
push ebx
call fcn.004c8c7f
add esp, 4
pop esi
pop ebx
cmp byte [0x5554bc], 0
jne 0x48aff9
cmp dword [0x55b150], 0
je 0x48afcc
cmp word [0x5554be], 0
jne 0x48aff9
push 0
push 0x453640
push 0
push 0x51191c
push dword [0x5509e8]
call edi
push 1
push dword [0x555ec8]
mov byte [0x5554bc], 1
call fcn.00473fd0
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x493300
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0x4904a0
push 0
push 0
call fcn.004d6048
add esp, 0x18
mov esi, eax
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x493363
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x20
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x493da0
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x434], ecx
mov ecx, dword [ebp + 0x14]
push eax
mov dword [ebp - 0x43c], ecx
mov ecx, dword [ebp + 0x18]
push 8
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x440], ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x438], ebx
cmp ebx, 0xffffffff
jne 0x493dfe
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push esi
push edi
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x428
push eax
push ebx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x493f89
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push 4
push 0x4fc4f4
push eax
call fcn.004c928a
add esp, 0xc
test eax, eax
jne 0x493e47
lea eax, [ebp - 0x204]
jmp 0x493ebd
push 0xc
lea eax, [ebp - 0x20c]
push 0x51336c
push eax
call fcn.004c94d0
add esp, 0xc
test eax, eax
jne 0x493eb7
lea esi, [ebp - 0x20c]
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x493e70
push 0
push 0
sub esi, ecx
push 0x513388
sar esi, 1
call ebx
inc eax
add esi, eax
lea eax, [esi + esi]
push eax
call fcn.004c8c9a
add esp, 4
mov edi, eax
push esi
push edi
push 0x513388
call ebx
lea eax, [ebp - 0x1f6]
push eax
push esi
push edi
call fcn.004d6277
add esp, 0xc
jmp 0x493ec8
lea eax, [ebp - 0x20c]
push eax
call fcn.004c8c20
mov edi, eax
add esp, 4
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
test ebx, ebx
je 0x493f0b
lea ecx, [ebx*2 + 2]
push ecx
call fcn.004c8c9a
add esp, 4
mov esi, eax
lea eax, [ebx + 1]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push edi
call fcn.004c8c7f
push 2
push 0
mov edi, esi
call fcn.004c3279
add esp, 0xc
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x424], eax
jne 0x493f2c
push edi
push dword [ebp - 0x434]
call fcn.004c9380
add esp, 8
test eax, eax
je 0x493f4f
push 2
push edi
call fcn.004c3279
mov ebx, dword [ebp - 0x438]
lea eax, [ebp - 0x42c]
add esp, 8
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
jmp 0x493e17
mov ecx, dword [ebp - 0x43c]
mov eax, dword [ebp - 0x418]
push 2
push edi
mov dword [ecx], eax
mov ecx, dword [ebp - 0x440]
mov eax, dword [ebp - 0x414]
mov dword [ecx], eax
call fcn.004c3279
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret
Function at 0x4b8800
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 2
mov esi, ecx
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0x88]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esi + 0x98]
lea edi, [edx + eax*8]
mov eax, dword [edi]
mov eax, dword [eax + 0x7c]
cmp dword [eax - 0xc], 0
jne 0x4b8852
push 0x10
push 0x4fc6f4
push 0x516ba0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004c52c0
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0x5153ec
mov dword [ebp - 0x38], 0xc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4b8a10
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f90dd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x53ba20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx + 0x88]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x98]
lea esi, [ecx + eax*8]
mov eax, dword [esi]
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 0x24]
push eax
push 0
push 2
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
mov dword [ebp - 4], 0
call fcn.0042dbe0
mov ecx, eax
test ecx, ecx
je 0x4b8b56
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
push dword [ebp - 0x14]
test edi, edi
jne 0x4b8ac6
lea eax, [ebp - 0x10]
push 0x516be4
push eax
call fcn.0042da10
mov esi, dword [ebp - 0x10]
add esp, 0xc
push 0x10
push 0x4fc6f4
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4b8b28
mov eax, dword [esi]
mov edx, 0x516c84
mov ecx, 0x516c74
cmp dword [eax + 0x74], 0
lea eax, [ebp - 0x10]
cmovle ecx, edx
push ecx
push 0x516c98
push eax
call fcn.0042da10
mov esi, dword [ebp - 0x10]
add esp, 0x10
push 0x134
push 0x4fc6f4
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4b8b21
mov eax, dword [ebp - 0x18]
push 0
push edi
mov eax, dword [eax]
cmp dword [eax + 0x74], 0
jle 0x4b8b1c
call sub.ntdll.dll_NtResumeThread
jmp 0x4b8b21
call sub.ntdll.dll_NtSuspendThread
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b8b40
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.0042d2e0
int3