joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488ba1
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x95
mov ebx, edx
push edi
push 0x722a1c
push 1
push 0xc
mov ebp, ecx
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x488c29
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x9a
mov dword [esi + 4], ebx
push edi
push 0x722aa0
push 1
push ebx
call fcn.005e7f10
add esp, 0x10
mov dword [esi], eax
test eax, eax
jne 0x488c11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea esi, [edi + 0x64]
mov edx, 0x722ac0
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722ae0
push 0x722b00
jmp 0x488c4e
push ebx
push ebp
mov edx, ebx
mov ecx, eax
call section..text
and dword [esi + 8], 0
mov eax, esi
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x722a3c
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722a5c
push 0x722a7c
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x488c8e
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x113
mov edi, ecx
push ebx
push 0x722b24
push 1
push 0x38
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x488cfb
push 0x38
push 0
push esi
call fcn.005b5fd0
add esp, 0xc
mov ecx, str.ILibProcessPipe_Manager
call fcn.00480fb6
push 4
pop ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], edi
call fcn.0048708c
mov dword [esi + 0x20], eax
mov edx, esi
mov dword [esi + 8], 0x488c65
mov ecx, edi
cmp dword [edi + 4], 0
jne 0x488cf0
call fcn.004819aa
jmp 0x488cf5
call fcn.00481758
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x722b44
push esi
push ebx
xor ecx, ecx
call fcn.00488a50
push ebx
push 0x722b64
push 0x722b84
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x488ec4
Capabilities:
Create pipe
Terminate process

Disassembly:
sub esp, 0x110
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
xor ebp, ebp
mov eax, esi
mov ebx, ecx
not eax
push edi
mov edi, ebp
cmp eax, 0x68
jbe 0x488f2f
cmp esi, 0xffffff97
jae 0x488f2f
lea eax, [esi + 0x68]
cmp eax, 0xffffffef
jae 0x488f2f
test esi, esi
je 0x488f0b
lea eax, [esi + 0x78]
cmp eax, 0xffffffef
jae 0x488f2f
push 0x19d
push 0x722c44
push 1
push 0x78
pop eax
test esi, esi
lea ecx, [eax + 0x10]
cmovg eax, ecx
add eax, esi
push eax
call fcn.005e7f10
add esp, 0x10
jmp 0x488f31
mov eax, ebp
push ebp
push esi
push 0x68
pop edx
mov ecx, eax
call fcn.004811d1
mov esi, eax
pop ecx
pop ecx
mov dword [esi + 0x1c], ebx
xor ebx, ebx
mov dword [esi + 0x2c], ebp
inc ebx
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebp
push edi
push esi
push str..pipe_p_u
lea eax, [esp + 0x28]
push 0xff
push eax
call fcn.0040117f
add esp, 0x14
lea eax, [esp + 0x10]
inc edi
push eax
push ebp
mov eax, 0x1000
push eax
push eax
push ebx
push ebp
push 0x40080001
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x48907e
cmp eax, 5
je 0x488f5a
mov ebx, 0x1ad
push ebx
push 0x722cd8
push 1
push 0x14
call fcn.005e7f10
mov edi, eax
add esp, 0x10
mov dword [esi + 0x48], edi
test edi, edi
je 0x4890aa
xor eax, eax
stosd dword es:[edi], eax
push ebp
push ebp
push 1
stosd dword es:[edi], eax
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x10], eax
test eax, eax
jne 0x489011
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
lea edi, [ebx + 2]
push esi
push edi
mov edx, 0x722d5c
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722d7c
push 0x722d9c
jmp 0x4890cf
push ebp
push 0x80
push 3
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x44], eax
cmp eax, 0xffffffff
jne 0x489063
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1b2
push esi
push edi
mov edx, 0x722dc0
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722de0
push 0x722e00
jmp 0x4890cf
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x1aa
push esi
push edi
mov edx, 0x722c74
xor ecx, ecx
call fcn.00488a50
push edi
push 0x722c94
push 0x722cb4
jmp 0x4890cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x722cf8
push esi
push ebx
xor ecx, ecx
call fcn.00488a50
push ebx
push 0x722d18
push 0x722d38
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x489d00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x1c]
xor ebx, ebx
push edi
mov dword [ebp + 0x1c], ebx
mov edi, dword [esi + 0x28]
cmp dword [ebp + 0x10], ebx
jne 0x489dd4
mov eax, dword [ebp + 0x18]
add dword [esi + 0x14], eax
push dword [esi + 0x34]
lea eax, [ebp + 0x1c]
push dword [esi + 0x30]
push eax
mov eax, dword [esi + 0xc]
push dword [esi + 0x14]
add eax, dword [esi]
push eax
call edi
mov ecx, dword [ebp + 0x1c]
add esp, 0x14
sub dword [esi + 0x14], ecx
add dword [esi + 0xc], ecx
mov eax, dword [esi + 0x14]
cmp dword [esi + 0x64], ebx
jne 0x489d51
test ecx, ecx
je 0x489d51
test eax, eax
jne 0x489d20
test eax, eax
jne 0x489d58
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x64], ebx
jne 0x489dd4
mov edx, dword [esi + 0xc]
test edx, edx
je 0x489d7a
mov ecx, dword [esi]
push eax
lea eax, [ecx + edx]
mov edx, dword [esi + 4]
push eax
call fcn.00464bc3
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
jmp 0x489da5
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x489da5
mov edi, 0x508
lea eax, [ecx + ecx]
push edi
push 0x723000
push 1
push eax
push dword [esi]
call fcn.005e80c0
add esp, 0x14
mov dword [esi], eax
test eax, eax
je 0x489ddb
shl dword [esi + 4], 1
push dword [esi + 0x60]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
add ecx, dword [esi + 0x14]
sub eax, dword [esi + 0x14]
add ecx, dword [esi]
mov edx, dword [ebp + 0xc]
push esi
push fcn.00489d00
push eax
push ecx
push dword [esi + 0x48]
mov ecx, dword [ebp + 8]
call fcn.004837cd
xor eax, eax
add esp, 0x18
inc eax
jmp 0x489dd6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x723020
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x723040
push 0x723060
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3

Function at 0x48a039
Capabilities:
Create thread
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x53f
mov edi, edx
push ebx
push 0x7230e8
push 1
push edi
mov esi, ecx
call fcn.005e7f10
mov ecx, eax
add esp, 0x10
mov dword [esi], ecx
test ecx, ecx
je 0x48a0cd
mov eax, dword [esp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], edi
test eax, eax
je 0x48a081
mov dword [esi + 0x60], eax
cmp dword [esi + 0x48], 0
je 0x48a0a8
push dword [esi + 0x60]
mov edx, dword [esi + 0x40]
push esi
push fcn.00489d00
push edi
push ecx
mov ecx, dword [esi + 0x1c]
push dword [esi + 0x48]
mov ecx, dword [ecx + 0x10]
call fcn.004837cd
add esp, 0x18
jmp 0x48a0c9
xor edi, edi
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push esi
push 0x489bbb
push edi
push edi
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x723108
push esi
push ebx
xor ecx, ecx
call fcn.00488a50
push ebx
push 0x723128
push 0x723148
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3
Function at 0x48a2f5
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
push 0xfffffffffffffffc
pop edi
test esi, esi
je 0x48a3e9
push ebp
xor ebp, ebp
cmp dword [esi + 0x24], ebp
jne 0x48a319
xor ecx, ecx
call fcn.0048708c
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x24]
call fcn.0044c7d2
mov ecx, dword [esi + 0x24]
call fcn.0048718e
test eax, eax
je 0x48a348
mov edx, dword [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00488ba1
mov ecx, dword [esi + 0x24]
mov edx, eax
push ebp
call fcn.0048733f
pop ecx
pop ecx
jmp 0x48a3b6
push dword [esi + 0x48]
push ebp
push dword [esp + 0x1c]
push ebx
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x48a364
xor edi, edi
inc edi
jmp 0x48a3b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x48a3bd
mov edx, dword [esp + 0x14]
mov edi, ebp
push ecx
mov ecx, ebx
call fcn.00488ba1
mov ecx, dword [esi + 0x24]
mov edx, eax
push ebp
call fcn.0048733f
mov edx, 0x600
mov ecx, 0x7231b0
call fcn.004834cd
mov edx, dword [esi + 0x48]
mov ecx, dword [esi + 0x1c]
push eax
push esi
mov edx, dword [edx + 0x10]
mov ecx, dword [ecx + 0x10]
push 0x4899d7
push 0xffffffffffffffff
call fcn.00483cc9
add esp, 0x18
mov ecx, dword [esi + 0x24]
mov dword [ecx], ebp
jmp 0x48a3e8
mov eax, dword [esi + 0x24]
mov dword [eax], ebp
cmp dword [esi + 0x2c], ebp
je 0x48a3e1
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x48a3dc
mov edx, dword [esi + 0x48]
mov ecx, dword [ecx + 0x10]
mov edx, dword [edx + 0x10]
call fcn.00483e34
push esi
call dword [esi + 0x2c]
pop ecx
mov ecx, esi
call fcn.00488d2f
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x48a885
Capabilities:
Clear file content
Write file on windows

Disassembly:
sub esp, 0x50
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x60]
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
push edi
push 2
mov edi, ecx
mov dword [esp + 0x18], edx
push 0
push edi
mov dword [esp + 0x1c], eax
call fcn.005e2940
push edi
call fcn.005c3d10
mov ecx, dword [esp + 0x74]
add esp, 0x10
mov ebx, dword [esp + 0x6c]
add ecx, 0x3c
mov esi, dword [sym.imp.WS2_32.dll_htonl]
add ecx, ebx
cdq
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
call esi
push dword [esp + 0x64]
mov dword [esp + 0x24], eax
call esi
push ebx
mov dword [esp + 0x28], eax
call esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
push 0x30
test eax, eax
je 0x48a90a
pop edx
push edx
push eax
lea ecx, [esp + 0x34]
call section..text
pop ecx
pop ecx
jmp 0x48a919
lea eax, [esp + 0x30]
push 0
push eax
call fcn.005b5fd0
add esp, 0xc
push edi
push 0x3c
lea eax, [esp + 0x28]
push 1
push eax
call fcn.005e4940
push edi
push dword [esp + 0x78]
mov esi, eax
xor ebx, ebx
push 1
push dword [esp + 0x30]
call fcn.005e4940
add esi, eax
push edi
adc ebx, ebx
call fcn.005c3d10
cdq
add esp, 0x24
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
test ebp, ebp
je 0x48a96b
push edi
push dword [esp + 0x70]
push 1
push ebp
call fcn.005e4940
add esp, 0x10
add esi, eax
adc ebx, 0
push edi
call fcn.005e08f0
xor eax, eax
test ebp, ebp
pop ecx
cmovne eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x64]
add ecx, 0x3c
add eax, ecx
test ebx, ebx
ja 0x48a9ca
jb 0x48a98e
cmp esi, eax
jae 0x48a9ca
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x28]
push edi
call fcn.00606f50
push eax
call fcn.006052d0
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push edi
call fcn.00606f50
push eax
call fcn.006052d0
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
xor edx, edx
jmp 0x48a9d2
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0x50
ret
Function at 0x48a9e5
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x111c
call fcn.005b3d10
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x1114], eax
push ebx
push ebp
mov ebx, ecx
mov ebp, edx
mov dword [esp + 0xc], ebp
push esi
push edi
test ebx, ebx
jne 0x48aa14
xor eax, eax
jmp 0x48ab85
push dword [ebx]
lea edi, [ebx + 0x10]
call fcn.005c3d10
cdq
mov esi, eax
pop ecx
mov dword [esp + 0x10], esi
cmp esi, dword [ebx + 0x1010]
jne 0x48aa36
cmp edx, dword [ebx + 0x1014]
je 0x48aa0d
cmp ebp, 0x20
je 0x48aa4b
cmp dword [esp + 0x14], 0x40
push 0x48
pop ebp
push 0x3c
pop eax
cmovne ebp, eax
jmp 0x48aa4e
push 0x40
pop ebp
push dword [ebx]
push ebp
push 1
push edi
call fcn.005eac90
add esp, 0x10
cmp eax, ebp
jge 0x48aa6f
push 0
push esi
push dword [ebx]
call fcn.005e2940
add esp, 0xc
jmp 0x48aa0d
push dword [edi]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
call esi
push dword [edi + 4]
mov dword [edi], eax
call esi
push dword [edi + 8]
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
push dword [ebx]
call fcn.005c3d10
cdq
pop ecx
mov ecx, eax
mov esi, edx
mov eax, dword [edi + 4]
cdq
add eax, ecx
mov dword [edi - 8], eax
mov eax, 0xff8
adc edx, esi
sub eax, ebp
mov dword [edi - 4], edx
cmp dword [edi + 4], eax
jle 0x48aaba
push 0
push dword [esp + 0x14]
jmp 0x48aa63
push dword [ebx]
lea eax, [edi + ebp]
push dword [edi + 4]
push 1
push eax
call fcn.005eac90
add esp, 0x10
cmp eax, dword [edi + 4]
jne 0x48aab2
mov esi, dword [edi + 8]
lea eax, [esp + 0x18]
push eax
call fcn.004a2d50
pop ecx
test esi, esi
jle 0x48ab2a
mov edi, 0x1000
push dword [ebx]
cmp esi, edi
mov eax, esi
cmovg eax, edi
push eax
lea eax, [esp + 0x128]
push 1
push eax
call fcn.005eac90
mov ebp, eax
add esp, 0x10
test ebp, ebp
jle 0x48ab27
push ebp
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004a2e00
sub esi, ebp
add esp, 0xc
test esi, esi
jg 0x48aae9
lea edi, [ebx + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.004a2d40
cmp dword [edi + 8], 0
pop ecx
pop ecx
jle 0x48ab83
lea edx, [esp + 0xf0]
xor eax, eax
mov ecx, dword [edi + eax*4 + 0xc]
cmp ecx, dword [edx + eax*4]
jne 0x48ab5e
inc eax
cmp eax, 0xc
jne 0x48ab4d
jmp 0x48ab83
mov esi, dword [edi + 4]
cmp esi, 4
jbe 0x48aab2
lea eax, [esi - 4]
xor ecx, ecx
push eax
lea edx, [edi + 0x3c]
call fcn.00497da8
pop ecx
cmp eax, dword [esi + edi + 0x38]
jne 0x48aab2
mov eax, edi
mov ecx, dword [esp + 0x1124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0x111c
ret
Function at 0x48af54
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push ebp
push esi
push 0x1000
mov ebx, 0x72c000
mov eax, ecx
push ebx
push 0xffffffffffffffff
xor esi, esi
mov dword [esp + 0x18], eax
push eax
push esi
push 0xfde9
cmp dword [esp + 0x2c], esi
jne 0x48b016
test edx, edx
je 0x48af92
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push 0x80
push 5
jmp 0x48afa0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x48aff1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x48aff1
push 0x1000
push ebx
push ebp
push dword [esp + 0x18]
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push 0x80
push 1
push esi
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
push 2
push ebp
call fcn.00605450
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x48b003
push ebp
jmp 0x48b05a
push str.wbN
push eax
call fcn.00606f10
pop ecx
pop ecx
test eax, eax
jne 0x48b062
jmp 0x48b000
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push 0x80
push 3
push esi
push 3
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x48b060
push esi
push ebx
call fcn.00605450
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x48b059
push 0x723310
push eax
call fcn.00606f10
pop ecx
pop ecx
test eax, eax
jne 0x48b062
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x48beff
Capabilities:
Copy file
Delete file

Disassembly:
mov eax, 0x200c
call fcn.005b3d10
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x2008], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
test edi, edi
je 0x48c066
mov eax, dword [edi + 0x101c]
cmp eax, dword [edi + 0x1024]
jb 0x48c066
ja 0x48bf4d
mov eax, dword [edi + 0x1018]
cmp eax, dword [edi + 0x1020]
jb 0x48c066
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x48c066
push 0xffffffffffffffff
push str..tmp
or edx, 0xffffffff
call fcn.00487ef5
mov ebp, eax
xor eax, eax
push 0
mov ecx, ebp
lea edx, [eax + 1]
call fcn.0048af54
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x48bf91
inc esi
push esi
push ebp
call fcn.005e7dd0
pop ecx
pop ecx
mov eax, esi
jmp 0x48c069
mov ecx, dword [edi + 0x1008]
lea eax, [esp + 0x10]
and dword [edi + 0x1038], ebx
mov edx, 0x48bcd1
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], esi
call fcn.00487606
pop ecx
cmp dword [edi + 0x1038], ebx
jne 0x48c056
push dword [edi]
call fcn.005e1d40
push esi
call fcn.005e1d40
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x20]
pop ecx
pop ecx
push 0x1000
push eax
push 0xffffffffffffffff
push ebp
push 0
push 0xfde9
call esi
push 0x1000
push 0x72c000
push 0xffffffffffffffff
push dword [edi + 4]
push 0
push 0xfde9
call esi
push 0
push 0x72c000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
test eax, eax
lea eax, [esp + 0x1c]
pop esi
push eax
cmove ebx, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [edi + 4]
xor edx, edx
push 0
call fcn.0048af54
mov dword [edi], eax
pop ecx
test eax, eax
je 0x48c052
push eax
call fcn.005c3d10
cdq
pop ecx
mov dword [edi + 0x1010], eax
mov dword [edi + 0x1014], edx
jmp 0x48c059
mov ebx, esi
jmp 0x48c059
xor esi, esi
inc esi
push esi
push ebp
call fcn.005e7dd0
pop ecx
pop ecx
mov eax, ebx
jmp 0x48c069
xor eax, eax
inc eax
mov ecx, dword [esp + 0x2018]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005b35b0
add esp, 0x200c
ret
Function at 0x48cecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1034
call fcn.005b3d10
mov eax, dword [0x6ccd44]
xor eax, esp
mov dword [esp + 0x1030], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x28], eax
mov ebx, edx
mov dword [esp + 0x24], edi
call fcn.004813e2
push 0xfffffffffffffffc
test eax, eax
jne 0x48cf0e
pop eax
jmp 0x48d0ac
mov ecx, dword [edi + 0x3c4]
pop esi
call fcn.004844d4
xor ecx, ecx
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0xc], ecx
jne 0x48cf36
cmp ebx, 9
je 0x48cf2f
cmp ebx, 0xa
jne 0x48cf36
or ecx, 0xffffffff
mov dword [esp + 0x14], ecx
cmp dword [edi + 0x3c8], 0
je 0x48d0aa
test eax, eax
je 0x48d0aa
mov ecx, eax
call fcn.0048ce4d
mov ecx, dword [edi + 0x3c8]
add ecx, 0x20c
mov dword [esp + 0x1c], eax
call fcn.0044c7d2
mov ecx, dword [esp + 0x14]
cmp ecx, dword [ebp + 0xc]
jge 0x48d09a
mov edx, 0x1000
mov esi, dword [ebp + 0xc]
xor eax, eax
test ecx, ecx
cmovns eax, ecx
mov ecx, dword [esp + 0x28]
sub esi, eax
add ecx, eax
cmp esi, edx
mov dword [esp + 0x20], ecx
cmovg esi, edx
add eax, esi
cmp eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push esi
jl 0x48cfb9
xor ecx, ecx
mov edx, 0x8080
cmp dword [eax + 4], ecx
jne 0x48cfb3
push ebx
jmp 0x48cfcf
mov dword [eax + 4], ecx
push ecx
jmp 0x48cfcf
cmp dword [eax + 4], 0
mov edx, 0x80
jne 0x48cfcd
mov dword [eax + 4], 1
jmp 0x48cfb0
push 0
lea ecx, [esp + 0x34]
call fcn.00498c98
pop ecx
pop ecx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push 4
push eax
call fcn.004baa80
pop ecx
pop ecx
test esi, esi
jle 0x48d055
mov ecx, esi
xor edx, edx
sar ecx, 2
test ecx, ecx
jle 0x48d01d
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x38]
sub edi, eax
lea eax, [edi + edx*4]
mov eax, dword [esp + eax + 0x38]
xor eax, dword [esp + 0x18]
mov dword [esp + edx*4 + 0x38], eax
inc edx
cmp edx, ecx
jl 0x48d005
mov edi, dword [esp + 0x24]
shl edx, 2
cmp edx, esi
jge 0x48d055
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x38]
sub edi, eax
mov ecx, edx
lea eax, [edi + edx]
and ecx, reloc.WS2_32.dll_closesocket
jns 0x48d040
dec ecx
or ecx, 0xfffffffc
inc ecx
mov al, byte [esp + eax + 0x38]
xor al, byte [esp + ecx + 0x18]
mov byte [esp + edx + 0x38], al
inc edx
cmp edx, esi
jl 0x48d02e
mov edi, dword [esp + 0x24]
push 2
push esi
lea eax, [esp + 0x40]
push eax
push 2
push 4
lea eax, [esp + 0x2c]
push eax
push 2
push dword [esp + 0x2c]
lea eax, [esp + 0x4c]
push eax
push 0x40000003
push 0
push dword [edi + 0x3c8]
call fcn.0047ccbc
mov ecx, dword [esp + 0x44]
add esp, 0x30
mov esi, eax
mov edx, 0x1000
cmp ecx, dword [ebp + 0xc]
jl 0x48cf79
mov ecx, dword [edi + 0x3c8]
mov dword [ecx + 0x20c], 0
mov eax, esi
mov ecx, dword [esp + 0x103c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005b35b0
mov esp, ebp
pop ebp
ret
Function at 0x48e3c5
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
test ebx, ebx
jne 0x48e3d0
xor eax, eax
pop ebx
ret
push ebp
push esi
push edi
mov edi, 0x9c9
xor ebp, ebp
push edi
push 0x72378c
inc ebp
push ebp
push 0x5c
call fcn.005e7f10
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48e4f8
push 0x5c
xor edi, edi
push edi
push esi
call fcn.005b5fd0
mov ecx, str.ILibWebClient
mov dword [esi + 0x38], ebp
call fcn.00480fb6
push 0x9d2
push 0x723820
push ebp
push 0xc
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x48c37f
mov dword [esi], 0x48e130
mov dword [esi + 0x24], 3
call fcn.005e7f10
add esp, 0x1c
mov dword [esi + 0x20], eax
test eax, eax
jne 0x48e470
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x9d3
push esi
push edi
mov edx, 0x723840
xor ecx, ecx
call fcn.00488a50
push edi
push 0x723860
push 0x723880
jmp 0x48e51d
mov dword [esi + 0x44], edi
xor ecx, ecx
mov dword [esi + 0x10], ebx
call fcn.0048708c
xor ecx, ecx
mov dword [esi + 0x34], eax
call fcn.00484697
xor ecx, ecx
mov dword [esi + 0x2c], eax
call fcn.00484697
mov edx, esi
mov dword [esi + 0x30], eax
mov ecx, ebx
call fcn.004819aa
mov ecx, ebx
call fcn.00481a26
mov dword [esi + 0x3c], eax
mov dword [esi + 0x4c], edi
push 0
push fcn.0048dd36
push 0x48df1c
push 0x48dd80
push fcn.0048d4df
mov edx, 0xffff
mov ecx, ebx
call fcn.0047cb05
mov ecx, dword [esi + 0x20]
add esp, 0x14
mov dword [edi + ecx], eax
mov eax, dword [esi + 0x20]
mov eax, dword [edi + eax]
test eax, eax
je 0x48e4e9
mov dword [eax + 0x1d4], fcn.0048e2ab
add edi, 4
cmp edi, 0xc
jl 0x48e4aa
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7237ac
push esi
push edi
xor ecx, ecx
call fcn.00488a50
push edi
push 0x7237cc
push 0x7237ec
call fcn.00401109
add esp, 0x18
push esi
call fcn.005c3000
int3