joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x4714d7
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4714d7
cmp eax, 0x104
jae 0x4714d7
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 4]
call fcn.0040b8c0
call fcn.00440170
mov byte [esi], al
mov ecx, dword [ebp - 4]
mov al, byte [esi]
xor ecx, ebp
pop esi
call fcn.00401590
mov esp, ebp
pop ebp
ret

Function at 0x471bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
test esi, esi
je 0x471bf8
call fcn.00408d90
cmp eax, 1
jl 0x471bf8
mov dword [ebp - 4], 0x10000
jmp 0x471bfa
xor esi, esi
push 8
call fcn.00405f2d
mov ecx, dword [ebp + 0xc]
add esp, 4
mov edi, dword [ebp + 0x10]
mov ebx, eax
test edi, edi
push 0
push dword [ebp - 4]
mov dword [ebx], ecx
setne cl
push ebx
push 0x471c70
push esi
push 0
mov byte [ebx + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x471c40
push ebx
call fcn.004085be
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x471c4f
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4758e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523366
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0xc]
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x228], 0
push 0x8000
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
call fcn.00405f2d
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x47596b
call fcn.004f7859
lea esi, [ebx + 0x8000]
mov dword [ebp - 0x230], ebx
mov ecx, 0x2000
mov dword [ebp - 0x228], esi
xor eax, eax
mov dword [ebp - 0x22c], esi
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], eax
mov byte [ebp - 0x21d], al
test ecx, ecx
je 0x475a8d
sub esi, ebx
lea eax, [ebp - 0x21c]
sar esi, 2
push eax
lea eax, [esi*4]
push eax
push ebx
push ecx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x475a8d
mov edi, dword [ebp - 0x21c]
shr edi, 2
cmp esi, edi
jb 0x475a86
xor esi, esi
mov byte [ebp - 0x21d], 1
test edi, edi
je 0x475a8d
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebx + esi*4]
push dword [ebp - 0x224]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x475a86
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0040b818
add esp, 8
test eax, eax
je 0x475a3e
add eax, 2
jmp 0x475a44
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x24c]
call fcn.004076f0
mov ecx, dword [ebp - 0x234]
push eax
mov byte [ebp - 4], 1
call fcn.00422110
cmp dword [ebp - 0x238], 8
mov byte [ebp - 4], 0
jb 0x475a7b
push dword [ebp - 0x24c]
call fcn.004085be
add esp, 4
inc esi
cmp esi, edi
jb 0x4759f0
jmp 0x475a8d
mov byte [ebp - 0x21d], 0
push ebx
call fcn.004085be
mov al, byte [ebp - 0x21d]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x475ac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523398
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x579630]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x475ba9
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x475ba9
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x475b11
mov eax, dword [edi]
jmp 0x475b13
mov eax, edi
xor ecx, ecx
mov word [eax], cx
cmp dword [esi + 0x14], 8
jb 0x475b22
mov eax, dword [esi]
jmp 0x475b24
mov eax, esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp + 8], eax
test eax, eax
je 0x475ba9
lea ebx, [eax + 1]
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
push ebx
movq qword [ebp - 0x18], xmm0
call fcn.00470dc0
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x475b60
mov esi, dword [esi]
push ebx
mov ebx, dword [ebp - 0x18]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x475b83
cmp eax, dword [ebp + 8]
ja 0x475b83
push ebx
mov ecx, edi
call fcn.0040b8c0
mov byte [ebp + 0xb], 1
jmp 0x475b87
mov byte [ebp + 0xb], 0
test ebx, ebx
je 0x475b94
push ebx
call fcn.004085be
add esp, 4
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476430
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
test ebx, ebx
je 0x476557
cmp word [ebx], 0x5c
jne 0x476557
cmp word [ebx + 2], 0x5c
jne 0x476557
mov eax, dword [0x533f48]
push edi
mov dword [ebp - 0xc], eax
mov edi, 0x43
mov ax, word [0x533f4c]
mov word [ebp - 8], ax
push esi
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], di
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x476508
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x476508
lea esi, [ebp - 0x214]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4764c7
sub esi, ecx
mov ecx, ebx
sar esi, 1
lea edx, [ecx + 2]
jmp 0x4764e0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4764e0
sub ecx, edx
sar ecx, 1
cmp ecx, esi
jbe 0x476508
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call fcn.004208a2
add esp, 0xc
test eax, eax
je 0x476526
inc edi
cmp di, 0x5a
jbe 0x476486
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0xc]
push eax
call fcn.0040b8c0
mov ecx, dword [ebp - 0x21c]
lea eax, [ebx + esi*2]
push eax
call fcn.0042ec80
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x476600
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x214]
push eax
push esi
mov dword [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x476713
test eax, eax
jne 0x476654
cmp dword [ebp - 0x214], eax
je 0x476713
push 0
push 1
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x476713
push edi
push 1
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x47670b
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetMappedFileNameW
test eax, eax
je 0x476704
cmp word [ebp - 0x210], 0
jne 0x4766d2
xor ecx, ecx
jmp 0x4766ef
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
jmp 0x4766e0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4766e0
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
push eax
call fcn.00407750
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x477e70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
mov dword [ebp - 0x234], eax
test edi, edi
je 0x477e9d
mov dword [edi], 0
cmp dword [eax + 0x10], 0
je 0x477f70
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x477f5d
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.004f9050
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x477f56
lea ecx, [ecx]
mov ecx, dword [ebp - 0x234]
xor eax, eax
mov word [ebp - 6], ax
call fcn.00423ea0
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00409df7
add esp, 8
test eax, eax
je 0x477f48
push 0x22c
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.004f9050
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x477ef0
jmp 0x477f56
mov bl, 1
test edi, edi
je 0x477f56
mov ecx, dword [ebp - 0x228]
mov dword [edi], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x480220
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
mov dword [ebp - 0x420], 0
call fcn.004f9050
add esp, 0xc
xor bl, bl
test edi, edi
je 0x4802d2
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x105
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4802d2
push 0
push 0
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0040b560
add esp, 0x24
movzx ebx, bl
test eax, eax
mov ecx, 1
cmove ebx, ecx
test bl, bl
mov dword [esi + 0x14], 7
mov eax, 0x52d9b8
mov dword [esi + 0x10], 0
lea edx, [ebp - 0x41c]
cmove edx, eax
xor eax, eax
mov word [esi], ax
cmp word [edx], ax
jne 0x4802fe
xor ecx, ecx
jmp 0x480312
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480303
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00407750
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x480330
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52415b
mov eax, dword fs:[0]
push eax
mov eax, 0x10bc
call fcn.004f9af0
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x10]
cmp edi, 0x824
jb 0x480377
xor al, al
jmp 0x480529
xor eax, eax
mov dword [ebp - 0x105c], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x1070]
mov dword [ebp - 0x1060], 0
mov word [ebp - 0x1070], ax
call fcn.00407d00
mov dword [ebp - 4], 0
cmp edi, 2
jb 0x480401
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4803bb
mov ecx, dword [esi]
jmp 0x4803bd
mov ecx, esi
cmp word [ecx], 0x22
jne 0x480401
cmp eax, 8
jb 0x4803cc
mov eax, dword [esi]
jmp 0x4803ce
mov eax, esi
cmp word [eax + edi*2 - 2], 0x22
jne 0x480401
lea eax, [edi - 2]
mov ecx, esi
push eax
push 1
lea eax, [ebp - 0x10c8]
push eax
call fcn.00407cc0
push eax
lea ecx, [ebp - 0x1070]
call fcn.00407e20
lea ecx, [ebp - 0x10c8]
call fcn.004087d0
cmp dword [ebp - 0x1060], 0
mov dword [ebp - 0x1074], 0x824
je 0x48050e
cmp dword [ebp - 0x105c], 8
lea eax, [ebp - 0x1070]
cmovae eax, dword [ebp - 0x1070]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x48050e
push 0x3c
lea eax, [ebp - 0x10b0]
push 0
push eax
call fcn.004f9050
add esp, 0xc
mov dword [ebp - 0x10b0], 0x3c
cmp dword [ebp - 0x105c], 8
lea ecx, [ebp - 0x10b0]
lea eax, [ebp - 0x1070]
mov dword [ebp - 0x10a8], 1
cmovae eax, dword [ebp - 0x1070]
push ecx
push 0
push dword [ebp - 0x1060]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x48050e
mov eax, dword [ebp - 0x10a4]
cmp eax, 3
je 0x4804a0
cmp eax, 4
jne 0x48050e
cmp dword [ebp - 0x105c], 8
lea ecx, [ebp - 0x1074]
push 0
push 2
push ecx
lea ecx, [ebp - 0x1058]
lea eax, [ebp - 0x1070]
cmovae eax, dword [ebp - 0x1070]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_UrlGetPartW]
test eax, eax
jne 0x48050e
lea eax, [ebp - 0x1058]
push str.help.adobe.com
push eax
call fcn.00409df7
add esp, 8
test eax, eax
je 0x48050a
lea eax, [ebp - 0x1058]
push str.adobehelp.corp.adobe.com
push eax
call fcn.00409df7
add esp, 8
test eax, eax
jne 0x48050e
call fcn.004b6fb0
test al, al
je 0x48050e
mov bl, 1
jmp 0x480510
xor bl, bl
cmp dword [ebp - 0x105c], 8
jb 0x480527
push dword [ebp - 0x1070]
call fcn.004085be
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x480e20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524280
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor al, al
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov byte [ebp - 0x41], al
cmp dword [esi + 0x10], 0
je 0x480f36
mov ecx, esi
call fcn.00423ea0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x480f33
mov ecx, esi
call fcn.00423ea0
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x480f33
push 0
push str.ime_shared
lea eax, [ebp - 0x40]
push 0x25
push eax
call fcn.0042ef80
push 0
push str.ime_shared
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push 0x24
push eax
call fcn.0042ef80
push ebx
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push esi
push eax
call fcn.00480d20
add esp, 0x30
test al, al
jne 0x480ef7
push ebx
push edi
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00480d20
add esp, 0x10
test al, al
jne 0x480ef7
push ebx
push edi
push esi
call fcn.00480f70
add esp, 0xc
test al, al
jne 0x480ef7
xor bl, bl
jmp 0x480ef9
mov bl, 1
cmp dword [ebp - 0x14], 8
jb 0x480f0a
push dword [ebp - 0x28]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x480f2f
push dword [ebp - 0x40]
call fcn.004085be
add esp, 4
mov al, bl
jmp 0x480f36
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x481680
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524328
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x58]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
xor eax, eax
push 0xb
push str.imjpuex.exe
mov byte [ebp - 0x59], 0
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.00407750
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00407d00
push 1
push 0x52da1c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040ef80
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040af40
lea eax, [ebp - 0x28]
push eax
push eax
call fcn.00420960
add esp, 8
test al, al
je 0x481808
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x481808
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
push ebx
call fcn.00420960
add esp, 8
test al, al
je 0x4817e7
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.00445c30
add esp, 8
test al, al
jne 0x4817a8
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00445c30
add esp, 8
test al, al
je 0x4817e7
cmp dword [edi + 0x10], 0
je 0x4817cd
push ebx
push edi
call fcn.00445c30
add esp, 8
test al, al
jne 0x4817cd
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00445c30
add esp, 8
test al, al
je 0x4817e7
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x28]
cmp eax, ecx
je 0x4817e3
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00407d00
mov byte [ebp - 0x59], 1
cmp dword [ebp - 0x2c], 8
jb 0x4817f8
push dword [ebp - 0x40]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x14], 8
jb 0x481819
push dword [ebp - 0x28]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x44], 8
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], eax
jb 0x48183a
push dword [ebp - 0x58]
call fcn.004085be
add esp, 4
mov al, byte [ebp - 0x59]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret
Function at 0x482d00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 0x38]
push esi
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
test eax, eax
je 0x482d3a
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00482dd0
add esp, 0x2c
test eax, eax
jne 0x482d55
pop esi
pop ebp
ret
push 0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x482d55
pop esi
pop ebp
ret
push ebx
push edi
push 0
call fcn.00450d40
push 0
mov edi, eax
call fcn.004b59f0
add esp, 8
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x482d79
mov edi, 0x1fffff
mov ebx, edi
push 1
push 0
push edi
mov edi, dword [ebp + 0xc]
push esi
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x482da6
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
push 1
push 0
push ebx
lea eax, [esi + 4]
push eax
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
pop edi
sbb eax, eax
pop ebx
neg eax
pop esi
pop ebp
ret
Function at 0x483100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5245c8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x68], eax
call fcn.00408d90
cmp eax, 3
jge 0x4831e8
push 0x40
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.004f9050
mov edi, dword [ebp + 0x24]
add esp, 0xc
mov dword [ebp - 0x54], 0x44
or edi, 0x1080000
mov byte [ebp - 0x58], 0
mov ecx, 0x57fb8c
mov eax, 1
lock xadd dword [ecx], eax
inc eax
cmp eax, 1
sete byte [ebp - 0x57]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], esi
call fcn.00483a20
test al, al
je 0x4831d9
push dword [ebp - 0x68]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push edi
push dword [ebp + 0x20]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x6c]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
call fcn.00482bd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret