joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4868d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004053a0
xor eax, eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
setne al
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x486951
push 1
push 0x67d71c
lea ecx, [ebp - 0x28]
call fcn.004592b0
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], eax
push 1
push 3
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], 0x5c
call fcn.004884c0
mov esi, eax
cmp esi, 0xffffffff
je 0x4869e6
mov dword [ebp - 0x44], 0x5c
nop word [eax + eax]
push esi
push ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00488380
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00488270
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4869c4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00407550
push 1
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.004884c0
mov esi, eax
cmp esi, 0xffffffff
jne 0x486990
mov eax, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x54]
mov eax, 0x2aaaaaab
sub ecx, ebx
xor edi, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x44], eax
je 0x486a3e
mov esi, ebx
cmp dword [esi + 0x14], 8
jb 0x486a0f
mov eax, dword [esi]
jmp 0x486a11
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x486a35
cmp dword [esi + 0x14], 8
jb 0x486a26
mov eax, dword [esi]
jmp 0x486a28
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x486aa6
inc edi
add esi, 0x18
cmp edi, dword [ebp - 0x44]
jb 0x486a05
mov esi, dword [ebp - 0x4c]
test ebx, ebx
je 0x486a73
push dword [ebp - 0x4c]
mov edx, dword [ebp - 0x54]
push ecx
mov ecx, ebx
call fcn.00488970
mov ecx, dword [ebp - 0x48]
mov eax, 0x2aaaaaab
sub ecx, ebx
add esp, 8
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push ebx
call fcn.00459550
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x486a88
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407550
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x486a41
Function at 0x486b80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a408
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ecx + 0x6c]
mov dword [ecx + 0xc8], eax
lea eax, [ecx + 0x9c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00488860
push 0x6c35c0
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00488810
mov eax, dword [ebp - 0x2c]
add esp, 8
cmp eax, 8
jb 0x486bf5
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00407550
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x14]
cmp eax, 1
sete bl
cmp ecx, 8
jb 0x486c22
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407550
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret
Function at 0x486f10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a480
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x9c]
push eax
lea edx, [esi + 0x6c]
lea ecx, [ebp - 0x40]
call fcn.00488860
add esp, 4
push 0x6c35d8
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00488810
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x486f83
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00407550
push 0
push 0x80
push 3
xor eax, eax
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x14], 8
push 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 1
push 0xc0000000
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x486fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.00486b80
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x80
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x14]
cmp eax, 0xffffffff
mov dword [esi + 0xd0], eax
setne bl
cmp ecx, 8
jb 0x48702d
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00407550
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret

Function at 0x487050
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
push dword [edi + 0xd4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [edi + 0xd4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push edi
push 0x4870d0
push 0
push 0
mov dword [edi + 0xd8], eax
call fcn.005f8604
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
ret
Function at 0x487110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a4b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6b1a94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
call fcn.004871f0
xor esi, esi
cmp dword [edi + 0xb4], esi
jbe 0x48718c
xor ebx, ebx
nop dword [eax]
mov eax, dword [edi + 0xc4]
push 0
push 0
add eax, ebx
push eax
push 0x4870b0
push 0
push 0
call fcn.005f8604
add esp, 0x18
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
lea ecx, [edi + 0xb8]
push eax
call fcn.0043e570
inc esi
add ebx, 0x20
cmp esi, dword [edi + 0xb4]
jb 0x487150
lea esi, [edi + 0x10c]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x4871d3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
lea eax, [edi + 0x9c]
mov dword [ebp - 0x1c], edi
mov edx, dword [ecx]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [edx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4871f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0xbc]
sub eax, dword [esi + 0xb8]
sar eax, 2
test eax, eax
je 0x487244
push ebx
nop dword [eax]
cmp byte [ebp + 8], 0
mov eax, dword [esi + 0xb8]
mov ebx, dword [eax + edi*4]
je 0x487228
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xbc]
inc edi
sub eax, dword [esi + 0xb8]
sar eax, 2
cmp edi, eax
jb 0x487210
pop ebx
mov eax, dword [esi + 0xb8]
pop edi
mov dword [esi + 0xbc], eax
pop esi
pop ebp
ret 4
Function at 0x4878d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a53b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x230], ecx
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 4], edi
call fcn.004dd010
mov esi, eax
mov dword [ebp - 0x234], esi
test esi, esi
je 0x487af8
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], edi
mov byte [ebp - 0x22c], 0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x22c]
mov edi, dword [ebp - 0x230]
lea ecx, [edi + 0x84]
call fcn.00486ab0
cmp dword [ebp - 0x218], 0x10
lea eax, [ebp - 0x22c]
cmovae eax, dword [ebp - 0x22c]
push eax
push 0x2712
push esi
call fcn.004dd070
push 0x487b20
push 0x4e2b
push esi
call fcn.004dd070
push ebx
push 0x2711
push esi
call fcn.004dd070
push 0xf
push 0x5c
push esi
call fcn.004dd070
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
push eax
push 0x15
push esi
call fcn.004dd070
push 0xf
push 0xd
push esi
call fcn.004dd070
add esp, 0x48
push 0xf
push 0x4e
push esi
call fcn.004dd070
push 1
push 0x34
push esi
call fcn.004dd070
push 0x14
push 0x44
push esi
call fcn.004dd070
add esp, 0x24
lea ecx, [edi + 0x84]
push 5
push 0
push str.https
call fcn.004884c0
test eax, eax
jne 0x487a0d
push eax
push 0x40
push esi
call fcn.004dd070
push 0
push 0x51
push esi
call fcn.004dd070
add esp, 0x18
mov eax, dword [edi + 0x134]
mov dword [ebx + 4], eax
xor eax, eax
mov ecx, dword [edi + 0x134]
shld eax, ecx, 0xa
push eax
shl ecx, 0xa
push ecx
push 0x75c2
push esi
call fcn.004dd070
push esi
call fcn.004dd050
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x487a6b
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
push 0x200002
push esi
call fcn.004dcff0
add esp, 0xc
cmp dword [ebp - 0x230], 0xc8
je 0x487a6b
mov dword [ebx + 0x18], edi
push 0x200
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.005e27b0
push dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x18]
add eax, ecx
push eax
push ecx
push edi
push dword [ebx + 8]
lea eax, [ebp - 0x214]
push str.curl
push 0x100
push eax
call fcn.00485d10
add esp, 0x2c
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.004dcfd0
mov eax, dword [ebp - 0x218]
add esp, 4
cmp eax, 0x10
jb 0x487af8
inc eax
lea ecx, [ebp - 0x22c]
push eax
push dword [ebp - 0x22c]
call fcn.00403ac0
jmp 0x487af8
test edi, edi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret 4
Function at 0x487d30
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a5e0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0xd0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 0x9c]
mov dword [esi + 0xd0], 0xffffffff
push edi
lea edx, [esi + 0x6c]
lea ecx, [ebp - 0x40]
call fcn.00488860
push 0x6c35d8
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00488810
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x487db6
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00407550
xor eax, eax
mov dword [ebp - 0x2c], 7
push edi
lea edx, [esi + 0x6c]
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x28]
mov word [ebp - 0x40], ax
call fcn.00488860
add esp, 4
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.005f8697
mov eax, dword [ebp - 0x14]
add esp, 8
cmp eax, 8
jb 0x487e20
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00407550
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x487e49
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00407550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret
Function at 0x488ac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a71f
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x6b1a94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 1
lea ecx, [edi + 0x28]
push edi
mov dword [edi], vtable.CKDUpdateMgr.0
mov dword [edi + 4], vtable.CKDUpdateMgr.1.0
call fcn.00489fa0
mov byte [ebp - 4], 2
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040b700
mov dword [esi], eax
lea eax, [edi + 0x38]
mov byte [ebp - 4], 3
xorps xmm0, xmm0
push 0
movups xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x488b9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x488b96
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x488b9e
push eax
call fcn.00403d40
mov byte [ebp - 4], 4
call fcn.00403fe0
mov ecx, eax
test ecx, ecx
jne 0x488bb7
push 0x80004005
call fcn.00403d40
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi + 0x54], eax
mov byte [ebp - 4], 5
lea eax, [edi + 0x24]
push dword [ebp - 0x18]
push eax
push 0x6b2858
call fcn.0041c790
add esp, 0xc
movzx eax, ax
lea ecx, [edi + 4]
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0041c5d0
mov eax, dword [edi + 0x2c]
mov dword [edi + 0x50], 0
mov dword [edi + 0x58], 0
mov dword [eax + 0x38], 0x489930
mov dword [eax + 0x3c], 0
mov eax, dword [edi + 0x2c]
mov dword [eax + 0x30], 0x489810
mov dword [eax + 0x34], 0
mov eax, edi
mov dword [edi + 0x5c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x489120
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a7f0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6b1a94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [edi + 0x50]
mov dword [edi + 0x58], 1
test eax, eax
je 0x4892b0
mov eax, dword [eax + 0x10]
cmp dword [eax - 0xc], ebx
je 0x4892b0
push 0x678c3c
push str.start
push str.update
push ebx
call fcn.0047fde0
lea ecx, [ebp - 0x14]
call fcn.0046c7d0
mov dword [ebp - 4], ebx
lea esi, [edi + 0x54]
mov ecx, dword [edi + 0x50]
push dword [ecx + 4]
push dword [eax]
push str._sqySetup__s.exe
push esi
call fcn.00403390
mov dword [ebp - 4], 0xffffffff
add esp, 0x20
mov edx, dword [ebp - 0x14]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4891c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4891f7
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.00480b60
mov edx, dword [edi + 0x50]
mov ecx, eax
add edx, 0x18
mov ebx, 1
call fcn.0040b070
mov byte [ebp - 0xd], bl
test al, al
jne 0x4891fb
mov byte [ebp - 0xd], 0
test bl, 1
je 0x48921b
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48921b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
push ecx
mov esi, esp
je 0x489254
mov dword [ebp - 0x14], esi
mov ecx, dword [edi + 0x54]
sub ecx, 0x10
call fcn.00407830
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00489500
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x54]
sub ecx, 0x10
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x1c], esi
call fcn.00407830
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
mov ecx, dword [edi + 0x50]
add ecx, 0x10
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esi
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.00407830
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004892e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x5c], ebx
je 0x4892bd
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x489500
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a890
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6b1a94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edi, 0xffffffff
test eax, eax
jne 0x489557
cmp dword [esi + 0x5c], eax
je 0x48954d
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ebx, 0x80004005
jmp 0x4895dc
mov ecx, esi
call fcn.00489df0
call fcn.00403fe0
mov ecx, eax
test ecx, ecx
jne 0x489573
push 0x80004005
call fcn.00403d40
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
cmp dword [esi + 0x58], 0
je 0x489594
push 8
push str._S__R__U
jmp 0x48959b
push 5
push str._S__U
call fcn.00407780
mov esi, dword [ebp - 0x10]
push 1
push 0
push esi
push dword [ebp + 8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor ebx, ebx
add esi, 0xfffffff0
mov byte [ebp - 4], bl
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4895dc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x4895fb
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48b4f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61abdb
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], edx
mov ebx, ecx
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x48b5f7
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x48b5f7
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.005e27b0
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x48b5f0
or edi, 0xffffffff
nop dword [eax]
mov edx, dword [ebp - 0x234]
lea ecx, [ebp - 0x240]
call fcn.0048b650
lea edx, [ebp - 0x240]
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.0047e570
test eax, eax
je 0x48b5ba
mov edx, ebx
lea ecx, [ebp - 0x240]
call fcn.0047e570
test eax, eax
jne 0x48b615
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48b5de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x48b580
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x244]
test ecx, ecx
je 0x48b627
mov eax, dword [ebp - 0x234]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x48b649
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x48b5f9
Function at 0x48b650
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ac1b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x6b1a94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x21c], edi
mov ebx, ecx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x22c], 0
call fcn.00403fe0
mov ecx, eax
test ecx, ecx
jne 0x48b6ad
push 0x80004005
call fcn.00403d40
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x220], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005e27b0
add esp, 0xc
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x48b738
push dword [ebp - 0x21c]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x48b738
add esi, 0xfffffff0
mov ecx, esi
call fcn.00407830
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48b833
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x48b833
lea eax, [ebp - 0x228]
mov dword [ebp - 0x21c], 0
push eax
push 4
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], 0
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x48b783
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x48b7c9
mov eax, dword [0x6c27d4]
test eax, eax
jne 0x48b7a8
push str.QueryFullProcessImageNameW
push 0x682570
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6c27d4], eax
mov dword [ebp - 0x224], 0x104
test eax, eax
je 0x48b7c9
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48b7e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.00407780
mov esi, dword [ebp - 0x220]
add esi, 0xfffffff0
mov ecx, esi
call fcn.00407830
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48b833
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8db3
mov esp, ebp
pop ebp
ret