joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], edi
test bl, bl
je 0x48c87a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004e90c0
add esp, 4
neg eax
sbb esi, esi
mov eax, dword [ebp - 4]
and esi, 0xffffff00
add esi, 0x20206
jmp 0x48c87f
mov esi, 0x20206
push esi
push eax
push dword [edi]
lea ecx, [ebp - 0x10]
call fcn.004f0cd0
mov edi, eax
test edi, edi
je 0x48c8ac
cmp byte [ebp + 0x28], 0
je 0x48c8a8
push ebx
push dword [ebp - 4]
push dword [ebp - 0x14]
call fcn.0048c790
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x48c8e8
test bl, bl
je 0x48c8cb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004e90c0
add esp, 4
test eax, eax
je 0x48c8cb
or esi, 0x100
jmp 0x48c8d1
or esi, 0x200
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push esi
push dword [ebp - 4]
push dword [eax]
call fcn.004f0cd0
mov edi, eax
test edi, edi
je 0x48c8f2
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x48c91d
push eax
jmp 0x48c917
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
sub eax, ecx
je 0x48c936
mov esi, dword [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x20]
push 0
push dword [ebp - 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x48c91d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x48c92d
push eax
call fcn.0053c1e0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.0053af06
int3
Function at 0x49dc90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
call fcn.00468a00
call fcn.00468bd0
mov ecx, eax
test ecx, ecx
je 0x49dda0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], esi
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x49dd28
lea ecx, [ebp - 0x218]
call fcn.00468a00
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49dd00
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x218]
call fcn.004be590
mov esi, dword [ebp - 0x218]
push 0
push 0x2000000
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov edi, eax
lea eax, [ebp - 0x214]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x49dd6e
push ebx
push dword [ebp - 0x210]
push dword [ebp - 0x214]
call fcn.0048a3e0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x49dd8f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00468960
int3
Function at 0x4a3ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00468bd0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
je 0x4a40e7
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x5c], 0x7868474b
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 0x58], 0x6b514449
mov dword [ebp - 0x54], 0x365a444f
mov dword [ebp - 0x50], 0x5549434e
mov dword [ebp - 0x4c], 0x496f4342
mov dword [ebp - 0x48], 0x4e454249
mov dword [ebp - 0x44], 0x6a453344
mov dword [ebp - 0x40], 0x68777941
mov dword [ebp - 0x3c], 0x674d5348
mov dword [ebp - 0x38], 0x3356784a
mov dword [ebp - 0x34], 0x34455146
mov dword [ebp - 0x30], 0x58675349
mov dword [ebp - 0x2c], 0x5763774a
mov dword [ebp - 0x28], 0x31417750
mov dword [ebp - 0x24], 0x6b644442
mov dword [ebp - 0x20], 0x71456849
mov dword [ebp - 0x1c], 0x3551414d
mov dword [ebp - 0x18], 0x30416761
mov dword [ebp - 0x14], 0x41414141
mov word [ebp - 0x10], 0x674d
call dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0xe]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
call fcn.004660a0
lea eax, [ebp - 0x68]
push eax
call fcn.00480790
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 1
je 0x4a40f1
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.004ccf00
mov eax, dword [ebp - 0x68]
add esp, 0xc
test eax, eax
je 0x4a4039
push eax
call fcn.0053c1e0
add esp, 4
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov edx, dword [ebp - 8]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4a4058
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00468bd0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
je 0x4a40fb
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
mov ebx, dword [ebp - 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
add ebx, 0xfffffff0
lea eax, [ebp - 8]
push eax
push ecx
mov esi, esp
push ebx
call fcn.004c2870
add esp, 4
add eax, 0x10
mov dword [esi], eax
push 0
call fcn.004845c0
mov esi, dword [ebp - 8]
add esp, 0xc
add esi, 0xfffffff0
mov dword [ebp - 0xc], eax
mov edx, edi
lea ecx, [esi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a40bf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4a40d3
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00468960
push str.invalid_vector_T__subscript
call fcn.0053af06
push 0x80004005
call fcn.00468960
int3
Function at 0x4bd070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.00468bd0
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
je 0x4bd20c
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x64], 0x62414359
sub esp, 0xc
mov dword [ebp - 8], eax
mov ecx, esp
mov dword [ebp - 0x60], 0x6d41534e
lea eax, [ebp - 8]
mov dword [ebp - 0x5c], 0x6f734143
mov dword [ebp - 0x58], 0x574d4843
push dword [ebp - 8]
mov dword [ebp - 0x54], 0x766b7a50
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x50], 0x756b5243
mov dword [ebp - 0x4c], 0x5545434a
mov dword [ebp - 0x48], 0x7334544d
mov dword [ebp - 0x44], 0x4c515445
mov dword [ebp - 0x40], 0x7a413246
mov dword [ebp - 0x3c], 0x6230474a
mov dword [ebp - 0x38], 0x72736746
mov dword [ebp - 0x34], 0x6a387845
mov dword [ebp - 0x30], 0x54733242
mov dword [ebp - 0x2c], 0x34305443
mov dword [ebp - 0x28], 0x67774464
mov dword [ebp - 0x24], 0x4f30684d
mov dword [ebp - 0x20], 0x67564350
mov dword [ebp - 0x1c], 0x39384242
mov dword [ebp - 0x18], 0x58303344
mov dword [ebp - 0x14], 0x6c494463
mov dword [ebp - 0x10], 0x41676850
mov dword [ebp - 0xc], 0x2f414141
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.004660a0
lea eax, [ebp - 0x70]
push eax
call fcn.00480790
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 1
je 0x4bd216
push ecx
lea eax, [ebp - 8]
push eax
call fcn.004ccf00
mov eax, dword [ebp - 0x70]
add esp, 0xc
test eax, eax
je 0x4bd1ac
push eax
call fcn.0053c1e0
add esp, 4
mov esi, dword [ebp - 8]
lea ecx, [ebp - 8]
push esi
call fcn.004672d0
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 4]
call fcn.00539e90
mov edx, dword [ebp - 8]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4bd1e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4bd1fa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00468960
push str.invalid_vector_T__subscript
call fcn.0053af06
int3
Function at 0x4c3130
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
push 0xf0000000
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push dword [esi + 8]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4c31c4
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [esi + 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4c31c4
push 0
push dword [ebp + 0xc]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4c31c4
push 0
lea eax, [esi + 0xc]
push eax
push edi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4c31c4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0xc]
jmp 0x4c31dc
mov eax, dword [ebp - 8]
test eax, eax
je 0x4c31d2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c31e2
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ccfd0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 8]
push ecx
push 0
push 1
push dword [eax - 0xc]
push eax
call esi
test eax, eax
jne 0x4cd019
mov ecx, edi
call fcn.00468a00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4cd086
push dword [ebp - 8]
call fcn.0053ac46
push dword [ebp - 8]
mov ebx, eax
push 0
push ebx
call fcn.0053e0b0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
add esp, 0x10
push 0
push 0
push eax
push ebx
push 1
push dword [ecx - 0xc]
push ecx
call esi
test eax, eax
jne 0x4cd063
push ebx
call fcn.0053c676
add esp, 4
mov ecx, edi
call fcn.00468a00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4cd086
mov ecx, dword [ebp - 0xc]
push edi
push dword [ebp - 8]
push ebx
call fcn.004cd0c0
mov esi, eax
test esi, esi
je 0x4cd07d
mov ecx, edi
call fcn.00468a00
push ebx
call fcn.0053c676
add esp, 4
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4cd0a3
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 8
Function at 0x4cd0c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
lea eax, [edi + 1]
push eax
call fcn.0053ac46
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0
push eax
call fcn.0053e0b0
push edi
push esi
push dword [ebp - 8]
mov esi, dword [ebp - 0x10]
push esi
call fcn.0053c67b
add esp, 0x20
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push esi
push 0
push 1
push 0
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4cd154
push esi
call fcn.0053c676
mov ecx, dword [ebp - 0xc]
add esp, 4
call fcn.00468a00
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x114]
push 0xfde9
push esi
mov byte [esi + eax], 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], eax
call fcn.004e23c0
mov edx, dword [ebp - 0x114]
test edx, edx
jne 0x4cd186
xor ecx, ecx
jmp 0x4cd19f
mov ecx, edx
lea edi, [ecx + 2]
jmp 0x4cd190
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd190
sub ecx, edi
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0xc]
push edx
call fcn.00469090
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
cmp eax, ecx
je 0x4cd1c2
push eax
call fcn.0053c5ac
add esp, 4
push esi
call fcn.0053c676
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cd1e0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
lea eax, [edi + 1]
push eax
call fcn.0053ac46
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0
push eax
call fcn.0053e0b0
push edi
push esi
push dword [ebp - 8]
mov esi, dword [ebp - 0x10]
push esi
call fcn.0053c67b
add esp, 0x20
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push esi
push 0
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4cd274
push esi
call fcn.0053c676
mov ecx, dword [ebp - 0xc]
add esp, 4
call fcn.00468a00
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x114]
push 0xfde9
push esi
mov byte [esi + eax], 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], eax
call fcn.004e23c0
mov edx, dword [ebp - 0x114]
test edx, edx
jne 0x4cd2a6
xor ecx, ecx
jmp 0x4cd2bf
mov ecx, edx
lea edi, [ecx + 2]
jmp 0x4cd2b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cd2b0
sub ecx, edi
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0xc]
push edx
call fcn.00469090
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
cmp eax, ecx
je 0x4cd2e2
push eax
call fcn.0053c5ac
add esp, 4
push esi
call fcn.0053c676
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cf660
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0xf
mov dword [ebp - 0x240], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x238], eax
push ecx
push eax
mov dword [ebp - 0x234], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push ebx
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0
mov esi, eax
call fcn.004672d0
test esi, esi
mov esi, dword [ebp - 0x23c]
je 0x4cf76e
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0053ef62
add esp, 8
test eax, eax
jne 0x4cf754
push dword [ebp - 0x22c]
push eax
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x4cf754
mov ecx, dword [edi + 4]
lea eax, [ebp - 8]
cmp eax, ecx
jae 0x4cf739
mov eax, dword [edi]
lea edx, [ebp - 8]
cmp eax, edx
ja 0x4cf739
mov ebx, edx
sub ebx, eax
sar ebx, 2
cmp ecx, dword [edi + 8]
jne 0x4cf729
push 1
mov ecx, edi
call fcn.00538500
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4cf750
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
mov dword [ecx], eax
jmp 0x4cf750
cmp ecx, dword [edi + 8]
jne 0x4cf747
push 1
mov ecx, edi
call fcn.00538500
mov eax, dword [edi + 4]
test eax, eax
je 0x4cf750
mov dword [eax], ebx
add dword [edi + 4], 4
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x238]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4cf6d1
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 4]
xor ecx, ecx
sub eax, dword [edi]
sar eax, 2
cmp ecx, eax
sbb edi, edi
add esi, 0xfffffff0
neg edi
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4cf7a4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret
Function at 0x4cfcc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp]
sub esp, 0xc
mov dword [ebp - 0x60], 0x79415449
mov ecx, esp
mov dword [ebp - 0x5c], 0x74676a4d
mov dword [ebp - 0x58], 0x6c556850
mov dword [ebp - 0x54], 0x324e4350
push dword [ebp - 0x64]
mov dword [ebp - 0x50], 0x66497947
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], 0x32464248
mov dword [ebp - 0x48], 0x3578424a
mov dword [ebp - 0x44], 0x41634461
mov dword [ebp - 0x40], 0x5830684c
mov dword [ebp - 0x3c], 0x31414142
mov dword [ebp - 0x38], 0x5a735244
mov dword [ebp - 0x34], 0x7049774b
mov dword [ebp - 0x30], 0x2b46444a
mov dword [ebp - 0x2c], 0x6730514f
mov dword [ebp - 0x28], 0x364e7742
mov dword [ebp - 0x24], 0x4d6b7a45
mov dword [ebp - 0x20], 0x42596e42
mov dword [ebp - 0x1c], 0x43634144
mov dword [ebp - 0x18], 0x2f4d6a4c
mov dword [ebp - 0x14], 0x74384141
mov dword [ebp - 0x10], 0x6c4e6a43
mov dword [ebp - 0xc], 0x6a557741
mov dword [ebp - 8], 0x41306850
mov dword [ebp - 4], 0x35414141
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.004660a0
lea eax, [ebp - 0x70]
push eax
call fcn.00480790
add esp, 0x10
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sar eax, 1
je 0x4cfdf2
test edx, edx
jne 0x4cfdbd
xor ecx, ecx
jmp 0x4cfdd1
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cfdc2
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00469090
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x4cfdea
push eax
call fcn.0053c1e0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.invalid_vector_T__subscript
call fcn.0053af06
int3
Function at 0x4e02f0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], 0
call fcn.00468bd0
mov ecx, eax
test ecx, ecx
je 0x4e0458
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
call fcn.00468bd0
mov ecx, eax
test ecx, ecx
je 0x4e0462
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
call fcn.00468bd0
mov ecx, eax
test ecx, ecx
je 0x4e046c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, esi
call dword [eax + 0x20]
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
mov ecx, esi
call dword [eax + 0x3c]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.004a4110
add esp, 0xc
test eax, eax
je 0x4e03ba
mov eax, dword [esi]
mov ecx, esi
push 8
mov eax, dword [eax + 0x4c]
call eax
test al, al
jne 0x4e03ba
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
xor bl, bl
jmp 0x4e03d2
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e03d0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
mov edx, dword [ebp - 8]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4e03f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xc]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e040d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e0429
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4e0443
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00468960
push 0x80004005
call fcn.00468960
push 0x80004005
call fcn.00468960
int3
Function at 0x4e2660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x4e2677
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x4e26a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4e269c
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x4e27bb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x4e26d9
cmp byte [edi + 0x18], al
je 0x4e26cd
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.004be910
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x4e2712
call fcn.004be910
push 0x2710
mov ecx, esi
mov edi, eax
call fcn.0050a050
test eax, eax
jns 0x4e27b8
test edi, edi
pop ebx
cmovns edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.004b93b0
mov dword [ebp - 4], eax
test eax, eax
jns 0x4e2742
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0050a050
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x4e26e9
push 0
push 0
push ebx
mov ecx, esi
call fcn.004b93b0
mov edi, eax
test edi, edi
jns 0x4e2780
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0050a050
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x5389e0
push 0
push 0
call fcn.0054046b
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4e26e9
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4e27b8
call fcn.004be910
mov edi, eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret