joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4613c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x461543
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00409914
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc_1
test eax, eax
jne 0x461517
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation_1
test eax, eax
jne 0x461517
cmp dword [0x76f168], 0
jne 0x461440
push 0x461554
push 0x461580
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411010
mov dword [0x76f168], eax
cmp dword [0x76f168], 0
je 0x461472
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x76f168]
test eax, eax
je 0x461472
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040aa00
jmp 0x4614a9
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4614a9
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.0040a0a0
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.0040aa1c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x4614d5
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.0045edb8
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0041630c
cmp dword [edi], 0
je 0x461517
mov eax, dword [edi]
call fcn.00409e0c
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x461517
test bl, bl
je 0x461502
mov eax, edi
mov edx, 0x4615a4
call fcn.0040ab58
jmp 0x461517
mov eax, dword [edi]
call fcn.00409e0c
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.0040ad68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46154a
lea eax, [ebp - 0x21c]
call fcn.00409914
lea eax, [ebp - 0x218]
call fcn.00409938
lea eax, [ebp - 4]
call fcn.0040d514
ret

Function at 0x462028
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x462042
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4620a1
mov eax, edi
call fcn.00409e0c
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x46209c
mov eax, edi
call fcn.00409e0c
add eax, eax
add eax, 2
push eax
mov eax, edi
call fcn.0040a944
mov edx, esi
pop ecx
call fcn.0040690c
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret
Function at 0x4643e8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x46459c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.0046431c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x46457a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x763e10], 0
jne 0x46454e
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.0045fb48
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00414ca8
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x4645bc
call fcn.0040a1dc
mov eax, dword [ebp - 0x2c]
call fcn.0040a3a8
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x4644c2
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.00414ca8
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x4645bc
call fcn.0040a1dc
mov eax, dword [ebp - 0x34]
call fcn.0040a3a8
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x4644dd
xor esi, esi
push 0
push 0x4645d4
push 0x4645e0
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x46453d
test bl, bl
je 0x464524
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.004120bc
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection_1
jmp 0x46453d
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x46454e
mov eax, esi
call fcn.0049c5a0
mov dword [0x763e10], esi
cmp dword [0x763e10], 0
je 0x464564
mov eax, dword [0x763e10]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464581
mov eax, dword [ebp - 8]
call fcn.004643d4
ret

Function at 0x46f49c
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x763e3c], 0
jne 0x46f52f
xor eax, eax
call fcn.0041a254
mov dword [0x763e3c], eax
cmp dword [0x763e3c], 0
je 0x46f52f
mov eax, 0x46f300
xor ecx, ecx
xor edx, edx
call fcn.0041a758
mov dword [0x763e40], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x763e50], eax
push 0x763e34
push 4
push 0
push 0x46f348
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x763e38], eax
cmp dword [0x763e38], 0
je 0x46f52f
mov edx, 0x46f53c
mov eax, dword [0x763e34]
call fcn.0046074c
push 2
mov eax, dword [0x763e38]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x763e38]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x46f578
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x763e3c], 0
je 0x46f649
mov ebx, dword [0x763e50]
xor eax, eax
mov dword [0x763e50], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x763e4c], 0
je 0x46f5c1
mov ebx, dword [0x763e4c]
xor eax, eax
mov dword [0x763e4c], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x763e48], 0xffffffff
mov eax, 0x46f300
xor ecx, ecx
xor edx, edx
call fcn.0041a984
push 0x1f4
mov eax, dword [0x763e38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x46f60e
push 0
mov eax, dword [0x763e38]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x763e54], 0
je 0x46f60e
mov eax, dword [0x763e54]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
mov dword [0x763e54], eax
mov eax, dword [0x763e38]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x763e34]
call fcn.004604c0
xor eax, eax
mov dword [0x763e38], eax
xor eax, eax
mov dword [0x763e34], eax
xor eax, eax
mov dword [0x763e3c], eax
pop ebx
ret
Function at 0x4774b8
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.0040a3a8
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4774e4
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4774e4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x479990
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x7634f8], 0
je 0x4799b6
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x479a78
push 1
push 0x479a80
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00479928
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.0045cf80
test al, al
jne 0x479a20
cmp esi, 0x80090318
jne 0x479a28
test edi, edi
je 0x479a28
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x479a58
cmp dword [ebp - 0x24], 0
je 0x479a58
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x479a4e
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x479a6c
cmp dword [ebp - 0x18], 0
je 0x479a6c
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x479a88
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x479b0d
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x76350c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x479c30
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x479c30
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
push 0x479c40
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.00479928
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.00479990
mov ebp, eax
sub ebp, 0x80090318
je 0x479c28
sub ebp, 0x7ff6fce8
je 0x479ba5
sub ebp, 0x90312
je 0x479bed
sub ebp, 0xe
je 0x479c19
jmp 0x479c30
cmp dword [esp + 0x30], 5
jne 0x479be7
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.0040690c
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x479c30
cmp dword [esp + 0x30], 5
jne 0x479c12
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.0040690c
mov esi, dword [esp + 0x2c]
jmp 0x479aa2
xor esi, esi
jmp 0x479aa2
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x479aa2
or edi, 0xffffffff
jmp 0x479aa2
movzx eax, byte [esp]
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x479c48
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov esi, edx
mov ebp, eax
mov bl, 1
mov eax, esi
call fcn.0040a3a8
mov dword [esp], eax
mov dword [esp + 0x44], esi
mov eax, dword [esp + 0x44]
call fcn.00409e24
mov edi, eax
mov dword [esp + 4], 0x400
cmp dword [ebp + 8], 0
je 0x479d7c
mov eax, dword [esp + 4]
cmp eax, dword [ebp + 0x68]
jbe 0x479d7c
mov eax, dword [ebp + 0x68]
mov dword [esp + 4], eax
jmp 0x479d7c
cmp edi, dword [esp + 4]
jbe 0x479ca5
mov esi, dword [esp + 4]
jmp 0x479ca7
mov esi, edi
cmp dword [ebp + 8], 0
je 0x479d61
mov edx, dword [ebp + 0x78]
add edx, dword [ebp + 0x60]
mov eax, dword [esp]
mov ecx, esi
call fcn.0040690c
push 3
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
add eax, esi
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x4c]
push eax
push 3
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], esi
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x64]
push eax
push 3
push 0x479d94
push 3
lea ecx, [esp + 0x30]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.00479928
push 0
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebp + 0x54]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x479d59
push 0
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x24]
add eax, dword [esp + 0x30]
push eax
mov eax, dword [ebp + 0x78]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x479d5d
xor ebx, ebx
jmp 0x479d77
mov bl, 1
jmp 0x479d77
push 0
push esi
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg bl
add dword [esp], esi
sub edi, esi
test bl, bl
je 0x479d88
test edi, edi
ja 0x479c99
mov eax, ebx
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47aae0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x47ad47
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x47ad03
cmp byte [0x7634fa], 0
jne 0x47ab6b
mov eax, ebx
call fcn.00460250
test al, al
je 0x47aba8
push 0x47ad68
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.004160a0
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.00424264
push dword [ebp - 0x21c]
push 0x47ad80
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040a260
jmp 0x47abb7
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.0040a554
push 0x47ad90
lea eax, [ebp - 0x228]
mov edx, dword [0x763ec4]
mov ecx, 0
call fcn.0040a0a0
push dword [ebp - 0x228]
push 0x47ada0
push 0x47adb0
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.00477ebc
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.0040a554
push dword [ebp - 0x22c]
push 0x47adcc
push dword [ebp - 4]
push 0x47ade4
push 0x47ada0
push 0x47adf4
push 0x47ada0
push 0x47ae24
push dword [ebp - 4]
push 0x47ade4
push 0x47ada0
push 0x47ada0
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.0040a260
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.00479c48
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x47ad03
cmp esi, 0xff
jbe 0x47ac75
mov ebx, 0xff
jmp 0x47ac77
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x47ac97
cmp ebx, dword [ebp - 0x14]
je 0x47aca9
mov edx, 0x47ada0
mov eax, edi
call fcn.00479c48
mov byte [ebp - 0xd], 0
jmp 0x47ad03
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.0042412c
lea eax, [ebp - 0x234]
mov edx, 0x47ada0
call fcn.0040a184
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.00479c48
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x47acfb
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x47ac66
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ad4e
lea eax, [ebp - 0x234]
call fcn.00409938
lea eax, [ebp - 0x230]
call fcn.00409914
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.004099a4
lea eax, [ebp - 4]
call fcn.00409938
ret
Function at 0x47e570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x47e689
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x47e5ba
mov dword [ebp - 0x10], 0x600
jmp 0x47e5c1
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0040a4dc
test esi, esi
jbe 0x47e66b
cmp esi, dword [ebp - 0x10]
jae 0x47e5e7
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.0040a4dc
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00409e24
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x47e614
mov eax, dword [ebp - 4]
call fcn.00409e24
cmp eax, dword [ebp - 0x14]
je 0x47e618
xor ebx, ebx
jmp 0x47e66b
cmp byte [ebp + 8], 0
je 0x47e637
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00424264
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.0047d964
mov ebx, eax
jmp 0x47e643
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0047d964
mov ebx, eax
test bl, bl
je 0x47e66b
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0047deb4
test esi, esi
ja 0x47e5d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e690
lea eax, [ebp - 0x18]
call fcn.00409938
lea eax, [ebp - 4]
call fcn.00409938
ret
Function at 0x483ed4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099f8
xor eax, eax
push ebp
push 0x484017
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0041630c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00409d3c
cmp dword [ebp - 4], 0
je 0x483fed
mov eax, dword [ebp - 4]
call fcn.00409e0c
mov edx, dword [ebp - 4]
cmp word [edx + eax*2 - 2], 0x5c
jne 0x483f41
mov eax, dword [ebp - 4]
call fcn.00409e0c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.0040ad68
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x483f8d
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x483f89
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00483ed4
pop ecx
test al, al
je 0x483f85
push 0
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x483f89
xor ebx, ebx
jmp 0x483fef
mov bl, 1
jmp 0x483fef
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0xc]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x483fe9
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00483ed4
pop ecx
test al, al
je 0x483fe5
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x10]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x483fe9
xor ebx, ebx
jmp 0x483fef
mov bl, 1
jmp 0x483fef
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48401e
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004099a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409974
ret
Function at 0x486b28
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Read file via mapping
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x486d42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x70]
mov edx, 0x44
call fcn.004120bc
mov dword [ebp - 0x70], 0x44
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x486bdb
test ebx, ebx
jne 0x486b8f
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040a9ac
jmp 0x486b99
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409d3c
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x486c44
test ebx, ebx
jne 0x486bf5
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040a0a0
jmp 0x486c04
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 0
call fcn.0040a554
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040a3a8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x486cf5
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
call fcn.0045fb48
lea eax, [ebp - 0x294]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x78]
call fcn.00414ca8
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x486d5c
call fcn.0040a1dc
mov eax, dword [ebp - 0x290]
call fcn.0040a3a8
push eax
push 0x58
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x486cec
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx], eax
push 2
push 0
push 0
lea eax, [ebx + 4]
push eax
mov eax, dword [ebp - 0x80]
push eax
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
lea edx, [ebx + 8]
mov eax, 0x763630
mov ecx, 0x50
call fcn.0040690c
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_ResumeThread
cmp byte [ebp - 9], 0
je 0x486d0a
push 2
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x486d14
mov eax, 2
call fcn.00409774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486d49
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.004099a4
lea eax, [ebp - 8]
call fcn.00409938
lea eax, [ebp - 4]
call fcn.00409914
ret