joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a68b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.004a685c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a6928
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [0x4d3688], eax
mov dword [ebp - 4], 0x4a67e8
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a6928
xor eax, eax
push ebp
push 0x4a6921
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6928
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret

Function at 0x4a692c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.004a685c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a699b
mov eax, dword [0x4d3688]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a699b
xor eax, eax
push ebp
push 0x4a6994
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a699b
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret
Function at 0x4ad188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x42243c]
call fcn.004281c0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ad35b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x4ad33a
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004295ec
mov eax, dword [ebp - 8]
call fcn.00428790
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.00423bd8
cmp byte [ebp + 8], 0
je 0x4ad222
xor edx, edx
mov eax, ebx
call fcn.004ac110
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.004ac110
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.004ac040
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x4ad25e
xor edx, edx
mov eax, ebx
call fcn.004ac110
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.004ac040
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.004ac110
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00417f9c
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.00428790
pop edx
call fcn.00423f7c
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.004ac040
dec eax
test eax, eax
jl 0x4ad312
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004abfe4
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.004ac13c
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
xor edx, edx
mov dl, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.004ac13c
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
mov dl, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.00417f74
mov eax, dword [ebp - 8]
call fcn.00428790
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x4ad2a8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004abfe4
cmp byte [ebp + 0xc], 0
je 0x4ad33a
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.0042a7b0
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004ab7d4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad362
mov eax, dword [ebp - 8]
call fcn.00403764
ret
Function at 0x4b44a4
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x4cdb18
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4b4568
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4b44dc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4b457f
dec edx
je 0x4b45c0
jmp 0x4b461d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4b461d
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b4680
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4b469d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4b47af
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4b46d0
je 0x4b471c
sub ecx, 0x2b
je 0x4b4712
sub ecx, 4
je 0x4b4717
dec ecx
sub ecx, 0xa
jb 0x4b4701
jmp 0x4b471f
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4b46e2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4b46f0
jmp 0x4b471f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4b471f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4b471f
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4b471f
mov byte [eax], 0x3e
jmp 0x4b471f
mov byte [eax], 0x3f
jmp 0x4b471f
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4b46af
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4b476f
cmp byte [esp + 3], 0xff
jne 0x4b476f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4b47a7
cmp dl, 0xff
je 0x4b47a7
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4b46a8
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4b52f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4b5310
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4b52fe
pop edi
pop esi
pop ebx
ret
Function at 0x4b84e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
push 0
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.00404b34
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b8514
mov dword [esp], 0xffffffff
mov eax, dword [esp]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b8850
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
mov ebx, eax
lea eax, [ebp - 0x148]
mov edx, dword [0x4b8814]
call fcn.004050a0
xor eax, eax
push ebp
push 0x4b8926
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x130], 0x94
lea eax, [ebp - 0x130]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x120], 2
jne 0x4b88e3
cmp dword [ebp - 0x12c], 5
jae 0x4b88b8
lea ecx, [ebp - 0x148]
xor edx, edx
lea eax, [ebp - 0x9c]
call fcn.004b8934
jmp 0x4b88f4
mov dword [ebp - 0x9c], 0x9c
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA_2
lea ecx, [ebp - 0x148]
mov dl, 1
lea eax, [ebp - 0x9c]
call fcn.004b8934
jmp 0x4b88f4
lea edx, [ebp - 0x148]
lea eax, [ebp - 0x130]
call fcn.004b923c
mov eax, ebx
lea edx, [ebp - 0x148]
mov ecx, dword [0x4b8814]
call fcn.004053d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b892d
lea eax, [ebp - 0x148]
mov edx, dword [0x4b8814]
call fcn.00405170
ret

Function at 0x4bf3a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
mov edx, 0x104
call fcn.00404cc0
mov eax, dword [ebx]
call fcn.00404b34
push eax
push 0
push 0
push 0x26
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov edx, dword [ebx]
mov eax, 0x4bf3e8
call fcn.00404c78
test eax, eax
jle 0x4bf3de
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404cc0
pop ebx
ret
Function at 0x4bf3ec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2c
push 0
push 0
dec ecx
jne 0x4bf3f4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4bf595
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0x14
jge 0x4bf55f
mov dword [ebp - 0x130], 0x128
xor edx, edx
mov eax, 2
call fcn.0045fbec
mov ebx, eax
xor esi, esi
xor edi, edi
lea edx, [ebp - 0x130]
mov eax, ebx
call fcn.0045fc0c
test eax, eax
je 0x4bf4f3
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.004048e4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408a30
mov eax, dword [ebp - 0x134]
mov edx, 0x4bf5b0
call fcn.00404a80
jne 0x4bf4e2
mov edi, dword [ebp - 0x128]
push ebx
call sub.kernel32.dll_CloseHandle
or esi, 0xffffffff
jmp 0x4bf4f3
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.004048e4
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408a30
mov eax, dword [ebp - 0x13c]
mov edx, 0x4bf5b0
call fcn.00404a80
jne 0x4bf4e2
mov edi, dword [ebp - 0x128]
push ebx
call sub.kernel32.dll_CloseHandle
or esi, 0xffffffff
jmp 0x4bf4f3
lea edx, [ebp - 0x130]
mov eax, ebx
call fcn.0045fc2c
test eax, eax
jne 0x4bf498
push ebx
call sub.kernel32.dll_CloseHandle
test esi, esi
je 0x4bf55f
push edi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 4]
mov cl, 4
call fcn.00414664
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x160]
call fcn.00415a14
lea edx, [ebp - 0x160]
pop eax
call fcn.00415a1c
je 0x4bf548
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
inc dword [ebp - 8]
push 0x1f4
call sub.kernel32.dll_Sleep_1
cmp dword [ebp - 8], 0x14
jl 0x4bf41d
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf59c
lea eax, [ebp - 0x160]
mov edx, dword [0x4010b0]
mov ecx, 2
call fcn.004051bc
lea eax, [ebp - 0x140]
mov edx, 4
call fcn.00404698
ret

Function at 0x4bf5c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404b24
mov eax, dword [ebp - 8]
call fcn.00404b24
xor eax, eax
push ebp
push 0x4bf666
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403160
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], 0x500
mov eax, 0x4bf678
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00404b34
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404b34
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x4bf649
call fcn.0040e23c
jmp 0x4bf64b
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf66d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404698
ret
Function at 0x4bf680
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xfffffed0
xor ebx, ebx
mov dword [esp + 0x9c], 0x94
lea eax, [esp + 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4bf6b3
cmp dword [esp + 0xa0], 6
jb 0x4bf6c9
mov bl, 1
jmp 0x4bf6c9
mov dword [esp], 0x9c
push esp
call sub.kernel32.dll_GetVersionExA_3
cmp dword [esp + 4], 6
jb 0x4bf6c9
mov bl, 1
mov eax, ebx
add esp, 0x130
pop ebx
ret

Function at 0x4bf73c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bf7ec
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov esi, 0x4bf7fc
lea edi, [ebp - 0x10d]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00416548
test al, al
je 0x4bf7c4
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4bf7c4
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00416548
test al, al
je 0x4bf7c4
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [ebp - 8]
call fcn.00406270
mov eax, esi
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.004048e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf7f3
lea eax, [ebp - 8]
call fcn.00406270
ret
Function at 0x4c137c
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4c1526
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
call fcn.00404674
xor ebx, ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
push 0
call sub.IPHLPAPI.DLL_GetIpForwardTable
not eax
cmp eax, 0x6f
je 0x4c1503
mov eax, dword [ebp - 0x14]
call fcn.0040899c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c14fc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x4c14e6
mov eax, dword [ebp - 8]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x4c145e
inc edi
xor esi, esi
mov eax, esi
shl eax, 3
sub eax, esi
mov edx, dword [ebp - 8]
push esi
push edi
lea esi, [edx + eax*8 + 4]
lea edi, [ebp - 0x50]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x50]
call fcn.004befdc
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x44]
call fcn.004befdc
mov eax, dword [ebp - 0xc]
mov edx, 0x4c153c
call fcn.00404a80
jne 0x4c145a
mov eax, dword [ebp - 0x40]
call fcn.004beff8
lea edx, [ebp - 0x18]
call fcn.004befdc
mov bl, 1
jmp 0x4c145e
inc esi
dec edi
jne 0x4c1405
test bl, bl
jne 0x4c14d5
mov eax, dword [ebp - 8]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x4c14d5
inc edi
xor esi, esi
mov eax, esi
shl eax, 3
sub eax, esi
mov edx, dword [ebp - 8]
push esi
push edi
lea esi, [edx + eax*8 + 4]
lea edi, [ebp - 0x50]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x50]
call fcn.004befdc
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x44]
call fcn.004befdc
mov eax, dword [ebp - 0xc]
mov edx, 0x4c1550
call fcn.00404a80
je 0x4c14bf
mov eax, dword [ebp - 0xc]
mov edx, 0x4c1560
call fcn.00404a80
jne 0x4c14d1
mov eax, dword [ebp - 0x40]
call fcn.004beff8
lea edx, [ebp - 0x18]
call fcn.004befdc
jmp 0x4c14d5
inc esi
dec edi
jne 0x4c146f
cmp dword [ebp - 0x18], 0
je 0x4c14e6
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.004046c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1503
mov eax, dword [ebp - 8]
call fcn.00402a98
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c152d
lea eax, [ebp - 0x18]
call fcn.00404674
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404698
ret
Function at 0x4c7440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4c7448
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c75c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x12c], 0x128
xor edx, edx
mov eax, 2
call fcn.0045fbec
mov ebx, eax
xor esi, esi
xor edi, edi
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.0045fc0c
test eax, eax
je 0x4c753a
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004048e4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408a30
mov eax, dword [ebp - 0x130]
mov edx, 0x4c75e0
call fcn.00404a80
jne 0x4c7529
mov edi, dword [ebp - 0x124]
push ebx
call sub.kernel32.dll_CloseHandle
or esi, 0xffffffff
jmp 0x4c753a
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.004048e4
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00408a30
mov eax, dword [ebp - 0x138]
mov edx, 0x4c75e0
call fcn.00404a80
jne 0x4c7529
mov edi, dword [ebp - 0x124]
push ebx
call sub.kernel32.dll_CloseHandle
or esi, 0xffffffff
jmp 0x4c753a
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.0045fc2c
test eax, eax
jne 0x4c74df
push ebx
call sub.kernel32.dll_CloseHandle
test esi, esi
je 0x4c7594
push edi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
lea eax, [ebp - 0x14c]
mov edx, ebx
mov cl, 4
call fcn.00414664
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x15c]
call fcn.00415a14
lea edx, [ebp - 0x15c]
pop eax
call fcn.00415a1c
je 0x4c7594
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 4]
mov byte [eax + 0x36d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c75cf
lea eax, [ebp - 0x15c]
mov edx, dword [0x4010b0]
mov ecx, 2
call fcn.004051bc
lea eax, [ebp - 0x13c]
mov edx, 4
call fcn.00404698
ret
Function at 0x402274
Capabilities:
Delete directory
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
mov eax, dword [esp + 0xc]
mov dword [0x412a78], eax
mov edx, dword [0x412558]
xor ecx, ecx
call fcn.0040e0c0
jne 0x4022b0
mov edx, dword [0x412558]
push dword [0x412a78]
call fcn.0040e0f0
lea eax, [esp + 4]
push eax
call fcn.0040e040
jmp 0x40242c
push 0xc80001
push dword [0x412554]
push 0x6e
push 0xc8
push 0
push 0
push 0
call fcn.00409b60
push dword [0x4124c4]
push 0x14
push 0x9e
push 0xf
push 0x15
push 1
call fcn.00408d43
push 0x20
push 0x41101e
push 0x14
push 0x9e
push 0x28
push 0x15
push 2
call fcn.00408f1c
push 0x411053
push 0x14
push 0x4e
push 0x4b
push 0x3d
push 3
call fcn.00409229
push 4
push 0xd
push 0
call fcn.00409b83
push 2
call fcn.00409249
call fcn.00409d87
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x402390
push dword [0x412560]
call sub.i_RemoveDirectoryA
push 0
jmp 0x401d91
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x4023dc
call fcn.0040c19d
push eax
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4023d9
push dword [0x412a78]
push dword [0x412a78]
push 2
call fcn.00409284
lea eax, [esp + 0xc]
push eax
call fcn.0040e040
push 0
call fcn.00409723
add esp, 8
jmp 0x40242c
pop eax
jmp 0x402426
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x402426
call fcn.0040c1ac
push eax
mov ebx, 3
cmp ebx, dword [esp]
jne 0x402425
push dword [0x412a78]
push dword [0x412a78]
push 2
call fcn.00409284
lea eax, [esp + 0xc]
push eax
call fcn.0040e040
push 0
call fcn.00409723
add esp, 8
jmp 0x40242c
pop eax
pop eax
jmp 0x402366
push dword [0x412a78]
push dword [0x412a78]
push dword [esp + 8]
call fcn.00404300
push eax
mov eax, dword [esp + 0xc]
push eax
call fcn.0040c890
inc dword [0x412a78]
push dword [0x412a78]
push dword [0x412a78]
push dword [0x412474]
push dword [0x412460]
call fcn.0040b210
pop edx
pop ecx
mov dword [0x412a78], ecx
add ecx, dword [0x411324]
add edx, dword [0x411324]
call fcn.0040e0c0
jne 0x4024b5
push 0x10
push dword [0x412538]
push dword [0x412564]
call fcn.004070d0
push dword [0x412560]
call sub.i_RemoveDirectoryA
push 1
jmp 0x401d91
mov edx, dword [esp]
push dword [0x412a78]
call fcn.0040e0f0
pop eax
add eax, dword [0x411324]
jmp 0x4024da
push dword [esp]
call fcn.0040e150
add esp, 4
pop ebx
ret