joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4858ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x48591d
dec al
je 0x485958
dec al
je 0x48599d
dec al
je 0x485a06
jmp 0x485a90
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x485a90
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x48592d
jmp 0x485a90
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x485a90
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x485968
jmp 0x485a90
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x485a90
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4859cc
xor ebp, ebp
jmp 0x4859dc
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4859e5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4859ad
jmp 0x485a90
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x485a90
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x485a5f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00482c98
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x485a1a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48a6e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
cmp dword [ebp + 0x14], 0
je 0x48a874
xor eax, eax
push ebp
push 0x48a7a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
dec eax
test eax, eax
jl 0x48a79a
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
call fcn.004889f8
mov esi, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004889f8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004889f8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
lea ebx, [ebx + ebx*2]
dec ebx
test ebx, ebx
jl 0x48a792
inc ebx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + ecx]
movzx edx, byte [ebp + 0x10]
mov edi, 0xff
sub edi, edx
imul edi
mov edi, 0xff
cdq
idiv edi
push eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + ecx]
movzx edx, byte [ebp + 0x10]
imul edx
mov edi, 0xff
xor edx, edx
div edi
pop edx
add dl, al
mov byte [esi + ecx], dl
inc ecx
dec ebx
jne 0x48a755
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x48a71e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a7ae
xor eax, eax
push ebp
push 0x48a86a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
dec eax
test eax, eax
jl 0x48a860
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
call fcn.0048899c
mov esi, eax
test esi, esi
je 0x48a854
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0048899c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x48a854
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0048899c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48a854
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x48a854
inc ebx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + ecx]
movzx edx, byte [ebp + 0x10]
mov edi, 0xff
sub edi, edx
imul edi
mov edi, 0xff
cdq
idiv edi
push eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + ecx]
movzx edx, byte [ebp + 0x10]
imul edx
mov edi, 0xff
xor edx, edx
div edi
pop edx
add dl, al
mov byte [esi + ecx], dl
inc ecx
dec ebx
jne 0x48a817
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x48a7d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a874
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4c84f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c854a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c84e4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004c57d8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004c533c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8551
lea eax, [ebp - 4]
call fcn.00405988
ret
Function at 0x4dd5c0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405980
xor eax, eax
push ebp
push 0x4dd6ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x414]
call fcn.00405d6c
mov eax, dword [ebp - 8]
call fcn.0040cae0
test al, al
je 0x4dd693
mov eax, dword [ebp - 8]
call fcn.00405a24
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4dd693
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4dd693
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
push dword [ebx + 0x414]
push 0x4dd6c8
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.0040c5e4
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405e3c
mov eax, dword [ebp - 0xc]
call fcn.00405a24
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
call fcn.00405a24
push eax
call sub.kernel32.dll_MoveFileW
test eax, eax
je 0x4dd683
push 4
push 0x4dd6cc
push ebx
call sub.kernel32.dll_MoveFileExW
call sub.kernel32.dll_GetTickCount_1
cmp esi, eax
jne 0x4dd693
push 0x10
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd6b5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405990
ret

Function at 0x4dd904
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405980
mov eax, dword [ebp - 8]
call fcn.00405980
xor eax, eax
push ebp
push 0x4dda08
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004059ec
mov eax, dword [ebp - 0xc]
call fcn.0040cae0
test al, al
je 0x4dd9ed
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403674
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xc]
call fcn.00405a24
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 8], 0
jne 0x4dd993
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x4dd99e
mov eax, dword [ebp - 8]
call fcn.00405a24
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4dd9ed
xor eax, eax
mov dword [ebp - 0x10], eax
test esi, esi
je 0x4dd9ea
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dda0f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405990
ret
Function at 0x4ddb90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
push ebx
xor edx, edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405980
lea eax, [ebp - 0x280]
mov edx, dword [0x409f74]
call fcn.00406350
xor eax, eax
push ebp
push 0x4ddd5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040cb28
test al, al
je 0x4ddd13
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004059ec
lea eax, [ebp - 0x288]
mov edx, dword [ebp - 0xc]
call fcn.00405c14
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x284]
mov edx, 1
call fcn.00409dd8
mov eax, dword [ebp - 0x284]
mov edx, 0x4ddd74
call fcn.004058b0
je 0x4ddc42
lea eax, [ebp - 0xc]
mov edx, 0x4ddd84
call fcn.00405cec
lea eax, [ebp - 0x28c]
mov ecx, 0x4ddd94
mov edx, dword [ebp - 0xc]
call fcn.00405d6c
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.0040cce4
test eax, eax
jne 0x4ddd00
mov eax, dword [ebp - 0x26c]
mov edx, 0x4ddda4
call fcn.00405fe4
je 0x4ddced
mov eax, dword [ebp - 0x26c]
mov edx, 0x4dddb4
call fcn.00405fe4
je 0x4ddced
test byte [ebp - 0x270], 0x10
je 0x4ddcc1
lea eax, [ebp - 0x290]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 0xc]
call fcn.00405d6c
mov eax, dword [ebp - 0x290]
call fcn.004ddb90
jmp 0x4ddced
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 0xc]
call fcn.00405d6c
mov eax, 0x4f53a0
mov edx, dword [ebp - 8]
call fcn.00405998
mov eax, dword [ebp - 8]
call fcn.00405a24
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x280]
call fcn.0040cd34
test eax, eax
je 0x4ddc73
lea eax, [ebp - 0x280]
call fcn.0040cd58
mov eax, dword [ebp - 0xc]
call fcn.0040d2c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddd66
lea eax, [ebp - 0x290]
mov edx, 2
call fcn.00405990
lea eax, [ebp - 0x288]
mov edx, 2
call fcn.00405620
lea eax, [ebp - 0x280]
mov edx, dword [0x409f74]
call fcn.00406428
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405990
ret

Function at 0x4de0e0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4de1a3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x26
lea eax, [ebp - 0x20e]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00405b98
lea eax, [ebp - 0x218]
mov edx, dword [ebp - 4]
call fcn.00405c14
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov edx, 1
call fcn.00409dd8
mov eax, dword [ebp - 0x214]
mov edx, 0x4de1b4
call fcn.004058b0
je 0x4de173
lea eax, [ebp - 4]
mov edx, 0x4de1c4
call fcn.00405cec
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405998
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de1aa
lea eax, [ebp - 0x218]
mov edx, 2
call fcn.00405620
lea eax, [ebp - 4]
call fcn.00405988
ret
Function at 0x4df2f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4df300
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df567
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004e25dc
test eax, eax
jne 0x4df3ae
push 0x40
lea edx, [ebp - 8]
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
call fcn.0047cec8
mov eax, dword [ebp - 8]
call fcn.00405a24
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x3ac]
call fcn.0045c548
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00405c14
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edx, 2
call fcn.00409dbc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xf
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4df580
call fcn.0040dc18
mov eax, dword [ebp - 0xc]
call fcn.00405a24
push eax
mov eax, ebx
call fcn.00464e6c
push eax
call sub.user32.dll_MessageBoxW
xor edx, edx
mov eax, ebx
call fcn.004df63c
jmp 0x4df51d
lea edx, [ebp - 0x24]
mov eax, dword [0x4f539c]
mov eax, dword [eax + 0x3ac]
call fcn.0045c548
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x414]
call fcn.00405998
mov edx, dword [ebx + 0x414]
mov eax, ebx
call fcn.004e2090
test al, al
jne 0x4df41f
mov eax, dword [ebx + 0x3b4]
cmp eax, esi
jne 0x4df41f
push 0x24
lea edx, [ebp - 0x28]
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
call fcn.0047cec8
mov eax, dword [ebp - 0x28]
call fcn.00405a24
push eax
push 0x4df5b4
mov eax, ebx
call fcn.00464e6c
push eax
call sub.user32.dll_MessageBoxW
cmp eax, 7
je 0x4df51d
mov eax, dword [ebx + 0x414]
call fcn.0040cb28
test al, al
jne 0x4df439
mov eax, dword [ebx + 0x414]
call fcn.0040cb4c
lea eax, [ebp - 0x30]
mov edx, dword [ebx + 0x414]
call fcn.00405c14
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
mov edx, 1
call fcn.00409dd8
mov eax, dword [ebp - 0x2c]
mov edx, 0x4df5e0
call fcn.004058b0
je 0x4df476
lea eax, [ebx + 0x414]
mov edx, 0x4df5f0
call fcn.00405cec
xor edx, edx
mov eax, ebx
call fcn.004e4090
xor edx, edx
mov eax, dword [ebx + 0x384]
call fcn.0045c490
xor edx, edx
mov eax, dword [ebx + 0x394]
call fcn.0045c490
mov dl, 1
mov eax, dword [ebx + 0x3d0]
call fcn.0045c490
mov dl, 1
mov eax, dword [ebx + 0x388]
call fcn.0045c490
mov dl, 1
mov eax, dword [ebx + 0x3cc]
call fcn.0045c490
mov eax, dword [ebx + 0x3cc]
call fcn.0045c7f0
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
call fcn.0047d3a0
mov eax, ebx
call fcn.004e0bd8
mov eax, ebx
call fcn.004e4300
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4de20c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebx + 0x400], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4dec90
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebx + 0x404], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df56e
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00405620
lea eax, [ebp - 0x28]
call fcn.00405988
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405990
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405620
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405990
ret
Function at 0x4df8e4
Capabilities:
Hide graphical window

Disassembly:
test al, al
je 0x4df8f3
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
cmp byte [eax + 0xcf], 0
je 0x4df928
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
je 0x4df928
push 0
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
call fcn.00464e6c
push eax
call sub.user32.dll_ShowWindow
ret
push 0
mov eax, dword [0x4ee5ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x4e14dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e169a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x4e16b8
mov edx, dword [esi + 0x414]
call fcn.00405d6c
mov eax, dword [ebp - 4]
call fcn.0040cae0
test al, al
je 0x4e1590
mov eax, dword [ebp - 4]
call fcn.00405a24
push eax
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x4e1590
push 0x4e16d0
push ebx
call fcn.004084b0
mov edi, eax
test edi, edi
je 0x4e1543
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x4e16e8
push ebx
call fcn.004084b0
mov edi, eax
test edi, edi
je 0x4e155e
call edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e158a
push 0x4e1708
push ebx
call fcn.004084b0
mov edi, eax
test edi, edi
je 0x4e1577
call edi
push 0x4e1728
push ebx
call fcn.004084b0
mov edi, eax
test edi, edi
je 0x4e158a
call edi
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 4]
mov ecx, 0x4e1754
mov edx, dword [esi + 0x414]
call fcn.00405d6c
mov eax, dword [ebp - 4]
call fcn.0040cae0
test al, al
je 0x4e15dc
mov eax, dword [ebp - 4]
call fcn.00405a24
push eax
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x4e15dc
push 0x4e1770
push ebx
call fcn.004084b0
mov edi, eax
test edi, edi
je 0x4e15d6
call edi
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 4]
mov ecx, 0x4e17a8
mov edx, dword [esi + 0x414]
call fcn.00405d6c
mov eax, dword [ebp - 4]
call fcn.0040cae0
test al, al
je 0x4e1628
mov eax, dword [ebp - 4]
call fcn.00405a24
push eax
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x4e1628
push 0x4e17c8
push ebx
call fcn.004084b0
mov edi, eax
test edi, edi
je 0x4e1622
call edi
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 4]
mov ecx, 0x4e1808
mov edx, dword [esi + 0x414]
call fcn.00405d6c
mov eax, dword [ebp - 4]
call fcn.0040cae0
test al, al
je 0x4e167f
push 0x4e1834
push dword [ebp - 4]
push 0x4e184c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405e3c
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a24
push eax
push 0x4e1850
push 0x4e186c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e16a1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405990
ret
Function at 0x4e1878
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e193f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x434], 0
je 0x4e1924
lea eax, [ebp - 4]
mov edx, dword [esi + 0x414]
call fcn.004059ec
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004059ec
call fcn.004dda98
test eax, eax
je 0x4e18d1
lea eax, [ebp - 8]
mov edx, 0x4e195c
call fcn.00405cec
jmp 0x4e18de
lea eax, [ebp - 8]
mov edx, 0x4e1990
call fcn.00405cec
mov eax, dword [ebp - 8]
call fcn.0040cae0
test al, al
je 0x4e1922
push 0x4e19c0
push dword [ebp - 8]
push 0x4e19d8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405e3c
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405a24
push eax
push 0x4e19dc
push 0x4e19f8
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1946
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405990
ret
Function at 0x4e1a04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e1be5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x414]
call fcn.004059ec
cmp dword [ebx + 0x424], 0
je 0x4e1ab1
mov dl, 1
mov eax, dword [0x42dc5c]
call fcn.0042ddc8
mov esi, eax
mov edx, 0x80000002
mov eax, esi
call fcn.0042de68
lea eax, [ebp - 8]
mov ecx, dword [ebx + 0x424]
mov edx, 0x4e1c00
call fcn.00405d6c
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0042e78c
test al, al
jne 0x4e1a7f
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0042ded0
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0042dfac
test al, al
je 0x4e1aa8
mov ecx, dword [ebx + 0x414]
mov edx, 0x4e1c20
mov eax, esi
call fcn.0042e500
mov eax, esi
call fcn.0042de38
mov dl, 1
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, ebx
call fcn.004e14dc
push 0
push 0
push 0x4e1c2c
lea eax, [ebp - 0xc]
mov ecx, 0x4e1c48
mov edx, dword [ebp - 4]
call fcn.00405d6c
mov eax, dword [ebp - 0xc]
call fcn.00405a24
push eax
push 0x4e1c68
push 0
call sub.shell32.dll_ShellExecuteW
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004059ec
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405c14
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov edx, 1
call fcn.00409dd8
mov eax, dword [ebp - 0x10]
mov edx, 0x4e1c78
call fcn.004058b0
jne 0x4e1b67
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e1b38
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4e1b38
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004051d8
mov ebx, eax
test ebx, ebx
je 0x4e1b43
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00405c14
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edx, ebx
dec edx
call fcn.00409dbc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00405c00
push 0x4e1c88
push dword [ebp - 8]
push 0x4e1c88
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405e3c
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a24
push eax
lea eax, [ebp - 0x20]
mov ecx, 0x4e1c98
mov edx, dword [ebp - 4]
call fcn.00405d6c
mov eax, dword [ebp - 0x20]
call fcn.00405a24
push eax
push 0x4e1c68
push 0
call sub.shell32.dll_ShellExecuteW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1bec
lea eax, [ebp - 0x20]
call fcn.00405988
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405620
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405990
ret