joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44eee8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44eeff
add esp, 0xfffffff0
call fcn.0040326c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00415a84
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40f834]
call fcn.00402f3c
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40f834]
call fcn.00402f3c
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x41797c]
call fcn.0041fc38
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x44f074
mov eax, dword [0x4e60dc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00420008
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x450a98
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4e60dc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce84
test eax, eax
je 0x44eff2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004097ac
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ceac
test eax, eax
je 0x44f006
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403e24
mov eax, dword [0x4e5f6c]
cmp byte [eax], 0
jne 0x44f037
mov eax, ebx
call fcn.0044f160
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44f069
call fcn.004032c4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44f3d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4e77d4]
cmp dword [eax + 0x24], 0
je 0x44f473
cmp dword [ebx + 0x84], 0
jne 0x44f46d
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44f360
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x44f46d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44f436
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44f46d
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.00410ef8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44f445
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x44fe80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x44feb5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cdc
jmp 0x44febf
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403c48
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450e0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x450e44
mov eax, esi
call fcn.0043825c
test al, al
je 0x450e44
mov eax, dword [ebx + 0x74]
call fcn.00437f60
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450e44
push 0
mov eax, dword [ebx + 0x74]
call fcn.00437f60
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x459ee4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459fbc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e7840], 0
jne 0x459fa0
lea eax, [ebp - 4]
mov edx, 0x459fd4
call fcn.00403c8c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404038
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x459fa0
mov eax, ebx
call fcn.00402794
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x459f99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x459f83
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x459fe4
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x459f83
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4e7840], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459fa0
mov eax, dword [ebp - 0xc]
call fcn.004027ac
ret
mov ebx, dword [0x4e7840]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459fc3
lea eax, [ebp - 4]
call fcn.00403bf4
ret
Function at 0x4615db
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46161d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403c8c
mov eax, dword [ebp - 0x10]
call fcn.0046121c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x461506
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.004040bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004618f0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4615db
xor eax, eax
push ebp
push 0x4615d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0046138c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0046164c
test al, al
je 0x4615b2
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403cdc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4615b2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404038
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4615ac
mov eax, dword [ebp - 0x14]
call fcn.00404038
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403dac
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004614b4
dec ebx
cmp ebx, 0xffffffff
jne 0x461565
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4615db
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0046138c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404038
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00461378
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461624
lea eax, [ebp - 0x3c]
call fcn.00403bf4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403c18
ret

Function at 0x46164c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402c68
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4e63f8]
cmp byte [edx + 8], 0
je 0x4616b0
mov edx, dword [0x4e63f4]
cmp dword [edx], 2
jne 0x4616b0
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x461814
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00461230
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404038
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x461872
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e61ec]
mov dl, 1
mov eax, dword [0x461128]
call fcn.0040c278
call fcn.004036c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46187c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404038
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4618d4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e6404]
mov dl, 1
mov eax, dword [0x461128]
call fcn.0040c278
call fcn.004036c4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00461260
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47824c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x47827a
mov eax, ebx
call fcn.00478cf0
cmp dword [ebx + 0x3c], 0
je 0x478273
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4782eb
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4782dd
cmp dword [ebx + 8], 0
je 0x47829c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4782ae
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4782dd
cmp dword [ebx + 8], 0
je 0x47828f
cmp eax, 3
je 0x4782c1
dec eax
jne 0x47828f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47828f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x47828f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x478309
cmp dword [ebx + 0x10], 0xcc
je 0x478309
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00478314
pop ebx
ret

Function at 0x488e14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404038
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x488e2d
test al, 0x10
jne 0x488e31
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x48b4f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [0x4e79e0]
call fcn.00437f60
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x4e6388]
mov eax, dword [eax]
call fcn.00437f60
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4e6388]
mov eax, dword [eax]
call fcn.00437f60
push eax
call sub.user32.dll_SetForegroundWindow
mov edx, 1
mov eax, ebx
call fcn.004316a4
mov edx, 1
mov eax, ebx
call fcn.004316c4
mov dword [ebx + 0x318], 1
pop ebx
ret

Function at 0x48c1c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x2e0], 1
jne 0x48c24f
cmp dword [ebx + 0x2e4], 0
jne 0x48c232
mov eax, dword [0x4e6388]
mov eax, dword [eax]
call fcn.0044d228
push 5
mov eax, dword [0x4e6388]
mov eax, dword [eax]
call fcn.00437f60
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4e6030]
mov eax, dword [eax]
cmp dword [eax + 0x318], 0
jne 0x48c248
push 5
mov eax, dword [0x4e6030]
mov eax, dword [eax]
call fcn.00437f60
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4e6030]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x318], edx
jmp 0x48c248
mov eax, dword [0x4e6100]
cmp dword [eax], 0
je 0x48c248
mov eax, dword [0x4e6100]
mov eax, dword [eax]
call fcn.0044d228
mov eax, ebx
call fcn.0044d070
pop ebx
ret
Function at 0x4a3ab8
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404028
xor eax, eax
push ebp
push 0x4a3b91
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e74
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.0040407c
mov eax, dword [ebp - 0x28]
mov edx, 0x4a3ba8
call fcn.00403f84
jne 0x4a3b26
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e74
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040407c
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x2c]
mov ecx, 0x4a3bb4
mov edx, dword [ebp - 4]
call fcn.00403ec0
mov eax, dword [ebp - 0x2c]
call fcn.00404038
mov dword [ebp - 0x1a], eax
mov eax, 0x4a3bb8
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x414
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3b98
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403c18
lea eax, [ebp - 4]
call fcn.00403bf4
ret
Function at 0x4b9aac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b9be6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x8b0]
mov eax, dword [eax + 0x254]
call fcn.0045d4b4
test eax, eax
jle 0x4b9bcb
mov eax, dword [ebx + 0x8b0]
call fcn.0045f054
call fcn.0045cd0c
mov esi, dword [ebx + 0x5fd08]
mov edx, esi
dec edx
cmp eax, edx
jle 0x4b9bae
cmp esi, 0x64
jge 0x4b9bae
mov dl, 1
mov eax, dword [ebx + 0x67c]
call fcn.00453328
mov byte [ebx + 0xcbb0], 8
push 9
lea edx, [ebp - 8]
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.00450824
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004095d8
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
mov eax, dword [0x4e93bc]
push dword [eax + 0x5fcd8]
push 0x4b9bfc
push 0x4b9c14
push 0x4b9c24
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00403f34
mov eax, dword [ebp - 0xc]
call fcn.00404038
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.00450824
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040960c
mov eax, dword [ebp - 0x10]
call fcn.00404038
push eax
push 0x4b9c30
mov eax, dword [0x4e6268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b9bcb
xor edx, edx
mov eax, dword [ebx + 0x8b0]
call fcn.0045eddc
mov eax, dword [ebx + 0x8b0]
call fcn.0045f054
call fcn.0045d138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9bed
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403c18
ret
Function at 0x4b9c38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b9d97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x8b0]
mov eax, dword [eax + 0x254]
call fcn.0045d4b4
test eax, eax
jle 0x4b9d7c
mov eax, dword [ebx + 0x8b0]
call fcn.0045f054
call fcn.0045cd0c
mov edx, dword [ebx + 0x5fd08]
dec edx
cmp eax, edx
jle 0x4b9d3b
cmp byte [ebx + 0x5fd04], 0xb
jne 0x4b9d3b
mov dl, 1
mov eax, dword [ebx + 0x67c]
call fcn.00453328
mov byte [ebx + 0xcbb0], 8
push 9
lea edx, [ebp - 8]
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.00450824
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004095d8
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
mov eax, dword [0x4e93bc]
push dword [eax + 0x5fcd8]
push 0x4b9dac
push 0x4b9dc4
push 0x4b9dd4
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00403f34
mov eax, dword [ebp - 0xc]
call fcn.00404038
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.00450824
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040960c
mov eax, dword [ebp - 0x10]
call fcn.00404038
push eax
push 0x4b9de0
mov eax, dword [0x4e6268]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b9d7c
push 1
mov ecx, 0x4b9de8
mov edx, 0x4b9df0
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
dec eax
jne 0x4b9d7c
mov eax, dword [ebx + 0x8b0]
call fcn.0045f054
call fcn.0045cd0c
mov edx, eax
mov eax, ebx
call fcn.004b9e0c
mov edx, dword [ebx + 0xd624]
mov eax, ebx
call fcn.004b25c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9d9e
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403c18
ret
Function at 0x4c056c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4c07f0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xa04], 1
jne 0x4c05ae
push 0
mov ecx, 0x4c0800
mov edx, 0x4c0808
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
jmp 0x4c07c5
mov eax, dword [ebx + 0x8b0]
mov eax, dword [eax + 0x254]
call fcn.0045d4b4
test eax, eax
jne 0x4c05e0
push 0
mov ecx, 0x4c0800
mov edx, 0x4c0828
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
jmp 0x4c07c5
mov eax, dword [ebx + 0x780]
cmp byte [eax + 0x47], 0
jne 0x4c060a
mov eax, dword [ebx + 0xd624]
mov edx, eax
shl eax, 3
sub eax, edx
cmp byte [ebx + eax*8 + 0xd7e6], 0
jbe 0x4c060a
mov byte [ebx + 0xc5b0], 0
mov eax, dword [ebx + 0x8b0]
call fcn.0045f054
call fcn.0045cd0c
mov edx, eax
shl eax, 3
sub eax, edx
cmp byte [ebx + eax*8 + 0xd7e6], 5
je 0x4c064c
mov eax, dword [ebx + 0x8b0]
call fcn.0045f054
call fcn.0045cd0c
mov edx, eax
shl eax, 3
sub eax, edx
cmp byte [ebx + eax*8 + 0xd7e6], 6
jne 0x4c0653
mov byte [ebx + 0xc5b0], 0
cmp byte [ebx + 0xc5b0], 1
jne 0x4c068a
mov eax, dword [ebx + 0x8b0]
mov eax, dword [eax + 0x254]
call fcn.0045d4b4
test eax, eax
jle 0x4c068a
mov eax, dword [ebx + 0x8b0]
call fcn.0045f054
call fcn.0045cd0c
mov edx, eax
mov eax, ebx
call fcn.004b8fdc
cmp byte [ebx + 0x5fce0], 0
jne 0x4c072b
mov eax, dword [ebx + 0x8b0]
mov eax, dword [eax + 0x254]
call fcn.0045d4b4
test eax, eax
jle 0x4c0713
mov eax, dword [ebx + 0x2d4]
add eax, 0x68
mov edx, 0x4c084c
call fcn.00403c48
mov eax, dword [ebx + 0x2d4]
add eax, 0x70
call fcn.00403bf4
mov esi, dword [ebx + 0x2d4]
mov eax, dword [0x4c0858]
mov dword [esi + 0x54], eax
lea eax, [esi + 0x58]
mov edx, 0x4c0864
call fcn.00403c48
mov eax, dword [ebx + 0x2d4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x4c072b
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x2d4]
call fcn.004560c8
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, ebx
call fcn.004be7fc
jmp 0x4c072b
push 0
mov ecx, 0x4c0800
mov edx, 0x4c0880
mov eax, dword [0x4e6268]
mov eax, dword [eax]
call fcn.004504b4
cmp byte [ebx + 0x5fce0], 2
jne 0x4c07b2
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x5f910]
call fcn.0040909c
mov eax, dword [ebp - 0x10]
call fcn.00403e74
sub eax, 4
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x5f910]
call fcn.0040909c
mov eax, dword [ebp - 0x14]
mov edx, 1
pop ecx
call fcn.0040407c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x4c0898
call fcn.00403ec0
cmp byte [ebx + 0x6094c], 1
jne 0x4c07a3
push 0
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
mov eax, dword [ebx + 0x5f910]
call fcn.00404038
push eax
call sub.kernel32.dll_CopyFileA
xor ecx, ecx
mov edx, dword [ebx + 0x5f910]
mov eax, ebx
call fcn.004be7fc
mov eax, dword [ebx + 0x780]
cmp byte [eax + 0x47], 1
jne 0x4c07c5
mov byte [ebx + 0x5fd10], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c07f7
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403c18
lea eax, [ebp - 8]
call fcn.00403bf4
lea eax, [ebp - 4]
call fcn.00403bf4
ret
Function at 0x4c66e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4c66ec
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c688c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x5fd14], 0
je 0x4c671e
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x5fd14]
call fcn.0040909c
jmp 0x4c6775
call fcn.0042cee8
lea edx, [ebp - 0x10]
call fcn.0042cb08
mov eax, dword [ebx + 0x780]
call fcn.00428b2c
call fcn.0042cee8
lea edx, [ebp - 0x14]
call fcn.0042cb08
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.0040909c
call fcn.0042cee8
mov edx, dword [ebp - 0x10]
call fcn.0042cb88
mov eax, dword [ebx + 0x780]
mov edx, dword [eax]
call dword [edx + 0xb8]
test eax, eax
jne 0x4c6775
lea eax, [ebp - 4]
call fcn.00403bf4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040909c
cmp dword [ebp - 0x18], 0
jne 0x4c6793
lea eax, [ebp - 4]
mov edx, 0x4c68a0
call fcn.00403c8c
lea eax, [ebp - 8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040407c
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040407c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00408f00
mov eax, dword [ebp - 0x1c]
mov edx, 0x4c68c0
call fcn.00403f84
jne 0x4c67fc
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
push 0
mov eax, dword [0x4e93bc]
call fcn.00437f60
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c6866
mov eax, dword [ebx + 0x3e4]
cmp byte [eax + 0x2c], 0
jne 0x4c685c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00408f00
mov eax, dword [ebp - 0x20]
mov edx, 0x4c68d0
call fcn.00403f84
je 0x4c683c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00408f00
mov eax, dword [ebp - 0x24]
mov edx, 0x4c68e0
call fcn.00403f84
jne 0x4c685c
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404038
push eax
push 0
mov eax, ebx
call fcn.00437f60
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c6866
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004c6a0c
lea eax, [ebx + 0x5fd14]
call fcn.00403bf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6893
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403c18
ret