joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9054
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d9110
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10d]
call fcn.00409920
lea eax, [ebp - 0x114]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404700
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4d9128
call main
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0054604c
cmp dword [ebp - 8], 0
je 0x4d90ea
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00546d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9117
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4d9820
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d98dc
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10d]
call fcn.00409920
lea eax, [ebp - 0x114]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404700
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4d98f4
call main
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0054604c
cmp dword [ebp - 8], 0
je 0x4d98b6
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00546d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d98e3
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4dc100
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dc1bc
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10d]
call fcn.00409920
lea eax, [ebp - 0x114]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404700
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4dc1d4
call main
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0054604c
cmp dword [ebp - 8], 0
je 0x4dc196
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00546d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc1c3
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x4dc810
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4dc88c
mov eax, 0x4dc8a0
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4dc8c0
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret

Function at 0x4dda68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ddb24
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10d]
call fcn.00409920
lea eax, [ebp - 0x114]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404700
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4ddb3c
call main
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0054604c
cmp dword [ebp - 8], 0
je 0x4ddafe
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00546d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddb2b
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4df87c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df938
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10d]
call fcn.00409920
lea eax, [ebp - 0x114]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404700
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4df950
call main
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0054604c
cmp dword [ebp - 8], 0
je 0x4df912
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00546d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df93f
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x4e18b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e1967
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x110]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x110]
call fcn.00409920
lea eax, [ebp - 0x10]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404700
lea eax, [ebp - 4]
mov ecx, 0x4e197c
mov edx, dword [ebp - 0x10]
call main
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00546d9c
lea eax, [ebp - 8]
mov ecx, 0x4e19a8
mov edx, dword [ebp - 0xc]
call main
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00546d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e196e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404204
ret

Function at 0x4e1ab8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e1ba9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4e1bc0
push dword [ebp - 4]
push 0x4e1bd4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e1bc0
push dword [ebp - 4]
push 0x4e1bf0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push ebx
push esi
mov ecx, edi
mov edx, 0x4e1c0c
mov eax, 0x4e1c20
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1bb0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4e38ec
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e3968
mov eax, 0x4e397c
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e3998
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret
Function at 0x4e3be4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e3cd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4e3cec
push dword [ebp - 4]
push 0x4e3d00
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e3cec
push dword [ebp - 4]
push 0x4e3d1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push ebx
push esi
mov ecx, edi
mov edx, 0x4e3d38
mov eax, 0x4e3d4c
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3cdc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4e4070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e4161
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4e4178
push dword [ebp - 4]
push 0x4e418c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e4178
push dword [ebp - 4]
push 0x4e41a8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e41c4
mov eax, 0x4e41d8
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4168
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x4e56e0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e578c
mov eax, 0x4e57a0
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4e57bc
call sub.kernel32.dll_WinExec
push 0x4e57e0
mov ecx, 0x4e5814
mov edx, 0x4e582c
mov eax, 0x80000000
call fcn.004e5b78
push 0x4e5864
xor ecx, ecx
mov edx, 0x4e582c
mov eax, 0x80000000
call fcn.004e5b78
pop edi
pop esi
pop ebx
ret

Function at 0x4e5ec0
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e5f4c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10c]
call fcn.00409920
lea eax, [ebp - 0xc]
mov ecx, 0x4e5f60
mov edx, dword [ebp - 4]
call main
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4e5f78
call main
push 0
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5f53
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4e94b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e95a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4e95c0
push dword [ebp - 4]
push 0x4e95d4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e95c0
push dword [ebp - 4]
push 0x4e95f0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e960c
mov eax, 0x4e9620
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e95b0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x4e9bac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e9c9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4e9cb4
push dword [ebp - 4]
push 0x4e9cc8
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4e9cb4
push dword [ebp - 4]
push 0x4e9ce4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4e9d00
mov eax, 0x4e9d14
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9ca4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4ea094
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ea185
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4ea19c
push dword [ebp - 4]
push 0x4ea1b0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4ea19c
push dword [ebp - 4]
push 0x4ea1cc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4ea1e8
mov eax, 0x4ea1fc
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea18c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4eaed0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4eaf4c
mov eax, 0x4eaf60
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4eaf70
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret
Function at 0x4eb154
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4eb1d0
mov eax, 0x4eb1e4
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4eb1f4
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret

Function at 0x4eb6cc
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4eb748
mov eax, 0x4eb75c
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4eb76c
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret

Function at 0x4eb944
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4eb9c0
mov eax, 0x4eb9d4
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4eb9e4
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret
Function at 0x4ebe3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ebf57
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4ebf70
mov eax, 0x4ebf84
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4ebfac
push dword [ebp - 4]
push 0x4ebfc0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4ebfac
push dword [ebp - 4]
push 0x4ebfd8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4ebfac
push dword [ebp - 4]
push 0x4ebff4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0x10]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebf5e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404204
ret

Function at 0x4edd70
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
push ebx
push esi
mov ecx, edi
mov edx, 0x4eddec
mov eax, 0x4ede00
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
push 0
push 0x4ede10
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
ret
Function at 0x4ee0a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, eax
xor eax, eax
push ebp
push 0x4ee1c4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409920
lea eax, [ebp - 0x110]
mov ecx, 0x4ee1dc
mov edx, dword [ebp - 4]
call main
mov edx, dword [ebp - 0x110]
mov eax, esi
call fcn.0047002c
lea edx, [ebp - 0x114]
mov eax, esi
call fcn.0046fffc
mov eax, dword [ebp - 0x114]
call fcn.00409270
test al, al
je 0x4ee198
mov eax, ebx
call fcn.00492aa8
mov esi, eax
mov edx, esi
mov eax, ebx
call fcn.00492abc
add eax, 0xc
call fcn.004041e0
mov edx, esi
mov eax, ebx
call fcn.00492abc
add eax, 0x10
call fcn.004041e0
mov edx, esi
mov eax, ebx
call fcn.00492abc
add eax, 0x14
call fcn.004041e0
mov edx, esi
mov eax, ebx
call fcn.00492abc
add eax, 0x28
mov ecx, 0x4ee1dc
mov edx, dword [ebp - 4]
call main
mov edx, esi
mov eax, ebx
call fcn.00492abc
add eax, 0x1c
mov edx, 0x4ee1f4
call fcn.00404234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee1cb
lea eax, [ebp - 0x114]
call fcn.004041e0
lea eax, [ebp - 0x110]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret

Function at 0x4ef5bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ef6df
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4ef6f8
push dword [ebp - 4]
push 0x4ef70c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4ef6f8
push dword [ebp - 4]
push 0x4ef728
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push ebx
push esi
mov ecx, edi
mov edx, 0x4ef744
mov eax, 0x4ef758
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, 0x4ef770
call fcn.005479e4
mov eax, 0x4ef790
call fcn.005479e4
mov eax, 0x4ef7b0
call fcn.005479e4
mov eax, 0x4ef7d0
call fcn.005479e4
mov eax, 0x4ef7e4
call fcn.005479e4
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef6e6
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret