joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc2c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4dc335
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5a2ba8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4dc31f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004dc2b4
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d9870]
call fcn.004dd184
mov dword [0x5a2c10], eax
mov eax, dword [ebp - 4]
call fcn.004dc140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc33c
lea eax, [ebp - 8]
call fcn.00406968
ret

Function at 0x4dc3d4
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x4dc3e7
or esi, 2
test dl, dl
je 0x4dc3f0
or esi, 0
jmp 0x4dc3f3
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x4dd010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004051e0
xor eax, eax
push ebp
push 0x4dd168
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x4d9658]
call fcn.00419b8c
test eax, eax
jl 0x4dd077
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.004dc3b8
and eax, 0x7f
mov eax, dword [eax*4 + 0x5a2ba8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x4dd0da
mov eax, dword [ebx]
call fcn.00404ff0
test eax, eax
jle 0x4dd0da
mov eax, dword [ebx]
call fcn.00404ff0
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x4dd09e
mov eax, ebx
mov edx, 0x4dd180
call fcn.00404ff8
mov eax, dword [ebx]
call fcn.00404ff0
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.00405b80
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.004dc2b4
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x4dd125
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x5a5998]
call fcn.00406e2c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040ae28
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404d84
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x40871c]
call fcn.0040df78
call fcn.004046cc
mov eax, dword [ebp - 8]
call fcn.004dcf88
mov ebx, eax
test edi, edi
je 0x4dd13a
mov eax, edi
call fcn.00403f00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd16f
lea eax, [ebp - 0x1c]
call fcn.00404d30
lea eax, [ebp - 0x18]
call fcn.00406968
lea eax, [ebp - 0x14]
call fcn.00404d30
lea eax, [ebp - 4]
call fcn.00404d30
ret
Function at 0x4de868
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4de9d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5a6288]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x5a6288]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049dba8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004556a0
xor edx, edx
push ebp
push 0x4de9b5
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4de925
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00406968
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.004dc9d0
push eax
mov eax, dword [0x5a5f50]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x4de91b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404778
jmp 0x4de9bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4de961
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00455280
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004de6f8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x4de93d
push 0
mov edx, 0x4de690
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00454e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de9bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004556ec
mov eax, dword [0x5a6288]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.0049dba8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de9d9
lea eax, [ebp - 0x10]
call fcn.00406968
ret
Function at 0x4e4fe8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4e5016
mov eax, ebx
call fcn.004e5a9c
cmp dword [ebx + 0x40], 0
je 0x4e500f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4e5087
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4e5079
cmp dword [ebx + 8], 0
je 0x4e5038
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4e504a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4e5079
cmp dword [ebx + 8], 0
je 0x4e502b
cmp eax, 3
je 0x4e505d
dec eax
jne 0x4e502b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4e502b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4e502b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4e50a5
cmp dword [ebx + 0x14], 0xcc
je 0x4e50a5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004e50b0
pop ebx
ret
Function at 0x507734
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.0040a938
add esp, 0x3ec
pop ebx
ret

Function at 0x5088ac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x88]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x8c]
cdq
cmp edx, dword [esp + 4]
jne 0x5088e0
cmp eax, dword [esp]
pop edx
pop eax
jae 0x508918
jmp 0x5088e4
pop edx
pop eax
jge 0x508918
mov esi, 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x88], eax
push 0
mov eax, dword [ebx + 0x124]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push esi
mov eax, dword [ebx + 0xfc]
push eax
call sub.user32.dll_TrackPopupMenu
jmp 0x508934
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0043c39c
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x124]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x50fc58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50fd90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x7c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x50fd75
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.0040a938
mov dl, 1
mov eax, dword [0x4f8ee4]
call fcn.004f8f3c
mov edx, dword [ebp - 4]
mov dword [edx + 0x74], eax
mov dl, 1
mov eax, dword [0x41bca8]
call fcn.00403ed0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.004f8fb8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x50fd72
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, 0x50fda8
call fcn.004f9304
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040503c
xor eax, eax
push ebp
push 0x50fd6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0xc]
call fcn.00420d9c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0050fdb0
mov eax, dword [ebp - 0xc]
call fcn.0040a254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50fd72
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.00403f00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00403f00
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50fd97
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d54
ret
Function at 0x5472e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5474c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, esi
call fcn.0040967c
cmp dword [ebp - 0x50], 0
jne 0x54732d
mov byte [ebp - 9], 0
jmp 0x5474aa
mov eax, esi
call fcn.00409f60
test al, al
jne 0x54734c
mov eax, esi
call fcn.004d9000
test al, al
jne 0x54734c
mov byte [ebp - 9], 0
jmp 0x5474aa
xor ecx, ecx
mov edx, 0xd
mov eax, dword [ebx + 8]
mov edi, dword [eax]
call dword [edi + 0x20]
mov ecx, 0x5474e0
mov edx, 0xe
mov eax, dword [ebx + 8]
mov edi, dword [eax]
call dword [edi + 0x20]
lea eax, [ebp - 0x4c]
mov edx, 0x3c
call fcn.00408080
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov eax, 0x5474e4
mov dword [ebp - 0x40], eax
mov eax, esi
call fcn.004051f0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.004051f0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
sub eax, 1
jb 0x5473c0
je 0x5473d2
dec eax
je 0x5473c9
dec eax
je 0x5473db
jmp 0x5473e0
mov dword [ebp - 0x30], 1
jmp 0x5473e0
mov dword [ebp - 0x30], 2
jmp 0x5473e0
mov dword [ebp - 0x30], 3
jmp 0x5473e0
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
jmp 0x547479
lea ecx, [ebp - 0x54]
mov edx, 0xe
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x54]
mov edx, 0x5474e0
call fcn.0040513c
jne 0x547459
lea ecx, [ebp - 0x58]
mov edx, 0xd
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0x58], 0
je 0x547459
lea ecx, [ebp - 0x5c]
mov edx, 0xd
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x5c]
call fcn.00409b50
cmp eax, dword [ebp + 0xc]
jle 0x547459
mov byte [ebp - 9], 0
jmp 0x54748c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5a5f50]
mov eax, dword [eax]
call fcn.0049fa8c
cmp dword [ebp - 0x10], 0x103
jne 0x54748c
cmp byte [ebp + 0x10], 0
jne 0x547401
xor ecx, ecx
mov edx, 0xd
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call dword [esi + 0x20]
xor ecx, ecx
mov edx, 0xe
mov eax, dword [ebx + 8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5474cc
lea eax, [ebp - 0x5c]
mov edx, 4
call fcn.00404d54
ret
Function at 0x553558
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051e0
xor eax, eax
push ebp
push 0x5535c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404dc8
push 0x4400
push 0x160
push 0x5a8194
push 0
mov eax, dword [ebp - 8]
call fcn.004051f0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [0x5a8198]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5535cf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d54
ret
Function at 0x56b904
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x56b9df
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x56b9b8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040a380
xor eax, eax
push ebp
push 0x56b97a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d9000
test al, al
jne 0x56b970
mov eax, dword [ebp - 4]
call fcn.00404ff0
mov edx, eax
dec edx
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043e430
mov eax, dword [ebp - 8]
call fcn.004d9008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56b995
push 0
mov eax, ebx
call fcn.004051f0
push eax
mov eax, esi
call fcn.004051f0
push eax
call sub.kernel32.dll_CopyFileA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56b9c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56b9e6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d54
ret
Function at 0x56d87c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56d91e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov esi, pe_nt_image_headers32
lea edi, [ebp - 0x108]
mov bl, byte [edi]
test bl, bl
je 0x56d8e5
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.00404f18
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 8]
call fcn.00404ff8
inc edi
dec esi
jne 0x56d8c0
lea eax, [ebp - 8]
mov edx, 0x56d934
call fcn.00404ff8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404d84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d925
lea eax, [ebp - 0x10c]
call fcn.00404d30
lea eax, [ebp - 8]
call fcn.00404d30
ret

Function at 0x56daec
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
push esp
push eax
mov eax, dword [0x5a5f50]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040a938
add esp, 0x104
pop ebx
ret
Function at 0x56eef8
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051e0
mov eax, dword [ebp - 8]
call fcn.004051e0
mov eax, dword [ebp - 0xc]
call fcn.004051e0
xor eax, eax
push ebp
push 0x56f190
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
push eax
mov ecx, 2
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0043e470
mov eax, dword [ebp - 0x30]
mov edx, 0x56f1a8
call fcn.0040513c
je 0x56f168
xor eax, eax
push ebp
push 0x56ef89
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x56f1b4
mov eax, dword [ebp - 4]
call fcn.0056f47c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56ef93
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 8]
call fcn.0040967c
cmp dword [ebp - 0x34], 0
jne 0x56efc2
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0040967c
cmp dword [ebp - 0x38], 0
jne 0x56efc2
lea eax, [ebp - 8]
mov edx, 0x56f1c0
call fcn.00404dc8
mov dword [ebp - 0x2c], 2
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], 1
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.004051f0
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 1
mov eax, dword [ebp - 8]
call fcn.004051f0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004051f0
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov esi, eax
mov ebx, 0x56f1c8
mov eax, dword [ebp + 8]
mov edx, ebx
call fcn.00404f28
test esi, esi
je 0x56f168
cmp esi, 0x4b2
jg 0x56f086
je 0x56f136
cmp esi, 0x55
jg 0x56f063
je 0x56f0f7
sub esi, 5
je 0x56f0f0
sub esi, 0x3d
je 0x56f0fe
dec esi
je 0x56f10c
jmp case.0x56f095.1207
sub esi, 0x56
je 0x56f144
sub esi, 0x54
je 0x56f121
sub esi, 0x406
je 0x56f105
jmp case.0x56f095.1207
add esi, 0xfffffb4d
cmp esi, 0x14
ja case.0x56f095.1207
jmp dword [esi*4 + 0x56f09c]
mov ebx, 0x56f1d0
jmp 0x56f15e
mov ebx, 0x56f1f4
jmp 0x56f15e
mov ebx, 0x56f22c
jmp 0x56f15e
mov ebx, 0x56f258
jmp 0x56f15e
mov ebx, 0x56f27c
jmp 0x56f15e
mov ebx, 0x56f2a0
jmp 0x56f15e
mov ebx, 0x56f2d4
jmp 0x56f15e
mov ebx, 0x56f2f8
jmp 0x56f15e
mov ebx, 0x56f318
jmp 0x56f15e
mov ebx, 0x56f334
jmp 0x56f15e
mov ebx, 0x56f374
jmp 0x56f15e
mov ebx, 0x56f3b4
jmp 0x56f15e
mov ebx, 0x56f3e4
jmp 0x56f15e
mov ebx, 0x56f40c
jmp 0x56f15e
mov ebx, 0x56f444
jmp 0x56f15e
mov ebx, 0x56f464
mov eax, dword [ebp + 8]
mov edx, ebx
call fcn.00404f28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f197
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00404d54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d54
ret
Function at 0x570360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x57053c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4c]
mov eax, esi
call fcn.0040967c
cmp dword [ebp - 0x4c], 0
jne 0x5703a5
mov byte [ebp - 5], 0
jmp 0x570521
mov eax, esi
call fcn.00409f60
test al, al
jne 0x5703c4
mov eax, esi
call fcn.004d9000
test al, al
jne 0x5703c4
mov byte [ebp - 5], 0
jmp 0x570521
lea eax, [ebp - 0x48]
mov edx, 0x3c
call fcn.00408080
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, 0x570550
mov dword [ebp - 0x3c], eax
mov eax, esi
call fcn.004051f0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.004051f0
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
sub eax, 1
jb 0x570414
je 0x570426
dec eax
je 0x57041d
dec eax
je 0x57042f
jmp 0x570434
mov dword [ebp - 0x2c], 1
jmp 0x570434
mov dword [ebp - 0x2c], 2
jmp 0x570434
mov dword [ebp - 0x2c], 3
jmp 0x570434
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [0x5a5d58]
mov eax, dword [eax]
mov eax, dword [eax + 0x588]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.0045c414
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 9
mov esi, dword [eax]
call dword [esi + 0x20]
jmp 0x57050e
mov eax, dword [0x5a5d58]
mov eax, dword [eax]
mov eax, dword [eax + 0x588]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.0045c414
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x50]
mov edx, 9
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0x50], 0
je 0x5704ee
mov eax, dword [0x5a5d58]
mov eax, dword [eax]
mov eax, dword [eax + 0x588]
mov eax, dword [eax + 0x22c]
mov edx, ebx
call fcn.0045c414
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x54]
mov edx, 9
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x54]
call fcn.00409b50
cmp eax, dword [ebp + 0xc]
jle 0x5704ee
mov byte [ebp - 5], 0
jmp 0x570521
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x5a5f50]
mov eax, dword [eax]
call fcn.0049fa8c
cmp dword [ebp - 0xc], 0x103
jne 0x570521
cmp byte [ebp + 0x10], 0
jne 0x570481
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570543
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.00404d54
ret
Function at 0x5830fc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x5831f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5831d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040a380
xor eax, eax
push ebp
push 0x58318a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d9000
test al, al
jne 0x583180
mov eax, dword [ebp - 4]
call fcn.00404ff0
mov edx, eax
dec edx
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043e430
mov eax, dword [ebp - 8]
call fcn.004d9008
test al, al
jne 0x583180
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5831dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5831a5
push 0
mov eax, ebx
call fcn.004051f0
push eax
mov eax, esi
call fcn.004051f0
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x5831c4
mov bl, 1
jmp 0x5831c6
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5831dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5831fe
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d54
ret