joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4684d8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4684ef
add esp, 0xfffffff0
call fcn.00404064
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004243c8
mov eax, dword [0x4ef2fc]
cmp word [eax + 2], 0
jne 0x468517
mov eax, dword [0x4ef2fc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046a238
mov eax, dword [0x4ef464]
cmp word [eax + 2], 0
jne 0x468531
mov eax, dword [0x4ef464]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046a444
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41a988]
call fcn.00403d10
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41a988]
call fcn.00403d10
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41a988]
call fcn.00403d10
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x4291dc]
call fcn.004311c0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4686e8
mov eax, dword [0x4ef120]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00431594
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46ab18
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4ef120]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040eb70
test eax, eax
je 0x468638
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a2a8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040eba4
test eax, eax
je 0x46864c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404eb0
mov byte [ebx + 0xd4], 0
push ebx
push 0x469cac
call fcn.00425544
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4eeea0]
cmp byte [eax], 0
jne 0x46869d
mov eax, ebx
call fcn.0046882c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0046acfc
mov eax, ebx
call fcn.0046b860
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4686dd
call fcn.004040bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468aac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x468b4b
cmp dword [ebx + 0x94], 0
jne 0x468b45
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x468a34
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x468b45
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x468b0b
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x468b45
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d0ec
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x468b1a
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x468d64
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4f4ce8]
cmp dword [eax + 0x30], 0
je 0x468ec1
test bl, bl
jne 0x468e12
cmp dword [esi + 0x9c], 0
jne 0x468e07
mov eax, esi
call fcn.0046b6dc
push eax
push 0x468c90
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x468dd8
mov eax, dword [0x4f4ce8]
call fcn.0046bdbc
test al, al
je 0x468dd8
mov eax, dword [0x4f4d0c]
call fcn.00406014
mov edi, eax
cmp edi, 0
jl 0x468dd8
push 0
mov eax, dword [0x4f4d0c]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x468dc2
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x468e07
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041d0ec
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x468de7
inc dword [esi + 0x9c]
jmp 0x468ec1
cmp dword [esi + 0x9c], 0
jle 0x468ec1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x468ec1
cmp dword [esi + 0x44], 0
je 0x468e6d
mov eax, dword [0x4f4ce8]
call fcn.0046bdbc
test al, al
je 0x468e6d
mov eax, dword [0x4f4d0c]
call fcn.00406014
mov edi, eax
cmp edi, 0
jl 0x468e6d
push 5
mov eax, dword [0x4f4d0c]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x468e57
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x468e9c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041d0ec
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x468e7c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4f4d0c
mov ecx, 1
mov edx, dword [0x468c70]
call fcn.004061c8
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4699a8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x469a12
mov eax, ebx
call fcn.0046bdbc
test al, al
jne 0x469a12
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404d30
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4699ff
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x469a1f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c94
jmp 0x469a1f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c94
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x46aee0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46af4e
mov eax, esi
call fcn.00453978
test al, al
je 0x46af4e
mov eax, dword [ebx + 0x84]
call fcn.004535d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46af4e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46af42
push 0
mov eax, dword [ebx + 0x84]
call fcn.004535d8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044b420
jmp 0x46af4e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046ad1c
pop esi
pop ebx
ret

Function at 0x4746ac
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004745a4
test al, al
je 0x474796
xor eax, eax
push ebp
push 0x47478f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, edi
call fcn.004050d0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x474778
xor eax, eax
push ebp
push 0x474771
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x47473e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x474742
xor eax, eax
jmp 0x474744
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x47475a
mov eax, edi
call fcn.004050d0
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474778
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474796
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LocalFree
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4747a4
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x474930
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405360
push 0x104
lea eax, [ebp - 4]
call fcn.00405130
push eax
push 0x474944
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405360
mov eax, dword [ebp - 4]
test eax, eax
je 0x474808
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x474912
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403660
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0
push 0x8007
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x47490b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x80
push 0
push 0
push 0
push dword [ebp - 4]
push 0x474954
push ebx
push 0x474964
push esi
lea eax, [ebp - 0x68]
mov edx, 5
call fcn.00404fd4
mov eax, dword [ebp - 0x68]
call fcn.004050d0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4748f4
xor eax, eax
push ebp
push 0x4748ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne byte [ebp - 9]
cmp byte [ebp - 9], 0
jne 0x4748cd
push 0x102
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4748f4
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474912
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474937
lea eax, [ebp - 0x68]
call fcn.00404c40
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x474968
Capabilities:
Delete file
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x320], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x474b8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x4749cf
push 0x104
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetShortPathNameA
jmp 0x4749e0
push 0x474ba0
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x216]
push eax
push 0
push 0x474ba4
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
jbe 0x474b6d
xor eax, eax
push ebp
push 0x474b66
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x31b]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x474ba8
lea eax, [ebp - 0x31b]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x320]
lea edx, [ebp - 0x31b]
mov ecx, 0x105
call fcn.00404eb0
mov ecx, dword [ebp - 0x320]
mov edx, ebx
mov eax, esi
call fcn.004746ac
test al, al
je 0x474b4c
xor eax, eax
push ebp
push 0x474b45
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x324]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00404eb0
mov eax, dword [ebp - 0x324]
push eax
lea eax, [ebp - 0x328]
lea edx, [ebp - 0x31b]
mov ecx, 0x105
call fcn.00404eb0
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp + 8]
pop edx
call fcn.004747a4
test al, al
je 0x474b2b
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x216]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x474b2b
xor eax, eax
push ebp
push 0x474b24
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x474b04
cmp ebx, dword [ebp - 0xc]
je 0x474b08
xor eax, eax
jmp 0x474b0a
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b2b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b4c
lea eax, [ebp - 0x31b]
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b6d
lea eax, [ebp - 0x216]
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474b92
lea eax, [ebp - 0x328]
mov edx, 3
call fcn.00404c64
ret
Function at 0x493dd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x493e32
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00493dc8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004916b8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004911d0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493e39
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4a245c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x410134]
call fcn.0040570c
xor eax, eax
push ebp
push 0x4a25fd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4eda1c], 0
jne 0x4a24b7
mov ecx, dword [0x4eeec0]
mov dl, 1
mov eax, dword [0x4083b4]
call fcn.0040dce8
call fcn.004045b4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403660
mov eax, ebx
call fcn.004055bc
mov dword [ebp - 0x24], eax
mov esi, 0x4a260c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004069cc
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004055cc
test eax, eax
jle 0x4a25a0
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a258c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404eb0
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4a2532
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404ec8
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4a2548
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404ec8
mov eax, dword [ebp - 0x54]
call fcn.004050d0
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404eb0
mov eax, dword [ebp - 0x58]
call fcn.004050d0
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4a258e
xor eax, eax
test al, al
je 0x4a2599
mov ebx, 0x15
jmp 0x4a25a5
mov ebx, 0x10
jmp 0x4a25a5
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4eda1c]
call fcn.004a22dc
mov eax, dword [ebp - 4]
call fcn.004a22dc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004069e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2604
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404c64
lea eax, [ebp - 0xc]
mov edx, dword [0x410134]
call fcn.004057dc
ret
Function at 0x4a5f78
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a616b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x4a6152
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4a5fb6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a5fd6
mov eax, dword [edi + 0x34]
test eax, eax
je 0x4a5fc6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a5fd6
mov eax, edi
call fcn.004a620c
jmp 0x4a6152
cmp dword [edi + 0xa0], 0
jne 0x4a600d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040a314
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4f691c]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x4a6044
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040a314
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4f691c]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004a624c
mov ebx, eax
test bl, bl
jne 0x4a6107
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4a606d
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a6087
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x4a6080
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x4a6089
xor eax, eax
test al, al
jne 0x4a6107
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x4a609c
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x4a60b3
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040a314
jmp 0x4a60df
push dword [edi + 0x30]
push 0x4a6188
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404fd4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040a314
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4a6107
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004a624c
mov ebx, eax
test bl, bl
jne 0x4a6114
mov eax, edi
call fcn.004a620c
jmp 0x4a6152
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4a6123
mov dword [edi + 0xa8], eax
jmp 0x4a612d
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.004a62c4
test al, al
je 0x4a6152
mov eax, edi
mov si, 0xffee
call fcn.00403f3c
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004a6374
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6172
lea eax, [ebp - 0x108]
call fcn.00404c40
ret
Function at 0x4aec84
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, [0x4edb58]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x4aeceb
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 4]
jne 0x4aecb1
cmp dword [ebp - 8], 0
je 0x4aed3b
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 8]
je 0x4aed26
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x4aed35
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x4aeee4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404eb0
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x4aef23
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4aef38
mov eax, ebx
mov edx, 0x4aef48
call fcn.00404f0c
add esp, 0x10c
pop ebx
ret

Function at 0x4aef4c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404eb0
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x4aef87
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4aef9c
mov eax, ebx
mov edx, 0x4aefac
call fcn.00404f0c
add esp, 0x10c
pop ebx
ret

Function at 0x4aefb0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404eb0
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x4aefef
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4af004
mov eax, ebx
mov edx, 0x4af014
call fcn.00404f0c
add esp, 0x10c
pop ebx
ret