joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf2e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4cf324
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4cf324
xor eax, eax
jmp 0x4cf327
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4cf330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4cf397
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004d7870
push eax
push 0x4f810c
mov ecx, dword [ebp + 8]
call fcn.004d3ad0
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4cf3ad
cmp dword [ebp + 0x14], 0
je 0x4cf3a5
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4cf3c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0x10], 0
jne 0x4cf3f3
cmp dword [ebp + 0x14], 0
je 0x4cf3e6
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
call fcn.00403040
jmp 0x4cf48e
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4cf449
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004d7890
push eax
push 0x4f80dc
mov ecx, dword [ebp + 8]
call fcn.004d3ad0
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4cf48e
cmp dword [ebp + 0x14], 0
je 0x4cf457
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
jne 0x4cf486
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004d7890
push eax
push 0x4f80ec
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4cf48e
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d0370
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4d03b3
xor al, al
jmp 0x4d046b
mov edx, dword [ebp - 0x10]
push edx
call fcn.0041a7c6
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4d03dd
jmp 0x4d0456
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x4f85c4
mov edx, dword [ebp - 0xc]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4d03fb
jmp 0x4d0456
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
and edx, 0xffff
mov eax, dword [ebp + 0xc]
mov word [eax + 2], dx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
mov eax, dword [ebp + 0xc]
mov word [eax + 4], dx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
mov eax, dword [ebp + 0xc]
mov word [eax + 6], dx
mov byte [ebp - 5], 1
cmp dword [ebp - 0xc], 0
je 0x4d0468
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0041a6e9
add esp, 4
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4d05e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x506380]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0041de10
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4d062c
xor al, al
jmp 0x4d06a6
push 0x4f85c8
lea eax, [ebp - 0x210]
push eax
call fcn.00404170
add esp, 8
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.004d0370
add esp, 8
movzx eax, al
test eax, eax
jne 0x4d0661
xor al, al
jmp 0x4d06a6
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x114
movzx edx, word [ebp - 0x218]
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
movzx ecx, word [ebp - 0x216]
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
movzx eax, word [ebp - 0x214]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 2
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + 0x14], ax
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a0cf
mov esp, ebp
pop ebp
ret
Function at 0x4d2370
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
mov eax, dword [0x506380]
xor eax, ebp
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x800], ecx
lea ecx, [ebp - 0x7f8]
call fcn.004d7930
lea eax, [ebp - 0x7f8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d1f90
add esp, 8
movzx edx, al
test edx, edx
jne 0x4d23d2
mov ecx, dword [ebp + 8]
call fcn.00403030
mov byte [ebp - 0x7f9], al
lea ecx, [ebp - 0x7f8]
call fcn.004d78b0
mov al, byte [ebp - 0x7f9]
jmp 0x4d25e9
lea eax, [ebp - 0x270]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea ecx, [ebp - 0x6d0]
push ecx
call fcn.004d0890
add esp, 8
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x6d0]
push edx
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.004d7f50
push 0
lea ecx, [ebp - 0x3a0]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x7f8]
call fcn.004d8b60
push 0
push 0x4000000
push 3
push 0
push 5
push 0
lea ecx, [ebp - 0x3a0]
call fcn.004d7870
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x4d2490
mov ecx, dword [ebp + 8]
call fcn.00403030
mov byte [ebp - 0x7fa], al
lea ecx, [ebp - 0x3a0]
call fcn.004d78b0
lea ecx, [ebp - 0x7f8]
call fcn.004d78b0
mov al, byte [ebp - 0x7fa]
jmp 0x4d25e9
lea ecx, [ebp - 0x4c8]
call fcn.004d30f0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.004d7870
push eax
push str._s__s
lea ecx, [ebp - 0x4c8]
push ecx
call fcn.004d32a0
add esp, 0x10
push 0x44
push 0
lea edx, [ebp - 0x60]
push edx
call fcn.0041de10
add esp, 0xc
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x4c8]
call fcn.004d2c00
push eax
lea ecx, [ebp - 0x4c8]
call fcn.004d3080
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4d2553
lea ecx, [ebp - 0x4c8]
call fcn.004d3400
mov ecx, dword [ebp + 8]
call fcn.00403030
mov byte [ebp - 0x7fb], al
lea ecx, [ebp - 0x4c8]
call fcn.004d2f20
lea ecx, [ebp - 0x3a0]
call fcn.004d78b0
lea ecx, [ebp - 0x7f8]
call fcn.004d78b0
mov al, byte [ebp - 0x7fb]
jmp 0x4d25e9
lea ecx, [ebp - 0x4c8]
call fcn.004d3400
push 0xea60
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x4d2590
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea ecx, [ebp - 0x3a0]
call fcn.004d7c50
mov ecx, dword [ebp + 8]
call fcn.00403040
mov byte [ebp - 0x7fc], al
lea ecx, [ebp - 0x4c8]
call fcn.004d2f20
lea ecx, [ebp - 0x3a0]
call fcn.004d78b0
lea ecx, [ebp - 0x7f8]
call fcn.004d78b0
mov al, byte [ebp - 0x7fc]
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.0041a0cf
mov esp, ebp
pop ebp
ret 8
Function at 0x4d2a40
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x506380]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004d0360
movzx eax, al
test eax, eax
je 0x4d2a64
jmp 0x4d2be4
lea ecx, [ebp - 0x338]
call fcn.004d30f0
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x4d2b5c
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.004d21e0
add esp, 8
test eax, eax
je 0x4d2b5c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x348], eax
mov ecx, dword [ebp - 0x348]
add ecx, 2
mov dword [ebp - 0x34c], ecx
mov edx, dword [ebp - 0x348]
mov ax, word [edx]
mov word [ebp - 0x34e], ax
add dword [ebp - 0x348], 2
cmp word [ebp - 0x34e], 0
jne 0x4d2aaf
mov ecx, dword [ebp - 0x348]
sub ecx, dword [ebp - 0x34c]
sar ecx, 1
mov dword [ebp - 0x354], ecx
mov edx, dword [ebp - 0x354]
add edx, 1
mov dword [ebp - 0x33c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x33c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a042
add esp, 4
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x33c]
push edx
mov eax, dword [ebp - 0x340]
push eax
call fcn.0041ab6c
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp - 0x340]
push ecx
push 0x4d2a00
push 0
push 0
call fcn.0041cb24
add esp, 0x18
jmp 0x4d2bd9
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.004d1900
add esp, 8
test eax, eax
je 0x4d2bc3
push 0x4f8550
lea eax, [ebp - 0x210]
push eax
push 0x4f854c
lea ecx, [ebp - 0x338]
call fcn.004d3330
mov ecx, eax
call fcn.004d3330
mov ecx, eax
call fcn.004d3330
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x338]
call fcn.004d2d70
push eax
push 0x4f8554
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4d2bd9
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x338]
call fcn.004d2f20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a0cf
mov esp, ebp
pop ebp
ret
Function at 0x4d4070
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x4d4
push eax
call fcn.00403550
add esp, 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x4d4
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov cx, word [eax]
mov word [ebp - 0x1a], cx
add dword [ebp - 0x14], 2
cmp word [ebp - 0x1a], 0
jne 0x4d40b4
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
sar edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x4d40ec
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jge 0x4d411b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx + eax*2 + 0x4d4]
push edx
call fcn.0041af38
add esp, 4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov word [edx + ecx*2 + 0x6dc], ax
jmp 0x4d40e3
xor eax, eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov word [edx + ecx*2 + 0x6dc], ax
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 4

Function at 0x4d4790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x1a
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x254
call fcn.004d7910
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x4d47e0
mov ecx, dword [ebp - 4]
add ecx, 0x254
call fcn.00403250
push 0x4fae48
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d47f6
mov ecx, dword [ebp - 4]
add ecx, 0x254
call fcn.004d7ed0
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 4
Function at 0x4d4800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x506380]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x33c], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0041de10
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4d4881
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
push eax
push 0x4fadc8
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3970
mov ecx, eax
call fcn.00403030
jmp 0x4d498b
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x340], ecx
mov edx, dword [ebp - 0x340]
add edx, 2
mov dword [ebp - 0x344], edx
mov eax, dword [ebp - 0x340]
mov cx, word [eax]
mov word [ebp - 0x346], cx
add dword [ebp - 0x340], 2
cmp word [ebp - 0x346], 0
jne 0x4d489c
mov edx, dword [ebp - 0x340]
sub edx, dword [ebp - 0x344]
sar edx, 1
mov dword [ebp - 0x34c], edx
mov eax, dword [ebp - 0x34c]
movzx ecx, word [ebp + eax*2 - 0x212]
cmp ecx, 0x5c
jne 0x4d4944
lea edx, [ebp - 0x210]
mov dword [ebp - 0x350], edx
mov eax, dword [ebp - 0x350]
add eax, 2
mov dword [ebp - 0x354], eax
mov ecx, dword [ebp - 0x350]
mov dx, word [ecx]
mov word [ebp - 0x356], dx
add dword [ebp - 0x350], 2
cmp word [ebp - 0x356], 0
jne 0x4d48ff
mov eax, dword [ebp - 0x350]
sub eax, dword [ebp - 0x354]
sar eax, 1
mov dword [ebp - 0x35c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x35c]
mov word [ebp + edx*2 - 0x212], cx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x338]
call fcn.004d7f50
lea ecx, [ebp - 0x338]
push ecx
mov ecx, dword [ebp - 0x33c]
add ecx, 0x130
call fcn.004d7e10
lea ecx, [ebp - 0x338]
call fcn.004d78b0
mov ecx, dword [ebp + 8]
call fcn.00403040
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a0cf
mov esp, ebp
pop ebp
ret 4
Function at 0x4d7a10
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0x80
mov ecx, dword [ebp - 0x34]
call fcn.004d2d40
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x4d7aae
mov ecx, dword [ebp - 0x34]
call fcn.004d2d40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4d7aa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4d7a75
mov ecx, dword [ebp - 0x34]
call fcn.004d7820
movzx edx, al
test edx, edx
jne 0x4d7a75
mov ecx, dword [ebp + 8]
call fcn.00403040
jmp 0x4d7c40
mov ecx, dword [ebp - 0x34]
call fcn.004d2d70
push eax
push 0x4f92b4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.004d3b10
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d7c40
jmp 0x4d7c38
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4d7ad2
mov ecx, dword [ebp - 0x34]
call fcn.004d7820
movzx edx, al
test edx, edx
jne 0x4d7ad2
mov ecx, dword [ebp + 8]
call fcn.00403040
jmp 0x4d7c40
mov ecx, dword [ebp - 0x34]
call fcn.004d2c00
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.0041a7c6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d7b20
mov ecx, dword [ebp - 0x34]
call fcn.004d2d70
push eax
push 0x4f92c4
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d7c40
mov ecx, dword [ebp - 0x34]
call fcn.004d2d70
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0041ab6c
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov word [edx + ecx*2 - 2], ax
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 3
mov edx, 0x454
mov word [ebp - 0x20], dx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0041a6e9
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x4d7c38
cmp dword [ebp - 0xc], 0x402
jne 0x4d7bfb
mov edx, dword [ebp - 0xc]
push edx
push 0x4f92f4
mov ecx, dword [ebp - 0x34]
call fcn.004d2d70
push eax
push 0x4f92dc
mov ecx, dword [ebp + 8]
call fcn.004d3ad0
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3990
mov ecx, eax
call fcn.00403030
jmp 0x4d7c40
mov eax, dword [ebp - 0xc]
push eax
push 0x4f9310
mov ecx, dword [ebp - 0x34]
call fcn.004d2d70
push eax
push 0x4f92f8
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3990
mov ecx, eax
call fcn.00403030
jmp 0x4d7c40
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d80f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x506380]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], ecx
call fcn.004d0360
movzx eax, al
test eax, eax
je 0x4d8122
mov ecx, dword [ebp + 8]
call fcn.00403040
jmp 0x4d8261
mov ecx, dword [ebp - 0x138]
call fcn.004d7c90
movzx ecx, al
test ecx, ecx
jne 0x4d8172
mov ecx, dword [ebp - 0x138]
call fcn.004d7820
movzx edx, al
test edx, edx
jne 0x4d8172
mov ecx, dword [ebp - 0x138]
call fcn.004d2d70
push eax
push str.b_rN0R
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d8261
lea ecx, [ebp - 0x130]
call fcn.004d30f0
mov eax, dword [ebp + 0xc]
push eax
push 0x4fa8b8
mov ecx, dword [ebp - 0x138]
call fcn.004d2d70
push eax
push 0x22
lea ecx, [ebp - 0x130]
call fcn.004d33c0
mov ecx, eax
call fcn.004d3330
mov ecx, eax
call fcn.004d3330
mov ecx, eax
call fcn.004d3330
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x130]
call fcn.004d2c00
push eax
lea ecx, [ebp - 0x130]
call fcn.004d3080
push eax
mov ecx, dword [ebp - 0x138]
call fcn.004d2d40
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4d8237
lea ecx, [ebp - 0x130]
call fcn.004d3400
push 0x4fa8c0
mov ecx, dword [ebp + 8]
call fcn.004d3ad0
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
mov byte [ebp - 0x131], al
lea ecx, [ebp - 0x130]
call fcn.004d2f20
mov al, byte [ebp - 0x131]
jmp 0x4d8261
lea ecx, [ebp - 0x130]
call fcn.004d3400
mov ecx, dword [ebp + 8]
call fcn.00403040
mov byte [ebp - 0x132], al
lea ecx, [ebp - 0x130]
call fcn.004d2f20
mov al, byte [ebp - 0x132]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a0cf
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d8280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
call fcn.004d0360
movzx eax, al
test eax, eax
je 0x4d82a2
mov ecx, dword [ebp + 8]
call fcn.00403040
jmp 0x4d84be
mov ecx, dword [ebp - 0xc]
call fcn.004d7c90
movzx ecx, al
test ecx, ecx
jne 0x4d82e9
mov ecx, dword [ebp - 0xc]
call fcn.004d7820
movzx edx, al
test edx, edx
jne 0x4d82e9
mov ecx, dword [ebp - 0xc]
call fcn.004d2d70
push eax
push 0x4f93ec
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.004d2d40
push eax
push 0x4f9400
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jg 0x4d84b6
mov ecx, dword [ebp - 0xc]
call fcn.004d2d70
push eax
push 0x4f941c
mov ecx, dword [ebp - 8]
push ecx
push 0x4f940c
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.004d3990
mov ecx, eax
call fcn.004d3950
mov ecx, eax
call fcn.004d3950
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x20
ja case.0x4d836f.1
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x4d84fc]
jmp dword [ecx*4 + 0x4d84c4]
push 0x4f9428
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9490
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9510
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9568
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9600
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9680
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f96e8
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f97d8
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9810
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f98e0
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9950
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f9aa0
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
push 0x4f94d4
mov ecx, dword [ebp + 8]
call fcn.00403050
mov ecx, eax
call fcn.00403030
jmp 0x4d84be
mov ecx, dword [ebp + 8]
call fcn.00403030
jmp 0x4d84be
mov ecx, dword [ebp + 8]
call fcn.00403040
mov esp, ebp
pop ebp
ret 0x14