joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477a9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x477b95
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0047719c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ad40
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047846c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ac00
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004784e4
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477b9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040540c
ret
Function at 0x477ba4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x477cad
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0047719c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x477c73
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ad40
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047846c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ac00
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004784e4
jmp 0x477c85
xor edx, edx
mov eax, ebx
call fcn.0047846c
xor edx, edx
mov eax, ebx
call fcn.004784e4
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477cb4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040540c
ret
Function at 0x47b384
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b4f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b4d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004055d0
lea eax, [ebp - 0x118]
mov edx, 0x47b50c
call fcn.004056b4
mov eax, dword [ebp - 0x118]
call fcn.00405878
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x47b442
lea eax, [ebp - 0x111]
call fcn.0040af74
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004054d8
jmp 0x47b449
mov eax, esi
call fcn.004053e8
cmp bl, 0x61
jae 0x47b46a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040f78c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0040543c
jmp 0x47b484
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040f6f8
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0040543c
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x47b518
call fcn.0040ba40
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0040543c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b4d7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x484170
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004843ac
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004843ac
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4841e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x48420a
inc esi
mov eax, edi
call fcn.004841c8
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.00484170
inc ebx
dec esi
jne 0x4841f3
pop edi
pop esi
pop ebx
ret
Function at 0x4842a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x484316
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00484210
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004841c8
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00484170
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4842e0
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48431d
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x484fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x485196
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x485152
mov eax, dword [ebp - 4]
call fcn.00486958
cmp ebx, eax
jge 0x485152
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004759d0
mov edx, dword [0x47753c]
call fcn.004046b8
mov esi, eax
mov eax, esi
call fcn.00478400
test al, al
je 0x485148
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x48513c
xor eax, eax
push ebp
push 0x485135
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00485568
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041de60
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405b08
mov eax, dword [ebp - 8]
call fcn.004058d8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0048532c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485180
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x485134
mov eax, dword [ebp - 4]
call fcn.004855ec
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b1b4
jmp 0x485180
mov eax, dword [ebp - 8]
call fcn.004053e8
jmp 0x485180
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a588
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x418b24]
call fcn.0040e8c8
call fcn.00404d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48519d
lea eax, [ebp - 0x54]
call fcn.004053e8
ret
Function at 0x48a244
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40846c]
call fcn.00405ea0
xor eax, eax
push ebp
push 0x48a3e5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c5fc0], 0
jne 0x48a29f
mov ecx, dword [0x4c6f30]
mov dl, 1
mov eax, dword [0x408aac]
call fcn.0040e948
call fcn.00404d7c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403afc
mov eax, ebx
call fcn.00405d50
mov dword [ebp - 0x24], eax
mov esi, 0x48a3f4
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406fa4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405d60
test eax, eax
jle 0x48a388
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48a374
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405658
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x48a31a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405670
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x48a330
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405670
mov eax, dword [ebp - 0x54]
call fcn.00405878
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405658
mov eax, dword [ebp - 0x58]
call fcn.00405878
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x48a376
xor eax, eax
test al, al
je 0x48a381
mov ebx, 0x15
jmp 0x48a38d
mov ebx, 0x10
jmp 0x48a38d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4c5fc0]
call fcn.0048a0c4
mov eax, dword [ebp - 4]
call fcn.0048a0c4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406fbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a3ec
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040540c
lea eax, [ebp - 0xc]
mov edx, dword [0x40846c]
call fcn.00405f70
ret

Function at 0x4af960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4af9ba
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004af950
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004ad5a8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004ad0c0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af9c1
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x4b7c48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
xor edx, edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4b7d8d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4b7da0
call fcn.004b7ab0
lea eax, [ebp - 0x3f0]
call fcn.004053e8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.00405878
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b7d53
xor edx, edx
push ebp
push 0x4b7d4c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x3e9
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4b7de0
call fcn.004b7ab0
mov eax, dword [ebp - 0x408]
call fcn.00405878
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4b7d32
push ebp
mov eax, 0x4b7e0c
call fcn.004b7ba0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7d53
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040543c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7d94
lea eax, [ebp - 0x408]
call fcn.004053e8
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040540c
ret
Function at 0x4b7fa8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4b816c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4b8180
call fcn.004b7e10
lea eax, [ebp - 0x3f0]
call fcn.004053e8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.00405878
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b812d
xor eax, eax
push ebp
push 0x4b8126
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x4b81b8
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4b8082
push ebp
mov eax, 0x4b81d4
call fcn.004b7f00
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4b81e0
call fcn.004b7e10
mov eax, dword [ebp - 0x408]
call fcn.00405878
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4b810c
push dword [ebp - 0x3f0]
push 0x4b8204
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405658
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.0040577c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b812d
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040543c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8173
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.0040540c
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040540c
ret
Function at 0x4b940c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4b9574
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0049208c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004920ac
mov ebx, eax
jmp 0x4b9546
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040ad40
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004098bc
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004098bc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405810
je 0x4b9526
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004098bc
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004098bc
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405810
jne 0x4b953b
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004920cc
mov ebx, eax
test ebx, ebx
jne 0x4b9487
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b957b
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040540c
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x4ba26c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ba3de
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0049208c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004920ac
mov ebx, eax
jmp 0x4ba3b0
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040ad40
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004098bc
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004098bc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405810
je 0x4ba386
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004098bc
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004098bc
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405810
jne 0x4ba3a5
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [edi + 8]
je 0x4ba3a5
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004920cc
mov ebx, eax
test ebx, ebx
jne 0x4ba2e7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba3e5
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040540c
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x4baad0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
mov eax, dword [ebp - 8]
call fcn.00405868
xor eax, eax
push ebp
push 0x4bac9a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4bac62
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4195b8]
call fcn.0041e314
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bab68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a7ac
test al, al
je 0x4bab5e
mov eax, dword [ebp - 8]
call fcn.00405878
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.004055e0
mov eax, dword [ebp - 0x1c]
call fcn.00405878
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bab72
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00405878
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4195b8]
call fcn.0041e314
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bac51
push dword fs:[eax]
mov dword fs:[eax], esp
mov cx, 2
mov edx, 0xfffffffc
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041e08c
mov edx, dword [ebp - 0x14]
add edx, 8
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041e08c
mov edx, dword [ebp - 0x14]
add edx, 8
add edx, dword [ebp - 0x18]
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041e0fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bac58
mov eax, dword [ebp - 0x10]
call fcn.00404508
mov eax, dword [ebp - 0xc]
call fcn.00404508
ret