joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7150
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4b7159
mov eax, dword [ebp - 4]
add esp, 0xfffff794
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov eax, dword [ebp + 8]
call fcn.00404e8c
xor edx, edx
push ebp
push 0x4b72a5
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x4b729b
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.004036b8
mov dword [ebp - 0x5c], 0x44
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x101
mov word [ebp - 0x2c], 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.00405338
push eax
mov eax, ebx
call fcn.00405338
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4b7277
push 0x64
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4b7217
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x286d]
xor ecx, ecx
mov edx, 0x2801
call fcn.004036b8
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2801
lea eax, [ebp - 0x286d]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x286d]
mov ecx, 0x2801
call fcn.004050fc
cmp dword [ebp - 0xc], 0x2801
jae 0x4b7229
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b72b7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b73f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4b7400
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b75bc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b7597
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.00403390
push dword [ebp - 8]
push 0x4b75d4
push 0x4b75e0
push 0x4b75d4
lea edx, [ebp - 0xc]
movzx eax, byte [ebx + 8]
call fcn.00409978
push dword [ebp - 0xc]
push 0x4b75f4
lea eax, [ebp - 0x10]
lea edx, [ebx + 9]
mov ecx, 0x201
call fcn.004050fc
push dword [ebp - 0x10]
push 0x4b7600
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x20a]
mov ecx, 0x12c
call fcn.004050fc
push dword [ebp - 0x14]
push 0x4b75d4
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x3b0]
call fcn.00409978
push dword [ebp - 0x18]
push 0x4b75d4
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x3b4]
call fcn.00409978
push dword [ebp - 0x1c]
push 0x4b75d4
lea edx, [ebp - 0x20]
mov eax, dword [esi + 0x3b8]
call fcn.00409978
push dword [ebp - 0x20]
push 0x4b75d4
lea edx, [ebp - 0x24]
mov eax, dword [esi + 0x3bc]
call fcn.00409978
push dword [ebp - 0x24]
push 0x4b75d4
lea edx, [ebp - 0x28]
movzx eax, byte [ebx + 0x336]
call fcn.00409978
push dword [ebp - 0x28]
push 0x4b75d4
lea edx, [ebp - 0x2c]
mov eax, dword [ebx + 0x337]
call fcn.00409978
push dword [ebp - 0x2c]
push 0x4b75d4
lea edx, [ebp - 0x30]
mov eax, dword [ebx + 0x33b]
call fcn.00409978
push dword [ebp - 0x30]
push 0x4b75d4
lea edx, [ebp - 0x34]
mov eax, dword [ebx + 0x33f]
call fcn.00409978
push dword [ebp - 0x34]
push 0x4b75d4
lea eax, [ebp - 0x38]
lea edx, [ebx + 0x343]
mov ecx, 6
call fcn.004050fc
push dword [ebp - 0x38]
push 0x4b75d4
lea eax, [ebp - 0x3c]
lea edx, [ebx + 0x349]
mov ecx, 6
call fcn.004050fc
push dword [ebp - 0x3c]
lea eax, [ebp - 4]
mov edx, 0x1d
call fcn.0040523c
push 0
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b75a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b75c3
lea eax, [ebp - 0x3c]
mov edx, 0xf
call fcn.00404eb0
ret
Function at 0x4b7740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4b7823
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e8c
lea eax, [ebp - 8]
push eax
push 0x23
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4b77ca
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4b77ca
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040a5d8
push dword [ebp - 0x114]
push 0x4b7838
push 0x4b7844
push 0x4b7838
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040523c
mov eax, dword [ebp - 4]
call fcn.00409eec
test al, al
jne 0x4b77f3
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.0040a134
mov eax, dword [ebp - 0x118]
call fcn.00409f10
test al, al
je 0x4b77fd
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404ee0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b782a
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00404eb0
lea eax, [ebp - 4]
call fcn.00404e8c
ret
Function at 0x4b8644
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b864c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b87d4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b87af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x68]
mov ecx, 0x200
call fcn.004050fc
mov edx, dword [ebp - 0xc]
mov eax, 0x4b87ec
call fcn.00405484
test eax, eax
jle 0x4b86b7
mov eax, ebx
call fcn.004b8ab0
lea edx, [ebp - 0x10]
call fcn.00409978
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 0x4b87f8
call fcn.004051c0
jmp 0x4b86d6
mov eax, ebx
call fcn.004b8ab0
lea edx, [ebp - 0x14]
call fcn.00409978
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 0x4b8808
call fcn.004051c0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403390
push dword [ebp - 0x18]
push 0x4b8818
push 0x4b8824
push 0x4b8818
lea eax, [ebp - 0x1c]
lea edx, [ebx + 0x68]
mov ecx, 0x200
call fcn.004050fc
push dword [ebp - 0x1c]
push dword [ebp - 8]
push 0x4b8818
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x60]
call fcn.00409978
push dword [ebp - 0x20]
push 0x4b8818
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x64]
call fcn.00409978
push dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 0xa
call fcn.0040523c
push 0
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
call sub.kernel32.dll_WinExec
call fcn.0040b808
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004b5648
mov esi, eax
mov eax, dword [ebx + 0x698]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004b5648
cmp si, ax
je 0x4b878c
call fcn.0040b808
mov esi, dword [ebx + 0x698]
fstp qword [esi + 0x10]
wait
mov dword [esi + 0x18], 1
jmp 0x4b879e
call fcn.0040b808
mov esi, dword [ebx + 0x698]
fstp qword [esi + 0x10]
wait
inc dword [esi + 0x18]
mov eax, ebx
call fcn.004b9030
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b87b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b87db
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00404eb0
ret
Function at 0x4b8830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4b8838
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b89f4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b89d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
lea edx, [ebx + 0x68]
mov ecx, 0x200
call fcn.004050fc
mov edx, dword [ebp - 8]
mov eax, 0x4b8a0c
call fcn.00405484
test eax, eax
jle 0x4b88a2
mov eax, ebx
call fcn.004b8ab0
lea edx, [ebp - 0xc]
call fcn.00409978
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x4b8a18
call fcn.004051c0
jmp 0x4b88c1
mov eax, ebx
call fcn.004b8ab0
lea edx, [ebp - 0x10]
call fcn.00409978
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 0x4b8a28
call fcn.004051c0
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403390
push dword [ebp - 0x18]
push 0x4b8a38
push 0x4b8a44
push 0x4b8a38
lea eax, [ebp - 0x1c]
lea edx, [ebx + 0x490]
mov ecx, 0x200
call fcn.004050fc
push dword [ebp - 0x1c]
push dword [ebp - 4]
push 0x4b8a38
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x488]
call fcn.00409978
push dword [ebp - 0x20]
push 0x4b8a38
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x48c]
call fcn.00409978
push dword [ebp - 0x24]
push 0x4b8a38
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x690]
call fcn.00409978
push dword [ebp - 0x28]
lea eax, [ebp - 0x14]
mov edx, 0xc
call fcn.0040523c
mov eax, dword [ebp - 0x14]
call fcn.00405338
push eax
call sub.kernel32.dll_WinExec
call fcn.0040b808
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004b5648
mov esi, eax
mov eax, dword [ebx + 0x698]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.004b5648
cmp si, ax
je 0x4b8996
call fcn.0040b808
mov esi, dword [ebx + 0x698]
fstp qword [esi + 8]
wait
mov dword [esi + 0x1c], 1
jmp 0x4b89a8
call fcn.0040b808
mov esi, dword [ebx + 0x698]
fstp qword [esi + 8]
wait
inc dword [esi + 0x1c]
lea esi, [ebx + 0x484]
lea edi, [ebx + 0x272]
mov ecx, 0x84
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, ebx
call fcn.004b9030
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b89d9
ret
Function at 0x4b9504
Capabilities:
Print debug messages
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4b9631
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b9616
xor eax, eax
push ebp
push 0x4b960f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push 0x4b9640
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b95a0
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00409a64
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x4b965c
call fcn.004051c0
mov eax, dword [ebp - 0x2c]
call fcn.00405338
push eax
call sub.kernel32.dll_OutputDebugStringA
call fcn.00404890
jmp 0x4b9616
xor eax, eax
push ebp
push 0x4b95f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x24], 4
je 0x4b95da
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_StartServiceA
push 0x1f4
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b95f8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9638
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404eb0
ret
Function at 0x4b976c
Capabilities:
Modify service
Print debug messages
Query service configuration
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], eax
xor eax, eax
push ebp
push 0x4b9967
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b9949
xor edx, edx
push ebp
push 0x4b9942
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xf01ff
push 0x4b9974
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b97d3
call sub.kernel32.dll_GetLastError
xor eax, eax
push ebp
push 0x4b9924
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x2c], 4
je 0x4b990d
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
jne 0x4b98fe
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4b98fe
mov eax, dword [ebp - 0x10]
push eax
call fcn.00406d18
pop ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b98f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
je 0x4b98de
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 2
je 0x4b98de
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x20]
push eax
push 0
mov eax, dword [ebx + 0x1c]
push eax
mov eax, dword [ebx + 0x18]
push eax
push 0
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
push 2
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
jne 0x4b98de
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
call fcn.0040ce60
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
lea edx, [ebp - 0x44]
mov ecx, 1
mov eax, 0x4b9990
call fcn.0040aac8
mov eax, dword [ebp - 0x34]
call fcn.00405338
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b98fe
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00402f60
ret
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_StartServiceA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b992b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b996e
lea eax, [ebp - 0x48]
call fcn.00404e8c
lea eax, [ebp - 0x34]
call fcn.00404e8c
ret
Function at 0x4b9998
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405328
mov eax, dword [ebp - 8]
call fcn.00405328
xor eax, eax
push ebp
push 0x4b9a6c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.004036b8
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00405338
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00405338
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0040a168
mov eax, dword [ebp - 0x48]
call fcn.00405338
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4b9a49
jmp 0x4b9a37
push 0xa
call sub.kernel32.dll_Sleep_2
push 0x64
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4b9a30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9a73
lea eax, [ebp - 0x48]
call fcn.00404e8c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404eb0
ret
Function at 0x4bf6cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bf7f2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x4ec], 2
jge 0x4bf7d7
call fcn.004b8024
test al, al
je 0x4bf7d7
call fcn.004b5588
test al, al
jne 0x4bf7d7
call fcn.004a6dcc
test al, al
je 0x4bf72a
mov dword [ebx + 0x4ec], 2
call fcn.004b9504
jmp 0x4bf7d7
mov eax, dword [ebx + 0x4ec]
test eax, eax
jne 0x4bf7a6
inc dword [ebx + 0x4ec]
lea edx, [ebp - 4]
mov eax, 1
call fcn.00403390
mov eax, dword [ebp - 4]
mov edx, 0x4bf808
call fcn.00409594
test al, al
jne 0x4bf7d7
lea edx, [ebp - 8]
mov eax, 1
call fcn.00403390
mov eax, dword [ebp - 8]
mov edx, 0x4bf814
call fcn.00409594
test al, al
jne 0x4bf7d7
inc dword [ebx + 0x4ec]
push 1
push 0
push 0x4bf820
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00403390
mov eax, dword [ebp - 0xc]
call fcn.00405338
push eax
push 0x4bf82c
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4bf7d7
dec eax
jne 0x4bf7d7
inc dword [ebx + 0x4ec]
push 1
push 0
push 0x4bf820
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00403390
mov eax, dword [ebp - 0x10]
call fcn.00405338
push eax
push 0x4bf82c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf7f9
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404eb0
ret
Function at 0x4c1ff8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, 0x4e2180
xor eax, eax
push ebp
push 0x4c21d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c21af
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0
jne 0x4c205c
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
call fcn.0046a564
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov ecx, ebx
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
mov edx, dword [0x4c1d44]
call fcn.0046a57c
mov edx, 0x4c21f0
mov eax, dword [ebx]
call fcn.0044b19c
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0044b16c
mov edx, dword [ebp - 8]
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
call fcn.0046a01c
test esi, esi
jne 0x4c2092
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c21b9
mov eax, dword [ebx]
add eax, 0x3b8
mov edx, esi
call fcn.00404ee0
test edi, edi
jle 0x4c20ae
mov eax, dword [ebx]
mov dword [eax + 0x3b0], edi
jmp 0x4c20bb
mov eax, dword [ebx]
mov eax, dword [eax + 0x48]
mov edx, dword [ebx]
mov dword [edx + 0x3b0], eax
cmp dword [ebp - 4], 0
jle 0x4c20ce
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov dword [eax + 0x3b4], edx
jmp 0x4c20db
mov eax, dword [ebx]
mov eax, dword [eax + 0x4c]
mov edx, dword [ebx]
mov dword [edx + 0x3b4], eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x3b0]
mov eax, dword [ebx]
call fcn.0044a85c
mov eax, dword [ebx]
mov edx, dword [eax + 0x3b4]
mov eax, dword [ebx]
call fcn.0044a890
mov eax, dword [ebx]
mov edx, dword [eax + 0x48]
neg edx
mov eax, dword [ebx]
call fcn.0046725c
mov eax, dword [ebx]
mov edx, dword [eax + 0x4c]
neg edx
mov eax, dword [ebx]
call fcn.00467298
mov eax, dword [ebx]
mov byte [eax + 0x3a0], 0
mov eax, dword [ebx]
movzx edx, byte [0x4c2200]
not edx
and dl, byte [eax + 0x270]
mov eax, dword [ebx]
call fcn.00462b44
mov eax, dword [ebx]
mov edi, dword [eax + 0x3b0]
push edi
mov eax, dword [ebx]
mov eax, dword [eax + 0x3b4]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x3b4]
neg ecx
mov edx, edi
neg edx
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x88]
mov eax, dword [ebx]
mov eax, dword [eax + 0x3a8]
call fcn.00453284
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00405808
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov eax, dword [eax + 0x3a8]
call fcn.004987a8
push 0
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
call fcn.0046a6b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c21b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c21de
lea eax, [ebp - 0xc]
call fcn.0040565c
lea eax, [ebp - 8]
call fcn.00404e8c
ret
Function at 0x4c3570
Capabilities:
Access peb ldr_data
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
mov ebx, 0x4e2190
xor eax, eax
push ebp
push 0x4c3748
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4c3713
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
call fcn.0046a564
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov ecx, ebx
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
mov edx, dword [0x4c335c]
call fcn.0046a57c
movzx edx, byte [0x4c3758]
mov eax, dword [ebx]
call fcn.00462b44
mov eax, dword [ebx]
mov byte [eax + 0x275], 1
mov eax, dword [ebx]
mov byte [eax + 0x3a0], 0
mov edx, 0x4c3764
mov eax, dword [ebx]
call fcn.0044b19c
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.0044b16c
mov edx, dword [ebp - 4]
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
call fcn.0046a01c
lea eax, [ebp - 8]
push eax
mov eax, 0x4c377c
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4c378c
call fcn.0040aac8
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
mov eax, dword [eax + 0x3a8]
call fcn.0044b19c
lea eax, [ebp - 0x14]
push eax
mov eax, 0x4c377c
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4c37a8
call fcn.0040aac8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov eax, dword [eax + 0x3ac]
call fcn.0044b19c
mov eax, dword [ebx]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x4c]
push edi
mov eax, dword [0x4dc488]
mov eax, dword [eax]
call fcn.00468968
sub eax, edi
push eax
mov eax, dword [0x4dc488]
mov eax, dword [eax]
call fcn.00467a30
mov edx, eax
mov eax, dword [ebx]
sub edx, dword [eax + 0x48]
mov eax, dword [ebx]
pop ecx
mov edi, dword [eax]
call dword [edi + 0x88]
mov eax, dword [ebx]
call fcn.00466804
mov eax, dword [ebx]
mov eax, dword [eax + 0x3b4]
mov dword [eax + 0xc], esi
mov dl, 1
call fcn.004378d4
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4c37bc
call fcn.0040aac8
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 0x3b0]
call fcn.00493160
push 0
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4dc2a8]
mov eax, dword [eax]
call fcn.0046a6b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c371d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c374f
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404eb0
lea eax, [ebp - 8]
call fcn.00404e8c
lea eax, [ebp - 4]
call fcn.00404e8c
ret
Function at 0x427bdd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x427c15
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x427c03
mov al, 1
jmp 0x427c5f
cmp dword [ebx + 0x54], ecx
jne 0x427c0c
mov al, 2
jmp 0x427c5f
cmp dword [ebx + 0x7c], ecx
jne 0x427c5f
mov al, 3
jmp 0x427c5f
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x427c2a
mov al, 4
jmp 0x427c5f
cmp ecx, 5
jne 0x427c4a
cmp ebx, 0
jne 0x427c38
mov al, 5
jmp 0x427c5f
cmp ebx, 1
jne 0x427c41
mov al, 6
jmp 0x427c5f
cmp ebx, 2
jne 0x427c4a
mov al, 7
jmp 0x427c5f
cmp ecx, 6
jne 0x427c56
cmp ebx, 0
jne 0x427c58
mov al, 8
jmp 0x427c5f
cmp ebx, 1
jne 0x427c5f
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret