joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7cac
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404750
xor eax, eax
push ebp
push 0x4b7e93
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004b3404
mov edi, eax
mov dword [ebp - 0x138], 0x128
lea edx, [ebp - 0x138]
mov eax, edi
call fcn.004b3424
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004089bc
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 4]
call fcn.00404328
jmp 0x4b7e4a
push 0x4b7eac
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.00404510
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00409ab8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004089bc
push dword [ebp - 0x140]
push 0x4b7eac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404620
push 0x4b7eac
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.00404510
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.004089bc
push dword [ebp - 0x14c]
push 0x4b7eac
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404620
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004048a4
test eax, eax
jg 0x4b7e07
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004048a4
test eax, eax
jle 0x4b7e37
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4b7e37
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4b7e31
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_WaitForSingleObject
push esi
call sub.kernel32.dll_CloseHandle
lea edx, [ebp - 0x138]
mov eax, edi
call fcn.004b3444
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4b7d50
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7e9a
lea eax, [ebp - 0x150]
mov edx, 6
call fcn.004042b4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004042b4
lea eax, [ebp - 4]
call fcn.00404290
ret
Function at 0x4b8ca0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x178], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404750
lea eax, [ebp - 0x168]
mov edx, dword [0x407bf8]
call fcn.00404fb0
xor eax, eax
push ebp
push 0x4b8e54
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x4b8e6c
call fcn.004042e4
xor ebx, ebx
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 4]
call fcn.00409938
test eax, eax
jne 0x4b8d22
cmp dword [ebp - 0x164], 1
jle 0x4b8d22
mov bl, 1
lea eax, [ebp - 0x168]
call fcn.004099ac
test bl, bl
je 0x4b8e1d
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404760
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4b8e1d
mov eax, ebx
call fcn.00402790
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404760
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b8e70
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x16c]
call fcn.00409368
push dword [ebp - 0x16c]
push 0x4b8e7c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x170]
call fcn.00409368
push dword [ebp - 0x170]
push 0x4b8e7c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x174]
call fcn.00409368
push dword [ebp - 0x174]
push 0x4b8e7c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x178]
call fcn.00409368
push dword [ebp - 0x178]
mov eax, edi
mov edx, 7
call fcn.00404620
mov eax, esi
call fcn.004027b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8e5b
lea eax, [ebp - 0x178]
mov edx, 4
call fcn.004042b4
lea eax, [ebp - 0x168]
mov edx, dword [0x407bf8]
call fcn.00405080
lea eax, [ebp - 4]
call fcn.00404290
ret
Function at 0x4bab50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404750
mov eax, dword [ebp - 8]
call fcn.00404750
xor eax, eax
push ebp
push 0x4bac65
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4bac23
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 9], 0
mov dl, 1
mov eax, dword [0x418eb0]
call fcn.00403410
mov esi, eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004bd954
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x80
mov eax, dword [0x4d5f14]
push dword [eax]
push dword [ebp - 4]
push 0x4bac80
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404620
mov eax, dword [ebp - 0x14]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [0x4d5f14]
push dword [eax]
push dword [ebp - 4]
push 0x4bac80
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404620
mov edx, dword [ebp - 0x18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.00403440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bac3d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bac6c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004042b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042b4
ret
Function at 0x4bceec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bd077
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [0x4d92d0]
call fcn.004089f8
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00404560
cmp eax, 5
jl 0x4bd051
mov edx, dword [ebp - 8]
mov eax, 0x4bd090
call fcn.004048a4
test eax, eax
jg 0x4bd051
xor edx, edx
mov eax, 2
call fcn.004b3404
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4bd051
xor edx, edx
push ebp
push 0x4bd03e
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004b3424
jmp 0x4bd02c
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404510
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004089f8
mov edx, dword [ebp - 0x134]
mov eax, dword [0x4d56b4]
mov eax, dword [eax]
call fcn.004046ac
je 0x4bd01e
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0x128]
call fcn.004bc4e0
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 8]
call fcn.004048a4
test eax, eax
jle 0x4bd01e
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x4bd01e
push 9
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
inc esi
cmp esi, 0xa
jg 0x4bd034
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004b3444
test eax, eax
jne 0x4bcf96
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bd048
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd07e
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.004042b4
lea eax, [ebp - 8]
call fcn.00404290
ret
Function at 0x4bd498
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4bd4a0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404750
mov eax, dword [ebp - 8]
call fcn.00404750
mov edi, dword [0x4d5f14]
xor eax, eax
push ebp
push 0x4bd6ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push dword [edi]
push dword [ebp - 4]
push 0x4bd704
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x10]
call fcn.004b8fa8
test al, al
jne 0x4bd6d1
xor eax, eax
push ebp
push 0x4bd6c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd710
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x14]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x18]
push eax
push 0x4bd718
mov ecx, dword [0x4d7668]
mov dl, 1
mov eax, dword [0x4192a4]
call fcn.0041e768
mov esi, eax
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd710
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404620
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0041e434
mov eax, esi
call fcn.00403440
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd710
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x24]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00404498
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.004b8ca0
push dword [edi]
push dword [ebp - 4]
push 0x4bd704
push dword [ebp - 8]
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x30]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404498
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004b8ca0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.004046ac
jbe 0x4bd687
push 0x80
push dword [edi]
push dword [ebp - 4]
push 0x4bd704
push dword [ebp - 8]
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x34]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
push dword [edi]
push dword [ebp - 4]
push 0x4bd704
push dword [ebp - 8]
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x38]
call fcn.00404760
push eax
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd710
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x3c]
call fcn.00404760
push eax
call sub.kernel32.dll_CopyFileA
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd710
lea eax, [ebp - 0x44]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x44]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.00404498
mov eax, dword [ebp - 0x40]
call fcn.004099c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bd6d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd6f3
lea eax, [ebp - 0x44]
mov edx, 0x11
call fcn.004042b4
ret
Function at 0x4bd720
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4bd728
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404750
mov eax, dword [ebp - 8]
call fcn.00404750
xor eax, eax
push ebp
push 0x4bd920
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x10]
call fcn.004b7a84
cmp eax, 0x13880
jle 0x4bd8d8
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x18]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00404498
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.004b8ca0
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
call fcn.004045ac
mov eax, dword [ebp - 0x24]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00404498
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004b8ca0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004046ac
jbe 0x4bd8a9
push 0x80
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
call fcn.004045ac
mov eax, dword [ebp - 0x28]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
call fcn.004045ac
mov eax, dword [ebp - 0x2c]
call fcn.00404760
push eax
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x30]
call fcn.00404760
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4bd905
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x38]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x34]
call fcn.00404498
mov eax, dword [ebp - 0x34]
call fcn.004099c8
mov eax, dword [ebp - 8]
mov edx, 0x4bd934
call fcn.004046ac
je 0x4bd8a2
mov eax, dword [ebp - 8]
mov edx, 0x4bd948
call fcn.004046ac
jne 0x4bd905
call fcn.004b9660
jmp 0x4bd905
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x40]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00404498
mov eax, dword [ebp - 0x3c]
call fcn.004099c8
jmp 0x4bd905
mov edx, dword [0x4d5f14]
mov edx, dword [edx]
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x48]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.00404498
mov eax, dword [ebp - 0x44]
call fcn.004099c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd927
lea eax, [ebp - 0x48]
mov edx, 0x12
call fcn.004042b4
ret
Function at 0x4bdbb8
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x4bdc54
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or ebx, 2
mov dword [esp + 0x1c], ebx
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x30
pop ebx
ret

Function at 0x4bdc68
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.00404290
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409df0
add esp, 0x18
pop ebx
ret

Function at 0x4c290c
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
add esp, 0xfffffe70
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, 0x4c2970
call fcn.004042e4
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4c295e
mov eax, esi
call fcn.00404760
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4c2959
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404498
call sub.wsock32.dll_WSACleanup
add esp, 0x190
pop esi
pop ebx
ret
Function at 0x4c382c
Capabilities:
Check os version
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x18
push 0
push 0
dec ecx
jne 0x4c3834
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4c3ae8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 2
push 0
lea eax, [ebp - 0xa0]
mov ecx, 0x4c3b00
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 0xa0]
call fcn.00404760
push eax
lea eax, [ebp - 0xa4]
mov ecx, 0x4c3b18
mov edx, dword [0x4d9378]
call fcn.004045ac
mov eax, dword [ebp - 0xa4]
call fcn.00404760
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0xac]
mov ecx, 0x4c3b00
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 0xac]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0xa8]
call fcn.00404498
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 4]
call fcn.004b8ca0
lea eax, [ebp - 0xb0]
mov ecx, 0x4c3b00
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 0xb0]
call fcn.004099c8
mov eax, dword [ebp - 4]
call fcn.00404560
cmp eax, 3
jge 0x4c3942
lea eax, [ebp - 0xb8]
mov ecx, 0x4c3b18
mov edx, dword [0x4d9378]
call fcn.004045ac
mov eax, dword [ebp - 0xb8]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0xb4]
call fcn.00404498
mov eax, dword [ebp - 0xb4]
lea edx, [ebp - 4]
call fcn.004b8ca0
lea ecx, [ebp - 8]
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00435a10
lea ecx, [ebp - 0xbc]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00435a10
mov eax, dword [ebp - 0xbc]
xor edx, edx
call fcn.004093f4
mov ebx, eax
cmp ebx, 1
jne 0x4c39ab
lea ecx, [ebp - 8]
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00435a10
lea ecx, [ebp - 0xc0]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00435a10
mov eax, dword [ebp - 0xc0]
xor edx, edx
call fcn.004093f4
mov ebx, eax
lea ecx, [ebp - 0xc4]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00435a9c
mov eax, dword [ebp - 0xc4]
xor edx, edx
call fcn.004093f4
cmp ebx, 4
jle 0x4c3a38
cmp ebx, 6
jge 0x4c39df
mov esi, 1
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c39f2
test eax, eax
jne 0x4c39f2
mov esi, 1
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c3a06
cmp eax, 1
jne 0x4c3a06
mov esi, 2
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c3a1a
cmp eax, 2
jne 0x4c3a1a
mov esi, 3
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c3a2e
cmp eax, 3
jne 0x4c3a2e
mov esi, 3
jmp 0x4c3abd
mov esi, 4
jmp 0x4c3abd
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4c3abd
mov eax, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x8c]
sub edx, 2
jne 0x4c3abd
cmp ebx, 6
jge 0x4c3a75
mov esi, 1
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c3a85
test eax, eax
jne 0x4c3a85
mov esi, 1
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c3a96
cmp eax, 1
jne 0x4c3a96
mov esi, 2
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c3aa7
cmp eax, 2
jne 0x4c3aa7
mov esi, 3
jmp 0x4c3abd
cmp ebx, 6
jne 0x4c3ab8
cmp eax, 3
jne 0x4c3ab8
mov esi, 3
jmp 0x4c3abd
mov esi, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3aef
lea eax, [ebp - 0xc4]
mov edx, 0xa
call fcn.004042b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042b4
ret
Function at 0x4c3b28
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x4d5d94]
mov eax, dword [eax]
call fcn.0046ebac
push 0xa
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x4c3b57
cmp ebx, eax
jle 0x4c3b33
pop esi
pop ebx
ret

Function at 0x4c463c
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x4d94e3], 1
push 1
mov eax, dword [0x4d5d94]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4d5d94]
mov eax, dword [eax]
call fcn.0046e730
mov eax, dword [0x4d935c]
call fcn.00455330
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [0x4d5d94]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x4d5d94]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
ret
Function at 0x4c70dc
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c7337
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2fc]
cmp dword [eax + 0x30], 0x2bf20
je 0x4c72e8
mov edx, 0x2bf20
call fcn.0043483c
mov edx, 0x4c734c
mov eax, 0x4c7358
call fcn.004bd498
mov edx, 0x4c734c
mov eax, 0x4c7368
call fcn.004bd498
mov edx, 0x4c734c
mov eax, 0x4c7378
call fcn.004bd498
call fcn.004c376c
test al, al
je 0x4c715a
mov edx, 0x4c734c
mov eax, 0x4c7388
call fcn.004bd498
mov edx, 0x4c7398
mov eax, 0x4c7378
call fcn.004bd498
call fcn.004c376c
test al, al
je 0x4c7181
mov edx, 0x4c7398
mov eax, 0x4c7388
call fcn.004bd498
mov edx, 0x4c7398
mov eax, 0x4c73a4
call fcn.004bd498
mov edx, 0x4c73b4
mov eax, 0x4c73c8
call fcn.004bd720
mov edx, 0x4c73dc
mov eax, 0x4c73f0
call fcn.004bd720
mov edx, 0x4c7404
mov eax, 0x4c7418
call fcn.004bd720
mov edx, 0x4c742c
mov eax, 0x4c7440
call fcn.004bd720
mov edx, 0x4c7454
mov eax, 0x4c7468
call fcn.004bd720
mov edx, 0x4c747c
mov eax, 0x4c7490
call fcn.004bd720
mov edx, 0x4c74a4
mov eax, 0x4c74b8
call fcn.004bd720
mov edx, 0x4c74cc
mov eax, 0x4c74e0
call fcn.004bd720
mov edx, 0x4c74f4
mov eax, 0x4c7508
call fcn.004bd720
lea eax, [ebp - 8]
mov ecx, 0x4c751c
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 8]
call fcn.004b7a84
cmp eax, 0xc3500
jle 0x4c72e8
push 0x80
lea eax, [ebp - 0xc]
mov ecx, dword [0x4d936c]
mov edx, dword [0x4d9360]
call fcn.004045ac
mov eax, dword [ebp - 0xc]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0x4d9304
push 2
call sub.shell32.dll_Shell_NotifyIconA
push 0
mov eax, dword [0x4d9370]
call fcn.00404760
push eax
push 0x4c7530
push dword [0x4d936c]
push 0x4c7544
lea edx, [ebp - 0x14]
mov eax, dword [0x4d9360]
call fcn.004b6ea0
push dword [ebp - 0x14]
push 0x4c7550
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404620
mov eax, dword [ebp - 0x10]
call fcn.00404760
push eax
lea eax, [ebp - 0x18]
mov ecx, 0x4c7454
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 0x18]
call fcn.00404760
push eax
push 0x4c7554
mov eax, ebx
call fcn.00455330
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c731c
mov eax, 0x4d93e8
call fcn.00404290
mov eax, 0x4d93ec
call fcn.00404290
mov eax, 0x4d93f0
call fcn.00404290
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4be6ec
xor edx, edx
xor eax, eax
call fcn.00404244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c733e
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004042b4
ret
Function at 0x4c7db4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c7ead
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d94e8], 2
jne 0x4c7de8
mov edx, 0x4c7ec4
mov eax, ebx
call fcn.004cbe84
jmp 0x4c7e92
cmp dword [0x4d94e8], 1
jne 0x4c7dfd
mov edx, 0x4c7ef4
mov eax, ebx
call fcn.004cbe84
push 0x4d9304
push 2
call sub.shell32.dll_Shell_NotifyIconA
push 0x4d9304
push 2
call sub.shell32.dll_Shell_NotifyIconA
push 0
mov eax, dword [0x4d9370]
call fcn.00404760
push eax
push 0x4c7f90
push dword [0x4d936c]
push 0x4c7fa0
lea edx, [ebp - 8]
mov eax, dword [0x4d9360]
call fcn.004b6ea0
push dword [ebp - 8]
push 0x4c7fac
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404620
mov eax, dword [ebp - 4]
call fcn.00404760
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4c7fb8
mov edx, dword [0x4d9370]
call fcn.004045ac
mov eax, dword [ebp - 0xc]
call fcn.00404760
push eax
push 0x4c7fc4
mov eax, ebx
call fcn.00455330
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.0046b618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7eb4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004042b4
ret