joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489270
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066a8
xor eax, eax
push ebp
push 0x4893bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004280b0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.004069d0
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00407218
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48939d
mov eax, dword [ebp - 0x14]
call fcn.0040464c
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x489396
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00407218
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x489380
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x4893cc
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x489380
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
shr eax, 0x10
and ax, 0xffff
mov edx, dword [ebp - 8]
mov word [edx], ax
mov eax, dword [ebp - 0x20]
mov ax, word [eax + 8]
and ax, 0xffff
mov edx, dword [ebp - 0xc]
mov word [edx], ax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
shr eax, 0x10
and ax, 0xffff
mov edx, dword [ebp + 0xc]
mov word [edx], ax
mov eax, dword [ebp - 0x20]
mov ax, word [eax + 0xc]
and ax, 0xffff
mov edx, dword [ebp + 8]
mov word [edx], ax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48939d
mov eax, dword [ebp - 0x1c]
call fcn.00404668
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4893c2
lea eax, [ebp - 0x28]
call fcn.004065c4
lea eax, [ebp - 4]
call fcn.004065c4
ret
Function at 0x4894c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00407218
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov edx, dword [0x58e620]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax], 0xffffffff
mov byte [ebp - 0xd], 0
cmp dword [ebp - 0x1c], 0xffffffff
je 0x489597
xor eax, eax
push ebp
push 0x489590
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GetFileTime
test eax, eax
je 0x489579
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GetFileSize
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
lea eax, [ebp - 0x2c]
mov edx, 0x10
call fcn.0042a7e0
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
call fcn.0040b3c8
test eax, eax
je 0x489579
lea eax, [ebp - 0x2c]
call fcn.004207c4
mov eax, dword [ebp - 8]
fstp qword [eax]
wait
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489597
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x48b0c0
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48b1bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00406aa4
mov edx, eax
add edx, 0x1c
lea eax, [ebp - 0x14]
xor ecx, ecx
call fcn.00407038
mov eax, dword [ebp - 0x14]
call fcn.00406ef8
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
mov edx, 8
call fcn.0042a7e0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0xc]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x14]
call fcn.00406aa4
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406ef8
pop edx
call fcn.0042a7e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406aa4
push eax
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00406aa4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00406ef8
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.icmp.dll_IcmpSendEcho
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jl 0x48b1a7
mov eax, dword [ebp - 0x24]
cmp dword [eax + 4], 0
jne 0x48b1a7
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov dl, byte [edx + 0x14]
mov byte [eax], dl
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 8]
mov dword [eax], edx
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b1c4
lea eax, [ebp - 0x14]
call fcn.004065e8
ret
Function at 0x491290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x491619
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4912d7
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407218
push eax
call sub.kernel32.dll_LoadLibraryExW_1
mov dword [ebp - 0x28], eax
jmp 0x4912e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4915fb
xor eax, eax
push ebp
push 0x491410
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
push eax
push 1
push 0x10
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FindResourceExW
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x491320
call fcn.00405db0
jmp 0x4915fb
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x491340
call fcn.00405db0
jmp 0x4915fb
xor eax, eax
push ebp
push 0x4913e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_SizeofResource
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0x10
xor ecx, ecx
call fcn.00407038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406aa4
test eax, eax
jle 0x4913d2
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x4913cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00406aa4
push eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00406b68
mov edx, eax
mov eax, dword [ebp - 0x34]
pop ecx
call fcn.00404860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4913d2
mov eax, dword [ebp - 0x30]
call fcn.0040bbd4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4913f0
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491620
lea eax, [ebp - 0x14]
call fcn.004065c4
lea eax, [ebp - 0xc]
call fcn.004065c4
ret
Function at 0x4927a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
push 0x40
push 0x1000
push 0x228
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x492909
lea eax, [ebp - 0x248]
mov edx, 0x228
call fcn.0042a7e0
mov byte [ebp - 0x248], 0x68
mov eax, dword [ebp - 4]
add eax, 0x1e
mov dword [ebp - 0x247], eax
mov word [ebp - 0x243], 0x15ff
mov eax, dword [ebp - 4]
add eax, 0x16
mov dword [ebp - 0x241], eax
mov byte [ebp - 0x23d], 0x68
xor eax, eax
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x238], 0x15ff
mov eax, dword [ebp - 4]
add eax, 0x1a
mov dword [ebp - 0x236], eax
push 0x492910
mov eax, dword [0x58eaf4]
mov eax, dword [eax]
push eax
call fcn.0040b558
mov dword [ebp - 0x232], eax
push 0x49292c
mov eax, dword [0x58eaf4]
mov eax, dword [eax]
push eax
call fcn.0040b558
mov dword [ebp - 0x22e], eax
mov eax, dword [ebp - 0xc]
call fcn.00406a98
add eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x49288c
mov eax, dword [ebp - 0xc]
call fcn.00407218
lea edx, [ebp - 0x22a]
mov ecx, dword [ebp - 0x14]
call fcn.00404860
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x228
lea eax, [ebp - 0x248]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x492909
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x492909
xor eax, eax
push ebp
push 0x492902
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492909
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x492950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x4929ec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
jne 0x4929ec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x3c]
add dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xc]
cmp dword [eax], 0x4550
jne 0x4929ec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xc]
movzx eax, word [eax + 0x14]
cmp eax, 0xe0
jne 0x4929ec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xc]
cmp word [eax + 0x18], 0x10b
jne 0x4929ec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov dword [edx + 4], eax
pop ecx
pop ebp
ret
Function at 0x4a9ca0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x4a9e4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a9e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00406988
cmp dword [ebp - 8], 0
jne 0x4a9db4
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
mov dx, word [ebp - 2]
call fcn.00407230
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov ecx, 0x4a9e68
call fcn.00407408
lea eax, [ebp - 0x24]
mov edx, 0x105
call fcn.00407330
lea eax, [ebp - 0x24]
call fcn.00406b60
mov word [eax], 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x24]
call fcn.00406a98
push eax
mov eax, dword [ebp - 0x24]
call fcn.00407218
push eax
mov eax, dword [ebp - 0x20]
call fcn.00407218
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x4a9db4
mov eax, dword [ebp - 0x24]
call fcn.00406a98
test eax, eax
jle 0x4a9da9
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
cmp word [eax + edx*2 - 2], 0
jne 0x4a9da1
mov edx, dword [ebp - 0x14]
dec edx
lea eax, [ebp - 0x24]
call fcn.00407330
jmp 0x4a9da9
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4a9d85
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
call fcn.00406988
cmp word [ebp - 2], 0x61
jae 0x4a9dd5
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0041d164
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00406988
jmp 0x4a9ded
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0041d1a0
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00406988
push 0x4a9e7c
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x4a9e8c
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00407490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9e27
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4ab7d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4ab7d8
xor eax, eax
push ebp
push 0x4ab95e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 0xd], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0x1f
ja 0x4ab806
bt dword [ebp - 0xd], eax
jae case.0x4ab853.0
mov ax, word [ebp - 8]
add ax, 0x41
mov word [ebp - 2], ax
lea eax, [ebp - 0x18]
mov dx, word [ebp - 2]
call fcn.00407230
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0x4ab978
call fcn.00407408
mov eax, dword [ebp - 0x14]
call fcn.00407218
push eax
call sub.kernel32.dll_GetDriveTypeW
mov byte [ebp - 9], al
xor eax, eax
mov al, byte [ebp - 9]
cmp eax, 6
ja case.0x4ab853.0
jmp dword [eax*4 + 0x4ab85a]
push ebp
lea edx, [ebp - 0x20]
mov eax, dword [0x58ee30]
mov eax, dword [eax]
call fcn.00449300
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov ax, word [ebp - 2]
call fcn.004a9ca0
mov eax, dword [ebp - 0x1c]
call fcn.004ab6b0
pop ecx
jmp case.0x4ab853.0
push ebp
lea ecx, [ebp - 0x24]
xor edx, edx
mov ax, word [ebp - 2]
call fcn.004a9ca0
mov eax, dword [ebp - 0x24]
call fcn.004ab6b0
pop ecx
jmp case.0x4ab853.0
push ebp
lea edx, [ebp - 0x28]
mov ax, word [ebp - 2]
call fcn.004a9e90
mov eax, dword [ebp - 0x28]
call fcn.004ab6b0
pop ecx
jmp case.0x4ab853.0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x24]
test byte [eax + 0x2c], 1
jne case.0x4ab853.0
push ebp
lea edx, [ebp - 0x30]
mov eax, dword [0x58e688]
mov eax, dword [eax]
call fcn.00449300
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
mov ax, word [ebp - 2]
call fcn.004a9ca0
mov eax, dword [ebp - 0x2c]
call fcn.004ab6b0
pop ecx
jmp case.0x4ab853.0
push ebp
lea edx, [ebp - 0x38]
mov eax, dword [0x58ea50]
mov eax, dword [eax]
call fcn.00449300
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
mov ax, word [ebp - 2]
call fcn.004a9ca0
mov eax, dword [ebp - 0x34]
call fcn.004ab6b0
pop ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jne 0x4ab7fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab965
lea eax, [ebp - 0x38]
mov edx, 0xa
call fcn.00406624
ret
Function at 0x4c3f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c40f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push dword [eax + 8]
mov edx, 0x4c4110
mov eax, dword [ebp - 8]
call fcn.0043a0c0
call fcn.0043a2c0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00409db0
mov eax, dword [ebp - 0xc]
push eax
mov edx, 0x4c4124
mov eax, dword [ebp - 8]
call fcn.0043a0c0
pop edx
call fcn.0043a1f0
mov edx, 0x4c4138
mov eax, dword [ebp - 8]
call fcn.0043a0c0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14]
call fcn.0043a270
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00409db0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x4c4154
mov eax, dword [ebp - 8]
call fcn.0043a0c0
pop edx
call fcn.0043a1f0
mov eax, dword [ebp - 4]
push dword [eax + 0x24]
push dword [eax + 0x20]
mov edx, 0x4c4174
mov eax, dword [ebp - 8]
call fcn.0043a0c0
call fcn.0043a2c0
mov edx, 0x4c41a4
mov eax, dword [ebp - 8]
call fcn.0043a0c0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
call fcn.0043a1f0
mov edx, 0x4c41c0
mov eax, dword [ebp - 8]
call fcn.0043a0c0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x2c]
call fcn.0043a1f0
mov edx, 0x4c41d8
mov eax, dword [ebp - 8]
call fcn.0043a0c0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
call fcn.0043a1f0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00409db0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x4c4200
mov eax, dword [ebp - 8]
call fcn.0043a0c0
pop edx
call fcn.0043a1f0
mov edx, 0x4c421c
mov eax, dword [ebp - 8]
call fcn.0043a0c0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x38]
call fcn.0043a1f0
mov eax, dword [ebp - 4]
push dword [eax + 0x44]
push dword [eax + 0x40]
mov edx, 0x4c4240
mov eax, dword [ebp - 8]
call fcn.0043a0c0
call fcn.0043a2c0
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push dword [eax + 0x48]
mov edx, 0x4c4274
mov eax, dword [ebp - 8]
call fcn.0043a0c0
call fcn.0043a2c0
mov eax, dword [ebp - 4]
push dword [eax + 0x54]
push dword [eax + 0x50]
mov edx, 0x4c42c8
mov eax, dword [ebp - 8]
call fcn.0043a0c0
call fcn.0043a2c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c40fe
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406624
ret
Function at 0x4c9440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.0042a7e0
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
mov edx, 0x10
call fcn.0042a7e0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407218
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4c94b7
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4c94c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4c9605
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x4c94fc
mov eax, dword [0x58e6cc]
mov eax, dword [eax]
cmp byte [eax + 0x1b8], 0
jne 0x4c95ea
mov al, byte [ebp - 1]
mov byte [ebp - 9], al
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x4427cc]
call fcn.00442b40
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c95e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.004437c0
mov cl, 1
mov edx, 0x4c961c
mov eax, dword [ebp - 8]
call fcn.00443180
test al, al
jne 0x4c954e
call fcn.00405db0
jmp 0x4c95ea
mov edx, 0x4c9684
mov eax, dword [ebp - 8]
call fcn.00442d70
mov edx, 0x4c96ac
mov eax, dword [ebp - 8]
call fcn.00442d70
cmp byte [ebp - 9], 0
je 0x4c95af
lea ecx, [ebp - 0x10]
mov edx, 0x4c96dc
mov eax, dword [ebp - 8]
call fcn.00443700
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.004c93b0
mov edx, dword [ebp - 0x14]
pop eax
call fcn.004075a0
je 0x4c95cd
lea eax, [ebp - 0x18]
call fcn.004c93b0
mov ecx, dword [ebp - 0x18]
mov edx, 0x4c96dc
mov eax, dword [ebp - 8]
call fcn.00443820
jmp 0x4c95cd
mov edx, 0x4c96dc
mov eax, dword [ebp - 8]
call fcn.004437f0
test al, al
je 0x4c95cd
mov edx, 0x4c96dc
mov eax, dword [ebp - 8]
call fcn.00442d70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c95ea
mov eax, dword [ebp - 8]
call fcn.00404fec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c960c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00406624
ret
Function at 0x4cef50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 4
jb 0x4cf0d6
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00406b68
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp byte [eax], 2
jne 0x4cf0d6
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 2]
add eax, 4
cmp eax, dword [ebp - 8]
jne 0x4cf0d6
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
sub al, 1
jb 0x4cefa8
sub al, 4
jb 0x4cf008
jmp 0x4cf0d6
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 2]
cmp eax, 0x14
jne 0x4cf0d6
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00406b68
add eax, 4
mov edx, dword [ebp - 4]
mov esi, eax
lea edi, [edx + 0x44c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
add eax, 0x44c
push eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ce844]
call fcn.004cec80
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
jmp 0x4cf0d6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x444]
call fcn.00406aa4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx edx, word [eax + 2]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, 0x444
xor ecx, ecx
call fcn.00407038
mov eax, dword [ebp - 0x10]
cmp word [eax + 2], 0
jbe 0x4cf06a
mov eax, dword [ebp - 4]
add eax, 0x444
call fcn.00406b68
mov edx, dword [ebp - 0x14]
add eax, edx
push eax
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00406b68
add eax, 4
mov edx, dword [ebp - 0x10]
movzx ecx, word [edx + 2]
pop edx
call fcn.00404860
mov eax, dword [ebp - 0x10]
cmp byte [eax + 1], 2
je 0x4cf07c
mov eax, dword [ebp - 0x10]
cmp byte [eax + 1], 4
jne 0x4cf0d6
mov eax, dword [ebp - 0x10]
cmp byte [eax + 1], 2
jne 0x4cf08b
mov byte [ebp - 0x19], 3
jmp 0x4cf08f
mov byte [ebp - 0x19], 2
mov eax, dword [ebp - 4]
add eax, 0x44c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x444]
push eax
push 0
push 0
push 0
mov cl, byte [ebp - 0x19]
mov dl, 1
mov eax, dword [0x4ce844]
call fcn.004cec80
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0x444
xor ecx, ecx
xor edx, edx
call fcn.00407038
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
push fcn.004ceb80
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00406aa4
push eax
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00406b68
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x448]
push eax
call sub.kernel32.dll_ReadFileEx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4cf11f
mov eax, dword [ebp - 4]
mov byte [eax + 4], 1
mov al, byte [ebp - 9]
pop edi
pop esi
mov esp, ebp
pop ebp
ret