joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd544
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4bd54c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404750
mov eax, dword [ebp - 8]
call fcn.00404750
mov edi, dword [0x4d6f14]
xor eax, eax
push ebp
push 0x4bd798
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push dword [edi]
push dword [ebp - 4]
push 0x4bd7b0
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x10]
call fcn.004b9054
test al, al
jne 0x4bd77d
xor eax, eax
push ebp
push 0x4bd771
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd7bc
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x14]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x18]
push eax
push 0x4bd7c4
mov ecx, dword [0x4d8668]
mov dl, 1
mov eax, dword [0x4192a4]
call fcn.0041e768
mov esi, eax
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd7bc
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404620
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0041e434
mov eax, esi
call fcn.00403440
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd7bc
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x24]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00404498
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.004b8d4c
push dword [edi]
push dword [ebp - 4]
push 0x4bd7b0
push dword [ebp - 8]
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x30]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404498
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004b8d4c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.004046ac
jbe 0x4bd733
push 0x80
push dword [edi]
push dword [ebp - 4]
push 0x4bd7b0
push dword [ebp - 8]
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x34]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
push dword [edi]
push dword [ebp - 4]
push 0x4bd7b0
push dword [ebp - 8]
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x38]
call fcn.00404760
push eax
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd7bc
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x3c]
call fcn.00404760
push eax
call sub.kernel32.dll_CopyFileA
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4bd7bc
lea eax, [ebp - 0x44]
mov edx, 4
call fcn.00404620
mov eax, dword [ebp - 0x44]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.00404498
mov eax, dword [ebp - 0x40]
call fcn.004099c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bd77d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd79f
lea eax, [ebp - 0x44]
mov edx, 0x11
call fcn.004042b4
ret
Function at 0x4bd7cc
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4bd7d4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404750
mov eax, dword [ebp - 8]
call fcn.00404750
xor eax, eax
push ebp
push 0x4bd9cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x10]
call fcn.004b7b30
cmp eax, 0x13880
jle 0x4bd984
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x18]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00404498
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.004b8d4c
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
call fcn.004045ac
mov eax, dword [ebp - 0x24]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00404498
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004b8d4c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004046ac
jbe 0x4bd955
push 0x80
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
call fcn.004045ac
mov eax, dword [ebp - 0x28]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
call fcn.004045ac
mov eax, dword [ebp - 0x2c]
call fcn.00404760
push eax
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x30]
call fcn.00404760
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4bd9b1
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x38]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x34]
call fcn.00404498
mov eax, dword [ebp - 0x34]
call fcn.004099c8
mov eax, dword [ebp - 8]
mov edx, 0x4bd9e0
call fcn.004046ac
je 0x4bd94e
mov eax, dword [ebp - 8]
mov edx, 0x4bd9f4
call fcn.004046ac
jne 0x4bd9b1
call fcn.004b970c
jmp 0x4bd9b1
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x40]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00404498
mov eax, dword [ebp - 0x3c]
call fcn.004099c8
jmp 0x4bd9b1
mov edx, dword [0x4d6f14]
mov edx, dword [edx]
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 4]
call fcn.004045ac
mov eax, dword [ebp - 0x48]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0x44]
call fcn.00404498
mov eax, dword [ebp - 0x44]
call fcn.004099c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd9d3
lea eax, [ebp - 0x48]
mov edx, 0x12
call fcn.004042b4
ret
Function at 0x4bdc64
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x4bdd00
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or ebx, 2
mov dword [esp + 0x1c], ebx
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x30
pop ebx
ret

Function at 0x4bdd14
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.00404290
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409df0
add esp, 0x18
pop ebx
ret

Function at 0x4c2a68
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
add esp, 0xfffffe70
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, 0x4c2acc
call fcn.004042e4
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4c2aba
mov eax, esi
call fcn.00404760
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4c2ab5
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404498
call sub.wsock32.dll_WSACleanup
add esp, 0x190
pop esi
pop ebx
ret
Function at 0x4c3988
Capabilities:
Check os version
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x18
push 0
push 0
dec ecx
jne 0x4c3990
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4c3c44
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 2
push 0
lea eax, [ebp - 0xa0]
mov ecx, 0x4c3c5c
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0xa0]
call fcn.00404760
push eax
lea eax, [ebp - 0xa4]
mov ecx, 0x4c3c74
mov edx, dword [0x4da384]
call fcn.004045ac
mov eax, dword [ebp - 0xa4]
call fcn.00404760
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0xac]
mov ecx, 0x4c3c5c
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0xac]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0xa8]
call fcn.00404498
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 4]
call fcn.004b8d4c
lea eax, [ebp - 0xb0]
mov ecx, 0x4c3c5c
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0xb0]
call fcn.004099c8
mov eax, dword [ebp - 4]
call fcn.00404560
cmp eax, 3
jge 0x4c3a9e
lea eax, [ebp - 0xb8]
mov ecx, 0x4c3c74
mov edx, dword [0x4da384]
call fcn.004045ac
mov eax, dword [ebp - 0xb8]
call fcn.00404760
mov edx, eax
lea eax, [ebp - 0xb4]
call fcn.00404498
mov eax, dword [ebp - 0xb4]
lea edx, [ebp - 4]
call fcn.004b8d4c
lea ecx, [ebp - 8]
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00435a18
lea ecx, [ebp - 0xbc]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00435a18
mov eax, dword [ebp - 0xbc]
xor edx, edx
call fcn.004093f4
mov ebx, eax
cmp ebx, 1
jne 0x4c3b07
lea ecx, [ebp - 8]
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00435a18
lea ecx, [ebp - 0xc0]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00435a18
mov eax, dword [ebp - 0xc0]
xor edx, edx
call fcn.004093f4
mov ebx, eax
lea ecx, [ebp - 0xc4]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00435aa4
mov eax, dword [ebp - 0xc4]
xor edx, edx
call fcn.004093f4
cmp ebx, 4
jle 0x4c3b94
cmp ebx, 6
jge 0x4c3b3b
mov esi, 1
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3b4e
test eax, eax
jne 0x4c3b4e
mov esi, 1
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3b62
cmp eax, 1
jne 0x4c3b62
mov esi, 2
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3b76
cmp eax, 2
jne 0x4c3b76
mov esi, 3
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3b8a
cmp eax, 3
jne 0x4c3b8a
mov esi, 3
jmp 0x4c3c19
mov esi, 4
jmp 0x4c3c19
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4c3c19
mov eax, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x8c]
sub edx, 2
jne 0x4c3c19
cmp ebx, 6
jge 0x4c3bd1
mov esi, 1
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3be1
test eax, eax
jne 0x4c3be1
mov esi, 1
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3bf2
cmp eax, 1
jne 0x4c3bf2
mov esi, 2
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3c03
cmp eax, 2
jne 0x4c3c03
mov esi, 3
jmp 0x4c3c19
cmp ebx, 6
jne 0x4c3c14
cmp eax, 3
jne 0x4c3c14
mov esi, 3
jmp 0x4c3c19
mov esi, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3c4b
lea eax, [ebp - 0xc4]
mov edx, 0xa
call fcn.004042b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042b4
ret
Function at 0x4c3c84
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x4d6d94]
mov eax, dword [eax]
call fcn.0046ebb4
push 0xa
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp esi, edx
jle 0x4c3cb3
cmp ebx, eax
jle 0x4c3c8f
pop esi
pop ebx
ret

Function at 0x4c4798
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x4da4f7], 1
push 1
mov eax, dword [0x4d6d94]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4d6d94]
mov eax, dword [eax]
call fcn.0046e738
mov eax, dword [0x4da35c]
call fcn.00455338
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [0x4d6d94]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [0x4d6d94]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
ret
Function at 0x4c7488
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c770a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x2fc]
cmp dword [eax + 0x30], 0x2bf20
je 0x4c76bb
mov edx, 0x2bf20
call fcn.00434844
mov edx, 0x4c7720
mov eax, 0x4c772c
call fcn.004bd544
mov edx, 0x4c7720
mov eax, 0x4c773c
call fcn.004bd544
mov edx, 0x4c7720
mov eax, 0x4c774c
call fcn.004bd544
call fcn.004c38c8
test al, al
je 0x4c7506
mov edx, 0x4c7720
mov eax, 0x4c775c
call fcn.004bd544
mov edx, 0x4c7720
mov eax, 0x4c776c
call fcn.004bd544
call fcn.004c38c8
test al, al
je 0x4c752d
mov edx, 0x4c7720
mov eax, 0x4c777c
call fcn.004bd544
mov edx, 0x4c778c
mov eax, 0x4c774c
call fcn.004bd544
call fcn.004c38c8
test al, al
je 0x4c7554
mov edx, 0x4c778c
mov eax, 0x4c775c
call fcn.004bd544
mov edx, 0x4c778c
mov eax, 0x4c7798
call fcn.004bd544
mov edx, 0x4c77a8
mov eax, 0x4c77bc
call fcn.004bd7cc
mov edx, 0x4c77d0
mov eax, 0x4c77e4
call fcn.004bd7cc
mov edx, 0x4c77f8
mov eax, 0x4c780c
call fcn.004bd7cc
mov edx, 0x4c7820
mov eax, 0x4c7834
call fcn.004bd7cc
mov edx, 0x4c7848
mov eax, 0x4c785c
call fcn.004bd7cc
mov edx, 0x4c7870
mov eax, 0x4c7884
call fcn.004bd7cc
mov edx, 0x4c7898
mov eax, 0x4c78ac
call fcn.004bd7cc
mov edx, 0x4c78c0
mov eax, 0x4c78d4
call fcn.004bd7cc
mov edx, 0x4c78e8
mov eax, 0x4c78fc
call fcn.004bd7cc
lea eax, [ebp - 8]
mov ecx, 0x4c7910
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 8]
call fcn.004b7b30
cmp eax, 0xc3500
jle 0x4c76bb
push 0x80
lea eax, [ebp - 0xc]
mov ecx, dword [0x4da36c]
mov edx, dword [0x4da360]
call fcn.004045ac
mov eax, dword [ebp - 0xc]
call fcn.00404760
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0x4da304
push 2
call sub.shell32.dll_Shell_NotifyIconA
push 0
mov eax, dword [0x4da374]
call fcn.00404760
push eax
push 0x4c7924
push dword [0x4da36c]
push 0x4c7938
lea edx, [ebp - 0x14]
mov eax, dword [0x4da360]
call fcn.004b6f4c
push dword [ebp - 0x14]
push 0x4c7944
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404620
mov eax, dword [ebp - 0x10]
call fcn.00404760
push eax
lea eax, [ebp - 0x18]
mov ecx, 0x4c7848
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0x18]
call fcn.00404760
push eax
push 0x4c7948
mov eax, ebx
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c76ef
mov eax, 0x4da3fc
call fcn.00404290
mov eax, 0x4da400
call fcn.00404290
mov eax, 0x4da404
call fcn.00404290
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4be798
xor edx, edx
xor eax, eax
call fcn.00404244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7711
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004042b4
ret
Function at 0x4c81a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c82a1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4da4fc], 2
jne 0x4c81dc
mov edx, 0x4c82b8
mov eax, ebx
call fcn.004cc2a8
jmp 0x4c8286
cmp dword [0x4da4fc], 1
jne 0x4c81f1
mov edx, 0x4c82e8
mov eax, ebx
call fcn.004cc2a8
push 0x4da304
push 2
call sub.shell32.dll_Shell_NotifyIconA
push 0x4da304
push 2
call sub.shell32.dll_Shell_NotifyIconA
push 0
mov eax, dword [0x4da374]
call fcn.00404760
push eax
push 0x4c8384
push dword [0x4da36c]
push 0x4c8394
lea edx, [ebp - 8]
mov eax, dword [0x4da360]
call fcn.004b6f4c
push dword [ebp - 8]
push 0x4c83a0
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404620
mov eax, dword [ebp - 4]
call fcn.00404760
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4c83ac
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0xc]
call fcn.00404760
push eax
push 0x4c83b8
mov eax, ebx
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.0046b620
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c82a8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004042b4
ret

Function at 0x4c83c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c84ce
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4da4cd], 0
je 0x4c844e
mov eax, 0x4c84e4
call fcn.004b7bd8
test al, al
jne 0x4c84b3
push 0
mov eax, dword [0x4da374]
call fcn.00404760
push eax
lea eax, [ebp - 4]
mov ecx, dword [0x4da4b0]
mov edx, 0x4c84f8
call fcn.004045ac
mov eax, dword [ebp - 4]
call fcn.00404760
push eax
lea eax, [ebp - 8]
mov ecx, 0x4c84e4
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 8]
call fcn.00404760
push eax
push 0x4c8504
mov eax, ebx
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c84b3
mov eax, 0x4c8514
call fcn.004b7bd8
test al, al
jne 0x4c84b3
push 0
mov eax, dword [0x4da374]
call fcn.00404760
push eax
lea eax, [ebp - 0xc]
mov ecx, dword [0x4da4b0]
mov edx, 0x4c84f8
call fcn.004045ac
mov eax, dword [ebp - 0xc]
call fcn.00404760
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x4c8514
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0x10]
call fcn.00404760
push eax
push 0x4c8504
mov eax, ebx
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c84d5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004042b4
ret
Function at 0x4c8520
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x160]
mov edx, dword [0x407bf8]
call fcn.00404fb0
xor eax, eax
push ebp
push 0x4c87a9
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004b93d8
mov eax, dword [0x4da3c8]
call fcn.00404560
cmp eax, 2
jle 0x4c858a
call fcn.004b7218
xor eax, eax
push ebp
push 0x4c864e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
mov ecx, 0x4c87c0
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x3f
call fcn.00409938
test eax, eax
jne 0x4c8617
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x154]
call fcn.004089f8
mov eax, dword [ebp - 8]
mov edx, dword [0x4da36c]
call fcn.004046ac
je 0x4c8608
lea eax, [ebp - 0x168]
mov ecx, dword [ebp - 0x154]
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0x168]
call fcn.004099c8
lea eax, [ebp - 0x160]
call fcn.00409988
test eax, eax
je 0x4c85c8
lea eax, [ebp - 0x160]
call fcn.004099ac
call fcn.004bb46c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov edx, 0x64
call fcn.00434844
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004c7488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c8658
push 0
mov eax, dword [0x4da384]
call fcn.00404760
push eax
push 0x4c87c4
lea eax, [ebp - 0x16c]
mov ecx, 0x4c87dc
mov edx, dword [0x4da384]
call fcn.004045ac
mov eax, dword [ebp - 0x16c]
call fcn.00404760
push eax
push 0x4c87e8
mov eax, dword [ebp - 4]
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, 0x64
mov eax, dword [ebp - 4]
call fcn.004c3c84
cmp byte [0x4da4cd], 0
je 0x4c8710
mov eax, 0x4c87f8
call fcn.004b7bd8
test al, al
jne 0x4c8772
push 0
mov eax, dword [0x4da374]
call fcn.00404760
push eax
push 0x4c8804
lea eax, [ebp - 0x170]
mov ecx, 0x4c87f8
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0x170]
call fcn.00404760
push eax
push 0x4c87e8
mov eax, dword [ebp - 4]
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4c8765
mov eax, 0x4c8814
call fcn.004b7bd8
test al, al
jne 0x4c8772
push 0
mov eax, dword [0x4da374]
call fcn.00404760
push eax
push 0x4c8804
lea eax, [ebp - 0x174]
mov ecx, 0x4c8814
mov edx, dword [0x4da374]
call fcn.004045ac
mov eax, dword [ebp - 0x174]
call fcn.00404760
push eax
push 0x4c87e8
mov eax, dword [ebp - 4]
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, 0x4c8828
mov eax, dword [ebp - 4]
call fcn.004c3cb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c87b0
lea eax, [ebp - 0x174]
mov edx, 5
call fcn.004042b4
lea eax, [ebp - 0x160]
mov edx, dword [0x407bf8]
call fcn.00405080
lea eax, [ebp - 8]
call fcn.00404290
ret
Function at 0x4c883c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov edx, 0x4c8874
mov eax, ebx
call fcn.004c3cb8
push 1
push 0
push 0
push esi
push 0x4c88a8
mov eax, ebx
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
pop esi
pop ebx
ret

Function at 0x4cc6a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cc8bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4da4ea], 0
mov eax, dword [0x4d6600]
lea eax, [eax + eax*8]
mov edx, dword [0x4d6e18]
cmp dword [edx + eax*4 + 0x20], 1
jne 0x4cc6e6
mov eax, ebx
call fcn.004d18b8
jmp 0x4cc8a0
mov eax, dword [0x4da46c]
call fcn.00404560
dec eax
jge 0x4cc712
mov ecx, dword [0x4d7134]
mov ecx, dword [ecx + 0x30]
mov eax, 0x4da46c
mov edx, 0x4cc8d0
call fcn.004045ac
call fcn.004bdd44
jmp 0x4cc74f
mov eax, dword [0x4d7134]
mov eax, dword [eax + 0x30]
mov edx, dword [0x4da46c]
call fcn.004048a4
dec eax
jge 0x4cc74f
push dword [0x4da46c]
push 0x4cc8dc
mov eax, dword [0x4d7134]
push dword [eax + 0x30]
mov eax, 0x4da46c
mov edx, 3
call fcn.00404620
call fcn.004bdd44
mov edx, 0x4cc8e8
mov eax, ebx
call fcn.004c3cb8
mov dword [0x4d6604], 0xffffffff
mov dword [0x4d6600], 0xffffffff
mov eax, dword [0x4d7134]
cmp byte [eax + 0xa], 0
je 0x4cc78a
lea eax, [ebp - 4]
mov edx, dword [0x4da414]
call fcn.00404328
jmp 0x4cc798
lea eax, [ebp - 4]
mov edx, dword [0x4da410]
call fcn.00404328
mov edx, dword [ebp - 4]
mov eax, 0x4cc924
call fcn.004048a4
test eax, eax
jle 0x4cc7c3
push 1
mov eax, dword [0x4d7134]
mov eax, dword [eax + 0x34]
call fcn.00404760
push eax
call sub.kernel32.dll_WinExec
jmp 0x4cc8a0
mov edx, dword [ebp - 4]
mov eax, 0x4cc934
call fcn.004048a4
test eax, eax
jle 0x4cc809
push 1
push dword [0x4da388]
push 0x4cc944
mov eax, dword [0x4d7134]
push dword [eax + 0x34]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404620
mov eax, dword [ebp - 8]
call fcn.00404760
push eax
call sub.kernel32.dll_WinExec
jmp 0x4cc8a0
mov edx, dword [ebp - 4]
mov eax, 0x4cc95c
call fcn.004048a4
test eax, eax
jle 0x4cc865
push 1
mov eax, dword [0x4da388]
call fcn.00404760
push eax
mov eax, dword [0x4d7134]
mov eax, dword [eax + 0x34]
call fcn.00404760
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4cc944
mov edx, dword [0x4da388]
call fcn.004045ac
mov eax, dword [ebp - 0xc]
call fcn.00404760
push eax
push 0x4cc968
mov eax, ebx
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4cc8a0
push 1
mov eax, dword [0x4d7134]
mov eax, dword [eax + 0x3c]
call fcn.00404760
push eax
mov eax, dword [0x4da434]
call fcn.00404760
push eax
mov eax, dword [0x4d7134]
mov eax, dword [eax + 0x34]
call fcn.00404760
push eax
push 0x4cc968
mov eax, ebx
call fcn.00455338
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc8c2
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004042b4
ret