joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c485
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519e00
push 0x50ca2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x50c4fa
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x50c4f6
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x50c4f6
cmp word [eax + 0x14], 0
jne 0x50c4eb
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x50c4fc
mov eax, ecx
jmp 0x50c4e5
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a00
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402a3d
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402a5d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004046a4
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402c24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404434
test esi, esi
jne 0x402c5a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404524
jmp 0x402c78
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402ad8
mov edi, eax
test esi, esi
je 0x402c78
cmp dword [ebx], 0
je 0x402c78
dec esi
jmp 0x402c61
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f90
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5a6008], 0x8088405
inc edx
mov dword [ebx + 0x5a6008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5a6024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403508
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034e8
xor eax, eax
push ebp
push 0x4034e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403524
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x5a6024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5a6024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404214
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5af04c], 0
je 0x404275
cmp word [0x5af220], 0xd7b2
jne 0x40423d
cmp dword [0x5af228], 0
jbe 0x40423d
mov eax, 0x5af21c
call dword [0x5af238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x5a6070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40429c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5a6034], 0
jne 0x404291
push 0
push 0x5a6068
push 0x5a6070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4eeee8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419744]
call fcn.00404e2c
xor eax, eax
push ebp
push 0x4ef02c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5ab884], 0
jne 0x4eef3b
mov ecx, dword [0x5ae524]
mov dl, 1
mov eax, dword [0x407cc0]
call fcn.0040ce84
call fcn.00403dcc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f70
mov eax, ebx
call fcn.00404c9c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4ef03c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405ef8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404cac
test eax, eax
jle 0x4eefd3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4eefcc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004046bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004046a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b6c
test eax, eax
jne 0x4eefcc
mov ebx, 0x15
jmp 0x4eefd8
mov ebx, 0x10
jmp 0x4eefd8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5ab884]
call fcn.004eee40
mov eax, dword [ebp - 8]
call fcn.004eee40
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef033
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, dword [0x419744]
call fcn.00404efc
ret
Function at 0x51c7e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51c9df
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x51c821
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0051ce70
jmp 0x51c850
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
call fcn.004048f4
push eax
mov eax, edi
call fcn.004048f4
push eax
mov eax, esi
call fcn.004048f4
push eax
mov eax, ebx
call fcn.004048f4
push eax
push 0
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jg 0x51c9c7
lea eax, [ebp - 8]
mov edx, 0x51c9fc
call fcn.004044cc
mov eax, dword [ebp - 4]
cmp eax, 0x20
ja case.0x51c879.0
mov al, byte [eax + 0x51c880]
jmp dword [eax*4 + 0x51c8a1]
lea eax, [ebp - 8]
mov edx, 0x51ca14
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51ca50
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51ca7c
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51caa8
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51caf4
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cb38
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cb74
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cbdc
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cc00
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cc54
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cc90
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cce0
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cd20
call fcn.004044cc
push 0x10
mov eax, dword [ebp - 8]
call fcn.004048f4
mov edx, eax
mov ecx, 0x51cd40
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
xor ebx, ebx
jmp 0x51c9c9
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c9e6
lea eax, [ebp - 8]
call fcn.00404434
ret
Function at 0x51cd48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x1c]
call fcn.004048e4
xor eax, eax
push ebp
push 0x51ce5e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x1c], 0
jne 0x51cd81
lea edx, [ebp + 0x1c]
mov eax, ebx
call fcn.00409848
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
mov dword [ebp - 0x34], edi
mov eax, ebx
call fcn.004048f4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004048f4
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x1c], 0
je 0x51cdc7
mov eax, dword [ebp + 0x1c]
call fcn.004048f4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x51cde9
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x51ce48
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x51ce42
cmp byte [ebp + 0x14], 0
je 0x51ce04
push 0xffffffffffffffff
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x51ce2f
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a12b8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 8]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x51ce0a
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov dword [esi], 0x21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ce65
lea eax, [ebp + 0x1c]
call fcn.00404434
ret
Function at 0x555718
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x555919
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x376], 1
cmp dword [ebp - 4], 0
jne 0x555796
xor edx, edx
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x33c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x308]
call fcn.004835fc
mov esi, eax
dec esi
test esi, esi
jl 0x5558fc
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x308]
call fcn.004835c0
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc edi
dec esi
jne 0x555779
jmp 0x5558fc
mov dl, 1
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x33c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x308]
call fcn.004835fc
mov esi, eax
dec esi
test esi, esi
jl 0x5557dd
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x308]
call fcn.004835c0
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc edi
dec esi
jne 0x5557c5
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
mov edx, dword [esi + 0x14]
mov eax, dword [ebx + 0x31c]
call fcn.0047ffe4
lea edx, [ebp - 8]
mov ax, word [esi + 4]
call fcn.00490198
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x320]
call fcn.0047ffe4
mov eax, dword [ebx + 0x340]
mov eax, dword [eax + 0x168]
xor edx, edx
call fcn.0042c71c
mov edx, dword [esi + 0x18]
mov eax, dword [ebx + 0x348]
call fcn.0047ffe4
mov dl, byte [esi + 6]
mov eax, dword [ebx + 0x350]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xa]
mov eax, dword [ebx + 0x354]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 9]
mov eax, dword [ebx + 0x360]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 8]
mov eax, dword [ebx + 0x358]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xc]
mov eax, dword [ebx + 0x35c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xb]
mov eax, dword [ebx + 0x364]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
xor edx, edx
mov dl, byte [esi + 7]
mov eax, dword [ebx + 0x370]
call fcn.0054aba8
mov eax, dword [esi + 0x1c]
call fcn.0040553c
test eax, eax
jne 0x5558c0
mov edx, 0x555930
mov eax, dword [ebx + 0x368]
call fcn.0047ffe4
jmp 0x5558d0
mov edx, 0x555940
mov eax, dword [ebx + 0x368]
call fcn.0047ffe4
cmp dword [esi + 0x10], 0
je 0x5558fc
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x340]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x340]
call fcn.0043b568
mov ecx, dword [esi + 0x10]
pop edx
call fcn.0042a12c
mov byte [ebx + 0x376], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555920
lea eax, [ebp - 8]
call fcn.00404434
ret
Function at 0x55c9fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x55ca04
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x55cc1c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov edx, 0x400
call fcn.00404a80
push 0x400
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040462c
lea eax, [ebp - 0x20]
mov edx, 0x55cc38
call fcn.004044cc
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
jne 0x55ca8a
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 1
call fcn.00404994
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.00409430
test al, al
jne 0x55cb4c
xor eax, eax
push ebp
push 0x55cb24
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a850]
call fcn.004035d0
mov dword [ebp - 8], eax
call fcn.0040af5c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.0040a908
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x55cc4c
call fcn.00404740
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55cb40
mov dword [ebp - 4], 0x1e
jmp 0x55cbf4
xor eax, eax
push ebp
push 0x55cbb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a850]
call fcn.004035d0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 0x10]
mov edx, 0x55cc58
mov eax, dword [ebp - 8]
call fcn.0041e6a0
mov eax, dword [ebp - 0x10]
call fcn.0040a968
fstp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55cbd0
call fcn.0040af5c
fsubr qword [ebp - 0x18]
call fcn.00402d38
add eax, 0x1e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x55cbef
cmp dword [ebp - 4], 0x1e
jle 0x55cbf4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cc23
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404458
ret
Function at 0x56895c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x568b82
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x568b5f
mov eax, dword [0x5ae694]
mov eax, dword [eax]
call fcn.0059d094
test al, al
je 0x568b5f
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049f32c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x568a56
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x568b9c
call fcn.00404740
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.0041fa64
mov dword [ebp - 0xc], eax
push 0xffff
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x34c]
call fcn.00437fa4
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.0041fa64
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0041f5d0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0041f7e8
mov eax, dword [ebp - 0xc]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x568a92
mov eax, dword [ebp - 8]
call fcn.0041f54c
mov dword [ebp - 0x10], eax
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004f83e4
test al, al
jne 0x568ace
mov eax, dword [ebp - 8]
call fcn.00403600
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
xor edx, edx
call fcn.0049f32c
jmp 0x568b5f
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 8]
call fcn.00403600
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x34c]
call fcn.00437fa4
mov eax, dword [ebp - 0x1c]
mov edx, 0x568bb4
call fcn.004fd200
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
xor edx, edx
call fcn.0049f32c
mov byte [ebp - 1], 1
push 0x44
mov ecx, 0x568bc4
mov edx, 0x568bd4
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
cmp eax, 6
jne 0x568b5f
push 5
push 0
push 0
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x34c]
call fcn.00437fa4
mov eax, dword [ebp - 0x20]
call fcn.004048f4
push eax
push 0x568bf8
mov eax, ebx
call fcn.004869e8
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568b89
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404458
lea eax, [ebp - 0x14]
call fcn.00404434
ret
Function at 0x56c5d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x56c6f4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 4]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, 0x56c70c
call fcn.004f90e8
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x4ec]
add eax, 0x78
call fcn.00404488
mov eax, dword [esi + 0x4ec]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x56c6bc
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x4ec]
call fcn.00437fa4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040898c
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, 0x56c70c
call fcn.004f90e8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040898c
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00404840
je 0x56c6bc
push 0
lea ecx, [ebp - 0x18]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, 0x56c70c
call fcn.004f90e8
mov eax, dword [ebp - 0x18]
call fcn.004048f4
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x4ec]
call fcn.00437fa4
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x56c6ba
mov eax, 0x13ec
call fcn.004fb63c
jmp 0x56c6bc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c6fb
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404458
lea eax, [ebp - 0xc]
call fcn.00404434
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404458
ret
Function at 0x56ce9c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x56cea5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x56d0e9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.004044cc
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408bdc
mov eax, dword [ebp - 0x14]
mov edx, 0x56d104
call fcn.00404840
jne 0x56cef5
lea eax, [ebp - 8]
call fcn.00404434
mov eax, dword [edi + 0x4a8]
add eax, 0x60
mov edx, dword [ebp - 4]
call fcn.00404488
cmp dword [ebp - 8], 0
je 0x56cf4a
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
je 0x56cf24
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x56d104
call fcn.00404740
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00408bdc
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
mov eax, dword [edi + 0x4a8]
add eax, 0x78
call fcn.00404740
jmp 0x56cf6b
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
mov eax, dword [edi + 0x4a8]
call fcn.0043800c
mov eax, dword [edi + 0x4a8]
add eax, 0x78
call fcn.00404434
mov eax, dword [edi + 0x4a8]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x56d0ce
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x4a8]
call fcn.00437fa4
lea ecx, [ebp - 8]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.004f9008
cmp dword [ebp - 8], 0
jne 0x56d0c2
push 0x24
mov ecx, 0x56d108
mov edx, 0x56d114
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
cmp eax, 6
jne 0x56d0ce
lea eax, [ebp - 8]
mov edx, 0x56d15c
call fcn.004f8e90
test al, al
je 0x56d0ce
mov eax, dword [ebp - 8]
mov edx, 0x56d104
call fcn.00404840
jne 0x56cff5
lea eax, [ebp - 8]
call fcn.00404434
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409930
cmp dword [ebp - 0x10], 0
je 0x56d01e
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x5c
je 0x56d01e
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x56d104
call fcn.00404740
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004046fc
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x1c]
call fcn.00409430
test al, al
je 0x56d084
push 0x24
push 0x56d190
push dword [ebp - 0x10]
push 0x56d19c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x20]
call fcn.004048f4
mov edx, eax
mov ecx, 0x56d1bc
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
cmp eax, 6
jne 0x56d0ce
push 0
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.004048f4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x56d0ce
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
jmp 0x56d0ce
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d0f0
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00404458
ret
Function at 0x5860c4
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x5860dc
push 0x5860f4
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x5860fc
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x586114
push 0x58613c
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x586144
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x586158
push 0
push eax
call sub.shell32.dll_ShellExecuteA
ret