joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546028
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd80
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
lea eax, [ebp - 0x278]
mov edx, dword [0x40f7d8]
call fcn.004085a8
xor eax, eax
push ebp
push 0x5461c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x279], 0
mov dl, 1
mov eax, dword [0x529188]
call fcn.005297c4
mov dword [ebp - 0x280], eax
xor edx, edx
push ebp
push 0x546198
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.00416bf0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x280]
call fcn.00529bfc
xor edx, edx
mov eax, dword [ebp - 0x280]
call fcn.005298fc
test al, al
jne 0x5460d4
test bl, bl
je 0x5460be
mov eax, dword [ebp - 0x280]
cmp dword [eax + 0x18], 2
je 0x5460c2
xor eax, eax
jmp 0x5460c4
mov al, 1
mov byte [ebp - 0x279], al
call fcn.0040634c
jmp 0x54619f
cmp byte [edi + 0x21], 0
jne 0x5460ea
mov eax, dword [ebp - 0x280]
cmp dword [eax + 0x18], 5
je 0x54617f
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
mov eax, dword [ebp - 4]
call fcn.004160b4
test eax, eax
jne 0x546150
test byte [ebp - 0x268], 1
sete byte [ebp - 0x279]
lea eax, [ebp - 0x278]
call fcn.00416128
cmp byte [ebp - 0x279], 0
je 0x546149
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00415c64
cmp eax, 0xffffffff
setg byte [ebp - 0x279]
cmp byte [ebp - 0x279], 0
je 0x546149
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040634c
jmp 0x54619f
xor ecx, ecx
mov edx, 0x10
mov eax, dword [ebp - 4]
call fcn.00415cbc
cmp eax, 0xffffffff
jle 0x54617f
mov byte [ebp - 0x279], 1
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
call fcn.00407880
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54619f
mov eax, dword [ebp - 0x280]
call fcn.00405780
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5461cd
lea eax, [ebp - 0x278]
mov edx, dword [0x40f7d8]
call fcn.00408680
lea eax, [ebp - 4]
call fcn.004077e4
ret
Function at 0x5497ac
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5498a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0054b578
mov esi, eax
mov eax, dword [ebx + 0x14c]
mov dword [ebp - 8], eax
test esi, esi
jne 0x5497f1
cmp dword [ebp - 8], 0
jg 0x5497f1
mov esi, 0xeef77ff3
test esi, esi
jne 0x54988c
mov eax, dword [ebx + 0x148]
sub eax, dword [ebx + 0x14c]
dec eax
jge 0x549822
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
mov eax, dword [ebx + 0x48]
call fcn.00407880
push eax
call sub.kernel32.dll_DeleteFileW
mov esi, dword [ebp - 8]
jmp 0x54988c
or esi, 0xffffffff
mov edx, esi
mov eax, ebx
call fcn.00532db8
mov esi, eax
test esi, esi
jl 0x549859
mov edx, esi
mov eax, ebx
call fcn.005327e8
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00559ec0
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x549825
mov edi, dword [ebx + 0x148]
mov cl, 2
mov edx, 0x5498c0
mov eax, ebx
call fcn.00532e88
push 0
mov ecx, dword [ebx + 0x148]
sub ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00542368
mov esi, eax
test esi, esi
jl 0x54988c
sub edi, esi
mov esi, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5498a9
lea eax, [ebp - 0xc]
call fcn.004077e4
ret

Function at 0x57f0c4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
dec ecx
js 0x57f115
lea eax, [ebp - 0x30]
cmp word [eax + 0x20], 3
je 0x57f0fc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x57f0ec
jmp 0x57f115
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x57f0fd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x590b10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077dc
xor eax, eax
push ebp
push 0x590d33
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x590d06
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x590b6d
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x590b6d
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406c0c
mov ebx, eax
test ebx, ebx
je 0x590b78
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebx + 1]
call fcn.0041721c
mov edx, dword [ebp - 4]
call fcn.00416f60
mov dword [ebp - 0x18], eax
xor ebx, ebx
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x590bf0
xor eax, eax
push ebp
push 0x590be1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.004042b0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x590bf0
mov eax, esi
xor edx, edx
call fcn.004077f4
test bl, bl
je 0x590c15
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x590d44
mov eax, dword [ebp - 0x24]
push eax
call sub.version.dll_VerQueryValueW
jmp 0x590c1a
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x590c43
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp - 0xc]
movzx edx, word [edx]
shl edx, 0x10
or eax, edx
lea ecx, [ebp - 8]
mov edx, 8
call fcn.00415840
test bl, bl
je 0x590c9b
push 0x590d84
push dword [ebp - 8]
push 0x590db4
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.00407dac
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x224]
call fcn.00416f60
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x590c9b
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.004171f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x590d0d
xor eax, eax
push ebp
push 0x590cd1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x24], 0
je 0x590cc7
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
call fcn.004042cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x590cdb
xor eax, eax
push ebp
push 0x590cfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.0041725c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x590d05
ret
Function at 0x595c50
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, eax
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 0
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebp
call sub.user32.dll_SetWindowPos
call sub.user32.dll_GetForegroundWindow
mov dword [esp], eax
xor ebx, ebx
jmp 0x595ccd
call sub.kernel32.dll_GetCurrentThreadId_1
mov edi, eax
push 0
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
push ebp
call sub.user32.dll_SetForegroundWindow
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
test bl, bl
je 0x595c9a
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push ebp
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [esp + 8]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x597590
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
cmp al, 1
jne 0x5975ec
push 0x597694
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5975ec
xor eax, eax
push ebp
push 0x5975e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ClearEventLogW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5975ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseEventLog
ret
cmp byte [ebp - 1], 1
jne 0x59763e
push 0x5976a4
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x59763e
xor eax, eax
push ebp
push 0x597637
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ClearEventLogW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59763e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseEventLog
ret
cmp byte [ebp - 2], 1
jne 0x597690
push 0x5976bc
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x597690
xor eax, eax
push ebp
push 0x597689
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ClearEventLogW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x597690
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseEventLog
ret
pop ecx
pop ecx
pop ebp
ret
Function at 0x599858
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x599860
mov eax, dword [esp + 0x2000]
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.004077f4
push 0x2002
lea eax, [esp + 4]
push eax
mov eax, dword [ebx]
call fcn.00407880
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, ebx
mov edx, esp
mov ecx, 0x1001
call fcn.004079f4
add esp, 0x2004
pop esi
pop ebx
ret

Function at 0x599b14
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077dc
xor eax, eax
push ebp
push 0x599c95
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00519800
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.00519820
mov ebx, eax
jmp 0x599c61
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004079f4
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00416704
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00414744
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.00414744
mov edx, dword [ebp - 0x240]
pop eax
call fcn.00407ecc
je 0x599c38
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004079f4
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00414744
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.00414744
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.00407ecc
jne 0x599c52
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.00519840
mov ebx, eax
test ebx, ebx
jne 0x599b93
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599c9c
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.004077ec
lea eax, [ebp - 4]
call fcn.004077e4
ret
Function at 0x599ca8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x298], edx
mov dword [ebp - 0x29c], edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077dc
lea eax, [ebp - 0x280]
mov edx, dword [0x40f7d8]
call fcn.004085a8
xor eax, eax
push ebp
push 0x599efd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00416704
cmp dword [ebp - 8], 0
jne 0x599d22
lea eax, [ebp - 8]
mov edx, 0x599f18
call fcn.00407848
lea edx, [ebp - 0x288]
mov eax, dword [ebp - 4]
call fcn.00416430
mov edx, dword [ebp - 0x288]
lea eax, [ebp - 4]
call fcn.00407848
cmp dword [ebp - 4], 0
jne 0x599d74
lea eax, [ebp - 0x28c]
call fcn.00416e30
mov ebx, dword [ebp - 0x28c]
lea edx, [ebp - 0xc]
mov dword [ebp - 0x290], ebx
mov eax, dword [ebp - 0x290]
call fcn.0041d058
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00407848
mov dl, 1
mov eax, dword [0x4323d4]
call fcn.0043e344
mov dword [ebp - 0x284], eax
xor edx, edx
push ebp
push 0x599eaa
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x294]
mov ecx, 0x599f18
mov edx, dword [ebp - 4]
call fcn.00407cc8
mov eax, dword [ebp - 0x294]
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
call fcn.004160b4
mov ebx, eax
xor edx, edx
push ebp
push 0x599e8a
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
jne 0x599e0e
test byte [ebp - 0x270], 0x10
jne 0x599dfd
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x26c]
call fcn.0044e3a8
test al, al
je 0x599dfd
mov edx, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x284]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x280]
call fcn.00416104
mov ebx, eax
test ebx, ebx
je 0x599dd1
mov eax, dword [ebp - 0x284]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x599e71
inc ebx
xor esi, esi
lea ecx, [ebp - 0x29c]
mov edx, esi
mov eax, dword [ebp - 0x284]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x29c]
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.00407cc8
mov edi, dword [ebp - 0x298]
mov dword [ebp - 0x290], edi
mov eax, dword [ebp - 0x290]
call fcn.00407880
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
inc esi
dec ebx
jne 0x599e23
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599e91
lea eax, [ebp - 0x280]
call fcn.00416128
ret
Function at 0x599f20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004077dc
xor eax, eax
push ebp
push 0x599fa8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00404c64
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x599fc4
mov edx, dword [ebp - 4]
call fcn.00407cc8
mov eax, dword [ebp - 0x28]
call fcn.00407880
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599faf
lea eax, [ebp - 0x28]
call fcn.004077e4
lea eax, [ebp - 4]
call fcn.004077e4
ret
Function at 0x59a494
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x59a49c
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x59a6bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
lea edx, [ebp - 4]
mov eax, esi
call fcn.00599858
lea eax, [ebp - 0x27]
xor ecx, ecx
mov edx, 0x1e
call fcn.00404c64
lea eax, [ebp - 8]
mov edx, edi
call fcn.00407848
lea ecx, [ebp - 0x2c]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040f4c8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.00407848
mov eax, dword [ebp - 8]
mov edx, 0x59a6dc
call fcn.00407ecc
jne 0x59a50f
mov byte [ebp - 9], 1
lea eax, [ebp - 8]
mov edx, esi
call fcn.00407848
lea ecx, [ebp - 0x30]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0040f4c8
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 8]
call fcn.00407848
mov eax, dword [ebp - 8]
mov edx, 0x59a6dc
call fcn.00407ecc
jne 0x59a547
mov byte [ebp - 9], 1
mov esi, 0x14
lea edx, [ebp - 0x34]
mov eax, dword [0x5c3868]
mov eax, dword [eax + 0x4d0]
call fcn.004bcbd4
mov eax, dword [ebp - 0x34]
mov edx, 0x59a6f0
call fcn.00407ecc
je 0x59a67b
lea edx, [ebp - 0x38]
mov eax, dword [0x5c3868]
mov eax, dword [eax + 0x4d0]
call fcn.004bcbd4
mov eax, dword [ebp - 0x38]
mov edx, 0x59a708
call fcn.00407ecc
je 0x59a67b
lea eax, [ebp - 0x3c]
mov ecx, edi
mov edx, 0x59a720
call fcn.00407cc8
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x5bd7d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x388]
call fcn.004bcc0c
mov eax, dword [0x5bd978]
mov eax, dword [eax]
call fcn.004ed510
cmp bl, 1
je 0x59a623
mov dword [ebp - 0x23], 2
mov word [ebp - 0x17], 0x490
lea eax, [ebp - 0x40]
mov ecx, 0x59a74c
mov edx, edi
call fcn.00407cc8
mov eax, dword [ebp - 0x40]
call fcn.00407880
mov dword [ebp - 0x1f], eax
mov eax, dword [ebp - 4]
call fcn.00407880
mov dword [ebp - 0x1b], eax
lea eax, [ebp - 0x27]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
test bl, bl
jne 0x59a623
cmp byte [ebp - 9], 0
je 0x59a623
mov edx, edi
mov eax, 0xa
call fcn.0059674c
dec esi
jne 0x59a54c
test bl, bl
jne 0x59a652
lea eax, [ebp - 0x44]
mov ecx, edi
mov edx, 0x59a75c
call fcn.00407cc8
mov edx, dword [ebp - 0x44]
mov eax, dword [0x5bd7d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x388]
call fcn.004bcc0c
cmp bl, 1
jne 0x59a67b
lea eax, [ebp - 0x48]
mov ecx, edi
mov edx, 0x59a720
call fcn.00407cc8
mov edx, dword [ebp - 0x48]
mov eax, dword [0x5bd7d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x388]
call fcn.004bcc0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a6c4
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.004077ec
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004077ec
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004077ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004077ec
ret
Function at 0x59aa18
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 4], ebx
mov word [ebp - 6], cx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59ab63
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
mov edx, ebx
call fcn.00407a5c
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00416430
mov eax, dword [ebp - 0x60]
call fcn.00407880
mov esi, eax
lea eax, [ebp - 0x6c]
mov edx, ebx
call fcn.00407a5c
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.00414b0c
mov eax, dword [ebp - 0x68]
push eax
lea edx, [ebp - 0x74]
mov eax, 0x59ab80
call fcn.00599858
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.00414b0c
mov edx, dword [ebp - 0x70]
pop eax
call fcn.00407ecc
jne 0x59aac3
lea edx, [ebp - 0x78]
mov eax, 0x59abc4
call fcn.00599858
mov eax, dword [ebp - 0x78]
call fcn.00407880
mov esi, eax
push 0x59abec
push ebx
push 0x59abf4
push edi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00407620
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00404c64
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x20], 1
movzx eax, word [ebp - 6]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push esi
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004075d0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x59ab40
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ab6a
lea eax, [ebp - 0x78]
mov edx, 7
call fcn.004077ec
lea eax, [ebp - 4]
call fcn.00407404
ret
Function at 0x59abfc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x59ad8a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x68]
mov edx, ebx
call fcn.00407a5c
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00416430
mov eax, dword [ebp - 0x64]
call fcn.00407880
mov esi, eax
lea eax, [ebp - 0x70]
mov edx, ebx
call fcn.00407a5c
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00414b0c
mov eax, dword [ebp - 0x6c]
push eax
lea edx, [ebp - 0x78]
mov eax, 0x59ada8
call fcn.00599858
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00414b0c
mov edx, dword [ebp - 0x74]
pop eax
call fcn.00407ecc
jne 0x59acaf
lea edx, [ebp - 0x7c]
mov eax, 0x59adec
call fcn.00599858
mov eax, dword [ebp - 0x7c]
call fcn.00407880
mov esi, eax
push 0x59ae14
push ebx
push 0x59ae1c
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00407620
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00404c64
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x24], 1
movzx eax, word [ebp - 0xa]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004075d0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x59ad67
jmp 0x59ad2a
mov eax, dword [0x5bd978]
mov eax, dword [eax]
call fcn.004ed510
push 0xc8
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x59ad1e
push edi
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [edi], 0x3e8
jne 0x59ad55
xor eax, eax
mov dword [edi], eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ad91
lea eax, [ebp - 0x7c]
mov edx, 7
call fcn.004077ec
lea eax, [ebp - 4]
call fcn.00407404
ret