joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fe18
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x42ff20
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004030e4
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
mov eax, 0x42ff30
mov dword [ebp - 0x44], eax
push 0x42ff44
push dword [ebp - 4]
push 0x42ff64
push dword [ebp - 8]
lea eax, [ebp - 0x60]
mov edx, 4
call fcn.00404758
mov eax, dword [ebp - 0x60]
call fcn.0043f944
cmp dword [ebp - 8], 0
jne 0x42feac
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404454
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x42fee0
mov ebx, dword [ebp - 0x54]
jmp 0x42fef8
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov edx, 0x42ff7c
call fcn.004046e4
mov eax, dword [ebp - 0x64]
call fcn.0043f944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ff27
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret

Function at 0x42ffa0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43003e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f38
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x430058
mov edx, ebx
call fcn.004046e4
mov eax, dword [ebp - 0x24]
call fcn.00404898
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x430058
mov edx, esi
call fcn.004046e4
mov eax, dword [ebp - 0x28]
call fcn.00404898
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430045
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004043e0
ret

Function at 0x430ed8
Capabilities:
Log keystrokes

Disassembly:
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
ret
Function at 0x431264
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43132f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0044a474
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, 0x431344
call fcn.004046e4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00445db4
test al, al
jne 0x431314
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4312f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4312fc
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431336
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004043e0
ret

Function at 0x431464
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43151c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x431530
call fcn.004460e4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00445db4
test al, al
jne 0x4314ee
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4314e7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4314ee
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c860
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431523
lea eax, [ebp - 0xc]
call fcn.004043bc
ret
Function at 0x431bb8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x431cd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004043bc
mov eax, dword [ebp - 4]
call fcn.004458cc
test al, al
je 0x431cbd
mov al, 2
call fcn.00433cb4
mov ebx, 0x46
mov esi, 0x9d
mov edi, 0x8c
push 1
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00431574
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.00417f98
lea eax, [ebp - 0x24]
push eax
push 0
push 0x458d08
mov ecx, 0x4315cc
xor edx, edx
xor eax, eax
call fcn.00404370
mov ebx, eax
mov edx, 0xbb8
mov eax, ebx
call fcn.00445190
xor edx, edx
push ebp
push 0x431cb6
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 1
jae 0x431c98
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x431c7e
cmp eax, 0
jbe 0x431ca0
jmp 0x431c80
jle 0x431ca0
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 8]
call fcn.004044ac
jmp 0x431ca0
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431cbd
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431cda
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x432cb8
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, dword [0x458cfc]
push eax
call sub.kernel32.dll_TerminateThread
mov dl, 1
mov eax, 0x432ce4
call fcn.004482cc
mov byte [0x458cf8], 0
ret

Function at 0x433a0c
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, dword [0x458d00]
push eax
call sub.kernel32.dll_TerminateThread
push 0
mov eax, dword [0x458d04]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x458cf9], 0
mov byte [0x458d28], 1
ret

Function at 0x433ae0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433c0f
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040c84c
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x148]
mov ecx, 0x433c28
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x148]
call fcn.00404898
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x433be9
test byte [ebp - 0x144], 0x10
je 0x433bc7
cmp byte [ebp - 0x118], 0x2e
je 0x433bc8
mov edx, 0x433c2c
lea eax, [ebp - 0x118]
call fcn.00408cbc
test eax, eax
je 0x433bc8
mov edx, 0x433c30
lea eax, [ebp - 0x118]
call fcn.00408cbc
test eax, eax
je 0x433bc8
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.0040462c
mov ecx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x14c]
call fcn.00433ae0
add esi, eax
jmp 0x433bc8
inc esi
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x433b54
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433c16
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.004043e0
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x433e34
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x433f7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004043bc
cmp dword [ebp - 4], 0
jne 0x433e76
push 0
call sub.user32.dll_GetDC
mov ebx, eax
jmp 0x433e8c
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.gdi32.dll_CreateDCA
mov ebx, eax
test ebx, ebx
jne 0x433e9f
mov eax, 0x433f98
call fcn.0043f944
jmp 0x433f69
push 8
push ebx
call sub.gdi32.dll_GetDeviceCaps
push 0xa
push ebx
call sub.gdi32.dll_GetDeviceCaps
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov dl, 1
mov eax, dword [0x426324]
call fcn.00429954
mov ebx, eax
xor ecx, ecx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.0043118c
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, esi
call fcn.00431574
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [0x458d2e], 0
jne 0x433ef0
mov byte [0x458d2d], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x45765c]
push eax
mov ecx, 0x431614
xor edx, edx
xor eax, eax
call fcn.00404370
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.00445190
mov byte [0x458d2d], 0
sub eax, 1
jae 0x433f52
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.004044ac
jmp 0x433f5a
push 0
push esi
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433f86
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x434898
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x458d30]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [0x458d2c], 0
push 0
mov eax, dword [0x458d38]
push eax
call sub.kernel32.dll_TerminateThread
ret
Function at 0x4348f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x434afe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004043bc
push 0
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x3c
call fcn.00431574
xor edx, edx
push ebp
push 0x434adc
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x457860]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x434abe
inc esi
xor ebx, ebx
mov dl, 1
mov eax, dword [0x426324]
call fcn.00429954
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x28]
mov eax, dword [0x457860]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.00408434
mov edx, dword [ebp - 8]
call fcn.00430a1c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0x29a
jl 0x434aae
lea ecx, [ebp - 0x2c]
mov eax, dword [0x457860]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.00408434
mov edx, dword [0x45757c]
mov dword [edx], eax
mov eax, dword [0x45757c]
mov eax, dword [eax]
call fcn.00430a88
test al, al
je 0x4349d8
mov eax, dword [0x45757c]
mov eax, dword [eax]
call fcn.00430a7c
push 6
movzx eax, word [0x458d50]
push eax
movzx eax, word [0x458d4e]
push eax
push 0
push 0
push 0
mov eax, dword [0x45757c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [0x45757c]
mov eax, dword [eax]
call fcn.004305d4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x434a2d
cmp eax, 0x2710
jbe 0x434abe
jmp 0x434a33
jle 0x434abe
mov eax, 1
call fcn.00444ca4
mov eax, dword [0x457520]
cmp byte [eax], 0
jne 0x434a33
mov eax, dword [0x45763c]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x457658]
push eax
mov ecx, 0x4315f0
xor edx, edx
xor eax, eax
call fcn.00404370
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.00445190
mov edx, dword [0x45763c]
mov byte [edx], 0
sub eax, 1
jae 0x434a9d
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, dword [ebp - 4]
call fcn.004044ac
jmp 0x434abe
push 0
push esi
call sub.kernel32.dll_TerminateThread
push 0
call sub.kernel32.dll_ExitThread_1
mov eax, dword [ebp - 8]
call fcn.00403698
inc ebx
dec esi
jne 0x434958
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434ae3
mov eax, dword [ebp - 8]
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
Function at 0x435f34
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x436120
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x457890]
mov eax, dword [eax]
call fcn.004458cc
test al, al
je 0x435f78
mov eax, dword [0x457890]
mov eax, dword [eax]
call fcn.004462a0
lea eax, [ebp - 0xc]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004048f8
mov eax, dword [ebp - 0xc]
mov edx, 0x436134
call fcn.004047e4
je 0x435fac
mov eax, 0x436140
call fcn.0043fa44
jmp 0x436105
test bl, bl
je 0x435fc8
mov eax, dword [0x457668]
mov eax, dword [eax]
call fcn.00447fec
mov eax, dword [0x4576f8]
mov eax, dword [eax]
call fcn.00447fec
lea ecx, [ebp - 0x10]
mov eax, dword [0x4574e8]
mov eax, dword [eax]
mov edx, 0x436168
call fcn.00416e34
mov eax, dword [ebp - 0x10]
call fcn.0043c964
test al, al
je 0x4360dd
lea ecx, [ebp - 0x14]
mov eax, dword [0x4574e8]
mov eax, dword [eax]
mov edx, 0x436174
call fcn.00416e34
mov eax, dword [ebp - 0x14]
call fcn.0043c964
test al, al
je 0x4360bd
lea eax, [ebp - 8]
call fcn.00444e04
call fcn.00435dc0
test al, al
jne 0x436083
lea eax, [ebp - 0x18]
call fcn.0044a5e0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 6
call fcn.00449e4c
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.004046a0
mov eax, dword [ebp - 0x18]
call fcn.00404898
push eax
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
call sub.kernel32.dll_MoveFileA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004459bc
test bl, bl
je 0x436105
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00445ba4
call fcn.00444dac
jmp 0x436105
mov ecx, dword [0x457534]
mov ecx, dword [ecx]
mov edx, dword [0x457720]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004046e4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004459bc
test bl, bl
je 0x436105
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00445ba4
call fcn.00444dac
jmp 0x436105
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004048f0
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004424e0
call fcn.00444dac
jmp 0x436105
mov eax, 0x436180
call fcn.0043fa44
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004048f0
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004424e0
call fcn.00444dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436127
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004043e0
ret
Function at 0x4362a4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4362ac
push ecx
push ebx
xor eax, eax
push ebp
push 0x436419
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x457534]
mov ecx, dword [ecx]
mov edx, dword [0x457720]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004046e4
mov eax, dword [ebp - 8]
call fcn.004458cc
test al, al
je 0x4363fe
push 0x436430
mov eax, dword [0x457720]
push dword [eax]
mov eax, dword [0x45764c]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404758
mov eax, dword [ebp - 0xc]
call fcn.0043fa44
lea edx, [ebp - 0x10]
mov eax, 0x43644c
call fcn.00444d60
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.0044a538
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
pop ecx
call fcn.004046e4
lea edx, [ebp - 0x18]
mov eax, 4
call fcn.00449e4c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004459bc
push 0
mov eax, dword [0x457554]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_TerminateThread
call fcn.0043620c
push 0
push 0
mov ecx, dword [0x45764c]
mov ecx, dword [ecx]
mov edx, dword [0x457720]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
call fcn.004046e4
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [0x457534]
mov ecx, dword [ecx]
mov edx, dword [0x457720]
mov edx, dword [edx]
lea eax, [ebp - 0x20]
call fcn.004046e4
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x457720]
mov ecx, dword [ecx]
pop edx
call fcn.00448974
test eax, eax
jbe 0x4363fe
xor ebx, ebx
inc ebx
cmp ebx, 0x1e
jne 0x4363e3
push 0x43645c
mov eax, dword [0x457720]
push dword [eax]
mov eax, dword [0x45764c]
push dword [eax]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404758
mov eax, dword [ebp - 0x24]
call fcn.0043fa44
jmp 0x4363fe
mov eax, 0x64
call fcn.00444ca4
mov eax, dword [ebp - 4]
call fcn.004458cc
test al, al
jne 0x4363b3
call fcn.00444dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436420
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.004043e0
ret
Function at 0x4398fc
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x439904
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x439b5e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0044a474
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x439b74
call fcn.004046e4
mov eax, dword [ebp - 4]
call fcn.00445db4
test al, al
je 0x4399d4
mov dl, 1
mov eax, 0x439b88
call fcn.004482cc
mov eax, 0x9c4
call fcn.00444ca4
push 0x439b9c
push dword [ebp - 4]
push 0x439bb0
lea edx, [ebp - 0x14]
mov eax, 6
call fcn.00449e4c
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404758
mov edx, dword [ebp - 0x10]
mov eax, 0x439bd4
call fcn.00445c30
lea eax, [ebp - 0x18]
mov ecx, 0x439be4
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x18]
call fcn.00445db4
test al, al
je 0x4399d4
push 0x439bf4
push dword [ebp - 4]
push 0x439c10
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404758
mov edx, dword [ebp - 0x1c]
mov eax, 0x439bd4
call fcn.00445c30
lea eax, [ebp - 0x20]
call fcn.0044a3ac
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 0x439c24
call fcn.004046e4
mov eax, dword [ebp - 4]
call fcn.00445db4
test al, al
je 0x439a90
lea eax, [ebp - 4]
call fcn.0044a3ac
mov dl, 1
mov eax, 0x439c34
call fcn.004482cc
mov eax, 0x9c4
call fcn.00444ca4
push 0x439b9c
push dword [ebp - 4]
push 0x439c48
lea edx, [ebp - 0x28]
mov eax, 6
call fcn.00449e4c
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404758
mov edx, dword [ebp - 0x24]
mov eax, 0x439bd4
call fcn.00445c30
lea eax, [ebp - 4]
call fcn.0044a474
push 0x439b9c
push dword [ebp - 4]
push 0x439c48
lea edx, [ebp - 0x30]
mov eax, 6
call fcn.00449e4c
push dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00404758
mov edx, dword [ebp - 0x2c]
mov eax, 0x439bd4
call fcn.00445c30
mov dl, 1
mov eax, dword [0x4155c4]
call fcn.00403668
mov ebx, eax
lea eax, [ebp - 0x34]
call fcn.0044a474
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
mov ecx, 0x439c68
call fcn.004046e4
mov eax, dword [ebp - 4]
call fcn.00445db4
test al, al
je 0x439b3b
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x439c80
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00449370
mov dl, 1
mov eax, 0x439c90
call fcn.004482cc
mov eax, 0x64
call fcn.00444ca4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x439b34
inc eax
mov dword [ebp - 8], eax
xor esi, esi
lea ecx, [ebp - 0x3c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x3c]
mov eax, 0x439c80
call fcn.00404980
test eax, eax
jle 0x439b2e
lea ecx, [ebp - 0x40]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x40]
call fcn.004462a0
inc esi
dec dword [ebp - 8]
jne 0x439afd
mov eax, ebx
call fcn.00403698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439b65
lea eax, [ebp - 0x40]
mov edx, 0xe
call fcn.004043e0
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x43a11c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x43a2ff
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x43a15a
lea eax, [ebp - 4]
mov edx, 0x43a31c
call fcn.00404454
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x43a268
xor edi, edi
inc edi
cmp edi, 0xd
je 0x43a268
lea eax, [ebp - 0xb0]
mov edx, 0x48
call fcn.004256c8
call fcn.0043a0a8
mov ecx, eax
xor edx, edx
mov eax, 0x2000000
call fcn.00445030
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov esi, eax
mov dword [ebp - 0x6c], esi
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push esi
call sub.kernel32.dll_InitializeProcThreadAttributeList
push 0
push 0
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.00425740
push eax
push 0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_UpdateProcThreadAttribute
mov dword [ebp - 0xb0], 0x48
mov word [ebp - 0x80], 0
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA_1
test eax, eax
je 0x43a168
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc0]
call fcn.0042cfb4
mov ebx, eax
test bl, bl
je 0x43a2e9
cmp byte [ebp - 9], 0
je 0x43a258
call fcn.00444dac
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xb8]
mov dword [eax], edx
jmp 0x43a2e9
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.004256c8
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.004256c8
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x43a2e9
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x68]
call fcn.0042cfb4
mov ebx, eax
test bl, bl
je 0x43a2e9
cmp byte [ebp - 9], 0
je 0x43a2e1
call fcn.00444dac
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a306
lea eax, [ebp - 4]
call fcn.004043bc
ret