joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ded90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c7c
mov eax, dword [ebp - 8]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x4deea2
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b028
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xc]
mov eax, 0x4deeb8
call fcn.0040bd2c
lea edx, [ebp - 0x20]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409954
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov ecx, 0x4deed0
call fcn.00404ad8
mov eax, dword [ebp - 0x10]
call fcn.004097a4
test al, al
jne 0x4dee26
mov eax, dword [ebp - 0x10]
call fcn.00409be4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x38]
mov ecx, 2
mov eax, 0x4deee0
call fcn.0040a2dc
push 0x4deefc
push dword [ebp - 0x14]
push 0x4def10
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404b4c
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404c8c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4deea9
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004047f0
ret
Function at 0x4e09c0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404c7c
lea eax, [ebp - 0x15c]
mov edx, dword [0x407e50]
call fcn.0040518c
xor eax, eax
push ebp
push 0x4e0b08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c8c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea ecx, [ebp - 0x15c]
mov edx, 0x10
mov eax, 0x4e0b20
call fcn.0040982c
jmp 0x4e0aba
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e660
mov eax, dword [ebp - 0x150]
mov edx, 0x4e0b2c
call fcn.00404bd8
je 0x4e0aba
mov eax, dword [ebp - 0x150]
mov edx, 0x4e0b38
call fcn.00404bd8
je 0x4e0aba
mov eax, dword [esi + 0x22c]
call fcn.00451f38
mov ebx, eax
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.004519d8
push dword [ebp - 4]
push 0x4e0b44
push dword [ebp - 0x150]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404b4c
mov edx, dword [ebp - 0x160]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4e0b50
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4e0b60
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x15c]
call fcn.0040987c
test eax, eax
je 0x4e0a2a
mov edx, esi
mov eax, edi
call fcn.004e4d28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0b0f
lea eax, [ebp - 0x160]
call fcn.004047cc
lea eax, [ebp - 0x15c]
mov edx, dword [0x407e50]
call fcn.0040525c
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4e2958
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4e2960
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e2b1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027bc
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004049c4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x4e2b34
call fcn.00404ad8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43da24]
call fcn.0043dad4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41828c]
call fcn.00403968
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e2af3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x4e2b48
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e2ad5
inc eax
mov dword [ebp - 0x14], eax
xor esi, esi
mov edx, dword [0x4d0b14]
mov eax, 8
call fcn.004056d0
mov ebx, eax
mov eax, ebx
mov edx, 0x4e2b48
call fcn.00404820
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 4]
call fcn.00404820
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
mov edx, ebx
call fcn.0041a594
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x22c]
call fcn.00451f38
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.004519d8
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4e2b48
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 8]
mov edx, 0x4e2b58
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00451b90
mov ecx, 2
mov edx, 2
mov eax, ebx
call fcn.00451b90
inc esi
dec dword [ebp - 0x14]
jne 0x4e2a02
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2afa
mov eax, dword [ebp - 0xc]
call fcn.00403998
mov eax, dword [ebp - 0x10]
call fcn.00403998
ret
Function at 0x4e2b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4e2b68
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e2d09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027bc
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004049c4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x4e2d20
call fcn.00404ad8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43da24]
call fcn.0043dad4
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41828c]
call fcn.00403968
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e2cdf
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x4e2d34
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e2cc1
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, dword [0x4d0b14]
mov eax, 8
call fcn.004056d0
mov esi, eax
mov eax, esi
mov edx, 0x4e2d34
call fcn.00404820
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 4]
call fcn.00404820
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
mov edx, esi
call fcn.0041a594
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov eax, dword [eax + 0x22c]
call fcn.00451f38
mov esi, eax
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.004519d8
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4e2d34
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 8]
mov edx, 0x4e2d40
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x14]
jne 0x4e2c0a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2ce6
mov eax, dword [ebp - 0xc]
call fcn.00403998
mov eax, dword [ebp - 0x10]
call fcn.00403998
ret
Function at 0x4e7cc0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e7f90
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43e9dc]
call fcn.0043eadc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e7ec3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0043eb7c
xor ecx, ecx
mov edx, 0x4e7fa4
mov eax, dword [ebp - 8]
call fcn.0043ebe4
test al, al
je 0x4e7db2
lea edx, [ebp - 0x158]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00409a1c
mov edx, dword [ebp - 0x154]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0043f160
lea edx, [ebp - 0x15c]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0xc]
call fcn.00404bd8
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 8]
call fcn.0043eb4c
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0043eb7c
xor ecx, ecx
mov edx, 0x4e7fdc
mov eax, dword [ebp - 8]
call fcn.0043ebe4
test al, al
je 0x4e7ea5
lea ecx, [ebp - 0xc]
mov edx, 0x4e7ffc
mov eax, dword [ebp - 8]
call fcn.0043f160
mov eax, dword [ebp - 0xc]
mov edx, 0x4e8014
call fcn.00404bd8
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0xc]
mov edx, 0x4e8020
mov eax, dword [ebp - 8]
call fcn.0043f160
mov eax, dword [ebp - 0xc]
mov edx, 0x4e8014
call fcn.00404bd8
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0xc]
mov edx, 0x4e8034
mov eax, dword [ebp - 8]
call fcn.0043f160
mov eax, dword [ebp - 0xc]
mov edx, 0x4e8014
call fcn.00404bd8
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0x10]
mov edx, 0x4e8048
mov eax, dword [ebp - 8]
call fcn.0043f160
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 0x10]
call fcn.00408d8c
cmp dword [ebp - 0x160], 0
jne 0x4e7ea5
lea eax, [ebp - 0x10]
mov edx, 0x4e8058
call fcn.00404864
mov eax, dword [ebp - 8]
call fcn.0043eb4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7eca
mov eax, dword [ebp - 8]
call fcn.00403998
ret
Function at 0x4ec1dc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x4ec26f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x300
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404c8c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebx + 0x2f8]
call fcn.0047b0b8
mov edx, dword [ebp - 0x164]
call fcn.0042f56c
mov eax, dword [ebp - 0x164]
push eax
call sub.user32.dll_DestroyIcon
mov eax, esi
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00404a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec276
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4ee0ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ee11c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push ebx
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00409dec
mov eax, dword [ebp - 0x104]
mov ecx, 3
xor edx, edx
call fcn.00404cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee123
lea eax, [ebp - 0x104]
call fcn.004047cc
ret

Function at 0x4ee128
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ee2ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41828c]
call fcn.00403968
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x43e9dc]
call fcn.0043eadc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ee27d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043eb7c
xor ecx, ecx
mov edx, 0x4ee2c4
mov eax, dword [ebp - 4]
call fcn.0043ebe4
test al, al
je 0x4ee1a9
lea ecx, [ebp - 8]
mov edx, 0x4ee2f8
mov eax, dword [ebp - 4]
call fcn.0043f160
mov eax, dword [ebp - 4]
call fcn.0043eb4c
xor ecx, ecx
mov edx, 0x4ee30c
mov eax, dword [ebp - 4]
call fcn.0043ebe4
test al, al
je 0x4ee25f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043f370
test al, al
je 0x4ee1df
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043ee80
jmp 0x4ee25f
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0043efd0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4ee25f
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0043f110
dec eax
sub al, 2
jae 0x4ee25b
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0043f160
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00404dd0
test eax, eax
jle 0x4ee25b
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0043ee80
inc ebx
dec esi
jne 0x4ee1fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee284
mov eax, dword [ebp - 4]
call fcn.00403998
mov eax, dword [ebp - 0x10]
call fcn.00403998
ret
Function at 0x4ee33c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4ee344
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4ee4b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43e9dc]
call fcn.0043eadc
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x41828c]
call fcn.00403968
mov esi, eax
xor eax, eax
push ebp
push 0x4ee48e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043eb7c
mov cl, 1
mov edx, 0x4ee4d0
mov eax, dword [ebp - 4]
call fcn.0043ebe4
test al, al
je 0x4ee478
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0043efd0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4ee478
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0043f110
dec eax
sub al, 2
jae 0x4ee46e
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043f160
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00408c7c
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x4ee508
call fcn.00408c7c
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00404dd0
test eax, eax
jg 0x4ee457
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00408c7c
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x4ee51c
call fcn.00408c7c
mov eax, dword [ebp - 0x24]
pop edx
call fcn.00404dd0
test eax, eax
jle 0x4ee46e
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0043ee80
inc ebx
dec dword [ebp - 0xc]
jne 0x4ee3cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee495
mov eax, dword [ebp - 4]
call fcn.00403998
ret
Function at 0x4f27f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4f2800
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x4f28dd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b028
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 4]
mov eax, 0x4f28f4
call fcn.0040bd2c
lea edx, [ebp - 0x14]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409954
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4f290c
call fcn.00404ad8
mov eax, dword [ebp - 8]
call fcn.004097a4
test al, al
jne 0x4f286f
mov eax, dword [ebp - 8]
call fcn.00409be4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x4f2920
call fcn.0040a2dc
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00404820
mov ecx, dword [ebx]
lea eax, [ebp - 0xc]
mov edx, 0x4f293c
call fcn.00404ad8
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404c8c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f28e4
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004047f0
ret
Function at 0x4f2948
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f2ab4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x300]
mov eax, dword [eax + 0x22c]
call fcn.00452094
lea edx, [ebp - 0x14c]
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048ee1c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409954
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
mov ecx, 0x4f2acc
call fcn.00404ad8
mov eax, dword [ebp - 4]
call fcn.00404c8c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [ebp - 0x144]
push eax
push 0x4f2ad8
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4f2a88
mov eax, dword [edi + 0x300]
mov eax, dword [eax + 0x22c]
call fcn.00451f38
mov ebx, eax
lea eax, [ebp - 0x140]
call fcn.004d174c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x150]
call fcn.0040bd18
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.004519d8
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404a3c
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00404ad8
mov edx, dword [ebp - 0x154]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4f29f8
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2abb
lea eax, [ebp - 0x158]
mov edx, 5
call fcn.004047f0
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4f31e8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x4f33d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0x10]
call fcn.00404c8c
push eax
mov eax, dword [ebp + 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4f339e
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
cmp dword [ebp - 0x18], 0
jne 0x4f329b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
call fcn.004f2d7c
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4f339e
inc ebx
xor esi, esi
mov eax, dword [0x532ec0]
cmp byte [eax], 1
je 0x4f339e
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0x10], 0
jne 0x4f3306
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4f33e8
call fcn.0040a2dc
jmp 0x4f334d
push dword [ebp + 0x10]
push 0x4f33f4
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4f33e8
call fcn.0040a2dc
push dword [ebp - 0x23c]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404b4c
mov edx, dword [ebp - 0x30]
mov eax, edi
call fcn.0046dddc
mov eax, dword [ebp - 0x30]
mov edx, 0x4f3400
call fcn.00404bd8
je 0x4f3383
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004f31e8
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e660
inc esi
dec ebx
jne 0x4f32aa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f33d7
lea eax, [ebp - 0x23c]
call fcn.004047cc
lea eax, [ebp - 0x30]
call fcn.004047cc
lea eax, [ebp + 0x10]
call fcn.004047cc
ret