joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403180
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x412018]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
mov ebp, dword [esp + 0x28]
push esi
xor esi, esi
mov word [ebx], si
mov eax, dword [ebp]
cmp eax, 0xffffffff
push edi
mov byte [esp + 0x14], 0
je 0x4031c7
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x24], esi
call edi
cmp dword [esp + 0x10], esi
jg 0x4031dd
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040b007
add esp, 0x20
ret 4
mov al, byte [esp + 0x14]
cmp al, 0x7f
jbe 0x403276
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x14]
push eax
push esi
mov byte [esp + 0x19], 0
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov esi, eax
test esi, esi
je 0x40323d
mov ebp, dword [ebp]
cmp ebp, 0xffffffff
mov byte [esp + 0xf], 0
je 0x4031c7
push 0
lea ecx, [esp + 0x20]
push ecx
push 1
lea edx, [esp + 0x1b]
push edx
push ebp
mov dword [esp + 0x30], 0
call edi
cmp dword [esp + 0x1c], 0
jle 0x4031c7
mov al, byte [esp + 0xf]
mov byte [esp + 0x11], al
xor edx, edx
test esi, esi
setne dl
push 1
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x18]
add edx, 1
push edx
push eax
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
movzx eax, word [esp + 0x18]
je 0x40333b
mov eax, 0x3f
jmp 0x40333b
cmp al, 0xd
jne 0x4032cf
mov word [ebx], 0xd
cmp byte [ebp + 0xd], 0
je 0x40333e
lea ecx, [esp + 0xf]
push ecx
mov edx, 1
mov eax, ebp
mov byte [esp + 0x13], 0
call fcn.00402ed0
test eax, eax
jle 0x40333e
cmp byte [esp + 0xf], 0xa
je 0x4032c8
mov ebp, dword [ebp]
cmp ebp, 0xffffffff
je 0x40333e
push 1
push esi
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40333e
mov word [ebx], 0xa
jmp 0x40333e
cmp al, 0x5c
jne 0x403337
cmp byte [ebp + 0xc], 0
je 0x403337
xor eax, eax
lea edx, [esp + 0x21]
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
push edx
mov edx, 6
mov eax, ebp
mov byte [esp + 0x24], 0x5c
call fcn.00402ed0
lea esi, [esp + 0x20]
mov edi, eax
call fcn.00409da0
test al, al
je 0x403316
mov edi, ebx
call fcn.00409e10
jmp 0x40333e
test edi, edi
jle 0x403330
mov ebp, dword [ebp]
cmp ebp, 0xffffffff
je 0x403330
push 1
push 0
neg edi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [ebx], 0x5c
jmp 0x40333e
movzx ax, al
mov word [ebx], ax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.0040b007
add esp, 0x20
ret 4
Function at 0x403360
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [edi]
cmp eax, 0xffffffff
push ebp
mov byte [esp + 7], 0
je 0x403396
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 1
lea edx, [esp + 0x13]
push edx
push eax
mov dword [esp + 0x20], 0
call ebp
cmp dword [esp + 0xc], 0
jg 0x40339f
xor al, al
pop ebp
add esp, 0xc
ret 4
mov cl, byte [esp + 7]
cmp cl, 0x7f
ja 0x4033bc
movzx ax, cl
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
mov al, 1
pop ebp
add esp, 0xc
ret 4
mov dl, cl
and dl, 0xe0
cmp dl, 0xc0
push esi
jne 0x4033ce
mov esi, 2
jmp 0x4033ec
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x4033dd
mov esi, 3
jmp 0x4033ec
mov dl, cl
and dl, 0xf8
cmp dl, 0xf0
jne 0x403458
mov esi, 4
xor eax, eax
mov word [esp + 0xd], ax
mov byte [esp + 0xf], al
mov eax, dword [edi]
cmp eax, 0xffffffff
mov byte [esp + 0xc], cl
jne 0x403406
or eax, eax
jmp 0x403425
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esi - 1]
push edx
lea ecx, [esp + 0x19]
push ecx
push eax
mov dword [esp + 0x24], 0
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esi - 1]
cmp eax, edx
jl 0x403458
mov eax, dword [esp + 0x18]
push 1
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub eax, 1
neg eax
sbb eax, eax
pop esi
add eax, 1
pop ebp
add esp, 0xc
ret 4
pop esi
xor al, al
pop ebp
add esp, 0xc
ret 4

Function at 0x403470
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
xor ecx, ecx
mov word [edi], cx
mov eax, dword [esi]
cmp eax, 0xffffffff
mov dword [esp], ecx
je 0x4034a1
push ecx
mov dword [esp + 8], ecx
lea ecx, [esp + 8]
push ecx
push 2
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 4], 2
jge 0x4034a7
xor al, al
add esp, 8
ret
cmp dword [esi + 8], 4
jne 0x4034c1
mov ax, word [esp]
rol ax, 8
movzx eax, ax
mov word [edi], ax
mov al, 1
add esp, 8
ret
mov eax, dword [esp]
mov word [edi], ax
mov al, 1
add esp, 8
ret

Function at 0x4034f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov edx, dword [esi + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push eax
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push str.SubFolderSearch
push edx
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x40354a
cmp dword [esp + 8], 4
jne 0x40354a
mov edx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push str.SubFolderSearch
push edx
call edi
test eax, eax
je 0x40354a
xor eax, eax
pop edi
add esp, 0xc
ret
mov eax, dword [esp + 4]
pop edi
add esp, 0xc
ret
Function at 0x403750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40bbfd
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x412018]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea ebx, [esi + 8]
mov ecx, ebx
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea ebp, [esi + 0xc]
mov ecx, ebp
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov eax, dword [esp + 0x28]
push eax
mov ecx, esi
mov byte [esp + 0x20], 3
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, edi
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
mov edx, dword [esp + 0x30]
push edx
mov ecx, ebx
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
mov eax, dword [esp + 0x34]
push eax
mov ecx, ebp
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14

Function at 0x404b40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x844
mov eax, dword [0x412018]
xor eax, esp
mov dword [esp + 0x840], eax
push esi
push 2
push 0xffffffffffffffff
mov esi, ecx
mov eax, dword [esi + 0x388]
push 0x100c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x404bdc
push eax
lea ecx, [esi + 0x368]
call sub.MFC80U.DLL_Ordinal_2860
mov ecx, eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
lea edx, [esp + 0x40]
call fcn.004029b0
mov ecx, dword [esi + 0x20]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 4]
lea edx, [esp + 0x40]
push eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0x40df40
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x844]
pop esi
xor ecx, esp
call fcn.0040b007
mov esp, ebp
pop ebp
ret
Function at 0x409180
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x40c3f8
mov eax, dword fs:[0]
push eax
mov eax, 0x1264
call fcn.0040b760
mov eax, dword [0x412018]
xor eax, esp
mov dword [esp + 0x1260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x412018]
xor eax, esp
push eax
lea eax, [esp + 0x1278]
mov dword fs:[0], eax
mov esi, dword [esp + 0x128c]
mov edi, dword [esp + 0x1288]
mov ebp, dword [esp + 0x1294]
mov eax, esi
mov ecx, edi
lea edx, [esp + 0x824]
mov dword [esp + 0x1c], esi
call fcn.004029b0
lea eax, [esp + 0x1024]
push eax
lea ecx, [esp + 0x828]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4092a5
lea esp, [esp]
cmp word [esp + 0x1050], 0x2e
je 0x409287
lea eax, [esp + 0x1050]
mov ecx, edi
lea edx, [esp + 0x24]
call fcn.004029b0
lea esi, [esp + 0x18]
lea eax, [esp + 0x24]
call fcn.00402e50
mov edx, esi
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1284], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov byte [esp + 0x1280], 1
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, ebp
call sub.MFC80U.DLL_Ordinal_5711
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, esi
mov dword [esp + 0x1280], 0xffffffff
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x1024]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409210
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [esp + 0x1290], 0
je 0x409338
mov eax, 0x40e1c0
mov ecx, edi
lea edx, [esp + 0x24]
call fcn.004029b0
lea ecx, [esp + 0x1024]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409338
lea ecx, [ecx]
test byte [esp + 0x1024], 0x10
je 0x40931e
cmp word [esp + 0x1050], 0x2e
je 0x40931e
lea eax, [esp + 0x1050]
mov ecx, edi
lea edx, [esp + 0x824]
call fcn.004029b0
push ebp
push 1
lea eax, [esp + 0x82c]
push esi
push eax
call fcn.00409180
add esp, 0x10
lea ecx, [esp + 0x1024]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4092e0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1260]
xor ecx, esp
call fcn.0040b007
add esp, 0x1270
ret
Function at 0x40a6de
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a736
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x40df56
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a729
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40a738
xor eax, eax
pop esi
leave
ret 4

Function at 0x40b007
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x40b011
repz ret
jmp fcn.0040b4b8
Function at 0x4014d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x55f3d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
mov dword [ebp - 0x10c], esi
call fcn.004d84c0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x108]
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401545
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
mov ecx, esi
call fcn.00402e70
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d635c
mov esp, ebp
pop ebp
ret
Function at 0x401db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50321d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x55f3d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], 0
push edx
push dword [ebp + 0x1c]
mov dword [ebp - 0x2c], 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e5d
push eax
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], eax
call fcn.00402350
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp + 0x18]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov dword [esi + 0x10], 0
cmovae edx, dword [ebp - 0x28]
mov ecx, edx
mov dword [esi + 0x14], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e92
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00402e70
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x401ed4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401eca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ef1
push ecx
push edx
call fcn.004d634e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d635c
mov esp, ebp
pop ebp
ret
call fcn.004dc07f
int3

Function at 0x401f00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401f4e
mov eax, dword [ebp + 0x14]
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x401f31
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x401fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401fe5
xor al, al
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret
Function at 0x406230
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50354d
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x55f3d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x406418
cmp byte [esi], 0
je 0x406418
push 0x5c
push esi
call fcn.004d8800
mov edi, eax
add esp, 8
test edi, edi
je 0x406418
mov ecx, esi
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4062a0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404190
sub edi, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
lea eax, [edi + 1]
push eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00402250
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x406303
mov ecx, eax
call fcn.004033e0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0x78]
call fcn.004033e0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
je 0x406407
cmp eax, 5
je 0x406407
push esi
lea ecx, [ebp - 0x58]
call fcn.004024d0
push 0xffffffffffffffff
push dword [ebp - 0x60]
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x58]
call fcn.00402250
push eax
lea ecx, [ebp - 0x58]
call fcn.00402450
lea ecx, [ebp - 0x78]
call fcn.004033e0
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x50bb78
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.00404190
mov ecx, dword [ebp - 0x30]
or eax, 0xffffffff
xor esi, esi
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4063e3
mov edx, dword [ebp - 0x48]
cmp ecx, esi
jbe 0x406437
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
lea edi, [ebp - 0x58]
cmovae eax, dword [ebp - 0x40]
cmp dword [ebp - 0x44], 0x10
cmovae edi, dword [ebp - 0x58]
mov al, byte [eax + esi]
test edx, edx
je 0x4063d8
push edx
movsx eax, al
push eax
push edi
call fcn.004d8930
add esp, 0xc
test eax, eax
je 0x4063d5
sub eax, edi
jns 0x4063e3
mov ecx, dword [ebp - 0x30]
jmp 0x4063db
mov ecx, dword [ebp - 0x30]
or eax, 0xffffffff
mov edx, dword [ebp - 0x48]
inc esi
cmp esi, ecx
jb 0x406395
cmp eax, 0xffffffff
lea ecx, [ebp - 0x40]
sete byte [ebp - 0x59]
call fcn.004033e0
lea ecx, [ebp - 0x58]
call fcn.004033e0
lea ecx, [ebp - 0x28]
call fcn.004033e0
mov al, byte [ebp - 0x59]
jmp 0x40641a
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x59], 0
call fcn.004033e0
mov al, byte [ebp - 0x59]
jmp 0x40641a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d635c
mov esp, ebp
pop ebp
ret 4
call fcn.00402800
int3
Function at 0x406440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50358d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x55f3d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
mov ecx, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406490
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404190
mov ecx, edi
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4064b0
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.004023c0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0x3c
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x60], 0x440
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x406530
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x406560
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406556
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40657d
push ecx
push edx
call fcn.004d634e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d635c
mov esp, ebp
pop ebp
ret 0xc
call fcn.004dc07f
int3
Function at 0x406750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50360d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x55f3d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004d631e
mov edi, eax
add esp, 4
test edi, edi
je 0x4067f4
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00426440
add esp, 4
mov dword [edi + 4], eax
jmp 0x4067f6
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.00404270
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x10]
mov bl, al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x406850
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x406850
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x40686c
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40688f
cmp byte [ebp + 0xc], 0
je 0x40687b
push esi
call fcn.004268d5
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40689b
mov esi, str.ios_base::badbit_set
jmp 0x4068ab
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004053e0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.004047b0
push 0x536af0
lea eax, [ebp - 0x28]
push eax
call fcn.004d7b11
int3
Function at 0x408600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503833
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x55f3d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea edx, [esi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], 0
mov dword [esi + 0x68], eax
test byte [edi + 8], 8
mov byte [ebp - 4], 2
je 0x4086ff
test cl, 0x10
jne 0x4086ff
mov al, 1
jmp 0x408701
xor al, al
mov byte [esi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov edi, dword [edi + 0x18]
sar ecx, 3
cmp edi, ecx
jae 0x408725
lea ecx, [edi*8]
mov dword [edx + 4], ecx
jmp 0x40875f
jbe 0x40875f
mov eax, dword [edx + 8]
sar eax, 3
cmp edi, eax
jbe 0x40873f
lea eax, [ebp - 0xd]
mov ecx, edx
push eax
push edi
call fcn.00407fa0
jmp 0x40875f
sub edi, ecx
je 0x40875c
lea eax, [edi*8]
push eax
push 0
push ebx
call fcn.004d84c0
add esp, 0xc
lea ebx, [ebx + edi*8]
lea edx, [esi + 0x40]
mov dword [edx + 4], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c