joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af3ec
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4af55b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004046c8
call fcn.004afbac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4af52c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4f428c], 0
je 0x4af46c
mov edx, 0x80000003
mov eax, dword [ebp - 0xc]
call fcn.004335e8
lea eax, [ebp - 0x14]
call fcn.004af228
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
xor eax, eax
call fcn.004afa70
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4af570
call fcn.004049d4
jmp 0x4af486
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.004335e8
lea eax, [ebp - 8]
mov edx, 0x4af570
call fcn.00404760
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0043364c
test al, al
je 0x4af4bb
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00433928
test al, al
je 0x4af4b3
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0043380c
mov eax, dword [ebp - 0xc]
call fcn.004335b8
cmp dword [ebx], 0
je 0x4af4c7
call fcn.004040c8
jmp 0x4af533
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004335e8
lea eax, [ebp - 8]
mov edx, 0x4af570
call fcn.00404760
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0043364c
test al, al
je 0x4af516
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00433928
test al, al
je 0x4af50e
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0043380c
mov eax, dword [ebp - 0xc]
call fcn.004335b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af533
mov eax, dword [ebp - 0xc]
call fcn.0040387c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af562
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004046ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046ec
ret
Function at 0x4af6a8
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4af6ec
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4af6ec
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4af797
lea eax, [esp + 8]
push eax
push 0
push 0
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [esp + 8]
call fcn.00402ae0
mov esi, eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x4af790
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4ef248
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4af786
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4af782
mov byte [esp], 1
jmp 0x4af786
inc edi
dec ebx
jne 0x4af769
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402b10
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4afa70
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
mov eax, dword [ebp - 8]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4afb9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
call fcn.00408bb8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
call fcn.00408bb8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b88
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00404b88
mov ebx, eax
push ebx
call sub.advapi32.dll_LookupAccountNameA
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.00402b30
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.00402b30
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
push ebx
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x4afb55
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004af954
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetSidSubAuthorityCount
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetLengthSid
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.00409e80
jmp 0x4afb6a
call sub.kernel32.dll_GetLastError
test eax, eax
jns 0x4afb63
call fcn.004037b8
mov edx, edi
call fcn.004ad4e0
mov eax, dword [ebp - 0x10]
call fcn.00402b10
mov eax, dword [ebp - 0xc]
call fcn.00402b10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afba4
lea eax, [ebp - 0x20]
call fcn.004046c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046ec
ret
Function at 0x4afbd0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1dc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4afcbb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.004046c8
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4afca2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x4afc71
push dword [esi]
cmp ebx, 0xff
jbe 0x4afc45
call fcn.004037b8
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1dc]
call fcn.004048c0
push dword [ebp - 0x1dc]
push 0x4afcd4
mov eax, esi
mov edx, 3
call fcn.00404a48
inc ebx
cmp ebx, 0xff
jbe 0x4afc7e
call fcn.004037b8
mov eax, dword [ebp - 8]
mov edi, dword [eax + ebx*4]
test edi, edi
jne 0x4afc36
mov eax, dword [esi]
call fcn.00404988
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00404c28
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afcc2
lea eax, [ebp - 0x1dc]
call fcn.004046c8
ret
Function at 0x4b1d44
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1e7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00404d14
push 0x104
lea eax, [ebp - 8]
call fcn.00404be0
push eax
push 0x4b1e90
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404d14
mov eax, dword [ebp - 8]
call fcn.00404988
test eax, eax
jle 0x4b1e5e
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004031d4
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x4b1ea0
push ebx
push 0x4b1eb0
push esi
lea eax, [ebp - 0x60]
mov edx, 5
call fcn.00404a48
mov eax, dword [ebp - 0x60]
call fcn.00404b88
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4b1e5e
xor eax, eax
push ebp
push 0x4b1e57
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1e5e
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1e83
lea eax, [ebp - 0x60]
call fcn.004046c8
lea eax, [ebp - 8]
call fcn.004046c8
ret

Function at 0x4b1eb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b88
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4b1ed1
and eax, 0x10
cmp eax, 0x10
je 0x4b1ed5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4b2578
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4b258c
add esp, 0xfffffff0
call fcn.00403bb4
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004b0894
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x24
call fcn.004031d4
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0xa8], eax
mov eax, esi
test bl, bl
je 0x4b25cf
call fcn.00403c0c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c9f14
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c9f7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004046c8
test ebx, ebx
je 0x4c9f71
test esi, esi
je 0x4c9f71
test edi, edi
je 0x4c9f71
push edi
push 0xff
lea eax, [ebp - 0xff]
push eax
push 0
push esi
push ebx
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xff]
mov ecx, 0xff
call fcn.00404938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9f86
ret

Function at 0x4ca1e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ca331
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004046c8
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.00404b88
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ca310
mov eax, dword [ebp - 4]
call fcn.00402ae0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ca309
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ca2f3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4ca340
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x10], 0
je 0x4ca29f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00407824
mov edx, dword [ebp - 0x10]
mov dx, word [edx]
call fcn.00407818
lea ecx, [ebp - 0x14]
mov edx, 8
call fcn.004093fc
push 0x4ca364
push dword [ebp - 0x14]
push 0x4ca380
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00404a48
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.00409d10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ca2f3
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00409e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca310
mov eax, dword [ebp - 0xc]
call fcn.00402b10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca338
lea eax, [ebp - 0x118]
call fcn.004046c8
lea eax, [ebp - 0x14]
call fcn.004046c8
ret
Function at 0x4ca3d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004046c8
push 0xff
lea eax, [esp + 4]
push eax
push esi
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4ca405
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00404938
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4ca498
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4ca4ae
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_TerminateProcess
ret

Function at 0x4ca604
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409e80
add esp, 0x18
pop ebx
ret

Function at 0x4ca62c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x14]
push eax
push 0x4ca6c0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4ca685
mov dword [ebp - 0xc], 2
mov dword [ebp - 0x18], 1
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp byte [ebp + 8], 1
cmc
sbb eax, eax
push eax
cmp byte [ebp + 0xc], 1
cmc
sbb eax, eax
push eax
movzx eax, di
push eax
mov eax, esi
call fcn.00404b88
push eax
mov eax, ebx
call fcn.00404b88
push eax
call sub.advapi32.dll_InitiateSystemShutdownA
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ca728
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4ca741
mov eax, dword [0x4f29f0]
mov eax, dword [eax]
call fcn.00462f94
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp esi, eax
ja 0x4ca735
pop esi
pop ebx
ret

Function at 0x4cadec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004046c8
push 0xff
lea eax, [esp + 4]
push eax
push esi
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4cae21
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00404938
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4caf4c
Capabilities:
Create thread

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
lea eax, [esp + 4]
push eax
push 0
mov eax, dword [esp + 8]
push eax
push 0x4caecc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop ecx
pop edx
ret
Function at 0x4caf70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4cb0d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004046c8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b88
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4cb0a9
mov eax, dword [ebp - 8]
call fcn.00402ae0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cb0a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4cb08c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4cb0e0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x14], 0
je 0x4cb038
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00407824
mov edx, dword [ebp - 0x14]
mov dx, word [edx]
call fcn.00407818
lea ecx, [ebp - 0x18]
mov edx, 8
call fcn.004093fc
push 0x4cb104
push dword [ebp - 0x18]
push 0x4cb120
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.00404a48
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00409d10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4cb08c
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00409e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb0a9
mov eax, dword [ebp - 0x10]
call fcn.00402b10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb0d9
lea eax, [ebp - 0x11c]
call fcn.004046c8
lea eax, [ebp - 0x18]
call fcn.004046c8
lea eax, [ebp - 4]
call fcn.004046c8
ret

Function at 0x4cb1f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x4cb295
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
cmp byte [ebp - 1], 0
jne 0x4cb22a
mov word [ebp - 0x18], 0
lea edx, [ebp - 0x5c]
mov eax, esi
call fcn.00409a2c
mov eax, dword [ebp - 0x5c]
call fcn.00409c2c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push 0x4cb2a8
mov eax, esi
call fcn.00404b88
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4cb27f
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x50]
mov dword [edi], eax
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb29c
lea eax, [ebp - 0x5c]
call fcn.004046c8
ret
Function at 0x4cb328
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4cb33e
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_TerminateProcess
ret

Function at 0x4d28b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4d28bc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d2aae
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4d2ac4
mov eax, esi
call fcn.004d0740
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040471c
lea ecx, [ebp - 0x10]
mov edx, 0x4d2ad8
mov eax, esi
call fcn.004d0740
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040471c
lea ecx, [ebp - 0x14]
mov edx, 0x4d2af0
mov eax, esi
call fcn.004d0740
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040471c
lea ecx, [ebp - 0x18]
mov edx, 0x4d2b0c
mov eax, esi
call fcn.004d0740
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040471c
lea ecx, [ebp - 0x1c]
mov edx, 0x4d2b28
mov eax, esi
call fcn.004d0740
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040471c
lea ecx, [ebp - 0x24]
mov edx, 0x4d2b40
mov eax, esi
call fcn.004d0740
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408ec4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409490
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4d2b58
mov eax, esi
call fcn.004d0740
mov eax, dword [ebp - 0x28]
call fcn.004959c8
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4d2b68
mov eax, esi
call fcn.004d0740
mov eax, dword [ebp - 0x2c]
call fcn.004959c8
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4d2b80
mov eax, esi
call fcn.004d0740
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409490
inc eax
je 0x4d2a51
lea ecx, [ebp - 0x34]
mov edx, 0x4d2b80
mov eax, esi
call fcn.004d0740
mov eax, dword [ebp - 0x34]
call fcn.00409454
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ac70
fstp qword [ebp - 0x3c]
wait
call fcn.0040b0bc
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4d2a6c
lea ecx, [ebp - 0x40]
mov edx, 0x4d2b80
mov eax, esi
call fcn.004d0740
mov eax, dword [ebp - 0x40]
call fcn.004959c8
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4d2b90
mov eax, esi
call fcn.004d0740
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040471c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2ab5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004046ec
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004046ec
ret
Function at 0x4e82c0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
mov eax, dword [ebp - 8]
call fcn.00404b78
lea eax, [ebp - 0x160]
mov edx, dword [0x407e54]
call fcn.004050b4
xor eax, eax
push ebp
push 0x4e83e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
mov ecx, 0x4e83f8
mov edx, dword [ebp - 4]
call fcn.004049d4
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x3f
call fcn.004098fc
test eax, eax
jne 0x4e839c
lea eax, [ebp - 0x160]
call fcn.004de918
dec eax
jne 0x4e8381
push 0
push dword [ebp - 4]
push dword [ebp - 0x154]
push 0x4e8404
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00404a48
mov eax, dword [ebp - 0x168]
call fcn.00404b88
push eax
mov eax, dword [ebp - 8]
call fcn.00404b88
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x4f29f0]
mov eax, dword [eax]
call fcn.00462f94
lea eax, [ebp - 0x160]
call fcn.0040994c
test eax, eax
je 0x4e8339
lea eax, [ebp - 0x160]
call fcn.00409970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e83ea
lea eax, [ebp - 0x168]
mov edx, 2
call fcn.004046ec
lea eax, [ebp - 0x160]
mov edx, dword [0x407e54]
call fcn.00405184
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046ec
ret

Function at 0x4e85b4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
mov eax, dword [ebp - 8]
call fcn.00404b78
lea eax, [ebp - 0x160]
mov edx, dword [0x407e54]
call fcn.004050b4
xor eax, eax
push ebp
push 0x4e86f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
mov ecx, 0x4e8704
mov edx, dword [ebp - 4]
call fcn.004049d4
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x3f
call fcn.004098fc
test eax, eax
jne 0x4e86aa
lea eax, [ebp - 0x160]
call fcn.004de918
dec eax
jne 0x4e868f
push 0
push dword [ebp - 4]
push dword [ebp - 0x154]
push 0x4e8710
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 8]
call fcn.00409a60
push dword [ebp - 0x16c]
lea eax, [ebp - 0x168]
mov edx, 4
call fcn.00404a48
mov eax, dword [ebp - 0x168]
call fcn.00404b88
push eax
mov eax, dword [ebp - 8]
call fcn.00404b88
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x4f29f0]
mov eax, dword [eax]
call fcn.00462f94
lea eax, [ebp - 0x160]
call fcn.0040994c
test eax, eax
je 0x4e8633
lea eax, [ebp - 0x160]
call fcn.00409970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e86f8
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004046ec
lea eax, [ebp - 0x160]
mov edx, dword [0x407e54]
call fcn.00405184
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046ec
ret