joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db312
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 4], 0
call fcn.00462350
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0xc]
call fcn.0046d080
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.0047a850
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004014e0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x47b410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db405
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 4], 0
movzx eax, byte [ebp + 0xc]
neg eax
sbb al, al
and al, 0x2d
add al, 0x2f
mov byte [ebp - 0xd], al
push 0
lea ecx, [ebp + 8]
call fcn.0046d080
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x47b5a3
mov cl, byte [ebp - 0xd]
push ecx
lea ecx, [ebp + 8]
call fcn.0047c7f0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x47b4aa
mov byte [ebp - 0xd], 0x2f
mov dl, byte [ebp - 0xd]
push edx
lea ecx, [ebp + 8]
call fcn.0047c7f0
mov dword [ebp - 0x18], eax
mov byte [ebp + 0xc], 0
cmp dword [ebp - 0x18], 0xffffffff
jne 0x47b4aa
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014e0
mov eax, dword [ebp - 0x1c]
jmp 0x47b5bc
lea ecx, [ebp - 0x14]
call fcn.004014a0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0045c210
sub eax, 1
cmp dword [ebp - 0x18], eax
jne 0x47b4e0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0045c0d0
mov cl, byte [ebp - 0xd]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0046a6b0
jmp 0x47b521
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 8]
call fcn.00461ec0
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x38]
push edx
lea ecx, [ebp - 0x14]
call fcn.0045c0d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004014e0
mov al, byte [ebp - 0xd]
push eax
lea ecx, [ebp - 0x14]
call fcn.0046a6b0
mov cl, byte [ebp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 0x14]
push edx
call fcn.004014c0
mov dword [ebp - 0x3c], eax
call fcn.0047b410
add esp, 8
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x47b56f
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004014e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014e0
mov eax, dword [ebp - 0x28]
jmp 0x47b5bc
push 0
lea ecx, [ebp + 8]
call fcn.0046d080
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004014e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014e0
mov eax, dword [ebp - 0x2c]
jmp 0x47b5bc
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014e0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x47dd40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db5e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 0
push 0x4e648c
lea ecx, [ebp + 8]
call fcn.0045bdf0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp + 8]
push eax
call fcn.004014c0
mov dword [ebp - 0x4c], eax
call fcn.0047b0f0
add esp, 8
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x47ddb2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014e0
jmp 0x47decb
call fcn.00462350
mov dword [ebp - 0x28], eax
push 0x4e649c
push 0x97
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x20]
call fcn.004b1264
mov byte [ebp - 4], 1
push 0
push 0x9001
lea ecx, [ebp + 8]
call fcn.0046d080
push eax
lea ecx, [ebp - 0x20]
call fcn.004b15ac
test eax, eax
je 0x47deb0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
call fcn.004b0fb7
jmp 0x47dea1
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004b1202
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004b12a3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x481ea0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
jmp 0x481ebb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x8c4
call fcn.004622a0
cmp dword [ebp - 4], eax
jge 0x481f24
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x8c4
call fcn.0046ca70
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x481f03
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 4]
mov dword [ebp - 0x18], eax
jmp 0x481f0a
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x8c4
call fcn.0046ca70
mov dword [eax], 0
jmp 0x481eb2
mov ecx, dword [ebp - 0x14]
add ecx, 0x8c4
call fcn.004622c0
mov ecx, dword [ebp - 0x14]
add ecx, 0x8bc
call fcn.0045bed0
movzx ecx, al
test ecx, ecx
je 0x481f49
jmp 0x481f8c
mov edx, dword [ebp - 0x14]
add edx, 0x8bc
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push edx
call fcn.004014c0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
call fcn.00481f90
mov ecx, dword [ebp - 0x14]
add ecx, 0x8bc
call fcn.0046d080
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 0x14]
add ecx, 0x8bc
call fcn.0045c760
mov esp, ebp
pop ebp
ret
Function at 0x484a70
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dbf88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x11]
call fcn.0045cdf0
mov dword [ebp - 4], 0
push 0x4e767c
mov eax, dword [ebp - 0x1c]
add eax, 0x908
push eax
call fcn.0045beb0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x484b3f
push 0x4e7680
mov edx, dword [ebp - 0x1c]
add edx, 0x90c
push edx
call fcn.0045beb0
add esp, 8
movzx eax, al
test eax, eax
je 0x484b3f
push 0x4e7694
mov ecx, dword [ebp - 0x1c]
add ecx, 0x8bc
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0046faa0
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
call fcn.0046d080
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0048e646
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004014e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11]
call fcn.0045ce20
jmp 0x484be6
mov ecx, dword [ebp - 0x1c]
call fcn.00485d00
mov ecx, dword [ebp - 0x1c]
call fcn.00484d00
mov ecx, dword [ebp - 0x1c]
call fcn.00484c00
mov ecx, dword [ebp - 0x1c]
call fcn.00484e70
mov ecx, dword [ebp - 0x1c]
call fcn.00487c40
call fcn.004890d0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x484b8c
mov ecx, dword [ebp - 0x1c]
add ecx, 0x90c
call fcn.0046d080
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004affcb
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x994], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xa04], 0
mov ecx, dword [ebp - 0x1c]
call fcn.00485b10
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax + 0x94d]
test ecx, ecx
jne 0x484bd7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4845d0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x511360], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11]
call fcn.0045ce20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x486d60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc286
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x9fc], 0
jne 0x486e45
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x9f8], 0
je 0x486e45
call fcn.0045ce10
cmp dword [eax + 0xa4], 0
jne 0x486e45
lea ecx, [ebp - 0x14]
call fcn.0047d070
mov dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x14]
call fcn.0047d0c0
test eax, eax
je 0x486e2a
push 5
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp - 0x14]
push edx
call fcn.004014c0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0047af30
add esp, 8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0046d080
push eax
push 0x4e7f56
lea ecx, [ebp - 0x14]
call fcn.0046d080
push eax
push 0x4e7f58
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1c]
call fcn.004014e0
mov ecx, dword [ebp - 0x20]
call fcn.00481e60
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x9fc], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0047d0a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x488bf0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc57b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004014a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004014a0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004014a0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004014a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004014a0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004014a0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004014a0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004014a0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004014a0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004014a0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004014a0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004014a0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004014a0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.004014a0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004014a0
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.004014a0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.004aa7a0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.004aa7a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x488d40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc57b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.004aa7f2
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.004aa7f2
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.004014e0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004014e0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.004014e0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004014e0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004014e0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004014e0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004014e0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004014e0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004014e0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004014e0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004014e0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004014e0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004014e0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004014e0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004014e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x489180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x495f1c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x495f6f
call fcn.004c4cad
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x495f6f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x495f65
xor eax, eax
jmp 0x496088
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x495f9f
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x495f9f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x496085
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x495fcc
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0048e0aa
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x496085
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x496015
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x496015
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x49600f
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0048e0aa
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x496075
and dword [ebp + 0xc], 0
jmp 0x496075
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x496075
push 0xc
call fcn.004b0b97
mov esi, eax
test esi, esi
pop ecx
je 0x496057
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x496059
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x496070
push dword [ebp - 8]
call fcn.004aa5ba
jmp 0x496075
call fcn.004aa591
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x495fda
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4999ab
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00497e60
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x499a46
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x513384]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x499a46
cmp eax, 1
je 0x499a67
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x499a46
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x499a13
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x499a42
xor eax, eax
inc eax
jmp 0x499a86
cmp edi, eax
jae 0x499a4a
xor eax, eax
jmp 0x499a86
cmp eax, esi
jae 0x499a51
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x513384]
jmp 0x499a6a
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x499f5c
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4eee80
call fcn.0049a614
push 8
call fcn.0049d2ef
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x5133c4], esi
jne 0x499f90
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x5133c0], esi
mov al, byte [ebp + 0x10]
mov byte [0x5133bc], al
cmp dword [ebp + 0xc], edi
jne 0x499fda
cmp dword [0x514c6c], edi
je 0x499fca
mov eax, dword [0x514c68]
sub eax, 4
mov dword [0x514c68], eax
cmp eax, dword [0x514c6c]
jb 0x499fca
mov eax, dword [eax]
cmp eax, edi
je 0x499fab
call eax
jmp 0x499fab
push 0x50d0cc
mov eax, 0x50d0c4
call fcn.00499eda
pop ecx
push 0x50d0d8
mov eax, 0x50d0d0
call fcn.00499eda
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x49a00b
cmp dword [ebp + 0x10], edi
jne 0x49a019
mov dword [0x5133c4], esi
push dword [ebp + 8]
call fcn.00499e98
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x49a018
push 8
call fcn.0049d23a
pop ecx
ret
call fcn.0049a64f
ret
Function at 0x49a165
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4eee90
call fcn.0049a614
mov edi, 0x94
mov eax, edi
call fcn.00497e60
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x513384], ecx
mov eax, dword [esi + 4]
mov dword [0x513390], eax
mov edx, dword [esi + 8]
mov dword [0x513394], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x513388], esi
cmp ecx, 2
je 0x49a1c5
or esi, 0x8000
mov dword [0x513388], esi
shl eax, 8
add eax, edx
mov dword [0x51338c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x49a200
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49a200
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x49a218
cmp eax, 0x20b
je 0x49a205
mov dword [ebp - 0x1c], esi
jmp 0x49a22c
cmp dword [ecx + 0x84], 0xe
jbe 0x49a200
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x49a226
cmp dword [ecx + 0x74], 0xe
jbe 0x49a200
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0049d570
pop ecx
test eax, eax
jne 0x49a240
push 0x1c
call fcn.0049a141
pop ecx
call fcn.0049cffe
test eax, eax
jne 0x49a251
push 0x10
call fcn.0049a141
pop ecx
call fcn.004a384b
mov dword [ebp - 4], esi
call fcn.004a40d0
test eax, eax
jge 0x49a26a
push 0x1b
call fcn.0049a11c
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x514c60], eax
call fcn.004a3fae
mov dword [0x5133c8], eax
call fcn.004a3f0c
test eax, eax
jge 0x49a290
push 8
call fcn.0049a11c
pop ecx
call fcn.004a3cd9
test eax, eax
jge 0x49a2a1
push 9
call fcn.0049a11c
pop ecx
push 1
call fcn.00499ef2
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x49a2b7
push eax
call fcn.0049a11c
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004a3c7c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x49a2d8
movzx eax, word [ebp - 0x40]
jmp 0x49a2db
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004a8e32
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x49a2f9
push edi
call fcn.0049a01f
call fcn.0049a041
jmp 0x49a32b
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0049a64f
ret
Function at 0x49a983
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x49a9a0
call fcn.0049aab1
mov dword [eax], 0x16
xor eax, eax
jmp 0x49aa0a
push esi
push 0x8c
push 1
call fcn.0049a33a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x49a9f5
push esi
call fcn.0049ce04
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x49a9d3
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x49a8ee
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x49aa09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00497e9d
test ebx, ebx
pop ecx
je 0x49aa07
push ebx
call fcn.0049aac3
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret