joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af0d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x488b7c
call fcn.004874e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, edi
call fcn.00432486
mov byte [esi + 0xc], al
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00432557
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x10]
call fcn.00433ebf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00433d8a
mov ecx, edi
call fcn.004324af
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.0043249a
push eax
push dword [ebp + 8]
call fcn.00432aad
pop ecx
mov dword [esi + 0x18], eax
pop ecx
mov dword [esi + 0x1c], edx
mov ecx, edi
call fcn.004324af
mov ecx, edi
call fcn.004324af
mov ecx, edi
mov dword [esi + 0x20], eax
call fcn.004324af
mov dword [esi + 0x24], eax
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00432557
push eax
lea ecx, [esi + 0x28]
mov dword [ebp - 4], 1
call fcn.00433ebf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00433d8a
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00432557
push eax
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 2
call fcn.00433ebf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00433d8a
mov ecx, edi
call fcn.004324c3
and dword [esi + 0x3c], 0
mov ecx, edi
mov dword [esi + 0x38], eax
call fcn.004324c3
and dword [esi + 0x34], 0
mov ecx, edi
mov dword [esi + 0x30], eax
call fcn.004324c3
mov ecx, dword [ebp - 0xc]
and dword [esi + 0x44], 0
mov dword [esi + 0x40], eax
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40bac8
Capabilities:
Create directory

Disassembly:
mov eax, 0x488d34
call fcn.004874e0
sub esp, 0x10
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
call fcn.0043510b
call fcn.0040ba27
test al, al
pop ecx
jne 0x40bb48
mov ecx, dword [ebp + 8]
push 0
call fcn.00435b75
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40bb48
mov ecx, dword [ebp + 8]
call fcn.00435b75
push eax
lea ecx, [ebp + 8]
call fcn.00433e42
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00435b75
push eax
lea eax, [ebp - 0x1c]
push str.cant_create_folder__s_error__d
push eax
call fcn.00430892
add esp, 0x10
lea eax, [ebp - 0x1c]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40bdcc
Capabilities:
Delete file

Disassembly:
mov eax, 0x488de8
call fcn.004874e0
sub esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40be27
push esi
lea ecx, [ebp + 8]
push dword [ebp + 8]
call fcn.00433e42
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00435b75
push eax
lea eax, [ebp - 0x18]
push str.Cant_delete_file__s_error_d
push eax
call fcn.00430892
add esp, 0x10
lea eax, [ebp - 0x18]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x40be5a
Capabilities:
Move file

Disassembly:
mov eax, 0x488e04
call fcn.004874e0
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40bed3
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00433e42
mov esi, eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00433e42
mov edi, eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00435b75
push eax
mov ecx, edi
call fcn.00435b75
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str.error_d_while_renaming__s_to__s
push eax
call fcn.00430892
add esp, 0x14
lea eax, [ebp - 0x1c]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x40c1b0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x488e6f
call fcn.004874e0
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.004350ff
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
dec esi
neg esi
sbb esi, esi
push 0x104
and esi, 0xfffffff9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
add esi, 0x23
call fcn.004358fb
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x40c21d
push eax
lea eax, [ebp - 0x20]
push str.SHGetFolderPathW___Error_X
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x20]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004359d1
lea eax, [ebp - 0x10]
push eax
call fcn.0040bd26
lea ecx, [ebp - 0x10]
mov dword [esp], str.AMMYY_
call fcn.004358aa
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0043510b
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004353fc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40c2a5
Capabilities:
Get hostname

Disassembly:
mov eax, 0x488e9b
call fcn.004874e0
sub esp, 0x18
and dword [ebp - 0x18], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.00433a89
xor esi, esi
lea ecx, [ebp - 0x14]
mov eax, 0x400
inc esi
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
call fcn.00434277
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x40c30b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x24]
push str.GetComputerName___error_d
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0043434d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00433a95
mov dword [ebp - 0x18], esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00433d8a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40c97f
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push 1
push eax
push eax
push dword [esp + 0x10]
push 0x4b4584
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x4107a9
Capabilities:
Get common file path

Disassembly:
mov eax, 0x489777
call fcn.004874e0
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.004350ff
xor esi, esi
push 0x104
inc esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004358fb
push eax
push ebx
push ebx
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x410808
push eax
lea eax, [ebp - 0x20]
push str.SHGetFolderPathW___Error_X
push eax
call fcn.00430892
add esp, 0xc
lea eax, [ebp - 0x20]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004359d1
lea eax, [ebp - 0x10]
push eax
call fcn.0040bd26
pop ecx
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 8]
push eax
call fcn.0043510b
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004353fc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x411afe
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4899de
call fcn.004874e0
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
mov dword [ebp - 0x14], esi
call fcn.00433299
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.004320d4
mov dword [esi], 0x490c80
mov al, byte [ebp - 0xd]
mov dword [ebp - 4], 1
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea edi, [esi + 0x38]
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00433299
mov dword [edi], 0x490cd4
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 3
call fcn.00432f48
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 4
call fcn.00432f48
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 5
call fcn.00432f48
lea ecx, [esi + 0xb0]
mov byte [ebp - 4], 6
call fcn.00432f48
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 7
call fcn.00432f48
lea eax, [esi + 0x10]
push 0xaa
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
mov dword [esi], 0x490cc0
call fcn.0042e324
mov edi, 0x4c1e80
lea ecx, [ebp - 0x20]
push edi
push str.MS_Sans_Serif
push 8
push 0xa1
push 0xee
push ebx
push 0x80c80880
mov byte [ebp - 4], 9
call fcn.0042e369
push 0x4b4688
push 0x80
push 0x50010001
push 0xe
mov ebx, 0x8c
push 0x32
push ebx
push 0x7b
push 1
lea ecx, [ebp - 0x20]
call fcn.0042e492
push edi
push 0x80
push 0x50010000
push 0xe
push 0x32
push ebx
push 0xb5
push 2
lea ecx, [ebp - 0x20]
call fcn.0042e492
push edi
push 0x83
push 0x50a10101
push 0x64
push 0xe0
push 0x20
push 7
push 0x614
lea ecx, [ebp - 0x20]
call fcn.0042e492
push edi
push 0x80
push 0x50010000
push 0xe
push 0x69
push ebx
push 7
push 0x67a
lea ecx, [ebp - 0x20]
call fcn.0042e492
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.0042e340
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414a7a
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x48a07b
call fcn.004874e0
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
mov dword [ebp - 0x10], esi
call fcn.00433684
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.00425a3f
lea edi, [esi + 0x18]
push ebx
mov ecx, edi
call fcn.00433299
mov dword [edi], 0x490c74
push ebx
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.00433299
push ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00433299
push ebx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.00433299
push ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 4
call fcn.00433299
push ebx
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 5
call fcn.00433299
lea edi, [esi + 0x60]
push ebx
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00433299
mov dword [edi], 0x490c78
push ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 7
call fcn.00433299
push ebx
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 8
call fcn.00433299
push ebx
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 9
call fcn.00433299
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 0xa
call fcn.00432f48
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 0xb
call fcn.0040e93e
push fcn.00422ad6
push fcn.00422a9e
push 0x10
lea eax, [esi + 0x294]
push 0x18
push eax
mov byte [ebp - 4], 0xc
call fcn.00487713
lea ecx, [esi + 0x414]
mov byte [ebp - 4], 0xd
call fcn.00422a9e
push ebx
lea ecx, [esi + 0x430]
mov byte [ebp - 4], 0xe
call fcn.00432bc1
push 5
mov dword [esi], 0x490d10
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0xdef5d2
mov dword [esi + 0x21c], eax
call edi
push 0xf6e8d4
mov dword [0x4c206c], eax
call edi
push 0xffffff
mov dword [0x4c2070], eax
call edi
push 0xe9e9e9
mov dword [0x4c2074], eax
call edi
push 0xf0dcf5
mov dword [0x4c2078], eax
call edi
mov edi, dword [sym.imp.USER32.dll_LoadImageA]
push ebx
push 0x10
push 0x10
push 1
push 0x80
mov dword [0x4c207c], eax
push 0x400000
mov dword [esi + 0x288], ebx
mov dword [esi + 0x28c], ebx
mov dword [esi + 0x290], ebx
call edi
push ebx
push 0x20
push 0x20
push 1
push 0x80
push 0x400000
mov dword [esi + 0x454], eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x458], eax
mov byte [esi + 0x42c], bl
mov dword [0x4c1f8c], esi
mov dword [esi + 0x450], ebx
mov dword [esi + 0x284], ebx
mov dword [esi + 0x278], ebx
mov dword [esi + 0x27c], ebx
mov dword [esi + 0x280], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414c83
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x48a143
call fcn.004874e0
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x490d10
mov dword [ebp - 4], 0xe
mov edi, 0x4c2ac0
jmp 0x414cb1
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.00458bfb
test al, al
jne 0x414ca9
mov ecx, esi
call fcn.00414e84
and dword [0x4c1f8c], 0
lea edi, [esi + 0x450]
mov eax, dword [edi]
test eax, eax
je 0x414ce0
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
and dword [edi], 0
lea edi, [esi + 0x284]
push ebx
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi]
test eax, eax
je 0x414cf9
push eax
call ebx
and dword [edi], 0
mov eax, dword [esi + 0x278]
test eax, eax
je 0x414d06
push eax
call ebx
mov eax, dword [esi + 0x280]
pop ebx
test eax, eax
je 0x414d18
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
lea ecx, [esi + 0x414]
mov byte [ebp - 4], 0xd
call fcn.00422ad6
push fcn.00422ad6
push 0x10
lea eax, [esi + 0x294]
push 0x18
push eax
mov byte [ebp - 4], 0xc
call fcn.0048761f
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 0xb
call fcn.0040eadc
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 0xa
call fcn.00432fb6
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 9
call fcn.004332c7
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 8
call fcn.004332c7
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 7
call fcn.004332c7
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 6
call fcn.004332c7
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 5
call fcn.004332c7
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 4
call fcn.004332c7
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.004332c7
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.004332c7
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.004332c7
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004332c7
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004332c7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4159ba
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
mov eax, 0x48a25f
call fcn.004874e0
sub esp, 0xc0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
jmp 0x4159da
lea edi, [esi + 0x10]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00425a46
cmp byte [edi], bl
jne 0x415bca
mov eax, dword [0x4c1f90]
push 0x4b4bb4
xor eax, 0xfe7ded7b
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040bee5
add esp, 0xc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00435b75
push eax
lea ecx, [esi + 0x6c]
call fcn.0043337b
mov ecx, esi
call fcn.00414df2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DrawMenuBar]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00433d8a
jmp 0x415bca
cmp byte [esi + 0x10], bl
push ebx
push ebx
je 0x415da5
push 0x10
mov dword [ebp - 4], 0xa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0040c503
pop ecx
pop ecx
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 0xb
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040b938
pop ecx
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040c441
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xd
call fcn.0043553d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.004353fc
lea ecx, [ebp - 0x1c]
call fcn.00435b75
push ebx
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.004358fb
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
jne 0x415cbc
lea ecx, [ebp - 0x14]
call fcn.00435b75
push eax
lea ecx, [ebp - 0x2c]
call fcn.00433e42
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.00435b75
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x3c]
push str.Cant_run__s_error_d
push eax
call fcn.00430892
add esp, 0x10
lea eax, [ebp - 0x3c]
push 0x49c754
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004353fc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.004353fc
mov byte [0x4c1ecd], 1
jmp 0x415db6
mov ecx, 0x4c2030
mov dword [ebp - 4], 0x14
call fcn.0040b331
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4186fa
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x48a705
call fcn.004874e0
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push dword [esp + 0x34]
mov ebx, ecx
mov dword [esp + 0x14], ebx
call fcn.00431e8d
xor ebp, ebp
lea esi, [ebx + 0x54]
push ebp
mov ecx, esi
mov dword [esp + 0x2c], ebp
call fcn.00433299
mov edi, 0x490c7c
mov dword [esi], edi
lea esi, [ebx + 0x60]
push ebp
mov ecx, esi
mov byte [esp + 0x2c], 1
call fcn.00433299
mov dword [esi], 0x490c74
lea esi, [ebx + 0x6c]
push ebp
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.00433299
mov dword [esi], edi
lea eax, [ebx + 8]
push 0x1d0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
mov dword [ebx], 0x490d38
call fcn.0042e324
push 0x4c1e80
push str.Microsoft_Sans_Serif
push 8
push 0x10b
push 0x119
push ebp
push 0x80000080
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], 4
call fcn.0042e369
mov esi, 0x4b3f40
mov edi, 0x80
push esi
push edi
push 0x50010003
mov ebp, 0x10a
push 0xa
push ebp
push 0xc
push 7
push 0x64f
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
push edi
push 0x50010003
push 0xa
push ebp
push 0x1c
push 7
push 0x611
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
push edi
push 0x50010003
push 0xa
push ebp
push 0x2c
push 7
push 0x610
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
push edi
push 0x50010003
push 0xa
push ebp
push 0x3c
push 7
push 0x64c
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
push edi
push 0x50010003
push 0xa
push ebp
push 0x4c
push 7
push 0x64d
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
mov ebp, 0x50010000
push edi
push ebp
push 0xe
push 0x92
push 0x64
push 7
push 0x5ee
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
push edi
push ebp
push 0xe
push 0x91
push 0x87
push 7
push 0x67f
lea ecx, [esp + 0x34]
call fcn.0042e492
push 0x4c1e80
push 0x81
push 0x50810080
push 0xd
push 0xf7
push 0xd4
push 1
push 0x680
lea ecx, [esp + 0x34]
call fcn.0042e492
mov ebp, 0x82
push esi
push ebp
push 0x50020000
push 8
push 0x110
push 0xc8
push 1
push 0x682
lea ecx, [esp + 0x34]
call fcn.0042e492
push 0x4b4d54
push edi
push 0x50010000
push 0xd
push 0x10
push 0xd4
push 0x101
push 0x681
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
push ebp
push 0x50020002
push 9
push 0x56
push 0xed
push 0
push 0x68a
lea ecx, [esp + 0x34]
call fcn.0042e492
mov edi, 0x4c1e80
lea ecx, [esp + 0x14]
push edi
push 0x85
push 0x50210103
push 0x1e
push 0xb3
push 0xea
push 0x5e
push 0x61e
call fcn.0042e492
push edi
push 0x81
push 0x50810080
mov edi, 0x111
push 0xd
push edi
push 0xb3
push 0
push 0x69a
lea ecx, [esp + 0x34]
call fcn.0042e492
push esi
push ebp
push 0x50020000
push 8
push edi
push 0xa7
push 0
push 0x69b
lea ecx, [esp + 0x34]
call fcn.0042e492
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.0042e340
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41a4a3
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push 1
push eax
push eax
push str.http:__www.ammyy.com
push 0x4b4584
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x41bab2
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x48ac43
call fcn.004874e0
sub esp, 0x10
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
mov dword [esp + 0x14], esi
call fcn.00433299
lea ebp, [esi + 0x10]
mov dword [esp + 0x28], ebx
mov ecx, ebp
call fcn.004320d4
mov dword [esi], 0x490c80
lea ecx, [esi + 0x40]
mov dword [esp + 0x28], 1
call fcn.004350ff
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea edi, [esi + 0x44]
push ebx
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.00433299
mov dword [edi], 0x490c74
push ebx
lea ecx, [esi + 0x50]
mov byte [esp + 0x2c], 3
call fcn.00433299
push ebx
lea ecx, [esi + 0x5c]
mov byte [esp + 0x2c], 4
call fcn.00433299
push ebx
lea ecx, [esi + 0x68]
mov byte [esp + 0x2c], 5
call fcn.00433299
mov al, byte [esp + 0x34]
push 0x17c
push ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 6
mov dword [esi], 0x490d60
mov byte [esi + 0x74], al
call fcn.0042e324
mov edi, 0x4c1e80
lea ecx, [esp + 0x14]
push edi
push str.Microsoft_Sans_Serif
push 8
push 0x99
push 0xd4
push ebx
push 0x80c80880
mov byte [esp + 0x44], 7
call fcn.0042e369
mov ebp, 0x80
push 0x4b4688
push ebp
push 0x50010001
push 0xe
mov ebx, 0x86
push 0x32
push ebx
push 0x66
push 1
lea ecx, [esp + 0x34]
call fcn.0042e492
push edi
push ebp
push 0x50010000
push 0xe
push 0x32
push ebx
push 0x9d
push 2
lea ecx, [esp + 0x34]
call fcn.0042e492
mov ebx, 0x4b3f40
add ebp, 2
push ebx
push ebp
push 0x50020202
push 0xe
push 0x5c
push 6
push 7
push 0x690
lea ecx, [esp + 0x34]
call fcn.0042e492
push ebx
push ebp
push 0x50020202
push 0xe
push 0x5c
push 0x1c
push 7
push 0x68f
lea ecx, [esp + 0x34]
call fcn.0042e492
push edi
push 0x81
push 0x50810080
push 0xe
push 0x67
push 6
push 0x68
push 0x601
lea ecx, [esp + 0x34]
call fcn.0042e492
push edi
push 0x81
push 0x50810080
push 0xe
push 0x67
push 0x1c
push 0x68
push 0x66a
lea ecx, [esp + 0x34]
call fcn.0042e492
push edi
push 0x81
push 0x508100a0
push 0xe
push 0x67
push 0x32
push 0x68
push 0x633
lea ecx, [esp + 0x34]
call fcn.0042e492
push edi
push 0x81
push 0x508100a0
push 0xe
push 0x67
push 0x48
push 0x68
push 0x634
lea ecx, [esp + 0x34]
call fcn.0042e492
push ebx
mov edi, 0x50020202
push ebp
push edi
push 0xe
push 0x5c
push 0x32
push 7
push 0x691
lea ecx, [esp + 0x34]
call fcn.0042e492
push ebx
push ebp
push edi
push 0xe
push 0x5c
push 0x48
push 7
push 0x692
lea ecx, [esp + 0x34]
call fcn.0042e492
push ebx
push ebp
push 0x50020000
push 0x1d
push 0xcb
push 0x60
push 4
push 0x694
lea ecx, [esp + 0x34]
call fcn.0042e492
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 6
call fcn.0042e340
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41d856
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x48afd0
call fcn.004874e0
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.00433299
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0043336b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], eax
call fcn.004332c7
push 0
lea ecx, [ebp - 0x1c]
call fcn.00433299
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0xa2
push 0x7e
push ebx
push edi
push 7
push 0x3c
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 1
push eax
call fcn.0041d79b
push dword [ebp - 0x10]
add ebx, 0x15
add edi, 0xa
mov ecx, esi
push 0xa
push 0x71
push ebx
mov dword [ebp + 0x10], edi
push edi
mov edi, 0x10003
push edi
push 0xe
push dword [ebp + 8]
push esi
call fcn.0041d79b
push dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add ebx, 0x10
add eax, 0x17
push 0xa
push 0x5e
push ebx
push eax
push edi
push 0xf
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
lea eax, [esi + 0xc]
mov ecx, esi
push eax
call fcn.0041d79b
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x18]
mov ecx, esi
push 0xa
push 0x5e
push ebx
push dword [ebp + 0xc]
push edi
push 0x10
push dword [ebp + 8]
push eax
call fcn.0041d79b
push dword [ebp - 0x10]
add ebx, 0x10
push 0xa
push 0x5e
push ebx
push dword [ebp + 0xc]
lea eax, [esi + 0x24]
mov ecx, esi
push edi
push 0x11
push dword [ebp + 8]
push eax
call fcn.0041d79b
push dword [ebp - 0x10]
add ebx, 0x14
lea eax, [esi + 0x30]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x12
push dword [ebp + 8]
push eax
call fcn.0041d79b
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x3c]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x13
push dword [ebp + 8]
push eax
call fcn.0041d79b
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x48]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x14
push dword [ebp + 8]
push eax
call fcn.0041d79b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004332c7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc