joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb33c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
mov eax, dword [ebp - 8]
call fcn.00405f48
mov eax, dword [ebp - 0xc]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4bb58c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040f368
fstp qword [ebp - 0x30]
wait
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x20]
mov edx, 0x4bb5a8
call fcn.00410028
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x20]
call fcn.00405fb4
push 0x4bb5d4
push dword [ebp - 0x18]
push 0x4bb60c
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004063ec
push 0x4bb640
push dword [ebp - 0xc]
push 0x4bb674
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004063ec
lea edx, [ebp - 0x838]
mov eax, dword [ebp - 0xc]
call fcn.004bdb48
mov edx, dword [ebp - 0x838]
lea eax, [ebp - 0xc]
call fcn.00405fb4
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 1
jne 0x4bb438
push dword [ebp - 4]
push 0x4bb6a4
push dword [ebp - 8]
push 0x4bb6b8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004063ec
cmp dword [ebp - 0x24], 2
jne 0x4bb4c3
push 0
push 0x23
lea eax, [ebp - 0x832]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x832]
mov ecx, 0x401
call fcn.00406148
lea ecx, [ebp - 0x83c]
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.004b916c
mov eax, dword [ebp - 0x83c]
mov edx, 0x4bb6d0
call fcn.00406594
je 0x4bb499
lea eax, [ebp - 0x14]
mov edx, 0x4bb6d0
call fcn.0040629c
lea eax, [ebp - 0x14]
mov edx, 0x4bb6e0
call fcn.0040629c
push dword [ebp - 0x14]
push 0x4bb6a4
push dword [ebp - 8]
push 0x4bb6b8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004063ec
mov dl, 1
mov eax, dword [0x41f298]
call fcn.004247b4
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x4bb500
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb50a
mov eax, dword [ebp - 0x28]
call fcn.0040428c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jne 0x4bb415
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bada8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4bb54e
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4bb54e
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
call fcn.004056d0
test eax, eax
je 0x4bb557
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4bb55f
mov bl, 1
jmp 0x4bb561
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb593
lea eax, [ebp - 0x83c]
mov edx, 2
call fcn.00405f58
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405f58
ret
Function at 0x4bc8c4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
mov eax, dword [ebp - 8]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4bc9d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004bcb04
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x4bc9ec
mov eax, dword [ebp - 0xc]
call fcn.0040a21c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00405fb4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0040c8ec
test al, al
jne 0x4bc93a
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
call fcn.0040cd44
test al, al
je 0x4bc985
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004bcb04
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
mov edx, 0x4bc9ec
mov eax, dword [ebp - 0x10]
call fcn.0040a21c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00405fb4
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0040c8ec
test al, al
jne 0x4bc98c
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x4bc98c
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jg 0x4bc998
mov bl, 1
jmp 0x4bc9b7
push 0
mov eax, dword [ebp - 8]
call fcn.00405fec
push eax
mov eax, dword [ebp - 4]
call fcn.00405fec
push eax
call sub.kernel32.dll_CopyFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc9d9
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405f58
ret
Function at 0x4bc9f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bcae4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jbe 0x4bcac9
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405fb4
mov dword [ebp - 0x2c], 0x1c
xor edx, edx
mov eax, 4
call fcn.004ba79c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004ba7fc
mov ebx, eax
jmp 0x4bcac5
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
cmp edi, dword [ebp - 0xc]
jne 0x4bcab6
mov eax, dword [ebp - 0x20]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.0040c848
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004068b4
dec eax
jge 0x4bcaac
push dword [ebp - 4]
push 0x4bcb00
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004063ec
test esi, esi
je 0x4bcaac
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test esi, esi
je 0x4bcab6
push esi
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004ba820
mov ebx, eax
test ebx, ebx
jne 0x4bca4d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcaeb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405f58
ret
Function at 0x4bcb04
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4bcc78
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00405f60
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405fec
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4bcc55
mov eax, ebx
call fcn.00403110
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bcbda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4bcbc4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4bcc88
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4bcbc4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcbe1
mov eax, dword [ebp - 0x10]
call fcn.0040312c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcc7f
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00405f58
lea eax, [ebp - 4]
call fcn.00405f50
ret

Function at 0x4bd1e4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
mov eax, dword [ebp - 8]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4bd2d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00405f60
mov edx, dword [ebp - 8]
mov eax, 0x4bd2f0
call fcn.004068b4
test eax, eax
jg 0x4bd23d
mov edx, dword [ebp - 8]
mov eax, 0x4bd304
call fcn.004068b4
test eax, eax
jle 0x4bd24c
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bd148
jmp 0x4bd2b9
mov edx, dword [ebp - 8]
mov eax, 0x4bd318
call fcn.004068b4
test eax, eax
jle 0x4bd28f
mov eax, 0x400
call fcn.004030f8
mov esi, eax
push 0x400
push esi
mov eax, dword [ebp - 8]
call fcn.00405fec
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, ebx
mov edx, esi
call fcn.0040610c
mov eax, esi
call fcn.0040312c
jmp 0x4bd2b9
mov edx, dword [ebp - 8]
mov eax, 0x4bd328
call fcn.004068b4
test eax, eax
jle 0x4bd2ac
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405f60
jmp 0x4bd2b9
mov eax, ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040631c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd2db
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405f58
ret
Function at 0x4bd384
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x4fcf9c
mov eax, ebx
mov edx, 8
test al, 1
je 0x4bd3a0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bd3a2
shr eax, 1
dec edx
jne 0x4bd393
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4bd38c
pop ebx
ret

Function at 0x4bd3b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4bd3c1
mov eax, dword [ebp - 4]
add esp, 0xfffffdb8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4bd499
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004bd384
mov eax, dword [0x4f6760]
mov byte [eax], 0
or ebx, 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x258]
call fcn.004037f4
mov edx, 1
lea eax, [ebp - 0x258]
call fcn.00403bec
call fcn.004032b4
test eax, eax
jne 0x4bd476
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10249]
mov ecx, 0xfff1
lea eax, [ebp - 0x258]
call fcn.00403944
movzx edx, word [ebp - 8]
test dx, dx
jbe 0x4bd470
lea eax, [ebp - 0x10249]
movzx ecx, byte [eax]
mov esi, ebx
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x4fcf9c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc eax
dec dx
jne 0x4bd44f
cmp dword [ebp - 8], 0
jne 0x4bd426
lea eax, [ebp - 0x258]
call fcn.00403964
not ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd4a0
lea eax, [ebp - 4]
call fcn.00405f50
ret
Function at 0x4ce134
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4ce18e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004ce128
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004cb5f4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004cb158
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce195
lea eax, [ebp - 4]
call fcn.00405f50
ret
Function at 0x4e11ac
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e12b3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004e1540
mov dl, 1
mov eax, dword [0x41f298]
call fcn.004247b4
mov esi, eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4e12d0
mov edx, 0x4e12e4
mov eax, dword [ebp - 4]
call fcn.0040a21c
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4e1284
inc ebx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.0040d03c
lea eax, [ebp - 0x18]
mov ecx, 0x4e12f4
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x18]
call fcn.0040cd44
test al, al
je 0x4e127e
lea eax, [ebp - 0x1c]
mov ecx, 0x4e1320
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x1c]
call fcn.00405fec
push eax
lea eax, [ebp - 0x20]
mov ecx, 0x4e12f4
mov edx, dword [ebp - 8]
call fcn.0040631c
mov eax, dword [ebp - 0x20]
call fcn.00405fec
push eax
call sub.kernel32.dll_MoveFileW
inc dword [ebp - 0x10]
dec ebx
jne 0x4e1213
mov eax, esi
call fcn.0040428c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e12ba
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405f58
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405f58
ret
Function at 0x4e2fd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4e309e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x4e30b8
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040c63c
push dword [ebp - 0x10]
push 0x4e30d4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004063ec
mov edx, dword [ebp - 0xc]
mov ecx, 0x4e30e4
mov eax, dword [ebp - 4]
call fcn.004bd7a8
call fcn.004bd8d4
test al, al
jne 0x4e304d
mov dword [ebx + 0x3cc], 2
jmp 0x4e3083
push 1
push 0
push 0x4e30fc
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x3d8]
call fcn.00476948
mov eax, dword [ebp - 0x14]
call fcn.00405fec
push eax
push 0x4e312c
push 0
call sub.shell32.dll_ShellExecuteW
mov dword [ebx + 0x3cc], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e30a5
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405f58
ret
Function at 0x4e4ecc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4e4fbd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x4e4fd8
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.0040c63c
push dword [ebp - 0x14]
push 0x4e4ff4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004063ec
mov edx, dword [ebp - 0x10]
mov ecx, 0x4e5004
mov eax, dword [ebp - 4]
call fcn.004bd7a8
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4e5028
mov edx, 0x4e503c
mov eax, dword [ebp - 8]
call fcn.004bd7a8
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x3d8]
call fcn.00476948
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040d03c
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.004bd1e4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00405fb4
mov eax, dword [ebp - 0xc]
call fcn.0040cd44
test al, al
je 0x4e4f98
mov eax, dword [ebp - 0xc]
call fcn.00405fec
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebx + 0x3cc], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4fc4
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405f58
ret
Function at 0x4e6ec8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
mov eax, dword [ebp - 8]
call fcn.00405f48
mov eax, dword [ebp - 0xc]
call fcn.00405f48
mov esi, 0x4fd4a8
xor eax, eax
push ebp
push 0x4e6fb4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.004bd8d4
test al, al
je 0x4e6f99
mov eax, dword [ebp - 4]
call fcn.00405fec
mov edx, eax
mov eax, 0x4fd498
call fcn.0040610c
mov eax, dword [ebp - 8]
call fcn.00405fec
mov edx, eax
mov eax, 0x4fd49c
call fcn.0040610c
mov eax, dword [ebp - 0xc]
call fcn.00405fec
mov edx, eax
mov eax, 0x4fd4a0
call fcn.0040610c
mov eax, dword [ebp + 8]
mov dword [0x4fd4a4], eax
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x4e6e6c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
cmp dword [esi], 0
jne 0x4e6f8e
push 0x32
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
cmp dword [esi], 0
je 0x4e6f76
cmp dword [esi], 1
jne 0x4e6f97
mov bl, 1
jmp 0x4e6f99
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6fbb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405f58
ret
Function at 0x4e8290
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4e83e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov al, 1
call fcn.004bcc9c
xor eax, eax
push ebp
push 0x4e8300
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x4e8400
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004063ec
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x4e8410
call fcn.004e66b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e830a
xor eax, eax
push ebp
push 0x4e8341
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov ecx, 0x4e8424
mov edx, dword [ebp - 4]
call fcn.0040631c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x4e8410
call fcn.004e66b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e834b
push 0
push 0
push 0x4e8440
push dword [ebp - 4]
push 0x4e8400
push dword [ebp - 8]
push 0x4e8468
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004063ec
mov eax, dword [ebp - 0x14]
call fcn.00405fec
push eax
push 0x4e8470
push 0x4e8484
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0
push 0x4e8440
push dword [ebp - 4]
push 0x4e8424
push 0x4e8468
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004063ec
mov eax, dword [ebp - 0x18]
call fcn.00405fec
push eax
push 0x4e8470
push 0x4e8484
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e83ea
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405f58
ret
Function at 0x4eaf64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4eb007
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, esi
call fcn.0040c63c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x398]
call fcn.004bb33c
test al, al
je 0x4eafec
push 1
push 0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040c63c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x4eb020
call fcn.0040631c
mov eax, dword [ebp - 0xc]
call fcn.00405fec
push eax
mov eax, dword [ebx + 0x394]
call fcn.00405fec
push eax
push 0x4eb034
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb00e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405f58
ret

Function at 0x4ebac4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
mov eax, dword [ebp - 8]
call fcn.00405f48
mov esi, 0x4fd4bc
xor eax, eax
push ebp
push 0x4ebb83
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004bd8d4
test al, al
je 0x4ebb68
mov eax, dword [ebp - 4]
call fcn.00405fec
mov edx, eax
mov eax, 0x4fd4b4
call fcn.0040610c
mov eax, dword [ebp - 8]
call fcn.00405fec
mov edx, eax
mov eax, 0x4fd4b8
call fcn.0040610c
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x4eba74
push 0
push 0
call sub.kernel32.dll_CreateThread_1
cmp dword [esi], 0
jne 0x4ebb5d
push 0x32
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
cmp dword [esi], 0
je 0x4ebb45
cmp dword [esi], 1
jne 0x4ebb66
mov bl, 1
jmp 0x4ebb68
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebb8a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405f58
ret
Function at 0x4ece00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405f48
xor eax, eax
push ebp
push 0x4ed019
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00405fb4
mov ebx, 1
mov dl, 1
mov eax, dword [0x42e3f8]
call fcn.0042e5dc
mov dword [ebp - 0x10], eax
mov edx, reloc.MLoad.dll_Ordinal_2
mov eax, dword [ebp - 0x10]
call fcn.0042e67c
xor ecx, ecx
mov edx, 0x4ed038
mov eax, dword [ebp - 0x10]
call fcn.0042e7c0
test al, al
je 0x4ece8c
mov edx, 0x4ed064
mov eax, dword [ebp - 0x10]
call fcn.0042ef3c
mov ebx, eax
cmp ebx, 1
jl 0x4ece7f
cmp ebx, 2
jle 0x4ece84
mov ebx, 1
mov eax, dword [ebp - 0x10]
call fcn.0042e64c
mov eax, dword [ebp - 0x10]
call fcn.0040428c
mov dl, 1
mov eax, dword [0x42e3f8]
call fcn.0042e5dc
mov dword [ebp - 0x10], eax
mov edx, reloc.MLoad.dll_Ordinal_2
mov eax, dword [ebp - 0x10]
call fcn.0042e67c
push 0x4ed080
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0040c63c
push dword [ebp - 0x18]
push 0x4ed0b8
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004063ec
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.0042e7c0
test al, al
je 0x4ecf2c
xor eax, eax
push ebp
push 0x4ecf10
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x4ed0dc
mov eax, dword [ebp - 0x10]
call fcn.0042eeb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ecf24
mov eax, dword [ebp - 0x10]
call fcn.0042e64c
mov eax, dword [ebp - 0x10]
call fcn.0040428c
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0040cd44
test al, al
je 0x4ecff1
push 0
push 0
push 0x4ed0f0
mov eax, dword [ebp - 0xc]
call fcn.00405fec
push eax
push 0x4ed100
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
mov esi, 1
mov eax, dword [0x4f6634]
mov eax, dword [eax]
call fcn.00476158
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, esi
mov ecx, 0xa
cdq
idiv ecx
test edx, edx
jne 0x4ecfeb
lea eax, [ebp - 0x1c]
mov ecx, 0x4ed118
mov edx, dword [ebp - 4]
call fcn.0040631c
mov eax, dword [ebp - 0x1c]
mov edx, 0x4ed130
call fcn.004ed3e0
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040610c
mov eax, dword [ebp - 8]
test eax, eax
je 0x4ecfda
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4ecfda
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004056d0
test eax, eax
je 0x4ecfe3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4ecfeb
mov bl, 1
jmp 0x4ecff1
inc esi
cmp esi, 0x1f
jne 0x4ecf75
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed020
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405f58
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405f58
ret