joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51abf0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
test dl, dl
je 0x51ac07
add esp, 0xfffffff0
call fcn.00403964
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0045f1f4
xor eax, eax
mov dword [esi + 0x380], eax
mov dl, 1
mov eax, esi
call fcn.00460060
mov byte [esi + 0x387], 1
mov al, byte [0x51acf0]
mov byte [esi + 0x389], al
mov byte [esi + 0x384], 1
mov byte [esi + 0x386], 1
mov byte [esi + 0x385], 0
mov dl, 1
mov eax, dword [0x41a1ec]
call fcn.004035d0
mov dword [esi + 0x3a0], eax
xor eax, eax
mov dword [esi + 0x3a4], eax
mov byte [esi + 0x388], 0
mov byte [esi + 0x3b8], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x51acf4
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x390], eax
push 0x4000
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x51acf4
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x38c], eax
lea eax, [esi + 0x37c]
mov edx, 0x51ad00
call fcn.00404488
xor edx, edx
mov eax, esi
call fcn.004604bc
mov eax, esi
test bl, bl
je 0x51ace8
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51c7e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51c9df
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x51c821
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0051ce70
jmp 0x51c850
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
call fcn.004048f4
push eax
mov eax, edi
call fcn.004048f4
push eax
mov eax, esi
call fcn.004048f4
push eax
mov eax, ebx
call fcn.004048f4
push eax
push 0
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jg 0x51c9c7
lea eax, [ebp - 8]
mov edx, 0x51c9fc
call fcn.004044cc
mov eax, dword [ebp - 4]
cmp eax, 0x20
ja case.0x51c879.0
mov al, byte [eax + 0x51c880]
jmp dword [eax*4 + 0x51c8a1]
lea eax, [ebp - 8]
mov edx, 0x51ca14
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51ca50
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51ca7c
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51caa8
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x6b0228
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cb38
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cb74
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cbdc
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cc00
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cc54
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cc90
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cce0
call fcn.004044cc
jmp case.0x51c879.0
lea eax, [ebp - 8]
mov edx, 0x51cd20
call fcn.004044cc
push 0x10
mov eax, dword [ebp - 8]
call fcn.004048f4
mov edx, eax
mov ecx, 0x6b6164
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
xor ebx, ebx
jmp 0x51c9c9
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c9e6
lea eax, [ebp - 8]
call fcn.00404434
ret
Function at 0x52ae44
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x52ae4c
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x52b090
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404434
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
call fcn.00404434
xor eax, eax
push ebp
push 0x52b045
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x52b0a8
call fcn.004044cc
xor ebx, ebx
lea eax, [ebp - 0x14]
call fcn.0052adb0
jmp 0x52aea3
inc ebx
push dword [ebp - 0x14]
push 0x52b0bc
push dword [ebp - 0xc]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00408e44
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004047b4
mov eax, dword [ebp - 0x18]
call fcn.00409440
test al, al
jne 0x52aea2
push dword [ebp - 0x14]
push 0x52b0bc
push dword [ebp - 0xc]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00408e44
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004047b4
mov eax, dword [ebp - 0x14]
call fcn.00409acc
test al, al
jne 0x52af1c
mov eax, 0x1583
call fcn.004fb63c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b075
push 0
lea eax, [ebp - 0x24]
mov ecx, 0x52b0c8
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.004048f4
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a1a74
mov eax, dword [ebp - 0x28]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x52af6f
mov eax, 0x1584
call fcn.004fb63c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b075
lea eax, [ebp - 0x2c]
mov ecx, 0x52b0c8
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov eax, dword [ebp - 0x2c]
call fcn.0040954c
mov ebx, eax
and bx, 0xfffe
lea eax, [ebp - 0x30]
mov ecx, 0x52b0c8
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov eax, dword [ebp - 0x30]
movzx edx, bx
call fcn.00409560
lea eax, [ebp - 0x10]
mov ecx, 0x52b0c8
mov edx, dword [ebp - 0x14]
call fcn.00404740
push 0
lea eax, [ebp - 0x34]
mov ecx, 0x52b0c8
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.0041fa64
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041f56c
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041f56c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004f8638
test al, al
jne 0x52b033
mov eax, dword [ebp - 4]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b075
mov eax, dword [ebp - 4]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b06b
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.00404488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b097
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404458
ret
Function at 0x52c37c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52c490
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x52c45b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402c84
mov eax, 0x32
call fcn.00402f90
inc eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x52c3fb
inc ebx
mov eax, 0x7fffffff
call fcn.00402f90
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x10]
dec ebx
jne 0x52c3db
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x15], al
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004044cc
mov eax, dword [ebp - 0x14]
call fcn.004046f4
mov ebx, eax
test ebx, ebx
jle 0x52c438
mov esi, 1
lea eax, [ebp - 0x14]
call fcn.0040494c
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 0x15]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x52c41e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004fba10
test al, al
jne 0x52c451
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52c47a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52c476
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52c497
lea eax, [ebp - 0x14]
call fcn.00404434
ret

Function at 0x52c4a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x52c596
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x52c561
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x52c501
inc ebx
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
dec ebx
jne 0x52c4ef
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x15], al
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.004fbacc
test al, al
jne 0x52c51f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52c580
mov eax, dword [ebp - 0x14]
call fcn.004046f4
mov ebx, eax
test ebx, ebx
jle 0x52c54c
mov esi, 1
lea eax, [ebp - 0x14]
call fcn.0040494c
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 0x15]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x52c532
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52c57c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52c59d
lea eax, [ebp - 0x14]
call fcn.00404434
ret
Function at 0x5556fc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x5558fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x376], 1
cmp dword [ebp - 4], 0
jne 0x55577a
xor edx, edx
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x33c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x308]
call fcn.004835fc
mov esi, eax
dec esi
test esi, esi
jl 0x5558e0
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x308]
call fcn.004835c0
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc edi
dec esi
jne 0x55575d
jmp 0x5558e0
mov dl, 1
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x33c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x308]
call fcn.004835fc
mov esi, eax
dec esi
test esi, esi
jl 0x5557c1
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x308]
call fcn.004835c0
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc edi
dec esi
jne 0x5557a9
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
mov edx, dword [esi + 0x14]
mov eax, dword [ebx + 0x31c]
call fcn.0047ffe4
lea edx, [ebp - 8]
mov ax, word [esi + 4]
call fcn.00490198
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x320]
call fcn.0047ffe4
mov eax, dword [ebx + 0x340]
mov eax, dword [eax + 0x168]
xor edx, edx
call fcn.0042c71c
mov edx, dword [esi + 0x18]
mov eax, dword [ebx + 0x348]
call fcn.0047ffe4
mov dl, byte [esi + 6]
mov eax, dword [ebx + 0x350]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xa]
mov eax, dword [ebx + 0x354]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 9]
mov eax, dword [ebx + 0x360]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 8]
mov eax, dword [ebx + 0x358]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xc]
mov eax, dword [ebx + 0x35c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xb]
mov eax, dword [ebx + 0x364]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
xor edx, edx
mov dl, byte [esi + 7]
mov eax, dword [ebx + 0x370]
call fcn.0054ab8c
mov eax, dword [esi + 0x1c]
call fcn.0040553c
test eax, eax
jne 0x5558a4
mov edx, 0x555914
mov eax, dword [ebx + 0x368]
call fcn.0047ffe4
jmp 0x5558b4
mov edx, 0x6b1328
mov eax, dword [ebx + 0x368]
call fcn.0047ffe4
cmp dword [esi + 0x10], 0
je 0x5558e0
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x340]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x340]
call fcn.0043b568
mov ecx, dword [esi + 0x10]
pop edx
call fcn.0042a12c
mov byte [ebx + 0x376], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555904
lea eax, [ebp - 8]
call fcn.00404434
ret
Function at 0x55c9e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x55c9e8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x55cc00
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov edx, 0x400
call fcn.00404a80
push 0x400
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040462c
lea eax, [ebp - 0x20]
mov edx, 0x55cc1c
call fcn.004044cc
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
jne 0x55ca6e
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 1
call fcn.00404994
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.00409430
test al, al
jne 0x55cb30
xor eax, eax
push ebp
push 0x55cb08
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a850]
call fcn.004035d0
mov dword [ebp - 8], eax
call fcn.0040af5c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.0040a908
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x55cc30
call fcn.00404740
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55cb24
mov dword [ebp - 4], 0x1e
jmp 0x55cbd8
xor eax, eax
push ebp
push 0x55cb94
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a850]
call fcn.004035d0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 0x10]
mov edx, 0x55cc3c
mov eax, dword [ebp - 8]
call fcn.0041e6a0
mov eax, dword [ebp - 0x10]
call fcn.0040a968
fstp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55cbb4
call fcn.0040af5c
fsubr qword [ebp - 0x18]
call fcn.00402d38
add eax, 0x1e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x55cbd3
cmp dword [ebp - 4], 0x1e
jle 0x55cbd8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cc07
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404458
ret
Function at 0x568940
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x568b66
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x568b43
mov eax, dword [0x5ae694]
mov eax, dword [eax]
call fcn.0059d078
test al, al
je 0x568b43
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049f32c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x568a3a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x568b80
call fcn.00404740
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.0041fa64
mov dword [ebp - 0xc], eax
push 0xffff
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x34c]
call fcn.00437fa4
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.0041fa64
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0041f5d0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0041f7e8
mov eax, dword [ebp - 0xc]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x568a76
mov eax, dword [ebp - 8]
call fcn.0041f54c
mov dword [ebp - 0x10], eax
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004f83e4
test al, al
jne 0x568ab2
mov eax, dword [ebp - 8]
call fcn.00403600
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
xor edx, edx
call fcn.0049f32c
jmp 0x568b43
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 8]
call fcn.00403600
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x34c]
call fcn.00437fa4
mov eax, dword [ebp - 0x1c]
mov edx, 0x568b98
call fcn.004fd200
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
xor edx, edx
call fcn.0049f32c
mov byte [ebp - 1], 1
push 0x44
mov ecx, 0x6b6642
mov edx, 0x6b6653
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
cmp eax, 6
jne 0x568b43
push 5
push 0
push 0
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x34c]
call fcn.00437fa4
mov eax, dword [ebp - 0x20]
call fcn.004048f4
push eax
push 0x6b667b
mov eax, ebx
call fcn.004869e8
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568b6d
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404458
lea eax, [ebp - 0x14]
call fcn.00404434
ret
Function at 0x56c5b4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x56c6d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 4]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, 0x56c6f0
call fcn.004f90e8
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x4ec]
add eax, 0x78
call fcn.00404488
mov eax, dword [esi + 0x4ec]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x56c6a0
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x4ec]
call fcn.00437fa4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040898c
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, 0x56c6f0
call fcn.004f90e8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040898c
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00404840
je 0x56c6a0
push 0
lea ecx, [ebp - 0x18]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, 0x56c6f0
call fcn.004f90e8
mov eax, dword [ebp - 0x18]
call fcn.004048f4
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x4ec]
call fcn.00437fa4
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x56c69e
mov eax, 0x13ec
call fcn.004fb63c
jmp 0x56c6a0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c6df
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404458
lea eax, [ebp - 0xc]
call fcn.00404434
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404458
ret
Function at 0x56ce80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x56ce89
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x56d0cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.004044cc
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408bdc
mov eax, dword [ebp - 0x14]
mov edx, 0x56d0e8
call fcn.00404840
jne 0x56ced9
lea eax, [ebp - 8]
call fcn.00404434
mov eax, dword [edi + 0x4a8]
add eax, 0x60
mov edx, dword [ebp - 4]
call fcn.00404488
cmp dword [ebp - 8], 0
je 0x56cf2e
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
je 0x56cf08
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x56d0e8
call fcn.00404740
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00408bdc
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
mov eax, dword [edi + 0x4a8]
add eax, 0x78
call fcn.00404740
jmp 0x56cf4f
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
mov eax, dword [edi + 0x4a8]
call fcn.0043800c
mov eax, dword [edi + 0x4a8]
add eax, 0x78
call fcn.00404434
mov eax, dword [edi + 0x4a8]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x56d0b2
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x4a8]
call fcn.00437fa4
lea ecx, [ebp - 8]
mov eax, dword [0x5aeb50]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.004f9008
cmp dword [ebp - 8], 0
jne 0x56d0a6
push 0x24
mov ecx, 0x6b66d4
mov edx, 0x6b66e6
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
cmp eax, 6
jne 0x56d0b2
lea eax, [ebp - 8]
mov edx, 0x6b1bd0
call fcn.004f8e90
test al, al
je 0x56d0b2
mov eax, dword [ebp - 8]
mov edx, 0x56d0e8
call fcn.00404840
jne 0x56cfd9
lea eax, [ebp - 8]
call fcn.00404434
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409930
cmp dword [ebp - 0x10], 0
je 0x56d002
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x5c
je 0x56d002
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x56d0e8
call fcn.00404740
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004046fc
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x1c]
call fcn.00409430
test al, al
je 0x56d068
push 0x24
push 0x56d174
push dword [ebp - 0x10]
push 0x6b1c0c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x20]
call fcn.004048f4
mov edx, eax
mov ecx, 0x6b672c
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a15f4
cmp eax, 6
jne 0x56d0b2
push 0
mov edx, dword [0x5aeb50]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.004048f4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x56d0b2
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
jmp 0x56d0b2
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d0d4
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00404458
ret
Function at 0x5860a8
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x5860c0
push 0x5860d8
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x5860e0
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push 0x5860f8
push 0x586120
push eax
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x586128
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x58613c
push 0
push eax
call sub.shell32.dll_ShellExecuteA
ret