joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4985e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, 0x5f3900
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x49872d
push esi
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0053f340
add esp, 0xc
mov dword [ebp - 0x124], 0x11c
lea eax, [ebp - 0x124]
mov esi, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49871e
mov eax, dword [ebp - 0x120]
cmp eax, 6
jne 0x49865f
mov ecx, dword [ebp - 0x11c]
test ecx, ecx
jne 0x498665
cmp word [ebp - 0x10], cx
ja 0x498665
cmp eax, eax
jbe 0x49871e
push str.bcrypt.dll
mov esi, 1
call fcn.0042ec60
add esp, 4
test eax, eax
je 0x49871e
push 0x58f288
call fcn.0042ec60
add esp, 4
test eax, eax
je 0x49871e
push ebx
push edi
push 0
push str.Microsoft_Primitive_Provider
push str.ECDH_P256
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0
push eax
mov dword [ebp - 8], 0
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
mov edi, eax
test edi, edi
je 0x4986d1
mov dword [ebp - 0x128], 0
jmp 0x4986e3
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x4986e3
push 0
push eax
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
push 0
push str.Microsoft_Software_Key_Storage_Provider
lea eax, [ebp - 8]
push eax
call sub.ncrypt.dll_NCryptOpenStorageProvider
mov ecx, dword [ebp - 8]
mov ebx, eax
test ecx, ecx
je 0x498705
push ecx
call sub.ncrypt.dll_NCryptFreeObject
mov ecx, dword [ebp - 8]
test edi, edi
jne 0x49871c
test ebx, ebx
jne 0x49871c
cmp dword [ebp - 0x128], ebx
je 0x49871c
xor eax, eax
test ecx, ecx
cmovne esi, eax
pop edi
pop ebx
lea ecx, [esi + 1]
xor eax, eax
mov edx, 0x5f3900
lock cmpxchg dword [edx], ecx
pop esi
cmp dword [0x5f3900], 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret

Function at 0x498750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4987d9
cmp eax, 0x104
jae 0x4987d9
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4987c0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
jmp 0x4987f2
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x586454
mov ecx, esi
call fcn.00408f30
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x498810
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x498893
lea eax, [esi + 4]
push eax
call fcn.00415a80
add esp, 4
test al, al
je 0x498893
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x49888f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x49888f
mov al, 1
mov byte [esi], al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [esi], al
mov ecx, dword [ebp - 4]
mov al, byte [esi]
xor ecx, ebp
pop esi
call fcn.00401682
mov esp, ebp
pop ebp
ret

Function at 0x498fb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
test esi, esi
je 0x498fd8
call fcn.0040aac0
cmp eax, 1
jl 0x498fd8
mov dword [ebp - 4], 0x10000
jmp 0x498fda
xor esi, esi
push 8
call fcn.00406a5e
mov ecx, dword [ebp + 0xc]
add esp, 4
mov edi, dword [ebp + 0x10]
mov ebx, eax
test edi, edi
push 0
push dword [ebp - 4]
mov dword [ebx], ecx
setne cl
push ebx
push 0x499050
push esi
push 0
mov byte [ebx + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x499022
push 8
push ebx
call fcn.00409f25
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x499031
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49df70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575b26
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edi, dword [ebp + 0xc]
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push 0x8023
mov dword [ebp - 0x234], eax
lfence
call fcn.00406a5e
add esp, 4
test eax, eax
je 0x49e1fe
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
push 0x8000
push 0
push ecx
lea esi, [ecx + 0x8000]
mov dword [ebp - 0x230], ecx
mov dword [ecx - 4], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x220], esi
call fcn.0053f340
add esp, 0xc
mov dword [ebp - 0x224], esi
mov eax, dword [ebp - 0x234]
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x229], 0
test eax, eax
je 0x49e1d2
lea ecx, [ebp - 0x21c]
push ecx
push 0x8000
push dword [ebp - 0x230]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x49e1d2
mov eax, dword [ebp - 0x21c]
shr eax, 2
mov dword [ebp - 0x23c], eax
cmp eax, 0x2000
ja 0x49e1cb
xor esi, esi
mov byte [ebp - 0x229], 1
test eax, eax
je 0x49e1d2
nop dword [eax]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
mov eax, dword [ebp - 0x230]
mov eax, dword [eax + esi*4]
push eax
push dword [ebp - 0x234]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x49e1cb
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0040e532
mov edx, eax
add esp, 8
test edx, edx
je 0x49e0fb
add edx, 2
jmp 0x49e101
lea edx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x244], 0
mov word [ebp - 0x254], ax
mov eax, edx
mov dword [ebp - 0x240], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x238], ecx
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49e130
sub eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x254]
sar eax, 1
push eax
push edx
call fcn.00408f30
mov eax, dword [edi + 4]
mov byte [ebp - 4], 1
cmp eax, dword [edi + 8]
je 0x49e187
movups xmm0, xmmword [ebp - 0x254]
xor ecx, ecx
mov word [ebp - 0x254], cx
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x244]
movq qword [eax + 0x10], xmm0
mov eax, 7
add dword [edi + 4], 0x18
jmp 0x49e19c
lea ecx, [ebp - 0x254]
push ecx
push eax
mov ecx, edi
call fcn.0041f120
mov eax, dword [ebp - 0x240]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x49e1b8
inc eax
lea ecx, [ebp - 0x254]
push eax
push dword [ebp - 0x254]
call fcn.0040a2e0
inc esi
mov byte [ebp - 4], 0
cmp esi, dword [ebp - 0x23c]
jb 0x49e0a0
jmp 0x49e1d2
mov byte [ebp - 0x229], 0
lea ecx, [ebp - 0x228]
call fcn.0048a550
mov al, byte [ebp - 0x229]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
call fcn.0054223b
int3
Function at 0x49e210
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575b58
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x49e2ee
test edi, edi
je 0x49e2ee
mov dword [edi + 0x10], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x49e264
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x49e273
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x49e2ee
lea ecx, [ebp - 0x1d]
mov dword [ebp - 0x14], 0
push ecx
lea eax, [ebx + 1]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.00443b00
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x49e2b2
mov esi, dword [esi]
lea eax, [ebx + 1]
push eax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x49e2e0
cmp eax, ebx
ja 0x49e2e0
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.0040e5e0
lea ecx, [ebp - 0x1c]
mov bl, 1
call fcn.00430a10
mov al, bl
jmp 0x49e2f0
lea ecx, [ebp - 0x1c]
xor bl, bl
call fcn.00430a10
mov al, bl
jmp 0x49e2f0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x49ec20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
push esi
push edi
test ebx, ebx
je 0x49ed06
cmp word [ebx], 0x5c
jne 0x49ed06
cmp word [ebx + 2], 0x5c
jne 0x49ed06
mov eax, dword [0x5923a0]
mov edi, 0x43
mov dword [ebp - 0xc], eax
mov ax, word [0x5923a4]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], di
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x49ecfb
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x49ecfb
lea esi, [ebp - 0x214]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x49ecb7
sub esi, ecx
mov ecx, ebx
sar esi, 1
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49ecd0
sub ecx, edx
sar ecx, 1
cmp ecx, esi
jbe 0x49ecfb
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
lfence
call fcn.00420fc8
add esp, 0xc
test eax, eax
je 0x49ed19
inc edi
cmp di, 0x5a
jbe 0x49ec76
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0xc]
push eax
lfence
call fcn.0040e5e0
mov ecx, dword [ebp - 0x21c]
lea eax, [ebx + esi*2]
push eax
call fcn.0042ef80
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret

Function at 0x49ede0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x214]
push eax
push esi
mov dword [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x49eed4
test eax, eax
jne 0x49ee34
cmp dword [ebp - 0x214], eax
je 0x49eed4
push 0
push 1
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x49eed4
push edi
push 1
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x49eecc
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetMappedFileNameW
test eax, eax
je 0x49eec5
lea edx, [ebp - 0x210]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x49eea1
sub edx, ecx
lea eax, [ebp - 0x210]
mov ecx, dword [ebp - 0x218]
sar edx, 1
push edx
push eax
call fcn.00408f30
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x4a09c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor bl, bl
mov dword [ebp - 0x234], eax
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x4a09ed
mov dword [eax], 0
cmp dword [esi + 0x10], 0
je 0x4a0ac5
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4a0ab2
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.0053f340
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4a0aab
nop dword [eax]
xor eax, eax
cmp dword [esi + 0x14], 8
mov word [ebp - 6], ax
mov eax, esi
jb 0x4a0a50
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c291
add esp, 8
test eax, eax
je 0x4a0a97
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.0053f340
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a0a40
jmp 0x4a0aab
mov eax, dword [ebp - 0x234]
mov bl, 1
test eax, eax
je 0x4a0aab
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x4a8100
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5768eb
mov eax, dword fs:[0]
push eax
mov eax, 0x10bc
call fcn.0053d080
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x10]
cmp edi, 0x824
jb 0x4a8147
xor al, al
jmp 0x4a8310
push esi
lea ecx, [ebp - 0x1070]
call fcn.0040a1e0
mov dword [ebp - 4], 0
cmp edi, 2
jb 0x4a81b0
mov ecx, dword [esi + 0x14]
mov eax, esi
cmp ecx, 8
jb 0x4a816b
mov eax, dword [esi]
cmp word [eax], 0x22
jne 0x4a81b0
mov eax, esi
cmp ecx, 8
jb 0x4a817a
mov eax, dword [esi]
cmp word [eax + edi*2 - 2], 0x22
jne 0x4a81b0
lea eax, [edi - 2]
mov ecx, esi
push eax
push 1
lea eax, [ebp - 0x10c8]
push eax
lfence
call fcn.00409610
push eax
lea ecx, [ebp - 0x1070]
call fcn.0040f610
lea ecx, [ebp - 0x10c8]
call fcn.0040a280
cmp dword [ebp - 0x1060], 0
mov dword [ebp - 0x1074], 0x824
je 0x4a82e7
cmp dword [ebp - 0x105c], 8
lea eax, [ebp - 0x1070]
cmovae eax, dword [ebp - 0x1070]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x4a82e7
cmp dword [ebp - 0x105c], 8
lea ecx, [ebp - 0x10b0]
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x10ac], 0
push 0
push dword [ebp - 0x1060]
lea eax, [ebp - 0x1070]
movlpd qword [ebp - 0x10a4], xmm0
cmovae eax, dword [ebp - 0x1070]
push eax
movlpd qword [ebp - 0x109c], xmm0
movlpd qword [ebp - 0x1094], xmm0
movlpd qword [ebp - 0x108c], xmm0
movlpd qword [ebp - 0x1084], xmm0
movlpd qword [ebp - 0x107c], xmm0
mov dword [ebp - 0x10b0], 0x3c
mov dword [ebp - 0x10a8], 1
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4a82e7
mov eax, dword [ebp - 0x10a4]
cmp eax, 3
je 0x4a8279
cmp eax, 4
jne 0x4a82e7
cmp dword [ebp - 0x105c], 8
lea ecx, [ebp - 0x1074]
push 0
push 2
push ecx
lea ecx, [ebp - 0x1058]
lea eax, [ebp - 0x1070]
cmovae eax, dword [ebp - 0x1070]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_UrlGetPartW]
test eax, eax
jne 0x4a82e7
lea eax, [ebp - 0x1058]
push str.help.adobe.com
push eax
call fcn.0040c291
add esp, 8
test eax, eax
je 0x4a82e3
lea eax, [ebp - 0x1058]
push str.adobehelp.corp.adobe.com
push eax
call fcn.0040c291
add esp, 8
test eax, eax
jne 0x4a82e7
call fcn.004e2b00
test al, al
je 0x4a82e7
mov bl, 1
jmp 0x4a82e9
xor bl, bl
mov ecx, dword [ebp - 0x105c]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x4a830e
inc ecx
push ecx
push dword [ebp - 0x1070]
lea ecx, [ebp - 0x1070]
call fcn.0040a2e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x4a9160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5769e8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x5c], eax
call fcn.0040aac0
cmp eax, 3
jge 0x4a9327
or dword [ebp + 0x24], 0x1080000
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
mov eax, 1
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x54], 0x44
mov byte [ebp - 0x58], 0
lock xadd dword [0x5f3fc0], eax
inc eax
cmp eax, 1
sete bh
mov byte [ebp - 0x57], bh
xor bl, bl
mov dword [ebp - 4], esi
mov ecx, 0x5f3fc8
test bh, bh
je 0x4a92c6
cmp dword [0x5f3fc4], esi
jne 0x4a92c6
push 0x5f3fc4
push str.NtCreateProcessEx
call fcn.004305c0
mov ecx, dword [0x5f3fc4]
add esp, 8
test ecx, ecx
je 0x4a92c1
mov eax, dword [ebp + 0xc]
push ecx
push 0x4a9630
push str.NtCreateProcessEx
push 0x594888
push 0x58f3a0
mov dword [0x5ed910], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00411db0
add esp, 0x14
test al, al
je 0x4a92c1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x5f3fc8
xchg dword [ecx], eax
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
mov byte [ebp - 0x58], 1
push eax
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov bl, 1
mov ecx, 0x5f3fc8
mov dword [ebp - 4], 1
test bh, bh
je 0x4a9320
test bl, bl
je 0x4a9315
xor eax, eax
xchg dword [ecx], eax
push 0x4a9630
push dword [0x5f3fc4]
push str.NtCreateProcessEx
push 0x594888
push 0x58f3a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.00411db0
mov ecx, dword [0x5f3fc4]
xor edx, edx
add esp, 0x14
test al, al
cmovne ecx, edx
mov dword [0x5f3fc4], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x5ed910], eax
lock dec dword [0x5f3fc0]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x4b2840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576c6b
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
call fcn.00401bc0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x5817c0]
mov ecx, edi
call esi
mov ecx, eax
call fcn.00401c70
test al, al
je 0x4b2a67
call fcn.00416060
mov esi, eax
test esi, esi
je 0x4b2a67
test ebx, ebx
je 0x4b2a67
cmp word [ebx], 0
je 0x4b2a67
push ebx
lea ecx, [ebp - 0x23c]
call fcn.0040e610
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x4b2932
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x4b2932
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4b2932
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2910
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.00408f30
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x224]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
push esi
movq qword [ebp - 0x224], xmm0
call fcn.004bb5c0
push 0x34
lea eax, [ebp - 0x270]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea edi, [ebp - 0x23c]
cmp dword [ebp - 0x228], 8
lea ecx, [ebp - 0x224]
cmovae edi, dword [ebp - 0x23c]
call fcn.00416390
mov esi, eax
test esi, esi
je 0x4b2a5c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x274]
push 4
push 0
push 4
push eax
mov dword [ebp - 0x274], ecx
mov ecx, esi
push 0
mov dword [esi], 0x102
mov dword [esi + 4], 0
mov dword [esi + 0x3c], 3
mov dword [esi + 0x44], 0x70
call fcn.0041f690
test al, al
je 0x4b2a5c
push 1
push 0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x274], edi
call fcn.00416590
push eax
push edi
push 1
mov ecx, esi
call fcn.0041f690
test al, al
je 0x4b2a5c
push 6
push 1
push 0x208
push ebx
push 2
mov ecx, esi
mov dword [ebp - 0x278], 0x208
mov dword [ebp - 0x274], ebx
call fcn.0041f690
test al, al
je 0x4b2a5c
lea eax, [ebp - 0x270]
push eax
push esi
lea ecx, [ebp - 0x224]
call fcn.004bb5e0
mov edi, eax
cmp edi, 0xa
je 0x4b2a8c
mov ecx, dword [esi + 0x5c]
add ecx, esi
push ecx
lea ecx, [ebp - 0x278]
call fcn.0041ae80
lea ecx, [ebp - 0x224]
push esi
test al, al
jne 0x4b2a87
call fcn.00416c90
lea ecx, [ebp - 0x23c]
call fcn.0040a280
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 0xc
call fcn.00416c90
test edi, edi
jne 0x4b2a5c
lea ecx, [ebp - 0x23c]
call fcn.0040a280
lea eax, [edi + 1]
jmp 0x4b2a69