joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x496447
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x496431
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00475470
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x496460
call fcn.004799a8
mov eax, dword [0x4be7b4]
mov eax, dword [eax + 8]
mov edx, ebx
call fcn.00410da4
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.00403d38
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.0047f1fc
test al, al
jne 0x496431
call fcn.00407618
cmp eax, 2
jne 0x496416
mov eax, 0x496494
call fcn.00479788
jmp 0x496431
call fcn.00407618
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4964f0
call fcn.004799a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49644e
lea eax, [ebp - 0x18]
call fcn.00403ab8
ret
Function at 0x497d54
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497ecd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044bec0
lea eax, [ebp - 0x148]
mov edx, 0x497ee4
call fcn.00403d40
mov eax, dword [ebp - 0x148]
call fcn.00403efc
push eax
call fcn.00407548
mov ebx, eax
cmp ebx, 0xffffffff
je 0x497ea7
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00403ce8
mov eax, dword [ebp - 4]
call fcn.00403d38
cmp eax, 9
jl 0x497e8c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00403f40
mov eax, dword [ebp - 0x14c]
mov edx, 0x497ef8
call fcn.004096f8
test eax, eax
jne 0x497e8c
mov edx, 0x497f00
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
call fcn.0044e3cc
test al, al
je 0x497e8c
mov edx, 0x497f00
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
call fcn.0044e3cc
test al, al
je 0x497e8c
mov edx, 0x497f00
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
call fcn.0044e3cc
test al, al
je 0x497e8c
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x497e8c
lea eax, [ebp - 0x150]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00403f40
mov eax, dword [ebp - 0x150]
call fcn.00409cdc
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call fcn.00407550
test eax, eax
jne 0x497dc7
push ebx
call fcn.00407540
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497ed4
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00403adc
lea eax, [ebp - 4]
call fcn.00403ab8
ret
Function at 0x49a844
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 0x12], eax
mov eax, dword [esi]
call fcn.004129f0
mov dword [ebp - 0xe], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa], eax
call fcn.0049a76c
lea eax, [ebp - 0x12]
push eax
push 0
push 0x4a
mov eax, dword [0x4c038c]
push eax
call fcn.00407f00
mov ebx, eax
mov eax, esi
call fcn.0040d728
cmp ebx, 0x6c840001
jne 0x49a894
call fcn.0040c3e8
mov eax, ebx
and eax, 0xffff0000
cmp eax, 0x6c830000
je 0x49a8b8
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x49a968
call fcn.00475268
mov word [ebp - 6], bx
xor esi, esi
call fcn.00407690
mov ebx, eax
call dword [ebp - 4]
call fcn.00407690
mov edx, eax
sub edx, ebx
cmp edx, 0xa
jb 0x49a910
mov ebx, eax
mov edx, 1
mov ax, word [ebp - 6]
call fcn.0049a7c8
mov esi, eax
mov eax, esi
sub ax, 2
je 0x49a910
dec eax
sub ax, 2
jb 0x49a924
movzx eax, si
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x49a99c
call fcn.00475268
push 0xff
push 0xa
push 0
push 0
push 0
call fcn.00407e60
jmp 0x49a8c5
mov edx, 2
mov ax, word [ebp - 6]
call fcn.0049a7c8
movzx ebx, ax
mov edx, 3
mov ax, word [ebp - 6]
call fcn.0049a7c8
movzx eax, ax
shl eax, 0x10
or ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp si, 3
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x49af98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
mov edi, edx
mov esi, eax
push 0x49b044
push 0x49b060
call fcn.00407640
push eax
call fcn.00407658
mov ebx, eax
test ebx, ebx
je 0x49b02e
mov eax, esi
call fcn.00403efc
push eax
call fcn.00407600
cmp eax, 0xffffffff
je 0x49b02e
test al, 0x10
je 0x49afdf
mov ebp, 0x2000000
jmp 0x49afe1
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.00403efc
push eax
call fcn.004074d8
mov ebp, eax
cmp ebp, 0xffffffff
je 0x49b02e
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call fcn.004074a8
test ebx, ebx
jle 0x49b02e
cmp ebx, 0xff0
jge 0x49b02e
mov edx, edi
mov eax, esp
call fcn.0049aec4
jmp 0x49b037
mov eax, edi
mov edx, esi
call fcn.00403b0c
add esp, 0x1000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49b070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49b101
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call fcn.004075a8
mov ebx, eax
test ebx, ebx
jle 0x49b0d7
cmp ebx, 0x104
jge 0x49b0d7
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00403ce8
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.0049af98
jmp 0x49b0e8
mov eax, 0x49b118
call fcn.00475418
mov eax, esi
call fcn.00403ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b108
lea eax, [ebp - 0x108]
call fcn.00403ab8
ret
Function at 0x49b12c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49b27b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0049af98
lea eax, [ebp - 0xc]
call fcn.0049b070
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402acc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x49b288
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00403efc
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.00403efc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
call fcn.00403efc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call fcn.0044c6f0
test eax, eax
jne 0x49b1d7
call fcn.00407618
cmp eax, 0x4c7
jne 0x49b1cd
call fcn.0040c38c
mov eax, 0x49b298
call fcn.00475364
cmp dword [ebp - 0x10], 0
jne 0x49b1e7
mov eax, 0x49b2b0
call fcn.00475210
xor edx, edx
push ebp
push 0x49b259
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0049acb8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call fcn.00407e60
cmp eax, 1
je 0x49b1f5
cmp eax, 0xffffffff
jne 0x49b222
mov eax, 0x49b2dc
call fcn.00475364
call fcn.0049acb8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004075f8
test eax, eax
jne 0x49b242
mov eax, 0x49b300
call fcn.00475364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b260
mov eax, dword [ebp - 0x10]
push eax
call fcn.004074a8
ret

Function at 0x49b314
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49b3e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x49ac5c]
call fcn.0049b3fc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49b3b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x49b3f4
call fcn.0040aa18
mov edx, dword [ebp - 8]
mov eax, dword [0x4bea64]
mov eax, dword [eax]
call fcn.0044a864
call fcn.0049acb8
call fcn.00407c90
mov edx, dword [0x4bea64]
mov edx, dword [edx]
cmp eax, dword [edx + 0x24]
jne 0x49b39c
push 0x7a
call fcn.00407cb0
test ax, ax
jl 0x49b3a3
call fcn.00408020
jmp 0x49b379
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b3c0
mov eax, dword [ebp - 4]
call fcn.00402e48
ret
Function at 0x49f854
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x49f85c
push ecx
push ebx
xor eax, eax
push ebp
push 0x49f9c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004758e4
mov edx, dword [ebp - 0x10]
mov eax, 0x4c0434
call fcn.00403b0c
lea eax, [ebp - 0x14]
mov ecx, dword [0x4c0434]
mov edx, 0x49f9d8
call fcn.00403d84
mov eax, dword [ebp - 0x14]
call fcn.00479788
mov eax, dword [0x4beb04]
cmp byte [eax], 0
je 0x49f8b7
mov eax, dword [0x4c0434]
call fcn.00478f38
lea edx, [ebp - 0x18]
mov eax, dword [0x4c0434]
call fcn.0044bec0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x49fa00
call fcn.00403d84
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call fcn.004074c8
test eax, eax
jne 0x49f94d
call fcn.00407618
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004731d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00409ca8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.0044e218
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x60
call fcn.004731a0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x408a18]
call fcn.0040c3f4
call fcn.00403588
lea eax, [ebp - 0xc]
mov ecx, 0x49fa10
mov edx, dword [ebp - 4]
call fcn.00403d84
mov edx, dword [ebp - 0xc]
mov eax, 0x49fa28
call fcn.0049f7fc
lea eax, [ebp - 8]
call fcn.0047a490
cmp dword [ebp - 8], 0
je 0x49f99b
lea eax, [ebp - 0xc]
mov ecx, 0x49fa3c
mov edx, dword [ebp - 4]
call fcn.00403d84
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0049f7fc
mov eax, dword [ebp - 0xc]
call fcn.0047a4d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f9ca
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403adc
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403adc
ret

Function at 0x4a18c4
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x4c06c9], 1
call fcn.0047736c
test al, al
jne 0x4a1910
push 5
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call fcn.00407fd8
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call fcn.00407f40
push 0
push 1
push 1
mov eax, dword [0x4bea70]
mov eax, dword [eax + 0x108]
mov cl, 2
xor edx, edx
call fcn.004a17d0
ret

Function at 0x4a5b74
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call fcn.00407690
mov ebx, eax
jmp 0x4a5ba0
call fcn.00407690
sub eax, ebx
cmp eax, 0x3e8
jae 0x4a5ba9
call fcn.004a4d94
mov eax, 0xa
call fcn.0044e5a4
call fcn.004a4d94
call fcn.004a5b40
test al, al
jne 0x4a5b7e
pop ebx
ret
Function at 0x4a6074
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x4be6e0]
cmp dword [eax], 0
je 0x4a611c
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.0043338c
test al, al
je 0x4a611c
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
cmp byte [eax + 0x168], 0
je 0x4a60c6
cmp byte [ebx + 0x2e1], 0
jne 0x4a60c6
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call fcn.00407de0
test eax, eax
je 0x4a60ca
xor eax, eax
jmp 0x4a60cc
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.00433090
push eax
call fcn.00407d80
test eax, 0x10000000
setne al
cmp bl, al
je 0x4a611c
test bl, bl
je 0x4a6108
push 5
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.00433090
push eax
call fcn.00407fd8
jmp 0x4a611c
push 0
mov eax, dword [0x4be6e0]
mov eax, dword [eax]
call fcn.00433090
push eax
call fcn.00407fd8
pop ebx
ret

Function at 0x4a61cc
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x4c0684], 0
push 0x4a62a4
call fcn.00407640
mov ebx, eax
push 0x4a62b4
push ebx
call fcn.00407658
test eax, eax
je 0x4a6258
lea edx, [esp + 4]
push edx
call eax
push 0x4a62c8
push ebx
call fcn.00407658
mov esi, eax
test esi, esi
je 0x4a6262
push esp
call fcn.004075b0
push eax
call esi
test eax, eax
je 0x4a6262
cmp dword [esp], 0
je 0x4a6262
call fcn.00474588
test al, al
je 0x4a6262
push 0x4a62d8
push ebx
call fcn.00407658
test eax, eax
je 0x4a6262
push 0x4a62f4
push 0x4a6304
call fcn.00407640
push eax
call fcn.00407658
test eax, eax
je 0x4a6262
mov byte [0x4c0684], 1
jmp 0x4a6262
lea eax, [esp + 4]
push eax
call fcn.00407678
mov ax, word [esp + 4]
sub ax, 1
jb 0x4a627b
sub ax, 5
je 0x4a6284
sub ax, 3
je 0x4a628d
jmp 0x4a6296
mov byte [0x4be24c], 1
jmp 0x4a629d
mov byte [0x4be24c], 3
jmp 0x4a629d
mov byte [0x4be24c], 2
jmp 0x4a629d
mov byte [0x4be24c], 0
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x4a6314
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4a6384
mov edx, 0x80000002
xor eax, eax
call fcn.0044d8c4
test eax, eax
jne 0x4a637d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4a63b0
mov eax, dword [ebp - 4]
push eax
call fcn.00407498
test eax, eax
jne 0x4a6374
cmp dword [ebp - 0xc], 4
jne 0x4a6374
cmp dword [ebp - 8], 4
jne 0x4a6374
mov ax, word [ebp - 0x10]
mov word [0x4c0698], ax
mov eax, dword [ebp - 4]
push eax
call fcn.00407458
mov esp, ebp
pop ebp
ret
Function at 0x4a64f0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call fcn.004076a8
test eax, eax
je 0x4a65a2
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x4c0694], eax
cmp byte [0x4c0683], 0
je 0x4a65a2
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4a6593
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call fcn.004076a8
test eax, eax
je 0x4a65a2
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x4c0698], ax
mov al, byte [esp + 0x12e]
mov byte [0x4c069a], al
mov ax, word [esp + 0x12c]
mov word [0x4c069c], ax
jmp 0x4a65a2
cmp eax, 4
jne 0x4a65a2
call fcn.004a6314
call fcn.004a63bc
add esp, 0x130
ret
Function at 0x4b0bcc
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4b0d6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
mov ecx, 0x200
xor edx, edx
call fcn.00403ba0
push 0
xor eax, eax
mov al, byte [ebp + 8]
mov eax, dword [eax*4 + 0x4be684]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403efc
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0044d8c4
test eax, eax
jne 0x4b0d52
xor edx, edx
push ebp
push 0x4b0d47
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [esi + 4]
mov eax, dword [esi]
xor ecx, ecx
call fcn.00457fd8
xor ebx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00403d38
mov dword [ebp - 0x18], eax
cmp byte [ebp + 8], 0
je 0x4b0c84
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403f08
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407478
jmp 0x4b0ca3
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403f08
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407480
sub eax, 1
jb 0x4b0cf1
sub eax, 0xe9
je 0x4b0cb6
sub eax, 0x19
je 0x4b0d30
jmp 0x4b0cea
mov eax, dword [ebp - 0x10]
call fcn.00403d38
cmp eax, 0x10000
jl 0x4b0ccf
call fcn.00403628
jmp 0x4b0d52
mov eax, dword [ebp - 0x10]
call fcn.00403d38
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.00403ba0
jmp 0x4b0c52
call fcn.00403628
jmp 0x4b0d52
lea ecx, [ebx + 1]
mov edx, dword [esi + 4]
mov eax, dword [esi]
call fcn.00457fd8
lea eax, [ebp - 0x10]
call fcn.00403f08
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.00403ba0
lea ecx, [ebp - 0x24]
mov eax, esi
mov edx, ebx
call fcn.00464c84
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00456ef0
inc ebx
jmp 0x4b0c52
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0d4e
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407458
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0d74
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403adc
ret
Function at 0x4b9980
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b9a28
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b9a40
push ebx
push 0x4b9a4c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403df8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402acc
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
push 0
call fcn.004074f8
test eax, eax
jne 0x4b9a06
mov eax, dword [0x4bea70]
mov eax, dword [eax + 0x188]
call fcn.004b98d8
mov eax, dword [ebp - 0x54]
push eax
call fcn.004074a8
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9a2f
lea eax, [ebp - 4]
call fcn.00403ab8
ret
Function at 0x4ba244
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ba42f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0044d4c8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00475780
test al, al
jne 0x4ba2b1
xor eax, eax
push ebp
push 0x4ba2a7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00475ad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ba2b1
push 0
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
mov eax, dword [0x4c078c]
call fcn.00403efc
push eax
call fcn.004074c0
test eax, eax
jne 0x4ba2e0
mov eax, dword [0x4bea70]
mov eax, dword [eax + 0x184]
call fcn.004b98d8
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403efc
push eax
call fcn.004077c0
push 0
mov eax, dword [0x4bf4dc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4ba440
push 0x4ba444
push 0
call fcn.00407b58
mov dword [ebp - 8], eax
push 0x4b9a8c
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call fcn.00407f98
mov dword [0x4c07b8], eax
xor eax, eax
push ebp
push 0x4ba3f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call fcn.00407fa8
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.0044cfa0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4ba454
call fcn.0040aa18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.0044ce88
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00403d40
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004b9980
mov dword [ebp - 0xc], eax
call fcn.004b9a50
test al, al
jne 0x4ba3d8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.00407e60
cmp eax, 1
je 0x4ba3b6
mov eax, dword [ebp - 0xc]
push eax
call fcn.004074a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba3ff
mov eax, dword [ebp - 8]
push eax
call fcn.00407b98
ret
Function at 0x4bb42c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bb6e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov edx, 0x4bb6fc
call fcn.0044a864
push 5
mov eax, dword [0x4bea64]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call fcn.00407fd8
xor edx, edx
push ebp
push 0x4bb6aa
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004a1b20
lea eax, [ebp - 0x10]
call fcn.0044d418
mov eax, dword [ebp - 0x10]
call fcn.0040a28c
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0044cfa0
mov edx, dword [ebp - 0x14]
mov eax, 0x4c078c
call fcn.00403b0c
call fcn.004b9c30
lea ecx, [ebp - 0x18]
mov edx, 0x4bb710
mov eax, dword [0x4c078c]
call fcn.0044bf78
mov edx, dword [ebp - 0x18]
mov eax, 0x4c0790
call fcn.00403b0c
lea ecx, [ebp - 0x1c]
mov edx, 0x4bb720
mov eax, dword [0x4c078c]
call fcn.0044bf78
mov edx, dword [ebp - 0x1c]
mov eax, 0x4c0794
call fcn.00403b0c
push 2
push 0
push 1
mov ecx, dword [0x4c078c]
mov dl, 1
mov eax, dword [0x4720ac]
call fcn.00472398
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bb581
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.0047235c
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.00472334
cmp dword [ebp - 0xc], 0x67734d49
je 0x4bb55c
mov cl, 1
xor edx, edx
mov eax, dword [0x4c0794]
call fcn.00473328
jmp 0x4bb56b
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x4c078c]
call fcn.00473328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb588
mov eax, dword [ebp - 4]
call fcn.00402e48
ret