joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4898f4
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4898fd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x489b15
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004055f4
xor edx, edx
push ebp
push 0x489ac0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x489b30
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00471960
test al, al
jne 0x48995d
mov eax, dword [ebp + 8]
call fcn.004055f4
call fcn.00405014
jmp 0x489ad2
lea edx, [ebp - 4]
mov eax, 0x489b44
call fcn.00471aa4
mov eax, dword [ebp - 4]
call fcn.00406a00
cmp ebx, eax
jle 0x489980
mov eax, dword [ebp - 4]
call fcn.00406a00
mov ebx, eax
cmp byte [ebp - 0x12], 0
je 0x489992
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00406a00
jmp 0x489996
mov esi, ebx
mov eax, ebx
mov ebx, esi
mov esi, eax
sub esi, ebx
jl 0x489a91
inc esi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, ebx
test edi, edi
jns 0x4899b8
call fcn.004045bc
mov ecx, edi
mov edx, 0x489b64
mov eax, dword [ebp - 4]
call fcn.00471304
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x489b74
call fcn.0040b948
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.00471aa4
push 0
lea eax, [ebp - 0xc]
push eax
test ebx, ebx
jns 0x4899fa
call fcn.004045bc
mov ecx, edi
mov edx, 0x489bc0
mov eax, dword [ebp - 4]
call fcn.00471304
mov edx, 0x489bd4
mov eax, dword [ebp - 0xc]
call fcn.00409c08
test al, al
jne 0x489a76
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004058d0
cmp byte [ebp - 0x11], 0
je 0x489a61
push dword [ebp - 0x10]
push 0x489be4
push 0
lea eax, [ebp - 0x28]
push eax
test ebx, ebx
jns 0x489a42
call fcn.004045bc
mov ecx, edi
mov edx, 0x489bf4
mov eax, dword [ebp - 4]
call fcn.00471304
push dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405988
cmp byte [ebp - 0x12], 0
je 0x489a89
lea eax, [ebp - 0x10]
mov edx, 0x489c04
call fcn.004058d0
jmp 0x489a89
cmp byte [ebp - 0x12], 0
jne 0x489a89
lea eax, [ebp - 0x10]
mov edx, 0x489c10
call fcn.0040568c
inc ebx
dec esi
jne 0x4899a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489ac7
call fcn.00471e08
lea eax, [ebp - 4]
mov edx, dword [0x4712d8]
call fcn.00406350
lea eax, [ebp - 8]
mov edx, dword [0x4712d8]
call fcn.00406350
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489b1c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405618
lea eax, [ebp - 0x18]
call fcn.004055f4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405618
lea eax, [ebp - 8]
mov edx, dword [0x4712d8]
mov ecx, 2
call fcn.00406264
ret
Function at 0x496f9c
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x4ed928], 0
mov eax, dword [0x4f198c]
cmp dword [eax], 2
jne 0x497175
mov eax, dword [0x4f145c]
cmp dword [eax], 5
jl 0x497175
call fcn.0048ebb8
test al, al
jne 0x496fcd
call fcn.0048ebc4
call fcn.0048ebb0
mov dword [0x4ed930], eax
push 0x497178
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed8f4], eax
cmp dword [0x4ed8f4], 0
jne 0x497028
mov edx, 0x8000
mov eax, 0x49718c
call fcn.00410720
mov dword [0x4ed92c], eax
mov eax, dword [0x4ed92c]
mov dword [0x4ed930], eax
push 0x497178
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed8f4], eax
cmp dword [0x4ed8f4], 0
je 0x497170
push 0x497198
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed8f8], eax
cmp dword [0x4ed8f8], 0
je 0x497170
push 0x4971a4
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed8fc], eax
cmp dword [0x4ed8fc], 0
je 0x497170
mov byte [0x4ed928], 1
push 0x4971b4
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed900], eax
push 0x4971c0
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed904], eax
push 0x4971cc
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed908], eax
push 0x4971dc
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed90c], eax
push 0x4971ec
mov eax, dword [0x4ed930]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed910], eax
mov edx, 0x8000
mov eax, 0x497204
call fcn.00410720
mov dword [0x4ed934], eax
cmp dword [0x4ed934], 0
je 0x497175
push 0x497214
mov eax, dword [0x4ed934]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed914], eax
push 0x497230
mov eax, dword [0x4ed934]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed918], eax
push 0x497250
mov eax, dword [0x4ed934]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed91c], eax
push 0x49726c
mov eax, dword [0x4ed934]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed920], eax
push 0x497284
mov eax, dword [0x4ed934]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ed924], eax
ret
call fcn.00496f1c
ret

Function at 0x4b5038
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx edi, word [edx]
add edi, edi
movzx esi, cl
mov ebp, esi
shr ebp, 7
or edi, ebp
cmp edi, 0xffff
jbe 0x4b5064
call fcn.004045bc
mov word [edx], di
test bl, bl
je 0x4b5070
xor word [edx], 0x1021
add esi, esi
and esi, 0xff
cmp esi, 0xff
jbe 0x4b5085
call fcn.004045bc
mov ecx, esi
dec eax
jne 0x4b5041
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c27dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 9]
dec eax
test eax, eax
jl 0x4c282b
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
lea eax, [eax + edx*8]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
lea edx, [edx + ecx*8]
mov ecx, dword [ebp - 0x14]
xor byte [edx + ecx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x4c2805
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x4c27f0
mov esp, ebp
pop ebp
ret
Function at 0x4c2f1c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x200]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x4c2f58
sub eax, 0x40
je 0x4c2f61
sub eax, 0x40
je 0x4c2f6a
jmp 0x4c2f73
mov dword [ebp - 0x18], 4
jmp 0x4c2f7f
mov dword [ebp - 0x18], 6
jmp 0x4c2f7f
mov dword [ebp - 0x18], 8
jmp 0x4c2f7f
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x4c3072
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004c2760
sub eax, 0x80
je 0x4c2fa6
sub eax, 0x40
je 0x4c2faf
sub eax, 0x40
je 0x4c2fb8
jmp 0x4c2fc1
mov dword [ebp - 0x1c], 0xa
jmp 0x4c2fcd
mov dword [ebp - 0x1c], 0xc
jmp 0x4c2fcd
mov dword [ebp - 0x1c], 0xe
jmp 0x4c2fcd
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x4c3072
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x200]
mov eax, dword [ebp - 4]
call fcn.004c27dc
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jle 0x4c3038
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 1
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.004c28f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004c2838
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004c2954
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.004c27dc
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x4c2ff0
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.004c28f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004c2838
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.004c27dc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c3080
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe04
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x1fc]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x4c30bc
sub eax, 0x40
je 0x4c30c5
sub eax, 0x40
je 0x4c30ce
jmp 0x4c30d7
mov dword [ebp - 0x18], 4
jmp 0x4c30e3
mov dword [ebp - 0x18], 6
jmp 0x4c30e3
mov dword [ebp - 0x18], 8
jmp 0x4c30e3
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x4c31d1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004c2760
sub eax, 0x80
je 0x4c310a
sub eax, 0x40
je 0x4c3113
sub eax, 0x40
je 0x4c311c
jmp 0x4c3125
mov dword [ebp - 0x1c], 0xa
jmp 0x4c3131
mov dword [ebp - 0x1c], 0xc
jmp 0x4c3131
mov dword [ebp - 0x1c], 0xe
jmp 0x4c3131
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x4c31d1
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.004c27dc
mov cl, byte [ebp - 0x18]
mov edx, 0x4eed64
mov eax, dword [ebp - 4]
call fcn.004c28f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.004c2838
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 1
jl 0x4c31bb
mov dword [ebp - 0x14], eax
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.004c27dc
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004c2a6c
mov cl, byte [ebp - 0x18]
mov edx, 0x4eed64
mov eax, dword [ebp - 4]
call fcn.004c28f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.004c2838
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jne 0x4c3172
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.004c27dc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4c34e8
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00406128
xor eax, eax
push ebp
push 0x4c355a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405f98
push eax
push 0
call sub.netapi32.dll_NetUserGetLocalGroups
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x4c3544
mov eax, dword [ebp - 0xc]
push eax
call sub.netapi32.dll_NetApiBufferFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3561
lea eax, [ebp - 4]
call fcn.00405e38
ret
Function at 0x4c68b4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
xor edx, edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c693d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4c6917
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x88]
mov ecx, 0x80
call fcn.00405874
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 4]
call fcn.00409d00
jmp 0x4c6924
mov eax, dword [ebp - 4]
mov edx, 0x4c6950
call fcn.00405648
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6944
lea eax, [ebp - 0x8c]
call fcn.004055f4
ret

Function at 0x4c6958
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4c69fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040318c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.0040aba8
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4c69d9
lea eax, [ebp - 0x14]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405b28
mov eax, dword [ebp - 0x14]
mov edx, 0x4c6a14
call fcn.00405a14
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x4c69d9
mov eax, dword [ebp - 8]
call fcn.00405ac8
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6a03
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405618
lea eax, [ebp - 8]
call fcn.004055f4
ret

Function at 0x4c6a64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 0x104
call fcn.0040b0d0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c6ada
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x104
call fcn.00403890
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4c6abc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004057fc
jmp 0x4c6ac4
mov eax, dword [ebp - 8]
call fcn.004055f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6ae1
mov eax, dword [ebp - 0xc]
call fcn.0040b11c
ret
Function at 0x4c6bb4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ab8
xor eax, eax
push ebp
push 0x4c6c6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x4c6c80
call fcn.00405648
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405ac8
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4c6c4a
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 0x14]
mov edx, 4
call fcn.0040a298
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004085bc
movzx eax, ax
lea ecx, [ebp - 0x1c]
mov edx, 4
call fcn.0040a298
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00405914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6c74
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405618
lea eax, [ebp - 4]
call fcn.004055f4
ret

Function at 0x4c7398
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], 7
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c73c0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
call fcn.004c7398
test al, al
je 0x4c7403
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00405ac8
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4e2870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4e2918
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004863f8
lea eax, [ebp - 8]
mov ecx, 0x4e292c
mov edx, dword [ebp - 4]
call fcn.00405914
mov edx, dword [ebp - 8]
mov cl, 1
mov eax, 0x4e294c
call fcn.004862cc
test al, al
je 0x4e28e3
mov eax, 0x4e2984
call fcn.0043e234
push 5
lea eax, [ebp - 0xc]
mov ecx, 0x4e292c
mov edx, dword [ebp - 4]
call fcn.00405914
mov eax, dword [ebp - 0xc]
call fcn.00405ac8
push eax
call sub.kernel32.dll_WinExec
call fcn.0040542c
jmp 0x4e28fd
push 0
movzx ecx, word [0x4e2a1c]
mov dl, 2
mov eax, 0x4e2a28
call fcn.0043e0b8
call fcn.0040542c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e291f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405618
ret
Function at 0x4e3034
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e303c
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e3239
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004e2b94
mov eax, dword [0x4f18bc]
mov eax, dword [eax]
call fcn.004cb028
lea eax, [ebp - 0xc]
call fcn.00487b54
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov dl, 0xa
call fcn.00488398
push 0x4e3250
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x388]
call fcn.0044c244
push dword [ebp - 0x10]
push 0x4e326c
push 0x4e327c
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x390]
call fcn.0044c244
push dword [ebp - 0x14]
push 0x4e326c
push 0x4e3290
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x394]
call fcn.0044c244
push dword [ebp - 0x18]
push 0x4e326c
push 0x4e32a0
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x3c0]
call fcn.0044c244
push dword [ebp - 0x1c]
push 0x4e326c
push 0x4e32b0
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x3bc]
call fcn.0044c244
push dword [ebp - 0x20]
push 0x4e326c
push 0x4e32c0
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x3b8]
call fcn.0044c244
push dword [ebp - 0x24]
push 0x4e326c
push 0x4e32d4
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x3b4]
call fcn.0044c244
push dword [ebp - 0x28]
push 0x4e326c
push 0x4e32e4
lea edx, [ebp - 0x2c]
mov eax, dword [ebx + 0x3b0]
call fcn.0044c244
push dword [ebp - 0x2c]
push 0x4e326c
push 0x4e326c
lea edx, [ebp - 0x30]
mov eax, dword [ebx + 0x3c4]
call fcn.0044c244
push dword [ebp - 0x30]
push 0x4e326c
push 0x4e326c
push 0x4e32f4
push 0x4e326c
push 0x4e3330
push dword [0x4f65ec]
push 0x4e326c
push 0x4e3350
push 0x4e326c
lea edx, [ebp - 0x34]
mov eax, dword [0x4f18bc]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.0044c244
push dword [ebp - 0x34]
push 0x4e3378
push dword [ebp - 8]
push 0x4e3384
push 0x4e326c
push 0x4e3394
lea eax, [ebp - 4]
mov edx, 0x29
call fcn.00405988
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4e33bc
call fcn.00405914
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 4]
call fcn.0041cac4
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405ac8
push eax
push 0x4e3400
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3240
lea eax, [ebp - 0x34]
mov edx, 0xa
call fcn.00405618
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405618
ret
Function at 0x10002031
Capabilities:
Create thread

Disassembly:
push 0x34
mov eax, 0x10082694
call fcn.1006a09e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
push ecx
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
mov ecx, 0x1009ce74
call fcn.10002a34
push ecx
mov byte [ebp - 4], 2
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x1009cecc
call fcn.10002a34
push ecx
mov byte [ebp - 4], 3
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, 0x1009d084
call fcn.10002a34
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x20], esp
mov esi, esp
call fcn.10002aac
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.1000918c
add esp, 0x14
cmp dword [ebp - 0x2c], 5
jb 0x10002195
cmp dword [ebp - 0x2c], ebx
ja 0x100020d0
push 0x80070057
call fcn.10002b60
mov esi, dword [ebp - 0x30]
mov eax, dword [esi]
sub eax, 0x10
call fcn.10002aac
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x2c], 1
jbe 0x100020c6
push dword [esi + 4]
call fcn.1005fdfb
cmp dword [ebp - 0x2c], 2
pop ecx
mov edi, eax
jbe 0x100020c6
push dword [esi + 8]
call fcn.1005fdfb
cmp dword [ebp - 0x2c], 3
pop ecx
mov dword [ebp - 0x18], eax
jbe 0x100020c6
push dword [esi + 0xc]
call fcn.1005fdfb
cmp dword [ebp - 0x2c], 4
pop ecx
jbe 0x100020c6
mov ecx, dword [esi + 0x10]
mov esi, dword [ebp - 0x18]
add eax, edi
push ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
call fcn.1005fdfb
add eax, esi
pop ecx
mov dword [ebp - 0x34], eax
call fcn.1001a54d
mov edi, eax
add edi, 0xd4
lea esi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 8
movsd dword es:[edi], dword [esi]
call fcn.1005fc55
mov esi, eax
pop ecx
cmp esi, ebx
je 0x10002167
call fcn.10002b4b
mov edi, esi
jmp 0x10002169
xor edi, edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
lea eax, [ebp - 0x14]
call fcn.100023e1
push ebx
push ebx
push edi
push 0x10002255
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10002b29
lea esi, [ebp - 0x30]
call fcn.1000258e
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10002b29
xor eax, eax
call fcn.1006a176
ret 8