joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f8b8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.004057bc
xor eax, eax
push ebp
push 0x48f92b
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x10], 2
movzx eax, word [ebp + 8]
push eax
call sub.ws2_32.dll_htons
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0xc]
call fcn.004057cc
push eax
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push esi
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_sendto
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f932
lea eax, [ebp + 0xc]
call fcn.0040533c
ret

Function at 0x490e20
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057bc
xor eax, eax
push ebp
push 0x490fab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040533c
mov dword [ebp - 0x1c], 0x7d0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00490c80
push 0
push 0x490fbc
push 0x490fbc
push 0
push 0x490fc0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x490f89
push dword fs:[edx]
mov dword fs:[edx], esp
push 4
lea eax, [ebp - 0x1c]
push eax
push 2
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebp - 0x1c]
push eax
push 8
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, 0x400
call fcn.00402f84
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41804c]
call fcn.0041cb68
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 0x401
lea eax, [ebp - 0x429]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x490f2c
cmp dword [ebp - 0x28], 0
je 0x490f2c
lea edx, [ebp - 0x429]
mov ecx, dword [ebp - 0x28]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
jmp 0x490ef7
mov eax, esi
mov edx, dword [ebx + 4]
call fcn.00405390
mov eax, ebx
call fcn.00404378
mov eax, dword [ebp - 0x24]
call fcn.00402fa0
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490f90
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x4922c8
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4922d1
mov eax, dword [ebp - 4]
add esp, 0xfffff794
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov eax, dword [ebp + 8]
call fcn.0040533c
xor edx, edx
push ebp
push 0x49241d
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x492413
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a64
mov dword [ebp - 0x5c], 0x44
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x101
mov word [ebp - 0x2c], 0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.004057cc
push eax
mov eax, ebx
call fcn.004057cc
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4923ef
push 0x64
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x49238f
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x286d]
xor ecx, ecx
mov edx, 0x2801
call fcn.00403a64
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2801
lea eax, [ebp - 0x286d]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x286d]
mov ecx, 0x2801
call fcn.004055ac
cmp dword [ebp - 0xc], 0x2801
jae 0x4923a1
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49242f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x492578
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x492580
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x492780
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49275b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
lea edx, [ebx + 9]
mov ecx, 0x201
call fcn.004055ac
cmp dword [ebp - 8], 0
jne 0x4925e7
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x20a]
mov ecx, 0x12c
call fcn.004055ac
cmp dword [ebp - 0xc], 0
jne 0x4925e7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492765
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004033dc
push dword [ebp - 0x10]
push 0x492798
push 0x4927a4
push 0x492798
lea edx, [ebp - 0x14]
movzx eax, byte [ebx + 8]
call fcn.00409d7c
push dword [ebp - 0x14]
push 0x4927b8
lea eax, [ebp - 0x18]
lea edx, [ebx + 9]
mov ecx, 0x201
call fcn.004055ac
push dword [ebp - 0x18]
push 0x4927c4
lea eax, [ebp - 0x1c]
lea edx, [ebx + 0x20a]
mov ecx, 0x12c
call fcn.004055ac
push dword [ebp - 0x1c]
push 0x492798
lea edx, [ebp - 0x20]
mov eax, dword [esi + 0x3b0]
call fcn.00409d7c
push dword [ebp - 0x20]
push 0x492798
lea edx, [ebp - 0x24]
mov eax, dword [esi + 0x3b4]
call fcn.00409d7c
push dword [ebp - 0x24]
push 0x492798
lea edx, [ebp - 0x28]
mov eax, dword [esi + 0x3b8]
call fcn.00409d7c
push dword [ebp - 0x28]
push 0x492798
lea edx, [ebp - 0x2c]
mov eax, dword [esi + 0x3bc]
call fcn.00409d7c
push dword [ebp - 0x2c]
push 0x492798
lea edx, [ebp - 0x30]
movzx eax, byte [ebx + 0x336]
call fcn.00409d7c
push dword [ebp - 0x30]
push 0x492798
lea edx, [ebp - 0x34]
mov eax, dword [ebx + 0x337]
call fcn.00409d7c
push dword [ebp - 0x34]
push 0x492798
lea edx, [ebp - 0x38]
mov eax, dword [ebx + 0x33b]
call fcn.00409d7c
push dword [ebp - 0x38]
push 0x492798
lea edx, [ebp - 0x3c]
mov eax, dword [ebx + 0x33f]
call fcn.00409d7c
push dword [ebp - 0x3c]
push 0x492798
lea eax, [ebp - 0x40]
lea edx, [ebx + 0x343]
mov ecx, 6
call fcn.004055ac
push dword [ebp - 0x40]
push 0x492798
lea eax, [ebp - 0x44]
lea edx, [ebx + 0x349]
mov ecx, 6
call fcn.004055ac
push dword [ebp - 0x44]
lea eax, [ebp - 4]
mov edx, 0x1d
call fcn.004056d0
mov eax, dword [ebp - 4]
call fcn.004057cc
mov ebx, eax
push ebx
call sub.kernel32.dll_OutputDebugStringA
push 0
push ebx
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492765
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492787
lea eax, [ebp - 0x44]
mov edx, 0x11
call fcn.00405360
ret
Function at 0x49cb70
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057bc
xor eax, eax
push ebp
push 0x49ccfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040533c
mov dword [ebp - 0x1c], 0x7d0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004727f8
push 0
push 0x49cd0c
push 0x49cd0c
push 0
push 0x49cd10
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x49ccd9
push dword fs:[edx]
mov dword fs:[edx], esp
push 4
lea eax, [ebp - 0x1c]
push eax
push 2
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [ebp - 0x1c]
push eax
push 8
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, 0x400
call fcn.00402f84
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41804c]
call fcn.0041cb68
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 0x401
lea eax, [ebp - 0x429]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x49cc7c
cmp dword [ebp - 0x28], 0
je 0x49cc7c
lea edx, [ebp - 0x429]
mov ecx, dword [ebp - 0x28]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
jmp 0x49cc47
mov eax, esi
mov edx, dword [ebx + 4]
call fcn.00405390
mov eax, ebx
call fcn.00404378
mov eax, dword [ebp - 0x24]
call fcn.00402fa0
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cce0
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x49cd6c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x49ce09
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x49ce18
push 0x49ce18
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004057cc
push eax
push 0x49ce1c
push 0
call sub.shell32.dll_ShellExecuteA
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, 0x49ce28
mov ebx, dword [eax]
call dword [ebx + 0x4c]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x49ce34
call fcn.00405d28
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.004055c4
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0049cb70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ce10
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405b08
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405360
ret
Function at 0x49cea4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x49ceac
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
call fcn.004070f4
xor eax, eax
push ebp
push 0x49d0a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x49d0bc
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x4c]
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00405de0
je 0x49d075
mov bl, 1
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x49d061
lea edx, [ebp - 0xc]
mov eax, 0x10
call fcn.004712b0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00405c9c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
mov edx, 0x49d0bc
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x4c]
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00405cc8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004055c4
mov eax, dword [ebp - 4]
call fcn.0040a2bc
test al, al
je 0x49cf55
push ebp
call fcn.0049cd6c
pop ecx
jmp 0x49d075
lea edx, [ebp - 0xc]
mov eax, 0x19
call fcn.004712b0
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00405c9c
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
mov edx, 0x49d0bc
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x4c]
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00405cc8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.004055c4
mov eax, dword [ebp - 4]
call fcn.0040a2bc
test al, al
je 0x49cfad
push ebp
call fcn.0049cd6c
pop ecx
jmp 0x49d075
lea edx, [ebp - 0xc]
mov eax, 0x17
call fcn.004712b0
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00405c9c
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, 0x49d0bc
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x4c]
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00405cc8
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.004055c4
mov eax, dword [ebp - 4]
call fcn.0040a2bc
test al, al
je 0x49d002
push ebp
call fcn.0049cd6c
pop ecx
jmp 0x49d075
lea edx, [ebp - 0xc]
mov eax, 2
call fcn.004712b0
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
call fcn.00405c9c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
mov edx, 0x49d0bc
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x4c]
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00405cc8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.004055c4
mov eax, dword [ebp - 4]
call fcn.0040a2bc
test al, al
je 0x49d057
push ebp
call fcn.0049cd6c
pop ecx
jmp 0x49d075
push 0x12c
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0xea60
jb 0x49cefd
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d0af
lea eax, [ebp - 0x30]
mov edx, 9
call fcn.00405b08
lea eax, [ebp - 0xc]
call fcn.0040533c
lea eax, [ebp - 8]
call fcn.00407080
lea eax, [ebp - 4]
call fcn.0040533c
ret
Function at 0x49d474
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x49d47d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x10]
call fcn.00415f8c
lea eax, [ebp - 0x20]
call fcn.00415f8c
xor eax, eax
push ebp
push 0x49d59d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4b97b8]
push eax
mov eax, dword [0x4b97b8]
push eax
lea eax, [ebp - 0x30]
mov edx, 5
mov cl, 1
call fcn.00415ab0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov edx, dword [ebp + 0x10]
mov edx, dword [edx - 8]
call fcn.00405c9c
mov edx, dword [ebp - 0x34]
mov ecx, dword [0x4b97b8]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
call fcn.0049e774
test al, al
jne 0x49d564
push 6
push 0
push 0
push 0x49d5b0
push 0x49d5c0
push 0
call sub.shell32.dll_ShellExecuteA
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b97b8]
push eax
mov eax, dword [0x4b97b8]
push eax
lea eax, [ebp - 0x44]
mov edx, 5
mov cl, 1
call fcn.00415ab0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
mov edx, dword [ebp + 0x10]
mov edx, dword [edx - 8]
call fcn.00405c9c
mov edx, dword [ebp - 0x48]
mov ecx, dword [0x4b97b8]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
call fcn.0049e774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d5a4
lea eax, [ebp - 0x48]
call fcn.00405af0
lea eax, [ebp - 0x44]
call fcn.004117f0
lea eax, [ebp - 0x34]
call fcn.00405af0
lea eax, [ebp - 0x30]
mov edx, dword [0x40111c]
mov ecx, 3
call fcn.00406030
ret
Function at 0x49dc50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49ddba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x94]
cmp eax, dword [ebx + 0x424]
jle 0x49dd85
xor edx, edx
push ebp
push 0x49dd7b
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00470758
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x49ddd0
call fcn.00405654
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
call sub.kernel32.dll_DeleteFileA
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x417ecc]
call fcn.0041c778
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49dd04
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebx + 0x90]
mov ecx, 0x394
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dd0b
mov eax, dword [ebp - 0xc]
call fcn.00404378
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ddc1
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405360
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405360
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405360
ret

Function at 0x49de00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x49dedd
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [eax + 0x94]
cmp edx, dword [eax + 0x424]
jle 0x49deb5
xor edx, edx
push ebp
push 0x49deab
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004033dc
lea edx, [ebp - 8]
xor eax, eax
call fcn.004033dc
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49de61
sub ebx, 4
mov ebx, dword [ebx]
push 5
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405834
push dword [ebp - 0x14]
push 0x49def4
push 0x49df04
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004056d0
mov eax, dword [ebp - 0x10]
call fcn.004057cc
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49deb5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dee4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405360
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405360
ret
Function at 0x49fec0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x49fec8
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a007e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x14e5], 0
jne 0x4a0063
cmp dword [ebx + 0xdca], 0
je 0x4a0063
fld qword [ebx + 0x58]
fcomp dword [0x4a008c]
wait
fnstsw ax
sahf
je 0x4a0063
call fcn.0040bb80
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebx + 0x5c]
push dword [ebx + 0x58]
call fcn.0048f3b8
cmp edx, 0
jne 0x49ff34
cmp eax, 0xa
jae 0x49ff3a
jmp 0x4a0063
jl 0x4a0063
lea eax, [ebp - 0xc]
lea edx, [ebx + 0xdd6]
mov ecx, 0x200
call fcn.004055ac
cmp dword [ebp - 0xc], 0
je 0x4a0063
call fcn.004a4c54
test al, al
jne 0x4a0063
mov byte [ebx + 0x14e5], 1
lea eax, [ebp - 0x10]
lea edx, [ebx + 0xdd6]
mov ecx, 0x200
call fcn.004055ac
mov edx, dword [ebp - 0x10]
mov eax, 0x4a0098
call fcn.00405918
test eax, eax
jle 0x49ffb0
mov eax, ebx
call fcn.004a0ea8
lea edx, [ebp - 0x14]
call fcn.00409d7c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 0x4a00a4
call fcn.00405654
jmp 0x49ffcf
mov eax, ebx
call fcn.004a0ea8
lea edx, [ebp - 0x18]
call fcn.00409d7c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 0x4a00b4
call fcn.00405654
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004033dc
push dword [ebp - 0x1c]
push 0x4a00c4
lea eax, [ebp - 0x20]
mov edx, dword [0x4b9a44]
mov ecx, 8
call fcn.004055ac
push dword [ebp - 0x20]
push 0x4a00c4
lea eax, [ebp - 0x24]
lea edx, [ebx + 0xdd6]
mov ecx, 0x200
call fcn.004055ac
push dword [ebp - 0x24]
push dword [ebp - 8]
push 0x4a00c4
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0xdce]
call fcn.00409d7c
push dword [ebp - 0x28]
push 0x4a00c4
lea edx, [ebp - 0x2c]
mov eax, dword [ebx + 0xdd2]
call fcn.00409d7c
push dword [ebp - 0x2c]
push 0x4a00d0
lea eax, [ebp - 4]
mov edx, 0xb
call fcn.004056d0
push 0
mov eax, dword [ebp - 4]
call fcn.004057cc
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0085
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00405360
ret
Function at 0x4a0404
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4a040c
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a059e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a0579
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
lea edx, [ebx + 0x6b6]
mov ecx, 0x200
call fcn.004055ac
mov edx, dword [ebp - 8]
mov eax, 0x4a05b4
call fcn.00405918
test eax, eax
jle 0x4a0479
mov eax, ebx
call fcn.004a0ea8
lea edx, [ebp - 0xc]
call fcn.00409d7c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x4a05c0
call fcn.00405654
jmp 0x4a0498
mov eax, ebx
call fcn.004a0ea8
lea edx, [ebp - 0x10]
call fcn.00409d7c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 0x4a05d0
call fcn.00405654
cmp byte [ebx + 0x14e7], 0
jne 0x4a0543
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004033dc
push dword [ebp - 0x18]
push 0x4a05e0
lea eax, [ebp - 0x1c]
mov edx, dword [0x4b9a44]
mov ecx, 8
call fcn.004055ac
push dword [ebp - 0x1c]
push 0x4a05e0
lea eax, [ebp - 0x20]
lea edx, [ebx + 0x6b6]
mov ecx, 0x200
call fcn.004055ac
push dword [ebp - 0x20]
push dword [ebp - 4]
push 0x4a05e0
lea edx, [ebp - 0x24]
mov eax, dword [ebx + 0x6ae]
call fcn.00409d7c
push dword [ebp - 0x24]
push 0x4a05e0
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 0x6b2]
call fcn.00409d7c
push dword [ebp - 0x28]
push 0x4a05ec
push 0x4a05e0
push 0x4a05f8
lea eax, [ebp - 0x14]
mov edx, 0xd
call fcn.004056d0
mov eax, dword [ebp - 0x14]
call fcn.004057cc
push eax
call sub.kernel32.dll_WinExec
lea esi, [ebx + 0x6aa]
lea edi, [ebx + 0x49e]
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x6aa]
xor ecx, ecx
mov edx, 0x20c
call fcn.00403a64
mov eax, ebx
call fcn.004a1fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0583
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a05a5
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00405360
ret