joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4931d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4932d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00492794
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x49329f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a184
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00493ab4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040a0fc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00493b28
jmp 0x4932b1
xor edx, edx
mov eax, ebx
call fcn.00493ab4
xor edx, edx
mov eax, ebx
call fcn.00493b28
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4932e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cc0
ret

Function at 0x499c2c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.00499e60
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.00499e60
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x499ca0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x499cc5
inc esi
mov eax, edi
call fcn.00499c84
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.00499c2c
inc ebx
dec esi
jne 0x499caf
pop edi
pop esi
pop ebx
ret
Function at 0x499d54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x499dc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00499ccc
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00499c84
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00499c2c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x499d94
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499dd0
lea eax, [ebp - 4]
call fcn.00404c9c
ret
Function at 0x49aa54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ac38
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x49abf4
mov eax, dword [ebp - 4]
call fcn.0049c3b0
cmp ebx, eax
jge 0x49abf4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0049106c
mov edx, dword [0x492b68]
call fcn.00404008
mov esi, eax
mov eax, esi
call fcn.00493a48
test al, al
je 0x49abea
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x49abde
xor eax, eax
push ebp
push 0x49abd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0049b00c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041dc98
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004052e8
mov eax, dword [ebp - 8]
call fcn.004051b4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049add0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ac22
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x49abd6
mov eax, dword [ebp - 4]
call fcn.0049b090
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a568
jmp 0x49ac22
mov eax, dword [ebp - 8]
call fcn.00404c9c
jmp 0x49ac22
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00409b04
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4185ec]
call fcn.0040d988
call fcn.0040462c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ac3f
lea eax, [ebp - 0x54]
call fcn.00404c9c
ret
Function at 0x4a42e8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a4316
mov eax, ebx
call fcn.004a4d9c
cmp dword [ebx + 0x40], 0
je 0x4a430f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a4387
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a4379
cmp dword [ebx + 8], 0
je 0x4a4338
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a434a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a4379
cmp dword [ebx + 8], 0
je 0x4a432b
cmp eax, 3
je 0x4a435d
dec eax
jne 0x4a432b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a432b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a432b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a43a5
cmp dword [ebx + 0x14], 0xcc
je 0x4a43a5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a43b0
pop ebx
ret

Function at 0x4bca80
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
or ebx, 0xffffffff
xor edx, edx
push ebp
push 0x4bcafd
push dword fs:[edx]
mov dword fs:[edx], esp
test esi, esi
jne 0x4bcaac
mov eax, ebx
pop dword fs:[0]
add esp, 8
jmp 0x4bcb0c
mov eax, esi
call fcn.0040515c
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4bcaf3
push edi
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4bcadb
mov eax, dword [ebp - 4]
cmp word [eax + 0xa], 0
jg 0x4bcae9
mov eax, ebx
pop dword fs:[0]
add esp, 8
jmp 0x4bcb0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bcb0a
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4bcb14
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov byte [0x4f4fe4], 0
mov eax, sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4bcb4b
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
sub eax, 0x2726
je 0x4bcb4b
add eax, 0xffffffbb
sub eax, 2
jb 0x4bcb4b
mov byte [0x4f4fe4], 1
add esp, 0x190
ret

Function at 0x4bcdfc
Capabilities:
Create raw socket

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 8], 0xffffffff
jne 0x4bce2d
cmp dword [ebx + 0x28], 0xffffffff
je 0x4bce2d
push 1
push 3
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
push 1
push 0x502
mov eax, dword [ebx + 0x28]
push eax
push esi
call sub.wsock32.dll_WSAAsyncSelect
pop esi
pop ebx
ret
Function at 0x4bd0b8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + 0xc]
add ebx, 8
add ebx, 4
xor edx, edx
push ebp
push 0x4bd1d8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.00402b90
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax], 8
mov eax, dword [ebp - 8]
mov byte [eax + 1], 0
mov eax, dword [ebp - 8]
mov word [eax + 2], 0
mov eax, dword [ebp - 8]
mov dx, word [0x4f26d4]
mov word [eax + 6], dx
inc word [0x4f26d4]
mov eax, dword [ebp - 8]
mov dx, word [ebp - 4]
mov word [eax + 4], dx
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [eax + 0xc]
mov eax, dword [ebp - 8]
add eax, 0xc
mov cl, 0xa7
call fcn.004036cc
call fcn.004bccf4
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.004bcc98
mov edx, dword [ebp - 8]
mov word [edx + 2], ax
mov esi, 0x10
mov word [ebp - 0x18], 2
mov word [ebp - 0x16], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
inc eax
jne 0x4bd1b1
call sub.wsock32.dll_WSAGetLastError
neg eax
mov edx, dword [ebp - 4]
cmp word [edx + 0x72], 0
je 0x4bd1b1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1c]
push edx
push eax
mov ebx, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x74]
call dword [ebx + 0x70]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd1df
cmp dword [ebp - 8], 0
je 0x4bd1d7
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [eax + 0xc]
add edx, 8
mov eax, dword [ebp - 8]
call fcn.00402bc0
ret

Function at 0x4bdfa4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [0x4f3134]
mov eax, dword [eax]
call fcn.00474320
cmp byte [ebx + 0x28c], 0
je 0x4bdfd8
cmp byte [ebx + 0x294], 0
je 0x4bdfd8
push 0
mov eax, dword [0x4f3134]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
mov si, 0xffe8
call fcn.00404054
pop esi
pop ebx
ret
Function at 0x4be824
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417c3c]
call fcn.00405694
xor eax, eax
push ebp
push 0x4be968
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f26d8], 0
jne 0x4be877
mov ecx, dword [0x4f2c00]
mov dl, 1
mov eax, dword [0x4084bc]
call fcn.0040da08
call fcn.0040462c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004036cc
mov eax, ebx
call fcn.00405540
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4be978
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406828
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405550
test eax, eax
jle 0x4be90f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4be908
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404f24
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404f0c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004093c4
test eax, eax
jne 0x4be908
mov ebx, 0x15
jmp 0x4be914
mov ebx, 0x10
jmp 0x4be914
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4f26d8]
call fcn.004be77c
mov eax, dword [ebp - 8]
call fcn.004be77c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be96f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404cc0
lea eax, [ebp - 0x10]
mov edx, dword [0x417c3c]
call fcn.00405764
ret
Function at 0x4cb9c4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407e50
ret

Function at 0x4cbaec
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4cbc3a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004cb9c4
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4cbc19
xor eax, eax
push ebp
push 0x4cbc12
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4cbbfb
xor eax, eax
push ebp
push 0x4cbbf4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4cbbdd
xor eax, eax
push ebp
push 0x4cbbd6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004cb9f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbbdd
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbbfb
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbc19
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004cba78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbc41
lea eax, [ebp - 4]
call fcn.00404c9c
ret
Function at 0x4cbda8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cbf0d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x4cbf24
mov edx, ebx
call fcn.00404fa8
lea eax, [ebp - 8]
mov ecx, 0x4cbf34
mov edx, ebx
call fcn.00404fa8
mov eax, dword [ebp - 8]
call fcn.00409ca8
test al, al
jne 0x4cbdff
xor ebx, ebx
jmp 0x4cbeea
mov eax, dword [ebp - 8]
call fcn.004cc868
mov eax, ebx
call fcn.00409ca8
test al, al
je 0x4cbebc
mov eax, ebx
call fcn.004cc868
mov eax, ebx
call fcn.004cc714
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.004cc714
cmp esi, eax
jne 0x4cbe75
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004cbaec
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.004cbc48
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004cbaec
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x20]
call fcn.004cbc48
mov eax, dword [ebp - 0x20]
pop edx
call fcn.00409300
test al, al
je 0x4cbe75
mov ebx, 0xa
jmp 0x4cbeea
mov eax, dword [ebp - 4]
call fcn.00409ca8
test al, al
je 0x4cbe9c
mov eax, dword [ebp - 4]
call fcn.004cc868
mov eax, dword [ebp - 4]
call fcn.00409fa4
test al, al
jne 0x4cbe9c
mov ebx, 0xfffffffe
jmp 0x4cbeea
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409fbc
test al, al
jne 0x4cbebc
mov eax, ebx
call fcn.00409fa4
test al, al
jne 0x4cbebc
mov ebx, 0xfffffffd
jmp 0x4cbeea
push 0
mov eax, ebx
call fcn.0040515c
push eax
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4cbedf
mov ebx, 1
jmp 0x4cbee2
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00409fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbf14
lea eax, [ebp - 0x20]
call fcn.00404c9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cc0
ret
Function at 0x4cc26c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cc3aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004036cc
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.004036cc
mov dword [ebp - 0x4c], 0x44
call fcn.00403030
mov ebx, eax
test ebx, ebx
jle 0x4cc2f1
mov esi, 1
push dword [ebp - 8]
push 0x4cc3c4
lea edx, [ebp - 0x60]
mov eax, esi
call fcn.00403098
push dword [ebp - 0x60]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040501c
inc esi
dec ebx
jne 0x4cc2cb
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x74]
mov eax, dword [0x4f3134]
mov eax, dword [eax]
call fcn.00475048
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
lea edx, [ebp - 0x70]
mov ecx, 1
mov eax, 0x4cc3d0
call fcn.0040aa80
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x7c]
mov eax, dword [0x4f3134]
mov eax, dword [eax]
call fcn.00475048
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.0040a0fc
mov eax, dword [ebp - 0x78]
call fcn.0040515c
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc3b1
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00404cc0
lea eax, [ebp - 0x60]
call fcn.00404c9c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cc0
ret

Function at 0x4cc69c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cc706
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040a568
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040e690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc70d
lea eax, [ebp - 0x10c]
call fcn.00404c9c
ret
Function at 0x4ccabc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4ccac4
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ccc2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x4ccc44
call fcn.00404cf0
test ebx, ebx
jne 0x4ccafc
lea edx, [ebp - 4]
xor eax, eax
call fcn.00403098
jmp 0x4ccb06
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404d34
lea eax, [ebp - 4]
call fcn.004051ac
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4ccc09
mov eax, ebx
call fcn.00402b90
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ccc02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ccbec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4ccc4c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ccbec
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
call fcn.00407e2c
movzx eax, ax
lea edx, [ebp - 0x18]
call fcn.004096b0
push dword [ebp - 0x18]
push 0x4ccc58
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
call fcn.004096b0
push dword [ebp - 0x1c]
push 0x4ccc58
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.00407e2c
movzx eax, ax
lea edx, [ebp - 0x20]
call fcn.004096b0
push dword [ebp - 0x20]
push 0x4ccc58
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0xc]
call fcn.004096b0
push dword [ebp - 0x24]
mov eax, esi
mov edx, 7
call fcn.0040501c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccc09
mov eax, dword [ebp - 0xc]
call fcn.00402bc0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccc33
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404cc0
lea eax, [ebp - 4]
call fcn.00404c9c
ret