joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d29e8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419658]
call fcn.00404dcc
xor eax, eax
push ebp
push 0x4d2b2c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5a0954], 0
jne 0x4d2a3b
mov ecx, dword [0x5a1cc8]
mov dl, 1
mov eax, dword [0x407c34]
call fcn.0040cd98
call fcn.00403dcc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f70
mov eax, ebx
call fcn.00404c9c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4d2b3c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405e98
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404cac
test eax, eax
jle 0x4d2ad3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4d2acc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004046bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004046a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408ae0
test eax, eax
jne 0x4d2acc
mov ebx, 0x15
jmp 0x4d2ad8
mov ebx, 0x10
jmp 0x4d2ad8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5a0954]
call fcn.004d2940
mov eax, dword [ebp - 8]
call fcn.004d2940
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2b33
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, dword [0x419658]
call fcn.00404e9c
ret

Function at 0x4d7b2c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d7b5a
mov eax, ebx
call fcn.004d85e0
cmp dword [ebx + 0x40], 0
je 0x4d7b53
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d7bcb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d7bbd
cmp dword [ebx + 8], 0
je 0x4d7b7c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d7b8e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d7bbd
cmp dword [ebx + 8], 0
je 0x4d7b6f
cmp eax, 3
je 0x4d7ba1
dec eax
jne 0x4d7b6f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d7b6f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d7b6f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d7be9
cmp dword [ebx + 0x14], 0xcc
je 0x4d7be9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d7bf4
pop ebx
ret
Function at 0x4f2dc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x4f2de7
mov ecx, edi
mov dl, 1
mov eax, dword [0x4f1c04]
call fcn.004f1c68
mov dword [edi + 0x294], eax
jmp 0x4f2ef0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x4f2e28
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x4f2e1d
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.004f2370
jmp 0x4f2e5e
xor edx, edx
mov eax, edi
call fcn.004f2370
jmp 0x4f2e5e
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x4f2e55
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.004f2370
jmp 0x4f2e5e
mov dl, 0x64
mov eax, edi
call fcn.004f2370
cmp byte [edi + 0x22b], 0
je 0x4f2e70
cmp byte [edi + 0x22a], 0
je 0x4f2e82
cmp byte [edi + 0x22b], 0
jne 0x4f2e8d
cmp byte [edi + 0x22a], 0x64
jne 0x4f2e8d
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x4f2ebd
mov eax, dword [0x5a211c]
mov eax, dword [eax]
call fcn.004a2ac0
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x4f2ebd
cmp byte [edi + 0x224], 0
jne 0x4f2ebd
cmp byte [edi + 0x2a0], 0
je 0x4f2e8d
test bl, bl
jne 0x4f2ed7
cmp byte [edi + 0x224], 0
jne 0x4f2ed7
cmp byte [edi + 0x2a0], 0
je 0x4f2de9
cmp byte [edi + 0x2a0], 0
jne 0x4f2ee9
cmp byte [edi + 0x224], 0
jne 0x4f2ef0
mov eax, edi
call fcn.004f31e4
pop edi
pop esi
pop ebx
ret

Function at 0x4f4b54
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4f4ba5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4f4b8c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4f4b7c
jmp 0x4f4ba5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4f4b8d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50eb38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50eba9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5a1ad0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x50eb93
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0050eb28
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x50c0e4]
call fcn.0050f9f8
mov dword [0x5a1b38], eax
mov eax, dword [ebp - 4]
call fcn.0050e9b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ebb0
lea eax, [ebp - 8]
call fcn.00405e98
ret
Function at 0x50ec48
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x50ec5b
or esi, 2
test dl, dl
je 0x50ec64
or esi, 0
jmp 0x50ec67
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret

Function at 0x50f884
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004048e4
xor eax, eax
push ebp
push 0x50f9dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x50becc]
call fcn.00418704
test eax, eax
jl 0x50f8eb
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0050ec2c
and eax, 0x7f
mov eax, dword [eax*4 + 0x5a1ad0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x50f94e
mov eax, dword [ebx]
call fcn.004046f4
test eax, eax
jle 0x50f94e
mov eax, dword [ebx]
call fcn.004046f4
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x50f912
mov eax, ebx
mov edx, 0x50f9f4
call fcn.004046fc
mov eax, dword [ebx]
call fcn.004046f4
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.0040525c
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.0050eb28
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x50f999
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x5a1d08]
call fcn.00406378
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a0bc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404488
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407c34]
call fcn.0040ccdc
call fcn.00403dcc
mov eax, dword [ebp - 8]
call fcn.0050f7fc
mov ebx, eax
test edi, edi
je 0x50f9ae
mov eax, edi
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f9e3
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
call fcn.00405e98
lea eax, [ebp - 0x14]
call fcn.00404434
lea eax, [ebp - 4]
call fcn.00404434
ret
Function at 0x5110dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x511246
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5a2398]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x5a2398]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004a0b94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456dcc
xor edx, edx
push ebp
push 0x511229
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x511199
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00405e98
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.0050f244
push eax
mov eax, dword [0x5a211c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x51118f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403e78
jmp 0x511230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5111d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004569ac
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00510f6c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x5111b1
push 0
mov edx, 0x510f04
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00456564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511230
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456e18
mov eax, dword [0x5a2398]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.004a0b94
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51124d
lea eax, [ebp - 0x10]
call fcn.00405e98
ret

Function at 0x5121a0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x5121b7
add esp, 0xfffffff0
call fcn.00403964
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0046ba38
xor eax, eax
mov dword [ebx + 0x2b8], eax
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x512258
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
mov dword [ebx + 0x2a0], esi
lea eax, [ebx + 0x2a4]
push eax
lea eax, [ebx + 0x2a8]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov byte [ebx + 0x2c6], 0
xor edx, edx
mov eax, ebx
call fcn.0046bdd8
mov al, byte [0x51225c]
mov byte [ebx + 0x2c4], al
lea eax, [ebx + 0x2b4]
mov edx, 0x512268
call fcn.00404488
mov byte [ebx + 0x2c5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x51224f
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52f33c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
and eax, 0x7f
mov eax, dword [eax*4 + 0x5a1b44]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409bcc
add esp, 0x10c
pop ebx
ret

Function at 0x52fb90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x1c]
call fcn.004048e4
xor eax, eax
push ebp
push 0x52fca6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x1c], 0
jne 0x52fbc9
lea edx, [ebp + 0x1c]
mov eax, ebx
call fcn.00409728
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
mov dword [ebp - 0x34], edi
mov eax, ebx
call fcn.004048f4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004048f4
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x1c], 0
je 0x52fc0f
mov eax, dword [ebp + 0x1c]
call fcn.004048f4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x52fc31
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x52fc90
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x52fc8a
cmp byte [ebp + 0x14], 0
je 0x52fc4c
push 0xffffffffffffffff
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x52fc77
mov eax, dword [0x5a211c]
mov eax, dword [eax]
call fcn.004a2ac0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 8]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x52fc52
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov dword [esi], 0x21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fcad
lea eax, [ebp + 0x1c]
call fcn.00404434
ret
Function at 0x52fcb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x52fed6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
je 0x52feb3
mov edx, dword [0x5a2304]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
call fcn.00404740
mov eax, dword [ebp - 0x10]
call fcn.004093a4
test al, al
je 0x52feb3
xor ebx, ebx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x52fdbf
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x14]
call fcn.004044cc
cmp dword [ebp - 0xc], 0
je 0x52feb3
mov edx, dword [ebp - 0xc]
mov eax, 0x52feec
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x52feb3
mov ecx, dword [ebp - 8]
dec ecx
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00404994
mov edx, dword [ebp - 0xc]
mov eax, 0x52fef8
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x52fd79
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404994
mov edx, dword [ebp - 0xc]
mov eax, 0x52ff04
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x52fda4
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404994
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0052fa5c
cmp dword [ebp - 4], 0
jne 0x52fdb9
mov bl, 1
jmp 0x52fdc4
cmp dword [esi + 0x1c], 0
jmp 0x52fdc4
dec eax
jne 0x52fdc4
mov bl, 1
test bl, bl
je 0x52feb3
cmp byte [esi + 0x20], 0
je 0x52fe2b
cmp byte [esi + 0x2c], 0
je 0x52fe09
push 0x44
mov eax, dword [esi + 0x24]
call fcn.004048f4
push eax
mov eax, dword [esi + 0x28]
call fcn.004048f4
mov edx, eax
mov eax, dword [0x5a211c]
mov eax, dword [eax]
pop ecx
call fcn.004a2dfc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jne 0x52feb3
jmp 0x52fe2b
push 0x40
mov eax, dword [esi + 0x24]
call fcn.004048f4
push eax
mov eax, dword [esi + 0x28]
call fcn.004048f4
mov edx, eax
mov eax, dword [0x5a211c]
mov eax, dword [eax]
pop ecx
call fcn.004a2dfc
cmp byte [esi + 0xc], 0
jne 0x52fe6e
push 1
mov eax, dword [esi + 8]
call fcn.004048f4
push eax
mov eax, dword [esi + 4]
call fcn.004048f4
push eax
mov edx, dword [0x5a2304]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, dword [esi]
call fcn.00404740
mov eax, dword [ebp - 0x14]
call fcn.004048f4
push eax
push 0x52ff08
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x52feb3
mov edx, dword [0x5a2304]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, dword [esi + 8]
call fcn.00404740
mov eax, dword [ebp - 0x18]
push eax
push 1
push 1
push 1
push 0
lea eax, [ebp - 8]
push eax
mov edx, dword [0x5a2304]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [esi]
call fcn.00404740
mov edx, dword [ebp - 0x1c]
mov ecx, dword [esi + 4]
mov eax, 0x52ff18
call fcn.0052fb90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fedd
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404458
lea eax, [ebp - 4]
call fcn.00404434
ret
Function at 0x532bbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004048e4
mov eax, dword [ebp - 8]
call fcn.004048e4
mov eax, dword [ebp + 0x14]
call fcn.004048e4
mov eax, dword [ebp + 0x10]
call fcn.004048e4
xor eax, eax
push ebp
push 0x532dea
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0xc], 0
je 0x532c21
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005164bc
jmp 0x532c56
push esi
mov eax, dword [ebp + 0x10]
call fcn.004048f4
push eax
mov eax, dword [ebp + 0x14]
call fcn.004048f4
push eax
mov eax, dword [ebp - 8]
call fcn.004048f4
push eax
mov eax, dword [ebp - 4]
call fcn.004048f4
push eax
mov eax, ebx
call fcn.00488250
push eax
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
jg 0x532db8
lea eax, [ebp - 0x10]
mov edx, 0x532e04
call fcn.004044cc
mov eax, dword [ebp - 0xc]
cmp eax, 0x20
ja case.0x532c7f.0
mov al, byte [eax + 0x532c86]
jmp dword [eax*4 + 0x532ca7]
lea eax, [ebp - 0x10]
mov edx, 0x532e1c
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x532e58
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x532e84
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x532eb0
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x532efc
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x532f40
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x532f7c
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x532fe4
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x533008
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x53305c
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x533098
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x5330e8
call fcn.004044cc
jmp case.0x532c7f.0
lea eax, [ebp - 0x10]
mov edx, 0x533128
call fcn.004044cc
mov eax, dword [ebp - 0x10]
call fcn.0052cdc4
xor ebx, ebx
jmp 0x532dba
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532df1
lea eax, [ebp - 0x10]
call fcn.00404434
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404458
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00404458
ret
Function at 0x5362c8
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00404434
mov eax, ebx
call fcn.004093a4
test al, al
je 0x536344
push esp
mov eax, ebx
call fcn.004048f4
mov ebp, eax
push ebp
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
jbe 0x536344
mov eax, dword [esp]
call fcn.0040887c
mov esi, eax
push esi
mov eax, dword [esp + 4]
push eax
push 0
push ebp
call sub.version.dll_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x53634c
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x53633a
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0040462c
mov edx, dword [esp]
mov eax, esi
call fcn.0040280c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x536370
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5364a7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x53648c
mov eax, dword [ebp - 8]
call fcn.0040887c
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5364bc
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5363f8
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5364e4
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x53641a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x536508
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x53643c
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040280c
lea edx, [ebp - 0x14]
mov eax, dword [edi]
call fcn.00408b50
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00404488
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408b50
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00404488
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00408b50
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5364ae
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404458
ret
Function at 0x544690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00544440
lea edx, [ebp - 6]
mov ecx, 2
mov eax, ebx
call fcn.00544418
cmp word [ebp - 6], 0x5a4d
je 0x5446cd
mov eax, 0x544808
call fcn.00544548
mov edx, 0x3c
mov eax, ebx
call fcn.00544440
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
call fcn.00544418
cmp dword [ebp - 0xc], 0
jne 0x5446f8
mov eax, 0x54482c
call fcn.00544548
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00544440
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, ebx
call fcn.00544418
cmp dword [ebp - 0x10], 0x4550
je 0x544724
mov eax, 0x544850
call fcn.00544548
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, ebx
call fcn.00544418
movzx eax, word [ebp - 0x18]
cmp eax, 0xe0
je 0x544748
mov eax, 0x544874
call fcn.00544548
lea edx, [ebp - 0x108]
mov ecx, 0xe0
mov eax, ebx
call fcn.00544418
cmp word [ebp - 0x108], 0x10b
je 0x54476f
mov eax, 0x544898
call fcn.00544548
cmp dword [ebp - 0x98], 0
je 0x544781
cmp dword [ebp - 0x94], 0
jne 0x54478b
mov eax, 0x5448bc
call fcn.00544548
mov eax, dword [ebp - 0x98]
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
movzx esi, word [ebp - 0x26]
dec esi
test esi, esi
jl 0x5447e4
inc esi
lea edx, [ebp - 0x130]
mov ecx, 0x28
mov eax, ebx
call fcn.00544418
mov eax, dword [edi]
cmp eax, dword [ebp - 0x124]
jne 0x5447e1
cmp dword [ebp - 0x120], 0
je 0x5447e1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x11c]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x120]
mov dword [eax], edx
jmp 0x5447e4
dec esi
jne 0x5447a4
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x5447f6
mov eax, 0x5448d8
call fcn.00544548
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4