joyce8/EMBER2024-capa huggingface dataset:
Function at 0x266ad
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x60]
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [edi], 0
movzx eax, byte [edx]
sub eax, 0
mov esi, 0xc0000002
je 0x266bc
sub eax, 2
je 0x266bc
sub eax, 0xc
jne case.0x2680c.1673486111
mov eax, dword [edx + 0xc]
mov ecx, eax
cmp ecx, 0x9c4060d4
ja 0x26769
je 0x26735
cmp ecx, 0x9c40208c
ja 0x2670e
je 0x26700
add ecx, 0x63bfe000
cmp ecx, 0x88
ja case.0x2680c.1673486111
movzx eax, byte [ecx + 0x26878]
jmp dword [eax*4 + 0x26864]
mov ecx, dword [ebx + 0xc]
mov dword [ecx], 0x1020005
mov dword [edi], 4
xor esi, esi
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x2ab14]
mov edx, dword [ebx + 0xc]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
jmp 0x266b6
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026990
mov esi, eax
jmp case.0x2680c.1673486111
mov edx, dword [ebx + 0xc]
push edi
call fcn.00026a30
mov esi, eax
jmp case.0x2680c.1673486111
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026ac0
mov esi, eax
jmp case.0x2680c.1673486111
cmp ecx, 0x9c4060cc
ja 0x2672d
je 0x26735
cmp ecx, 0x9c402090
je 0x2672a
cmp ecx, 0x9c4060c4
je 0x26735
jmp case.0x2680c.1673486111
hlt
cmp ecx, 0x9c4060d0
jne case.0x2680c.1673486111
mov esi, dword [ebx + 0xc]
mov edx, dword [edx + 8]
mov ecx, dword [esi]
mov dword [esp + 0xc], edx
cmp eax, 0x9c4060cc
je 0x26755
push edx
call fcn.00026b60
mov esi, eax
jmp case.0x2680c.1673486111
push ecx
call dword [sym.imp.HAL.dll_READ_PORT_UCHAR]
mov edx, dword [esp + 0xc]
mov byte [esi], al
mov dword [edi], edx
jmp 0x266bc
cmp ecx, 0x9c40a0dc
ja 0x267f6
je case.0x2680c.1673486112
cmp ecx, 0x9c40a0c8
ja 0x267d1
je case.0x2680c.1673486112
cmp ecx, 0x9c406104
je 0x267b2
cmp ecx, 0x9c406144
jne case.0x2680c.1673486111
cmp dword [edx + 8], 8
mov esi, dword [edx + 4]
mov eax, dword [ebx + 0xc]
jne 0x26844
push eax
call fcn.00026bf0
mov esi, eax
jmp case.0x2680c.1673486111
cmp dword [edx + 8], 0x10
mov eax, dword [edx + 4]
mov esi, dword [ebx + 0xc]
jne 0x26844
push edi
push eax
push esi
call fcn.00026cc0
mov esi, eax
jmp case.0x2680c.1673486111
cmp ecx, 0x9c40a0d8
jne case.0x2680c.1673486111
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
cmp eax, 0x9c40a0d8
je 0x26813
push edx
call fcn.00026bb0
mov esi, eax
jmp case.0x2680c.1673486111
add ecx, 0x63bf5f20
cmp ecx, 0x6c
ja case.0x2680c.1673486111
movzx ecx, byte [ecx + 0x26918]
jmp dword [ecx*4 + 0x26904]
movzx eax, byte [ecx + 4]
push eax
push edx
call dword [sym.imp.HAL.dll_WRITE_PORT_UCHAR]
jmp 0x266bc
mov edx, dword [edx + 8]
mov ecx, dword [ebx + 0xc]
cmp edx, 8
jb 0x26844
push edx
mov eax, edi
call fcn.00026c70
mov esi, eax
jmp case.0x2680c.1673486111
mov dword [edi], 0
mov esi, 0xc000000d
jmp case.0x2680c.1673486111
mov ecx, dword [edx + 4]
mov edx, dword [ebx + 0xc]
push ecx
mov eax, edi
call fcn.000247e0
mov esi, eax
jmp case.0x2680c.1673486111
Function at 0x266d6
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x60]
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [edi], 0
movzx eax, byte [edx]
sub eax, 0
mov esi, 0xc0000002
je 0x266bc
sub eax, 2
je 0x266bc
sub eax, 0xc
jne case.0x2680c.1673486111
mov eax, dword [edx + 0xc]
mov ecx, eax
cmp ecx, 0x9c4060d4
ja 0x26769
je 0x26735
cmp ecx, 0x9c40208c
ja 0x2670e
je 0x26700
add ecx, 0x63bfe000
cmp ecx, 0x88
ja case.0x2680c.1673486111
movzx eax, byte [ecx + 0x26878]
jmp dword [eax*4 + 0x26864]
mov ecx, dword [ebx + 0xc]
mov dword [ecx], 0x1020005
mov dword [edi], 4
xor esi, esi
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x2ab14]
mov edx, dword [ebx + 0xc]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
jmp 0x266b6
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026990
mov esi, eax
jmp case.0x2680c.1673486111
mov edx, dword [ebx + 0xc]
push edi
call fcn.00026a30
mov esi, eax
jmp case.0x2680c.1673486111
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026ac0
mov esi, eax
jmp case.0x2680c.1673486111
cmp ecx, 0x9c4060cc
ja 0x2672d
je 0x26735
cmp ecx, 0x9c402090
je 0x2672a
cmp ecx, 0x9c4060c4
je 0x26735
jmp case.0x2680c.1673486111
hlt
cmp ecx, 0x9c4060d0
jne case.0x2680c.1673486111
mov esi, dword [ebx + 0xc]
mov edx, dword [edx + 8]
mov ecx, dword [esi]
mov dword [esp + 0xc], edx
cmp eax, 0x9c4060cc
je 0x26755
push edx
call fcn.00026b60
mov esi, eax
jmp case.0x2680c.1673486111
push ecx
call dword [sym.imp.HAL.dll_READ_PORT_UCHAR]
mov edx, dword [esp + 0xc]
mov byte [esi], al
mov dword [edi], edx
jmp 0x266bc
cmp ecx, 0x9c40a0dc
ja 0x267f6
je case.0x2680c.1673486112
cmp ecx, 0x9c40a0c8
ja 0x267d1
je case.0x2680c.1673486112
cmp ecx, 0x9c406104
je 0x267b2
cmp ecx, 0x9c406144
jne case.0x2680c.1673486111
cmp dword [edx + 8], 8
mov esi, dword [edx + 4]
mov eax, dword [ebx + 0xc]
jne 0x26844
push eax
call fcn.00026bf0
mov esi, eax
jmp case.0x2680c.1673486111
cmp dword [edx + 8], 0x10
mov eax, dword [edx + 4]
mov esi, dword [ebx + 0xc]
jne 0x26844
push edi
push eax
push esi
call fcn.00026cc0
mov esi, eax
jmp case.0x2680c.1673486111
cmp ecx, 0x9c40a0d8
jne case.0x2680c.1673486111
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
cmp eax, 0x9c40a0d8
je 0x26813
push edx
call fcn.00026bb0
mov esi, eax
jmp case.0x2680c.1673486111
add ecx, 0x63bf5f20
cmp ecx, 0x6c
ja case.0x2680c.1673486111
movzx ecx, byte [ecx + 0x26918]
jmp dword [ecx*4 + 0x26904]
movzx eax, byte [ecx + 4]
push eax
push edx
call dword [sym.imp.HAL.dll_WRITE_PORT_UCHAR]
jmp 0x266bc
mov edx, dword [edx + 8]
mov ecx, dword [ebx + 0xc]
cmp edx, 8
jb 0x26844
push edx
mov eax, edi
call fcn.00026c70
mov esi, eax
jmp case.0x2680c.1673486111
mov dword [edi], 0
mov esi, 0xc000000d
jmp case.0x2680c.1673486111
mov ecx, dword [edx + 4]
mov edx, dword [ebx + 0xc]
push ecx
mov eax, edi
call fcn.000247e0
mov esi, eax
jmp case.0x2680c.1673486111
Function at 0x2684e
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x60]
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [edi], 0
movzx eax, byte [edx]
sub eax, 0
mov esi, 0xc0000002
je 0x266bc
sub eax, 2
je 0x266bc
sub eax, 0xc
jne case.0x2680c.1673486111
mov eax, dword [edx + 0xc]
mov ecx, eax
cmp ecx, 0x9c4060d4
ja 0x26769
je 0x26735
cmp ecx, 0x9c40208c
ja 0x2670e
je 0x26700
add ecx, 0x63bfe000
cmp ecx, 0x88
ja case.0x2680c.1673486111
movzx eax, byte [ecx + 0x26878]
jmp dword [eax*4 + 0x26864]
mov ecx, dword [ebx + 0xc]
mov dword [ecx], 0x1020005
mov dword [edi], 4
xor esi, esi
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x2ab14]
mov edx, dword [ebx + 0xc]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
jmp 0x266b6
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026990
mov esi, eax
jmp case.0x2680c.1673486111
mov edx, dword [ebx + 0xc]
push edi
call fcn.00026a30
mov esi, eax
jmp case.0x2680c.1673486111
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026ac0
mov esi, eax
jmp case.0x2680c.1673486111
cmp ecx, 0x9c4060cc
ja 0x2672d
je 0x26735
cmp ecx, 0x9c402090
je 0x2672a
cmp ecx, 0x9c4060c4
je 0x26735
jmp case.0x2680c.1673486111
hlt
cmp ecx, 0x9c4060d0
jne case.0x2680c.1673486111
mov esi, dword [ebx + 0xc]
mov edx, dword [edx + 8]
mov ecx, dword [esi]
mov dword [esp + 0xc], edx
cmp eax, 0x9c4060cc
je 0x26755
push edx
call fcn.00026b60
mov esi, eax
jmp case.0x2680c.1673486111
push ecx
call dword [sym.imp.HAL.dll_READ_PORT_UCHAR]
mov edx, dword [esp + 0xc]
mov byte [esi], al
mov dword [edi], edx
jmp 0x266bc
cmp ecx, 0x9c40a0dc
ja 0x267f6
je case.0x2680c.1673486112
cmp ecx, 0x9c40a0c8
ja 0x267d1
je case.0x2680c.1673486112
cmp ecx, 0x9c406104
je 0x267b2
cmp ecx, 0x9c406144
jne case.0x2680c.1673486111
cmp dword [edx + 8], 8
mov esi, dword [edx + 4]
mov eax, dword [ebx + 0xc]
jne 0x26844
push eax
call fcn.00026bf0
mov esi, eax
jmp case.0x2680c.1673486111
cmp dword [edx + 8], 0x10
mov eax, dword [edx + 4]
mov esi, dword [ebx + 0xc]
jne 0x26844
push edi
push eax
push esi
call fcn.00026cc0
mov esi, eax
jmp case.0x2680c.1673486111
cmp ecx, 0x9c40a0d8
jne case.0x2680c.1673486111
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
cmp eax, 0x9c40a0d8
je 0x26813
push edx
call fcn.00026bb0
mov esi, eax
jmp case.0x2680c.1673486111
add ecx, 0x63bf5f20
cmp ecx, 0x6c
ja case.0x2680c.1673486111
movzx ecx, byte [ecx + 0x26918]
jmp dword [ecx*4 + 0x26904]
movzx eax, byte [ecx + 4]
push eax
push edx
call dword [sym.imp.HAL.dll_WRITE_PORT_UCHAR]
jmp 0x266bc
mov edx, dword [edx + 8]
mov ecx, dword [ebx + 0xc]
cmp edx, 8
jb 0x26844
push edx
mov eax, edi
call fcn.00026c70
mov esi, eax
jmp case.0x2680c.1673486111
mov dword [edi], 0
mov esi, 0xc000000d
jmp case.0x2680c.1673486111
mov ecx, dword [edx + 4]
mov edx, dword [ebx + 0xc]
push ecx
mov eax, edi
call fcn.000247e0
mov esi, eax
jmp case.0x2680c.1673486111
Function at 0x27080
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x100
xor eax, eax
jmp 0x27090
mov byte [esp + eax], al
inc eax
cmp eax, 0x100
jb 0x27090
push ebx
push ebp
push esi
xor ecx, ecx
xor eax, eax
push edi
xor esi, esi
jmp 0x270b0
movzx edi, byte [eax + 0x297f0]
mov dl, byte [esp + esi + 0x10]
movzx ebx, dl
add edi, ecx
add ebx, edi
and ebx, 0xff
inc eax
mov ecx, ebx
cmp eax, 0x70
jb 0x270d2
xor eax, eax
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], bl
inc esi
mov byte [esp + ecx + 0x10], dl
cmp esi, 0x100
jb 0x270b0
xor edi, edi
xor esi, esi
mov eax, 0x2a7aa
lea ebp, [edi + 0x7a]
inc esi
and esi, 0xff
mov dl, byte [esp + esi + 0x10]
movzx ecx, dl
add ecx, edi
and ecx, 0xff
movzx ebx, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx edi, byte [esp + esi + 0x10]
movzx edx, dl
add edi, edx
and edi, 0xff
movzx edx, byte [esp + edi + 0x10]
xor byte [eax - 2], dl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx edx, bl
add edx, ecx
and edx, 0xff
movzx ecx, byte [esp + edx + 0x10]
mov byte [esp + esi + 0x10], cl
mov byte [esp + edx + 0x10], bl
movzx ecx, byte [esp + esi + 0x10]
movzx edi, bl
add ecx, edi
and ecx, 0xff
movzx ecx, byte [esp + ecx + 0x10]
xor byte [eax - 1], cl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx ecx, bl
add ecx, edx
and ecx, 0xff
movzx edx, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], dl
mov byte [esp + ecx + 0x10], bl
movzx edx, byte [esp + esi + 0x10]
movzx edi, bl
add edx, edi
and edx, 0xff
movzx edx, byte [esp + edx + 0x10]
xor byte [eax], dl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx edx, bl
add edx, ecx
and edx, 0xff
movzx ecx, byte [esp + edx + 0x10]
mov byte [esp + esi + 0x10], cl
mov byte [esp + edx + 0x10], bl
movzx ecx, byte [esp + esi + 0x10]
movzx edi, bl
add ecx, edi
and ecx, 0xff
movzx ecx, byte [esp + ecx + 0x10]
xor byte [eax + 1], cl
inc esi
and esi, 0xff
mov cl, byte [esp + esi + 0x10]
movzx edi, cl
add edi, edx
and edi, 0xff
movzx edx, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], dl
mov byte [esp + edi + 0x10], cl
movzx edx, byte [esp + esi + 0x10]
movzx ecx, cl
add edx, ecx
and edx, 0xff
movzx edx, byte [esp + edx + 0x10]
xor byte [eax + 2], dl
add eax, 5
sub ebp, 1
jne 0x270f3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x27a90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, 0x1fc
or eax, 0xffffffff
push esi
lea esp, [esp]
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x29008]
dec ecx
inc edx
test ecx, ecx
jne 0x27aa0
not eax
pop esi
ret

Function at 0x27bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
setge al
test al, al
je 0x27bf2
test esi, esi
je 0x27bf2
mov ecx, dword [esp + 4]
mov dword [esi], ecx
add esp, 8
ret 4
Function at 0x27c00
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x24
xor eax, eax
push 5
push 0x18
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x27c51
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov al, 1
add esp, 0x24
ret
xor al, al
add esp, 0x24
ret

Function at 0x27c60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
push 0x54
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0
call sub.ntoskrnl.exe_memset
add esp, 0xc
test esi, esi
je 0x27cdd
test edi, edi
je 0x27cdd
mov eax, dword [ebp + 8]
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00027230
push edi
lea esi, [esp + 0xc]
call fcn.000272f0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x2b034
Capabilities:
Create device object
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call section.INIT
pop ebp
jmp fcn.00025bd0
Function at 0x40657c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065a0
xor eax, eax
test eax, eax
je 0x4065b3
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065b3
xor ecx, ecx
jmp 0x4065b6
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x4021e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x40221c
cmp dword [ebp + 8], 0xffffffff
je 0x40221c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
jne 0x40221c
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x40221c
mov eax, dword [ebp - 4]
jmp 0x40221e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401ce0
Capabilities:
Enumerate processes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x140
mov eax, dword [0x449590]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [ebx + 0x7c]
push esi
lea esi, [ebx + 0x78]
push edi
xor edi, edi
cmp eax, edi
je 0x401d14
push eax
call fcn.00405a65
add esp, 4
mov dword [esi + 4], edi
push edi
push edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov eax, dword [ebx + 0x1b0]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x18b
push eax
call edi
test eax, eax
jle 0x401d5c
mov ecx, dword [ebx + 0x1b0]
push 0
push 0
push 0x182
push ecx
call edi
mov edx, dword [ebx + 0x1b0]
push 0
push 0
push 0x18b
push edx
call edi
test eax, eax
jg 0x401d34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 2
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401df9
lea esp, [esp]
mov edx, dword [esp + 0x14]
cmp dword [esp + 0x20], edx
je 0x401dde
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
test eax, eax
jl 0x401e31
lea edi, [eax + 1]
call fcn.00401320
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0xc]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebx + 0x1b0]
lea eax, [esp + 0x3c]
push eax
push 0
push 0x180
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401d90
mov ecx, dword [ebx + 0x1b0]
push 0
push 0
push 0x18b
push ecx
call edi
mov edx, dword [ebx + 0x1b0]
push 1
dec eax
push eax
push 0x19e
push edx
call edi
mov ecx, dword [esp + 0x144]
pop edi
pop esi
xor ecx, esp
call fcn.0042433d
mov esp, ebp
pop ebp
ret
call fcn.004090a7
int3

Function at 0x401ef0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
lea eax, [esp + 4]
push eax
push 0x20
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401f78
lea ecx, [esp + 8]
xor eax, eax
push ecx
push str.SeDebugPrivilege
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x14]
push 0
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esp, ebp
pop ebp
ret
Function at 0x402fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402ff9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403034
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403030
lea ebx, [ebx]
cmp esi, eax
jae 0x403034
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403020
cmp esi, eax
jb 0x40303a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403480
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x403494
or eax, 0xffffffff
pop edi
ret
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x40348f
push ebx
mov ebx, dword [eax + 0x78]
mov ecx, dword [ebx + edi + 0x18]
add ebx, edi
push ebp
mov ebp, dword [ebx + 0x20]
add ebp, edi
test ecx, ecx
jne 0x4034bc
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
ret
mov eax, dword [ebx + 0x24]
push esi
add eax, edi
xor esi, esi
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x403521
lea esp, [esp]
mov eax, dword [ebp + esi*4]
mov ecx, dword [esp + 0x18]
add eax, edi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403500
test dl, dl
je 0x4034fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403500
add eax, 2
add ecx, 2
test dl, dl
jne 0x4034e0
xor eax, eax
jmp 0x403505
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403517
inc esi
cmp esi, dword [ebx + 0x18]
jl 0x4034d0
pop esi
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
ret
mov ecx, 0xffff
cmp si, cx
jne 0x403529
pop esi
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
ret
mov eax, dword [esp + 0x14]
movzx edx, si
movzx eax, word [eax + edx*2]
add eax, dword [ebx + 0x10]
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x403540
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x108
mov eax, dword [0x449590]
xor eax, esp
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x10c]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40357c
xor eax, eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042433d
add esp, 0x108
ret
push edi
mov edi, dword [ecx + 0x3c]
add edi, ecx
cmp dword [edi], 0x4550
je 0x4035a2
xor eax, eax
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042433d
add esp, 0x108
ret
mov eax, dword [edi + 0x78]
mov edx, dword [esp + 0x114]
add eax, ecx
push esi
mov esi, dword [eax + 0x10]
cmp edx, esi
jb 0x403677
sub edx, esi
cmp edx, dword [eax + 0x14]
ja 0x403677
mov esi, dword [eax + 0x1c]
lea edx, [esi + edx*4]
mov esi, dword [edx + ecx]
add esi, ecx
push ebx
cmp esi, eax
jb 0x40365d
mov ecx, dword [edi + 0x7c]
add ecx, eax
cmp esi, ecx
jae 0x40365d
push 0x2e
push esi
call fcn.00424a30
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x403628
push 0x104
lea edx, [esp + 0x10]
push 0
push edx
call fcn.00424c20
mov eax, ebx
sub eax, esi
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.00424af0
add esp, 0x18
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x403642
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042433d
add esp, 0x108
ret
inc ebx
push ebx
push edi
call fcn.00403480
push eax
push edi
call fcn.00403540
add esp, 0x10
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov eax, esi
pop esi
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042433d
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.0042433d
add esp, 0x108
ret