joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b97c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x58b9f6
mov eax, dword [ebx + 8]
call fcn.0050010c
mov ecx, eax
mov dl, 1
mov eax, dword [0x50c488]
call fcn.004fa530
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00510b70
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x58b274
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0050010c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0050010c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x58ba6c
mov eax, dword [ebx + 8]
call fcn.0050010c
mov ecx, eax
mov dl, 1
mov eax, dword [0x50c488]
call fcn.004fa530
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00510b70
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x58b2c0
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0050010c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0050010c
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x58bad8
mov eax, dword [ebx + 8]
call fcn.0050010c
mov ecx, eax
mov dl, 1
mov eax, dword [0x50cf08]
call fcn.004fa530
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0050010c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0050010c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x58f690
Capabilities:
Encrypt data using des

Disassembly:
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], dl
mov edi, eax
lea eax, [esp + 1]
xor ecx, ecx
mov edx, 8
call fcn.00405dd8
xor edx, edx
mov esi, str.:2_
movzx eax, byte [esp]
add eax, eax
add eax, eax
add eax, eax
movzx eax, byte [esi + eax*8]
dec eax
movzx ecx, al
shr ecx, 3
and ecx, 7
movzx ecx, byte [edi + ecx]
and al, 7
movzx eax, al
and cl, byte [eax + 0x6c51c8]
test cl, cl
je 0x58f6f7
mov al, 7
and al, dl
movzx eax, al
movzx eax, byte [eax + 0x6c51c8]
movzx ecx, dl
shr ecx, 3
and ecx, 7
or byte [esp + ecx + 1], al
inc edx
inc esi
cmp dl, 0x40
jne 0x58f6b1
mov edx, edi
lea eax, [esp + 1]
mov ecx, 8
call fcn.00405284
add esp, 0xc
pop edi
pop esi
ret

Function at 0x58f784
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, eax
mov edi, esp
xor edx, edx
mov eax, esi
call fcn.0058f690
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.00405284
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 8
call fcn.00405dd8
mov ebp, edi
movzx eax, byte [ebp + 7]
shl eax, 5
movzx edx, byte [ebp + 4]
movzx ecx, dl
shr ecx, 3
or al, cl
and al, 0x3f
mov byte [esp + 8], al
mov ecx, edx
add ecx, ecx
movzx eax, byte [ebp + 5]
movzx ebx, al
shr ebx, 7
or cl, bl
and cl, 0x3f
mov byte [esp + 9], cl
mov ecx, edx
shl ecx, 5
movzx ebx, al
shr ebx, 3
or cl, bl
and cl, 0x3f
mov byte [esp + 0xa], cl
mov ecx, eax
add ecx, ecx
movzx ebx, byte [ebp + 6]
shr ebx, 7
or cl, bl
and cl, 0x3f
mov byte [esp + 0xb], cl
shl eax, 5
movzx ecx, byte [ebp + 6]
shr ecx, 3
or al, cl
and al, 0x3f
mov byte [esp + 0xc], al
movzx eax, byte [ebp + 6]
add eax, eax
movzx ecx, byte [ebp + 7]
shr ecx, 7
or al, cl
and al, 0x3f
mov byte [esp + 0xd], al
movzx eax, byte [ebp + 6]
shl eax, 5
movzx ecx, byte [ebp + 7]
shr ecx, 3
or al, cl
and al, 0x3f
mov byte [esp + 0xe], al
movzx eax, byte [ebp + 7]
add eax, eax
movzx edx, dl
shr edx, 7
or al, dl
and al, 0x3f
mov byte [esp + 0xf], al
mov edx, ebp
lea eax, [esp + 8]
mov ecx, 8
call fcn.00405284
mov eax, edi
call fcn.0058f714
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 8
call fcn.00405dd8
xor eax, eax
movzx edx, byte [eax + 0x6c52d0]
dec edx
mov ecx, edx
shr ecx, 3
movzx ecx, byte [edi + ecx]
and edx, 7
and cl, byte [edx + 0x6c51c8]
test cl, cl
je 0x58f8bf
mov edx, 7
and edx, eax
movzx edx, byte [edx + 0x6c51c8]
mov ecx, eax
shr ecx, 3
or byte [esp + ecx + 0x14], dl
inc eax
cmp eax, 0x20
jl 0x58f88a
mov edx, edi
lea eax, [esp + 0x10]
mov ecx, 8
call fcn.00405284
movzx eax, byte [edi + 4]
xor byte [esi], al
movzx eax, byte [edi + 5]
xor byte [esi + 1], al
movzx eax, byte [edi + 6]
xor byte [esi + 2], al
movzx eax, byte [edi + 7]
xor byte [esi + 3], al
mov dl, 1
mov eax, esi
call fcn.0058f690
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5900a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, eax
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x5900d5
inc ebx
mov eax, edx
mov edx, ecx
shr edx, 8
and edx, 0xffffff
movzx esi, byte [eax]
xor ecx, esi
and ecx, 0xff
xor edx, dword [ecx*4 + 0x6d0784]
mov ecx, edx
inc eax
dec ebx
jne 0x5900b2
mov eax, ecx
pop esi
pop ebx
pop ebp
ret 4
Function at 0x5936f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00408794
xor eax, eax
push ebp
push 0x593756
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x59371b
sub eax, 4
mov eax, dword [eax]
mov ebx, 0x1505
test eax, eax
jle 0x593740
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov esi, ebx
shl ebx, 5
add ebx, esi
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x593729
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59375d
lea eax, [ebp - 4]
call fcn.004086c4
ret

Function at 0x598adc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x598af0
add esp, 0xfffffff0
call fcn.00406f10
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00406970
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x20]
call fcn.005986b0
mov dword [esi + 4], eax
mov dword [esi + 8], 0x10
xor eax, eax
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x598b37
call fcn.00406f68
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x598b78
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
mov esi, eax
test edx, edx
jbe 0x598c35
mov eax, dword [esi + 4]
xchg edx, eax
call fcn.005986a0
mov edi, eax
mov eax, 0x1c
call fcn.004050b4
mov ebx, eax
push 0x40
push 0x1000
push edi
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], 0x20
mov eax, dword [esi + 0x10]
test eax, eax
je 0x598bce
mov dword [eax + 4], ebx
mov dword [ebx], eax
mov dword [esi + 0x10], ebx
xor eax, eax
mov dword [ebx + 4], eax
jmp 0x598bdd
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
xor ecx, ecx
call fcn.00405dd8
mov eax, dword [ebx + 8]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
lea eax, [edx + eax - 0x10]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
mov edx, dword [0x6c7ac8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x18]
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebx + 0x18]
mov edx, dword [0x6c7ac8]
mov dword [eax], edx
mov edx, dword [ebx + 0x14]
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x598c37
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x59b0e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test eax, eax
je 0x59b12c
mov ecx, dword [eax - 4]
jecxz 0x59b12c
shr ecx, 1
mov esi, eax
mov eax, 0x811c9dc5
xor ebx, ebx
mov bx, word [esi]
xor eax, ebx
mov ebx, eax
mov edi, ebx
add edi, edi
add eax, edi
mov edi, ebx
shl edi, 4
add eax, edi
mov edi, ebx
shl edi, 7
add eax, edi
mov edi, ebx
shl edi, 8
add eax, edi
shl ebx, 0x18
add eax, ebx
add esi, 2
dec ecx
jne 0x59b0fb
or eax, eax
jne 0x59b130
xor eax, eax
not eax
pop edi
pop esi
pop ebx
ret

Function at 0x5bbb94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, eax
mov ebx, edx
sub ebx, esi
test ebx, ebx
jle 0x5bbc3a
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5bbbd6
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov edi, dword [edx - 0x38]
add edi, ebx
cmp eax, edi
jg 0x5bbc08
add edi, 0x1000
and edi, 0xfffff000
push edi
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov ecx, 1
mov edx, dword [0x595164]
call fcn.0040ae7c
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
add edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00405284
mov eax, dword [ebp + 8]
add dword [eax - 0x38], ebx
cmp byte [ebp - 9], 0
je 0x5bbc3a
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push esi
call sub.kernel32.dll_VirtualProtect
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x644398
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x701a94], 0
jne 0x6443af
call fcn.00644354
mov eax, edi
dec eax
test eax, eax
jl 0x6443d7
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x701694]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6443b9
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x647070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x64710a.0
jmp dword [ecx*4 + 0x6470a3]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6470d5
sub dl, 8
je 0x6470e4
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646d3c
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646d90
jmp case.0x64710a.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x64710a.0
movzx ecx, byte [ecx + 0x647111]
jmp dword [ecx*4 + 0x647122]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646e30
jmp case.0x64710a.0
cmp dl, 3
jne 0x64714f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646e88
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646e44
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646ecc
jmp case.0x64710a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x64717a
sub dl, 8
je 0x647186
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646ef8
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x646f5c
jmp case.0x64710a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6471a5
sub dl, 8
je 0x6471b1
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x64700c
jmp case.0x64710a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x647034
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x647253
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00646284
test eax, eax
je 0x647253
mov eax, ebx
call fcn.0064725c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x6471ec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x64725c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x64728d
dec al
je 0x6472c8
dec al
je 0x647305
dec al
je 0x64736e
jmp 0x6473f8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6473f8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x64729d
jmp 0x6473f8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6473f8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x6472d8
jmp 0x6473f8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6473f8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x647334
xor ebp, ebp
jmp 0x647344
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x64734d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x647315
jmp 0x6473f8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6473f8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x6473c7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.006443e0
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x647382
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x64e9c4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x64e9f2
mov eax, ebx
call fcn.0064f480
cmp dword [ebx + 0x40], 0
je 0x64e9eb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x64ea63
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x64ea55
cmp dword [ebx + 0x14], 0xcc
je 0x64ea81
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]

Function at 0x663f64
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0066399c
test byte [ebx + 0x2c5], 4
jne 0x663ff9
mov edx, esp
mov eax, ebx
call fcn.004f69ec
push esp
mov eax, ebx
call fcn.004ffe9c
push eax
push 0
mov eax, ebx
test eax, eax
je 0x663f99
sub eax, 0xfffffcf4
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x2a0]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x2b4], 0
jne 0x663fca
mov ecx, dword [0x6ca704]
mov dl, 1
mov eax, dword [0x4e6e9c]
call fcn.004254f8
call fcn.00407d20
mov eax, ebx
call fcn.00664578
cmp byte [ebx + 0x69], 0
jne 0x664000
mov eax, ebx
call fcn.0050010c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x664000
push 0
mov eax, ebx
call fcn.0050010c
push eax
call sub.user32.dll_ShowWindow
jmp 0x664000
mov eax, ebx
call fcn.004fbe0c
add esp, 0x10
pop ebx
ret
Function at 0x6a4488
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [esp + 4]
mov dword [0x701cc8], eax
mov eax, dword [esp + 0x14]
mov dword [0x701ccc], eax
add esp, 0x24
ret

Function at 0x6ac7b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408784
xor eax, eax
push ebp
push 0x6ac8d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00405dd8
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.00405dd8
mov dword [ebp - 0x50], 0x44
push 0
lea eax, [ebp - 8]
push eax
push 1
push 0x20000
push 2
call sub.advapi32.dll_SaferCreateLevel
test eax, eax
je 0x6ac871
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_SaferComputeTokenFromLevel
test eax, eax
je 0x6ac868
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_SaferCloseLevel
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040972c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x6ac89e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_SaferCloseLevel
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040972c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x6ac8b1
test bl, bl
je 0x6ac8b1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ac8e0
lea eax, [ebp - 4]
call fcn.004086a0
ret
Function at 0x6af198
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x6af1dc
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x3f0
jne 0x6af1dc
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x6af273
mov eax, 0x400
call fcn.004050b4
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x6af26c
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x6ca3a4
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x6af262
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x6af25e
mov byte [esp], 1
jmp 0x6af262
inc edi
dec ebx
jne 0x6af245
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.004050d0
movzx eax, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x6af394
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6af431
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x40], 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, 0x6af43c
mov dword [ebp - 0x34], eax
call sub.kernel32.dll_GetCommandLineW_1
call fcn.006af35c
mov edx, eax
lea eax, [ebp - 4]
call fcn.00409794
mov eax, dword [ebp - 4]
call fcn.0040972c
mov dword [ebp - 0x2c], eax
mov eax, dword [0x6caa64]
mov eax, dword [eax]
call fcn.0040972c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 5
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x6af41b
push 0x10
push 0x6af448
push 0x6af464
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6af438
lea eax, [ebp - 4]
call fcn.004086a0
ret
Function at 0x401aa0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x50cb30]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x114]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push 0x104
mov ebx, ecx
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x18], eax
call fcn.004203a0
add esp, 0xc
cmp dword [esi + 0x18], 8
lea ebp, [esi + 4]
jb 0x401aed
mov eax, dword [ebp]
jmp 0x401aef
mov eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 1
call edi
cmp dword [esi + 0x18], 8
jb 0x401b12
mov ecx, dword [ebp]
jmp 0x401b14
mov ecx, ebp
xor ebp, ebp
push ebp
push ebp
push eax
lea edx, [esp + 0x20]
push edx
push 0xffffffffffffffff
push ecx
push ebp
push 1
call edi
mov eax, dword [esp + 0x10]
mov edi, dword [ebx + 4]
push eax
lea edx, [esp + 0x18]
call fcn.004018f0
mov esi, dword [ebx + 4]
lea ecx, [esp + 0x10]
push ecx
push ebp
push esi
push 0x401870
push ebp
push ebp
mov dword [esp + 0x28], ebp
call fcn.004a8591
add esp, 0x18
cmp eax, ebp
mov dword [esi + 0xc], eax
pop edi
je 0x401b86
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401b7e
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], ebp
mov eax, dword [ebx + 4]
mov al, byte [eax + 4]
jmp 0x401b8c
mov ecx, dword [ebx + 4]
mov al, byte [ecx + 4]
jmp 0x401b8c
mov edx, dword [ebx + 4]
mov al, byte [edx + 4]
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420385
add esp, 0x10c
ret 8