joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x420595
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x432578]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 0x18], 0
mov dword [esi], vtable.CTrustee.0
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea eax, [esp + 0x20]
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x18], ecx
lea ecx, [esp + 0x20]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14

Function at 0x412640
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4205f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x432578]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 8]
mov ecx, edi
mov dword [esp + 0x18], 0
mov dword [esi], vtable.CACE.0
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
mov byte [esp + 0x1c], 1
mov dword [esi + 4], eax
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x14], ecx
lea ecx, [esp + 0x24]
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x18

Function at 0x412740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42064c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x432578]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
lea ebx, [esi + 0x1c]
mov ecx, ebx
mov dword [esi], vtable.CSD.0
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov eax, dword [esp + 0x24]
xor edi, edi
push 0x423734
mov ecx, ebx
mov dword [esp + 0x20], edi
mov dword [esi + 0x28], eax
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4148f0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
xor ebx, ebx
cmp eax, 1
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebx
jne 0x41490f
mov eax, dword [ebp + 4]
mov dword [esp + 8], eax
jmp 0x41491f
cmp eax, 2
jne 0x414afa
mov ecx, dword [ebp + 8]
mov dword [esp + 8], ecx
push esi
mov esi, dword [esp + 0xc]
cmp esi, ebx
jne 0x414933
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4
push 2
push 0xc
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x41495e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1d
pop ebx
add esp, 0x18
ret 4
mov eax, dword [esp + 0x18]
cmp eax, ebx
push edi
mov dword [esp + 0x14], eax
ja 0x41497b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x414ac5
mov ecx, dword [esp + 0x18]
test byte [ecx + 1], 0x10
jne 0x414aac
mov edx, dword [ebp + 0x28]
mov edi, dword [edx + 0xc]
test edi, edi
je 0x414aac
lea esp, [esp]
test edi, edi
mov eax, edi
je 0x414add
mov esi, dword [eax + 8]
cmp dword [esi + 0x14], 0
mov edi, dword [edi]
je 0x4149db
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x18]
push eax
add ecx, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4149e4
test edi, edi
jne 0x4149b0
jmp 0x414aac
mov eax, dword [esi + 0x10]
test eax, 0x200
je 0x414a0f
mov edx, dword [esp + 0x10]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x414ae2
sub dword [esp + 0x14], 1
sub ebx, 1
jmp 0x414aac
test eax, 0x100
je 0x414a48
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
push ecx
push ebx
push edx
mov ecx, ebp
call fcn.00411610
mov esi, eax
test esi, esi
jne 0x414a6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1f
pop ebx
add esp, 0x18
ret 4
test eax, 0x400
je 0x414aac
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
push ecx
push ebx
push edx
mov ecx, ebp
call fcn.00411850
mov esi, eax
test esi, esi
je 0x414a30
add dword [esp + 0x14], 1
mov edi, dword [esp + 0x2c]
cmp edi, 1
jne 0x414a80
mov ecx, ebp
call fcn.00412810
jmp 0x414a8c
cmp edi, 2
jne 0x414a8c
mov ecx, ebp
call fcn.00412840
cmp edi, 1
mov dword [esp + 0x10], esi
jne 0x414a9d
mov dword [ebp + 4], esi
mov dword [ebp + 0x30], edi
jmp 0x414aac
cmp edi, 2
jne 0x414aac
mov dword [ebp + 8], esi
mov dword [ebp + 0x34], 1
add ebx, 1
cmp ebx, dword [esp + 0x14]
jb 0x414977
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1d
pop ebx
add esp, 0x18
ret 4
call fcn.0041de3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [ebp + 0x18], eax
pop ebp
mov eax, 0x1e
pop ebx
add esp, 0x18
ret 4
pop ebp
mov eax, 3
pop ebx
add esp, 0x18
ret 4
Function at 0x418b40
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCR80.dll_fclose]
push esi
mov esi, ecx
mov eax, dword [esi + 0xd8]
test eax, eax
push edi
lea edi, [esi + 0xd8]
je 0x418b69
push eax
call ebp
add esp, 4
mov dword [edi], 0
lea ebx, [esi + 0xd4]
mov ecx, ebx
call dword [sym.imp.MFC80U.DLL_Ordinal_3927]
test al, al
jne 0x418bb4
push 0x4245c4
mov ecx, ebx
call dword [sym.imp.MFC80U.DLL_Ordinal_870]
push eax
push edi
call dword [sym.imp.MSVCR80.dll__wfopen_s]
mov eax, dword [edi]
add esp, 0xc
test eax, eax
je 0x418bdb
push eax
push 1
lea eax, [esp + 0x18]
push 2
push eax
mov dword [esp + 0x20], 0xfeff
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
mov eax, dword [esi + 0x50]
cmp eax, 1
jne 0x418be6
push fcn.004172c0
push ecx
lea edx, [esi + 0x4c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov ecx, esi
call fcn.004137e0
jmp 0x418c22
mov eax, 0x22
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp eax, 4
jne 0x418c0a
push fcn.004172c0
push ecx
lea eax, [esi + 0x4c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov ecx, esi
call fcn.00417050
jmp 0x418c22
push ecx
lea edx, [esi + 0x4c]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov ecx, esi
call fcn.004172c0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x418c36
push eax
call ebp
add esp, 4
mov dword [edi], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41da10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jbe 0x41db8b
test ecx, ecx
je 0x41db8b
cmp edi, 8
mov eax, dword [esp + 8]
push esi
jb 0x41db54
push ebp
mov ebp, edi
shr ebp, 3
lea ecx, [ecx]
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx]
add ecx, 1
add ecx, 1
add ecx, 1
xor dx, ax
movzx eax, dx
xor eax, esi
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx - 2]
add ecx, 1
add ecx, 1
add ecx, 1
xor dx, ax
movzx eax, dx
xor eax, esi
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx - 4]
add ecx, 1
add ecx, 1
xor dx, ax
movzx eax, dx
xor eax, esi
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx - 5]
xor dx, ax
movzx eax, dx
xor eax, esi
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx - 4]
xor dx, ax
movzx eax, dx
xor eax, esi
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx - 3]
xor dx, ax
movzx eax, dx
xor eax, esi
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx - 2]
xor dx, ax
movzx eax, dx
xor eax, esi
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx eax, byte [ecx - 1]
xor dx, ax
movzx eax, dx
xor eax, esi
sub edi, 8
sub ebp, 1
jne 0x41da40
pop ebp
test edi, edi
je 0x41db88
jmp 0x41db60
movzx edx, ax
shr edx, 8
movzx esi, word [edx*2 + 0x431080]
xor edx, edx
mov dh, al
movzx ax, byte [ecx]
sub edi, 1
add ecx, 1
xor dx, ax
movzx eax, dx
xor eax, esi
test edi, edi
jne 0x41db60
pop esi
pop edi
ret
mov ax, word [esp + 8]
pop edi
ret
Function at 0x41dba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jbe 0x41dcd6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41dcd6
cmp edi, 8
push esi
mov esi, dword [esp + 0xc]
not esi
jb 0x41dca7
push ebp
mov ebp, edi
shr ebp, 3
nop
movzx edx, byte [eax]
xor edx, esi
and edx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
movzx edx, byte [eax]
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
movzx edx, byte [eax + 1]
xor edx, ecx
and edx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
movzx edx, byte [eax + 1]
xor edx, ecx
add eax, 1
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
movzx edx, byte [eax + 1]
xor edx, ecx
add eax, 1
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
movzx edx, byte [eax + 1]
xor edx, ecx
add eax, 1
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
movzx edx, byte [eax + 1]
add eax, 1
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
movzx edx, byte [eax + 1]
add eax, 1
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x431280]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x41dbd0
pop ebp
test edi, edi
je 0x41dccf
jmp 0x41dcb0
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x431280]
sub edi, 1
add eax, 1
test edi, edi
jne 0x41dcb0
not esi
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 8]
pop edi
ret

Function at 0x41dce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4215d2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x432578]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call dword [sym.imp.MFC80U.DLL_Ordinal_2895]
lea ecx, [esp + 8]
mov esi, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_2461]
push eax
lea ecx, [esi + esi]
push ecx
push 0
call fcn.0041da10
mov edx, dword [esp + 0x30]
add esp, 0xc
lea ecx, [esp + 8]
mov word [edx], ax
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x41e2c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432578]
jne 0x41e2ca
repz ret
jmp fcn.0041e915
Function at 0x41edae
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x432578]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041ed43
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x41edfd
cmp dword [ebp - 0x1c], 5
jb 0x41ee15
jmp 0x41ee11
cmp dword [ebp - 0x10], 1
jne 0x41ee15
cmp dword [ebp - 0x1c], 4
ja 0x41ee11
jne 0x41ee15
cmp dword [ebp - 0x18], 0
jbe 0x41ee15
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x429900
call fcn.00403df0
test eax, eax
jge 0x41ee36
mov byte [0x432674], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e2c0
add ebp, 0x78
leave
ret
Function at 0x402873
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x403140
call fcn.00402b5c
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [0x402bbc]
call edi
cmp word [eax], 0x5a4d
jne 0x4028b3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4028b3
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4028cb
cmp eax, 0x20b
je 0x4028b8
mov dword [ebp - 0x1c], ebx
jmp 0x4028df
cmp dword [ecx + 0x84], 0xe
jbe 0x4028b3
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x4028d9
cmp dword [ecx + 0x74], 0xe
jbe 0x4028b3
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x404474], 0xffffffff
or dword [0x404478], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x404134]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x404130]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x404470], eax
call fcn.00402ab6
call fcn.00402b56
cmp dword [0x404014], ebx
jne 0x40293f
push 0x401b56
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00402b44
push 0x40400c
push 0x404008
call sub.MSVCR71.dll__initterm
push 0x401afa
call fcn.00402aa4
mov eax, dword [0x40412c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x404128]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x402993
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x404004
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x402a11
cmp al, bl
je 0x4029bd
cmp dword [ebp - 0x20], ebx
jne 0x402a11
mov al, byte [esi]
cmp al, bl
je 0x4029cd
cmp al, 0x20
ja 0x4029cd
inc esi
mov dword [ebp - 0x24], esi
jmp 0x4029bd
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x4029e9
movzx eax, word [ebp - 0x54]
jmp 0x4029ec
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.004025b6
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x402a09
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x402a66
cmp al, 0x22
jne 0x402a20
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x402a33
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x4029ab
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00402b97
ret
Function at 0x43ad00
Capabilities:
Create pipe
Create process on windows
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.00446cf0
mov eax, dword [0x45a9f4]
mov ecx, dword [0x45a480]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x43ae35
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x45a9f4], 0x959
jne 0x43ae1e
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0x1808]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0x402da8
push 0
push 0
push 0
call esi
push 0
lea ecx, [ebp - 0xc08]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [ebp - 4]
push edx
call fcn.0043aa70
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x43ad3e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d557
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ba78]
jne 0x43d561
repz ret
jmp fcn.0044280c

Function at 0x443ffb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043e8ea
and dword [ebp - 4], 0
cmp dword [0x4519fc], 0
mov ebx, eax
jne 0x4440ac
push 0x402488
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44415d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40247c
push edi
call esi
test eax, eax
je 0x44415d
push eax
call fcn.0043e878
mov dword [esp], 0x40246c
push edi
mov dword [0x4519fc], eax
call esi
push eax
call fcn.0043e878
mov dword [esp], 0x402458
push edi
mov dword [0x451a00], eax
call esi
push eax
call fcn.0043e878
mov dword [esp], 0x40243c
push edi
mov dword [0x451a04], eax
call esi
push eax
call fcn.0043e878
pop ecx
mov dword [0x451a0c], eax
test eax, eax
je 0x4440ac
push 0x402424
push edi
call esi
push eax
call fcn.0043e878
pop ecx
mov dword [0x451a08], eax
mov eax, dword [0x451a08]
cmp eax, ebx
je 0x444104
cmp dword [0x451a0c], ebx
je 0x444104
push eax
call fcn.0043e8f3
push dword [0x451a0c]
mov esi, eax
call fcn.0043e8f3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x444104
test edi, edi
je 0x444104
call esi
test eax, eax
je 0x4440fb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4440fb
test byte [ebp - 0xc], 1
jne 0x444104
or dword [ebp + 0x10], 0x200000
jmp 0x44413d
mov eax, dword [0x451a00]
cmp eax, ebx
je 0x44413d
push eax
call fcn.0043e8f3
pop ecx
test eax, eax
je 0x44413d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44413d
mov eax, dword [0x451a04]
cmp eax, ebx
je 0x44413d
push eax
call fcn.0043e8f3
pop ecx
test eax, eax
je 0x44413d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4519fc]
call fcn.0043e8f3
pop ecx
test eax, eax
je 0x44415d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44415f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001760
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x24
push esi
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x1000177a
xor eax, eax
pop esi
add esp, 0x24
ret
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x10001793
pop esi
add esp, 0x24
ret
push esi
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
test esi, esi
jne 0x100017a5
pop esi
add esp, 0x24
ret
push ebx
push ebp
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov edi, eax
mov eax, dword [esp + 0x3c]
sub ebx, ebp
mov ebp, dword [esp + 0x30]
mov ecx, dword [eax + 8]
sub ebp, edx
mov edx, dword [eax]
push ebp
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 0xc]
sub ecx, dword [esp + 0x14]
sub eax, edx
push ebx
push esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
push 0
push edi
push eax
call fcn.10001580
mov ecx, dword [esp + 0x48]
add esp, 0xc
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edx, dword [esp + 0x14]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x20]
push 0xcc0020
push eax
push ecx
push edi
push ebp
push ebx
mov ebx, dword [esp + 0x2c]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x3c]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, eax
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
mov ebx, dword [sym.imp.GDI32.dll_DeleteDC]
call ebx
push edi
call ebx
mov ecx, dword [esp + 0x38]
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret