joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407521
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42d868
call fcn.00407d9a
push 1
call fcn.004075c7
pop ecx
test al, al
jne 0x4073ca
push 7
call fcn.00407f37
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00407592
mov byte [ebp - 0x24], al
mov eax, dword [0x431c64]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4073c3
test eax, eax
jne 0x407434
mov dword [0x431c64], ecx
push 0x4283f0
push 0x4283d8
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x407417
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40751b
push 0x4283d4
push 0x428380
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x431c64], 2
jmp 0x407439
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00407724
pop ecx
call fcn.00407f2b
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x407469
push esi
call fcn.00407697
pop ecx
test al, al
je 0x407469
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00408166
call esi
call fcn.00407f31
mov esi, eax
cmp dword [esi], edi
je 0x407487
push esi
call fcn.00407697
pop ecx
test al, al
je 0x407487
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.0040804c
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0040807f
test al, al
jne 0x4074c0
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4074c9
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00407741
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40751b
call fcn.00407de0
ret
call fcn.00407230
jmp 0x4073ab

Function at 0x409132
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x432040], 0x20
push esi
push edi
mov esi, ecx
je 0x409173
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x428d88
push dword [0x43204c]
push dword [0x432048]
call fcn.0040be9f
push 0x1c135e
call fcn.00402d04
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x4091bb
cmp ecx, edi
je 0x4091eb
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x4091bb
cmp ecx, dword [ebp - 0x10]
jne 0x4091bb
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x40a71c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
jne 0x40a737
mov eax, 0x80004005
jmp 0x40a907
cmp byte [esi + 0x180], bl
je 0x40a746
xor eax, eax
jmp 0x40a907
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
call fcn.00417d12
test al, al
jne 0x40a773
mov eax, dword [esi]
push esi
call dword [eax + 0x30]
test eax, eax
je 0x40a773
push 0x1c1417
call fcn.00402d04
push edi
call fcn.0042280a
test al, al
jne 0x40a7f5
push 0x2710
lea ecx, [esi + 0x38]
call fcn.0040c537
test eax, eax
je 0x40a7f5
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x40a7d0
sub eax, 1
je 0x40a7eb
sub eax, 1
je 0x40a7d0
sub eax, 1
je 0x40a7b8
push 0x1c1418
call fcn.00402d04
jmp 0x40a7c6
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x80004005
jmp 0x40a906
or ecx, 0xffffffff
mov eax, 0x4e20
cmp dword [ebp + 8], ebx
cmove eax, ecx
lea ecx, [esi + 0x38]
push eax
call fcn.0040c537
test eax, eax
je 0x40a7f5
mov eax, 0x80004004
jmp 0x40a906
mov ecx, dword [esi + 0x24]
mov byte [esi + 0x180], 1
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edi, [esi + 0x124]
cmp dword [edi + 8], ebx
je 0x40a837
cmp dword [edi], ebx
je 0x40a837
jmp 0x40a828
mov ecx, dword [ebp - 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00417def
test al, al
jne 0x40a815
push 0x429288
lea eax, [esi + 0x10]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 4]
call fcn.0041b494
test eax, eax
js 0x40a85b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40a86b
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40a877
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x40a883
call fcn.00411006
lea edi, [esi + 0x7c]
cmp dword [edi + 8], ebx
je 0x40a8b2
cmp dword [edi], ebx
je 0x40a8b2
jmp 0x40a8a3
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.00417def
test al, al
jne 0x40a891
lea edi, [esi + 0xd0]
cmp dword [edi + 8], ebx
je 0x40a8db
cmp dword [edi], ebx
je 0x40a8db
jmp 0x40a8cc
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00417def
test al, al
jne 0x40a8c3
cmp dword [esi + 0x17c], ebx
je 0x40a904
call fcn.00417d12
test al, al
je 0x40a8fa
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 0x17c], ebx
jmp 0x40a904
push 0x1c141d
call fcn.00402d04
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e112
Capabilities:
Encode data using xor

Disassembly:
push esi
lea esi, [ecx + 0x10]
mov edx, dword [esi]
mov eax, edx
mov ecx, edx
and eax, 0xffffc000
add eax, 0x4000
xor eax, edx
and eax, 0xfffc000
xor edx, eax
mov eax, ecx
lock cmpxchg dword [esi], edx
mov edx, eax
cmp edx, ecx
jne 0x40e118
pop esi
ret

Function at 0x40ec14
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x40ec30
mov ebx, 0x80004005
jmp 0x40ece8
mov eax, dword [esi + 0x38]
push edi
cmp eax, dword [esi + 0x34]
ja 0x40ec60
lea eax, [eax*4 + 0x14]
push eax
lea edi, [esi + 0x2c]
push edi
call fcn.00402d2a
pop ecx
pop ecx
test eax, eax
jne 0x40ec5a
mov ebx, 0x8007000e
jmp 0x40ece7
add dword [esi + 0x38], 5
mov dword [edi], eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.0040ecf0
mov ebx, eax
test ebx, ebx
js 0x40ecd9
mov ecx, dword [esi + 0x40]
or ecx, dword [esi + 0x44]
jne 0x40ec85
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
mov edi, dword [ebp - 4]
lock inc dword [edi + 0x908]
lea eax, [edi + 0x8f0]
push eax
xor eax, eax
push eax
push edi
push 0x40f099
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x40ecb9
mov ecx, edi
call fcn.0040eeb1
mov ebx, 0x80004005
jmp 0x40ecdc
mov dword [edi + 0x8ec], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x2c]
push 0x3e
mov dword [eax + ecx*4], edi
xor edi, edi
inc dword [esi + 0x34]
lea eax, [esi + 0x30]
pop ecx
lock xadd dword [eax], ecx
jmp 0x40ecdc
mov edi, dword [ebp - 4]
test edi, edi
je 0x40ece7
mov ecx, edi
call fcn.0040eeb1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414bfe
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x428bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [edi + 8]
mov dword [ebp - 0x24], eax
cmp eax, dword [edx + 4]
jne 0x414c74
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [edi + 0x14]
jne 0x414c74
mov eax, dword [edi + 8]
inc dword [eax + 8]
test byte [0x432040], 0x80
je 0x414c61
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x428e08
push dword [0x43204c]
push dword [0x432048]
call fcn.00415000
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407223
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov byte [ebp - 8], 0
push ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x15], al
push esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
nop word [eax + eax]
mov eax, ecx
xor ebx, ebx
and eax, 0x7ff
mov edx, ecx
cmp eax, 0x7fb
sete bl
test ebx, ebx
jne 0x414cca
test eax, eax
je 0x414cca
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
cmp byte [ebp - 0x15], bl
jne 0x414cf4
and ecx, 0xfffff800
add ecx, 0x800
and ecx, 0xfffff800
jmp 0x414cf2
mov eax, dword [edi + 0x14]
xor eax, ecx
mov dword [ebp - 0x20], 1
and eax, 0x7ff
xor ecx, eax
cmp byte [ebp - 0x15], 0
je 0x414cf4
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
and ecx, 0x7ff
or ecx, eax
mov esi, dword [edi + 8]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x414c90
cmp dword [ebp - 0x20], 0
mov eax, dword [edi + 8]
jne 0x414db9
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x414d28
push 0x1c124c
call fcn.00402d04
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x414d60
cmp byte [ebp - 0x15], 0
jne 0x414d47
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [ebp - 0x1c], esi
test ebx, ebx
jne 0x414d60
jmp 0x414d4a
mov esi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, ebx
jae 0x414d7d
sub ebx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x15], 1
mov dword [ebp - 0x10], ebx
call fcn.00414f4e
jmp 0x414c82
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [edi + 8]
mov ecx, eax
shr ecx, 0xb
mov edx, eax
dec ecx
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x414d82
pop esi
pop ebx
mov eax, 0x102
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407223
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov eax, dword [edi + 8]
mov dword [eax + 8], 1
test byte [0x432040], 0x80
je 0x414df2
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x428e08
push dword [0x43204c]
push dword [0x432048]
call fcn.00415000
mov ecx, dword [ebp - 4]
neg ebx
pop esi
sbb ebx, ebx
xor ecx, ebp
and ebx, 0x80
mov eax, ebx
pop ebx
pop edi
call fcn.00407223
mov esp, ebp
pop ebp
ret 8
Function at 0x41a189
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x426f45
call fcn.00407a6a
mov esi, dword [ebp + 8]
test esi, esi
jne 0x41a1a3
xor al, al
jmp 0x41a274
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x41a1b4
xor ecx, ecx
cmp dword [0x44272c], ecx
jmp 0x41a1be
push esi
call fcn.00419f9c
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x41a19c
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.00419446
xor ecx, ecx
mov dword [ebp - 4], edi
push 2
test bl, bl
pop eax
cmovne ecx, eax
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x14], ecx
or eax, ecx
jmp 0x41a248
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x41a1fe
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.00419fc6
push ebx
test eax, eax
je 0x41a262
mov eax, dword [esi + 0xc]
xor edi, edi
mov ecx, 0x442418
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x4311b0], edi
call fcn.00419e93
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp + 8], edi
or eax, dword [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
call fcn.0041950b
mov edi, eax
test edi, edi
je 0x41a1f2
jmp 0x41a267
call fcn.0041a844
lea ecx, [ebp + 0xf]
call fcn.00419467
test edi, edi
sete al
call fcn.00407a3b
ret 8
Function at 0x41a38c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x41a3b2
cmp dword [0x44272c], edi
je 0x41a4a3
push 2
pop esi
jmp 0x41a3cb
cmp edi, 1
jne 0x41a4a3
push ebx
call fcn.00419f9c
test al, al
je 0x41a4a3
xor esi, esi
lea ecx, [ebp + 0xb]
mov dword [ebp - 0xc], esi
call fcn.00419446
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
push eax
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
or eax, esi
jmp 0x41a452
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41a400
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call fcn.00419fc6
push dword [ebp - 4]
test eax, eax
je 0x41a46b
mov eax, dword [ebx + 0xc]
xor esi, esi
mov ecx, 0x442418
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x4311b0], esi
call fcn.00419e93
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 4], esi
or eax, dword [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0xc]
call fcn.0041950b
mov esi, eax
test esi, esi
je 0x41a3ec
jmp 0x41a49b
call fcn.0041a844
test esi, esi
jne 0x41a49b
movzx ecx, word [ebx + 0x10]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x10], eax
je 0x41a4b8
cmp dword [ebp - 0x10], 3
jne 0x41a498
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x41a498
and cl, 0xf
cmp cl, 4
je 0x41a4b8
push 2
pop esi
lea ecx, [ebp + 0xb]
call fcn.00419467
inc edi
cmp edi, 2
jl 0x41a39a
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xb]
mov dword [eax], 1
call fcn.00419467
xor eax, eax
jmp 0x41a4af
Function at 0x41c51e
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x428bf0]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
inc ecx
cmp byte [ebp + 0xc], 0
mov word [ebp - 0x28], cx
je 0x41c54d
xor eax, eax
mov dword [ebp - 0x24], 0x20
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 8]
jmp 0x41c587
and dword [ebp - 0x24], 0
and dword [ebp - 0x18], 0
push 2
pop eax
push 6
mov word [ebp - 0x1c], cx
pop ecx
push 0xd
mov word [ebp - 0x1a], cx
pop ecx
mov word [ebp - 0x10], cx
xor ecx, ecx
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 8]
push 3
mov word [ebp - 0xe], cx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], eax
pop ecx
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.00407223
mov esp, ebp
pop ebp
ret 8

Function at 0x42298a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [esi], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, eax
test edi, edi
jne 0x4229ac
push 0x323658
jmp 0x4229c7
cmp dword [esi + 4], 6
jae 0x4229bc
push 0x323659
call fcn.00402d04
cmp dword [esi + 0x10], 2
je 0x4229cc
push 0x32365a
call fcn.00402d04
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x422a72
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x428bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x23c], ecx
lea eax, [ebp - 0x214]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x42c430]
add esp, 0xc
mov dword [ebp - 0xc], eax
mov ebx, edi
mov eax, dword [0x42c434]
mov esi, edi
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x214]
push 0x104
push eax
push edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
mov dword [ebp - 0x218], ecx
test ecx, ecx
je 0x422bc7
lea eax, [ebp - 0x214]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x422b28
lea ebx, [ebp - 0x214]
jmp 0x422b2d
push 2
pop eax
add ebx, eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x214]
push eax
push 3
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov dword [ebp - 0x220], eax
test eax, eax
je 0x422bc1
push eax
call fcn.00402d62
mov esi, eax
pop ecx
test esi, esi
je 0x422bc1
push esi
push dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push edi
push eax
push 3
call sub.VERSION.dll_GetFileVersionInfoExW
test eax, eax
je 0x422bc1
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x42a2c8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x422bc1
cmp dword [ebp - 0x224], 0x34
jne 0x422bc1
mov eax, dword [ebp - 0x228]
movzx ecx, word [eax + 8]
movzx edi, word [eax + 0xa]
mov dword [ebp - 0x234], ecx
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x218]
test ecx, ecx
mov eax, ecx
push 7
pop edx
cmove eax, edx
xor ecx, ecx
add eax, 0x1d
push 2
pop edx
mov dword [ebp - 0x220], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402d62
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x23c]
mov dword [eax + 4], ecx
test ecx, ecx
jne 0x422c05
mov edi, 0x8007000e
jmp 0x422c58
cmp dword [ebp - 0x218], 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x22c]
movzx eax, ax
push eax
mov eax, dword [ebp - 0x230]
movzx eax, ax
push eax
mov eax, dword [ebp - 0x234]
movzx eax, ax
push eax
movzx eax, di
push eax
mov eax, str.Unknown
cmovne eax, ebx
push eax
push str._s__d._d._d._d__s_s
push dword [ebp - 0x220]
push ecx
call fcn.00422e08
add esp, 0x28
mov edi, eax
test esi, esi
je 0x422c63
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407223
mov esp, ebp
pop ebp
ret
Function at 0x423d5a
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x428bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x408], eax
test esi, esi
jne 0x423da3
xor eax, eax
jmp 0x423f09
and dword [esi], 0
push ebx
push edi
xor edi, edi
inc edi
push edi
push eax
push ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.00425314
mov edx, dword [ebp - 0x408]
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x418], ecx
shr eax, 0x1a
xor ebx, ebx
and dword [ebp - 0x41c], ebx
not eax
and eax, edi
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x423e0a
mov eax, edx
shr eax, 0x17
push ecx
and eax, edi
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edx, dword [ebp - 0x408]
mov dword [esi], eax
mov eax, dword [ebp - 0x414]
cmp dword [esi], ebx
jne 0x423ead
test eax, eax
je 0x423ead
xor eax, eax
push edi
lea eax, [ebp - 0x40c]
push eax
push edx
call fcn.004250ca
test eax, eax
je 0x423e9d
mov eax, dword [ebp - 0x408]
push dword [ebp - 0x418]
shr eax, 0x19
and eax, edi
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x40c]
push edi
push eax
push dword [ebp - 0x408]
call fcn.004251fe
mov eax, dword [ebp - 0x410]
cmp eax, 5
jne 0x423e9f
cmp dword [ebp - 0x41c], ebx
jne 0x423e9f
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x41c], edi
jmp 0x423de4
mov eax, ebx
cmp dword [esi], ebx
je 0x423ead
xor ebx, ebx
cmp eax, 0xb7
setne bl
cmp dword [esi], 0
je 0x423eb7
cmp dword [esi], 0xffffffff
jne 0x423ed1
cmp dword [ebp - 0x414], 0
je 0x423eca
push 0x1631e1
call fcn.00402d04
and dword [esi], 0
xor ebx, ebx
xor edi, edi
mov edx, dword [ebp - 0x420]
test edx, edx
je 0x423ef9
mov ecx, dword [ebp - 0x418]
mov eax, 0x42c608
test ecx, ecx
cmovne eax, ecx
push eax
push dword [ebp + 0x14]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x423f05
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00407223
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x424f27
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x428bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
jne 0x424f53
push 0x15b3c8
jmp 0x424f8b
cmp dword [0x442ff8], esi
je 0x424f6a
mov eax, dword [0x4317f0]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x425096
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x424f97
push 0x15b3c9
call fcn.00402d04
mov edi, esi
jmp 0x425096
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x424fb5
push 0x15b3ca
jmp 0x424f8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x424fc7
push 0x15b3cb
jmp 0x424f8b
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.004194dd
mov esi, dword [ebp - 0x4c]
test al, al
jne 0x424fea
push 0x15b3cc
call fcn.00402d04
xor edi, edi
jmp 0x425089
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x425004
push 0x15b3cd
jmp 0x424fde
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x425036
push 0x15b3ce
jmp 0x424fde
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
je 0x4250bc
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jae 0x42507c
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x42506b
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x42507a
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x425042
mov dword [ebx], edi
mov dword [0x442ff8], edi
mov eax, dword [ebx]
mov dword [0x4317f0], eax
test esi, esi
je 0x425094
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
xor esi, esi
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4250a7
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407223
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov dword [0], 1
int 0x29