joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bff0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9e65
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4f4f98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov edi, dword [ecx + 0x30]
mov esi, dword [ecx + 0x34]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0xa
push 0x64
push 0x64
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 2
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push esi
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow_s]
call esi
add esp, 0x10
lea ecx, [ebp - 0x14]
push 0xffffffffffffffff
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0xa
push 0x64
push 0x64
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], 9
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push edi
call esi
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0xffffffffffffffff
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_Ordinal_5921]
push eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_285]
mov eax, dword [ebp - 0x10]
push 1
push 0x4d6fb4
mov dword [ebp - 0x18], 0x15
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::Concatenate]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00466260
add esp, 0x20
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push dword [ebp - 0x24]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
add esp, 4
lea ecx, [ebp - 0x24]
fstp qword [ebp - 0x20]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
fld qword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497cd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
lea edx, [ebp - 4]
push esi
push edx
call dword [eax + 8]
push 1
push 0
push 0
push dword [ebp - 4]
push 0x4d85f0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cdq
test edx, edx
jne 0x497d10
cmp eax, 0x20
ja 0x497d10
lea ecx, [ebp - 4]
xor esi, esi
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
mov esi, 1
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49f1f0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cd9dd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f4f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push eax
push 0x212
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.004b3a40
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov dword [edi], 0
cmovae edx, dword [ebp - 0x28]
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49f291
sub eax, esi
mov ecx, edi
sar eax, 1
push eax
push edx
call fcn.004b3de0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x49f2e5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49f2db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x49f2db
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004be864
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee1d
mov esp, ebp
pop ebp
ret

Function at 0x49f310
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cda2f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4f4f98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x212
mov ecx, edi
mov dword [ebp - 0x10], 2
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push 0x212
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
mov ecx, edi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a6690
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf4ac
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4f4f98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x512438]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5116b4]
cmp eax, dword [ecx + 4]
jg 0x4a684c
cmp dword [ebp + 8], 0
mov ecx, 0x5116a4
push 0x2a5e
push str.Ver98
push 0x4d76d4
je 0x4a6802
call fcn.00480080
cmp eax, 0x2a5e
jne 0x4a678e
push 0x9830
push str.Ver98
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004a6ad0
push 0
push str.DeveloperOnly
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.00480080
test eax, eax
jne 0x4a678e
push 0xe59e
push str.DeveloperOnly
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004a6ad0
push str.DeveloperName
push str.DeveloperUser
push 0x4d76d4
lea eax, [ebp - 0x10]
mov ecx, 0x5116a4
push eax
call fcn.00488590
push str.DeveloperName
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
test eax, eax
je 0x4a67a1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], 0x400
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x14]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push dword [ebp + 8]
mov ecx, 0x5116a4
push str.DeveloperUser
push 0x4d76d4
call fcn.004aa860
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x4a6836
call fcn.004a6ad0
push 0
push str.DeveloperOnly
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004a6ad0
push str.DeveloperName
push str.DeveloperUser
push 0x4d76d4
mov ecx, 0x5116a4
call fcn.004aa860
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
push 0x5116b4
call fcn.004bed2f
add esp, 4
cmp dword [0x5116b4], 0xffffffff
jne 0x4a66d5
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.00487c20
add esp, 4
push dword [eax]
mov ecx, 0x5116a4
mov byte [ebp - 4], 1
call fcn.00462070
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x4d31a0
call fcn.004bebe7
push 0x5116b4
mov dword [ebp - 4], 0xffffffff
call fcn.004bece5
add esp, 8
jmp 0x4a66d5
Function at 0x4ab700
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x18], 8
lea edx, [ecx + 4]
jb 0x4ab70e
mov edx, dword [edx]
mov eax, dword [ecx + 0x1c]
or eax, dword [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 4
Function at 0x401e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x401e19
xor ecx, ecx
jne 0x401e19
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401e60
mov eax, dword [ebp - 0xc]
jmp 0x401ebd
cmp dword [ebp - 4], 1
je 0x401e73
cmp dword [ebp - 4], 2
je 0x401e73
mov eax, 0xd
jmp 0x401ebd
cmp dword [ebp + 0xc], 0
je 0x401eb1
cmp dword [ebp - 8], 0
je 0x401ea9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x401ea0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x401ea7
mov eax, 0xd
jmp 0x401ebd
jmp 0x401eb1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402820
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40282a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
push dword [ebx]
leave
mov edi, 0x60000000
jmp 0x402848
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x8b402846
js 0x40286c
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4028a6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax - 0x77], al
jge 0x402885
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40288d
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x402896
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4028a0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402882
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40280c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4028f3
dec eax
je 0x4028ea
sub eax, 3
je 0x4028e1
mov dword [ebp - 4], 0x40
jmp 0x402910
mov dword [ebp - 4], 4
jmp 0x4028f6
mov dword [ebp - 4], 0x20
jmp 0x4028f6
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402942
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4028c2
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00402153
add byte [ebx + 0x75ffaeb9], bh
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40294e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402870
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40282a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
push dword [ebx]
leave
mov edi, 0x60000000
jmp 0x402848
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x8b402846
js 0x40286c
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4028a6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax - 0x77], al
jge 0x402885
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40288d
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x402896
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4028a0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402882
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40280c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4028f3
dec eax
je 0x4028ea
sub eax, 3
je 0x4028e1
mov dword [ebp - 4], 0x40
jmp 0x402910
mov dword [ebp - 4], 4
jmp 0x4028f6
mov dword [ebp - 4], 0x20
jmp 0x4028f6
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402942
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4028c2
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00402153
add byte [ebx + 0x75ffaeb9], bh
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40294e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret